Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

script/example-app

@@ -16,10 +16,10 @@
 #   - that a new discriminator container on the same volume still refuses the banned
 #     client;
 #   - that a discriminator container with its state files on a new volume mounted at
-#     the directory SWW_STATE_DIR_FILE names becomes healthy;
-#   - that one whose SWW_STATE_DIR does not exist logs discriminator's message
+#     the directory SWW_WAF_STATE_DIR_FILE names becomes healthy;
+#   - that one whose SWW_WAF_STATE_DIR does not exist logs discriminator's message
 #     about it.
-# discriminator runs with SWW_LOOKUP_SOURCE=off, so that no address is sent to
+# discriminator runs with SWW_WAF_LOOKUP_SOURCE=off, so that no address is sent to
 # GeoJS. The containers, the network, the volumes and both images are removed
 # however the script ends. Building the app needs network access, for nixpkgs'
 # binary cache. script/check does not run this.
@@ -37,7 +37,7 @@ NETWORK="$NAME"
 APP="$NAME-app-container"
 DISCRIMINATOR="$NAME-discriminator"
 VOLUME="$NAME-state"
-# The volumes of the container whose state directory SWW_STATE_DIR_FILE
+# The volumes of the container whose state directory SWW_WAF_STATE_DIR_FILE
 # names: its state files, and the file that names their directory.
 MOVED_VOLUME="$NAME-moved-state"
 SETTINGS_VOLUME="$NAME-settings"
@@ -94,8 +94,8 @@ start_discriminator() {
     docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \
         --volume "$VOLUME:/var/lib/sww" \
         --env SWW_COMMAND=discriminator \
-        --env SWW_RATE_LIMIT_PER_MINUTE=1 \
-        --env SWW_LOOKUP_SOURCE=off \
+        --env SWW_WAF_RATE_LIMIT_PER_MINUTE=1 \
+        --env SWW_WAF_LOOKUP_SOURCE=off \
         "$IMAGE" >/dev/null
     wait_for "discriminator's health check did not pass" healthy "$DISCRIMINATOR"
 }
@@ -104,14 +104,14 @@ start_discriminator() {
 # healthy.
 start_app() {
     docker run --detach --name "$APP" --network "$NETWORK" --publish 127.0.0.1::8080 \
-        --env SWRP_WAF_BACKEND="http://$DISCRIMINATOR:8080" \
+        --env SWW_RPROXY_WAF_BACKEND="http://$DISCRIMINATOR:8080" \
         "$APP_IMAGE" >/dev/null
     wait_for "the app's health check did not pass" healthy "$APP"
     address="$(docker port "$APP" 8080/tcp)"
 }
 
 # start_moved_discriminator: run discriminator with the state files on a new volume at
-# /srv/state, which SWW_STATE_DIR_FILE names in a file only the sww
+# /srv/state, which SWW_WAF_STATE_DIR_FILE names in a file only the sww
 # user can read, as under "Settings given as files" in docs/settings.md, and
 # wait until it is healthy. discriminator can write the new volume only once the run
 # script has given it to that user.
@@ -126,8 +126,8 @@ start_moved_discriminator() {
         --volume "$MOVED_VOLUME:/srv/state" \
         --volume "$SETTINGS_VOLUME:/etc/sww/settings:ro" \
         --env SWW_COMMAND=discriminator \
-        --env SWW_STATE_DIR_FILE=/etc/sww/settings/state-dir \
-        --env SWW_LOOKUP_SOURCE=off \
+        --env SWW_WAF_STATE_DIR_FILE=/etc/sww/settings/state-dir \
+        --env SWW_WAF_LOOKUP_SOURCE=off \
         "$IMAGE" >/dev/null
     wait_for "discriminator's health check did not pass" healthy "$DISCRIMINATOR"
 }
@@ -140,7 +140,7 @@ status_from() {
         --max-time 10 --header "X-Forwarded-For: $1" "http://$address$2" || true
 }
 
-# refused: a request to the container gets 403, SWW_BAN_RESPONSE's
+# refused: a request to the container gets 403, SWW_WAF_BAN_RESPONSE's
 # default.
 refused() {
     code="$(curl --silent --output /dev/null --write-out '%{http_code}' \
@@ -203,7 +203,7 @@ main() {
     wait_for "discriminator did not stop in order" logged "$DISCRIMINATOR" '"msg":"stopped"'
     [ "$(status_from 203.0.113.9 /)" = 200 ] ||
         fail "with discriminator stopped, the app did not answer through rproxy"
-    wait_for "rproxy logged no request SWRP_DEFAULT_DISPOSITION decided" \
+    wait_for "rproxy logged no request SWW_RPROXY_DEFAULT_DISPOSITION decided" \
         logged "$APP" '"default_disposition":true'
     docker exec "$APP" /usr/local/bin/sww healthcheck ||
         fail "with discriminator stopped, the app's health check failed"
@@ -238,16 +238,16 @@ main() {
     docker rm --force "$DISCRIMINATOR" >/dev/null
     start_moved_discriminator
     echo "example-app: the run script gives the state files' directory named" \
-        "by SWW_STATE_DIR_FILE to the sww user"
+        "by SWW_WAF_STATE_DIR_FILE to the sww user"
 
     docker rm --force "$DISCRIMINATOR" >/dev/null
     docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \
         --env SWW_COMMAND=discriminator \
-        --env SWW_STATE_DIR=/srv/missing \
-        --env SWW_LOOKUP_SOURCE=off \
+        --env SWW_WAF_STATE_DIR=/srv/missing \
+        --env SWW_WAF_LOOKUP_SOURCE=off \
         "$IMAGE" >/dev/null
     wait_for "discriminator did not report the missing state directory" \
-        logged "$DISCRIMINATOR" "SWW_STATE_DIR cannot be written"
+        logged "$DISCRIMINATOR" "SWW_WAF_STATE_DIR cannot be written"
     echo "example-app: discriminator reports a state directory that does not exist"
 }
 

script/run

@@ -2,11 +2,11 @@
 # script/run: build bin/sww with script/build and run discriminator and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
-# SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# discriminator listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
-# rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
-# SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
-# and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d,
+# SWW_RPROXY_LISTEN_ADDR says otherwise, in front of the app at SWW_RPROXY_UPSTREAM_URL.
+# discriminator listens on port 8090 unless SWW_WAF_LISTEN_ADDR says otherwise, and
+# rproxy asks it there unless SWW_RPROXY_WAF_BACKEND says otherwise. Unless
+# SWW_WAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
+# and unless SWW_WAF_RULES_DIR is set, the rule files are those of share/rules.d,
 # which the image ships.
 set -eu
 
@@ -26,18 +26,18 @@ stop_both() {
 
 main() {
     "$SCRIPT_DIR/build"
-    if [ -z "${SWW_STATE_DIR+set}" ]; then
-        SWW_STATE_DIR="$ROOT/bin/state"
-        export SWW_STATE_DIR
-        mkdir -p "$SWW_STATE_DIR"
+    if [ -z "${SWW_WAF_STATE_DIR+set}" ]; then
+        SWW_WAF_STATE_DIR="$ROOT/bin/state"
+        export SWW_WAF_STATE_DIR
+        mkdir -p "$SWW_WAF_STATE_DIR"
     fi
-    if [ -z "${SWW_RULES_DIR+set}" ]; then
-        SWW_RULES_DIR="$ROOT/share/rules.d"
-        export SWW_RULES_DIR
+    if [ -z "${SWW_WAF_RULES_DIR+set}" ]; then
+        SWW_WAF_RULES_DIR="$ROOT/share/rules.d"
+        export SWW_WAF_RULES_DIR
     fi
-    SWW_LISTEN_ADDR="${SWW_LISTEN_ADDR:-:8090}"
-    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWW_LISTEN_ADDR##*:}}"
-    export SWW_LISTEN_ADDR SWRP_WAF_BACKEND
+    SWW_WAF_LISTEN_ADDR="${SWW_WAF_LISTEN_ADDR:-:8090}"
+    SWW_RPROXY_WAF_BACKEND="${SWW_RPROXY_WAF_BACKEND:-http://127.0.0.1:${SWW_WAF_LISTEN_ADDR##*:}}"
+    export SWW_WAF_LISTEN_ADDR SWW_RPROXY_WAF_BACKEND
 
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM