Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/bans/bans.go

@@ -209,7 +209,10 @@ func New(params Params) *Ledger {
 	// The ledger drops bans itself, and never those whose cause is
 	// CauseAdmin, however many there are, so the LRU has no limit of its
 	// own: it keeps the netblocks in the order they were last seen.
-	netblocks, err := simplelru.NewLRU[netip.Prefix, *[]Ban](math.MaxInt, nil)
+	netblocks, err := simplelru.NewLRU[netip.Prefix, *[]Ban](
+		math.MaxInt,
+		nil,
+	)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one
 	}
@@ -312,7 +315,15 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 func (l *Ledger) BanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, true)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseLimit,
+		limitReason(notes),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForLimit returns what BanForLimit would, without making the ban:
@@ -320,7 +331,15 @@ func (l *Ledger) BanForLimit(
 func (l *Ledger) WouldBanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, false)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseLimit,
+		limitReason(notes),
+		notes,
+		false,
+	)
 }
 
 // BanForAttack bans netblock at now for a clear sign of attack, with
@@ -331,7 +350,15 @@ func (l *Ledger) WouldBanForLimit(
 func (l *Ledger) BanForAttack(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes, true)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseAttack,
+		attackReason(notes),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForAttack returns what BanForAttack would, without making the
@@ -339,8 +366,15 @@ func (l *Ledger) BanForAttack(
 func (l *Ledger) WouldBanForAttack(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes,
-		false)
+	return l.ban(
+		netblock,
+		now,
+		time.Time{},
+		CauseAttack,
+		attackReason(notes),
+		notes,
+		false,
+	)
 }
 
 // BanForCrowdSec bans netblock at now until expires, when CrowdSec's
@@ -348,19 +382,39 @@ func (l *Ledger) WouldBanForAttack(
 // whether it made it, as BanForLimit does. Its reason is "CrowdSec's
 // decision for <scenario>", the scenario that made the decision.
 func (l *Ledger) BanForCrowdSec(
-	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
-		true)
+	return l.ban(
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		true,
+	)
 }
 
 // WouldBanForCrowdSec returns what BanForCrowdSec would, without making
 // the ban: what observe mode would have done.
 func (l *Ledger) WouldBanForCrowdSec(
-	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	scenario string,
+	notes Notes,
 ) (Ban, bool) {
-	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
-		false)
+	return l.ban(
+		netblock,
+		now,
+		expires,
+		CauseCrowdSec,
+		crowdSecReason(scenario),
+		notes,
+		false,
+	)
 }
 
 // WouldBePermanent reports whether a ban on netblock for cause, CauseLimit,
@@ -505,7 +559,10 @@ func (l *Ledger) Bans(netblock netip.Prefix) []Ban {
 // about it. It is not a request from netblock, and leaves when it was last
 // seen unchanged. It does not have bans.json written at once: the notes
 // are written with its next write, as the counts in them are.
-func (l *Ledger) AddLookup(netblock netip.Prefix, asn, asName, country string) {
+func (l *Ledger) AddLookup(
+	netblock netip.Prefix,
+	asn, asName, country string,
+) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -654,7 +711,10 @@ func (l *Ledger) holds(netblock netip.Prefix, start time.Time) bool {
 // keep is true, the ban is not made, only returned: it is the ban that
 // would have been made.
 func (l *Ledger) ban(
-	netblock netip.Prefix, now, expires time.Time, cause, reason string, notes Notes,
+	netblock netip.Prefix,
+	now, expires time.Time,
+	cause, reason string,
+	notes Notes,
 	keep bool,
 ) (Ban, bool) {
 	l.mu.Lock()
@@ -675,7 +735,13 @@ func (l *Ledger) ban(
 	}
 
 	notes.Request = notes.Request.cut()
-	ban := Ban{Netblock: netblock, Start: now, Cause: cause, Reason: reason, Notes: notes}
+	ban := Ban{
+		Netblock: netblock,
+		Start:    now,
+		Cause:    cause,
+		Reason:   reason,
+		Notes:    notes,
+	}
 
 	switch cause {
 	case CauseAttack:
@@ -765,7 +831,9 @@ func (l *Ledger) active(client netip.Addr, now time.Time) *Ban {
 	var first *Ban
 
 	for _, length := range lengths {
-		bans, found := l.netblocks.Get(netip.PrefixFrom(client, length).Masked())
+		bans, found := l.netblocks.Get(
+			netip.PrefixFrom(client, length).Masked(),
+		)
 		if !found {
 			continue
 		}
@@ -798,7 +866,9 @@ func (l *Ledger) covering(client netip.Addr) []*[]Ban {
 	var found []*[]Ban
 
 	for _, length := range lengths {
-		bans, ok := l.netblocks.Peek(netip.PrefixFrom(client, length).Masked())
+		bans, ok := l.netblocks.Peek(
+			netip.PrefixFrom(client, length).Masked(),
+		)
 		if ok {
 			found = append(found, bans)
 		}
@@ -852,13 +922,15 @@ func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 	var last *Ban
 
 	for i, ban := range held {
-		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) && ban.Lifted.IsZero() &&
+		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) &&
+			ban.Lifted.IsZero() &&
 			(last == nil || ban.Expires.After(last.Expires)) {
 			last = &held[i]
 		}
 	}
 
-	if last != nil && now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
+	if last != nil &&
+		now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
 		lastLength := last.Expires.Sub(last.Start)
 		// This is repeatFactor * lastLength > MaxBanDuration, written so
 		// that it cannot overflow.