Caches of outside APIs live in /var/cache/sww (closes #314)

Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice.

A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups.

Model: opus-5-5

internal/sww/sww.go

@@ -1,9 +1,9 @@
 // Package sww runs the sww process, as the command it is given.
 // `sww waf` reads the settings, the rule files, the lookup database
-// and the state files, answers rproxy's questions until it is told to stop, and
-// then stops in an orderly way, writing the state files. `sww rproxy`
-// reads rproxy's settings alone, and runs the reverse proxy in front of one app
-// that asks waf about each request. `sww healthcheck` is the
+// and the state and cache files, answers rproxy's questions until it is told to
+// stop, and then stops in an orderly way, writing the state and cache files.
+// `sww rproxy` reads rproxy's settings alone, and runs the reverse proxy in
+// front of one app that asks waf about each request. `sww healthcheck` is the
 // container's health check.
 package sww
 
@@ -101,8 +101,8 @@ func printUsage(w io.Writer) int {
 }
 
 // RunWAF is `sww waf`: it reads the settings, the rule files,
-// the lookup database and the state files, then serves requests until ctx is
-// done. It returns the process's exit status, 1 when waf cannot start.
+// the lookup database and the state and cache files, then serves requests until
+// ctx is done. It returns the process's exit status, 1 when waf cannot start.
 func RunWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWW_LOG_LEVEL lets through.
@@ -171,7 +171,7 @@ func RunWAF(ctx context.Context, params Params) int {
 
 	files, err := loadStateFiles(cfg, server, alertQueue, now, processLog)
 	if err != nil {
-		processLog.Error("cannot use the state files", "error", err.Error())
+		processLog.Error("cannot use the state and cache files", "error", err.Error())
 
 		return 1
 	}
@@ -236,14 +236,15 @@ func newServer(
 	return server, nil
 }
 
-// loadStateFiles reads the state files into the parts of server and into
-// alertQueue, as state.Load does.
+// loadStateFiles reads the state and cache files into the parts of server and
+// into alertQueue, as state.Load does.
 func loadStateFiles(
 	cfg *config.Config, server *waf.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
 		Dir:             cfg.StateDir,
+		CacheDir:        cfg.CacheDir,
 		WriteDelay:      cfg.StateWriteDelay,
 		CounterInterval: cfg.StateCounterInterval,
 		Ledger:          server.Ledger,
@@ -252,6 +253,7 @@ func loadStateFiles(
 		Lists:           server.Lists,
 		DNSBL:           server.DNSBL,
 		AbuseIPDB:       server.AbuseIPDB,
+		RouteWatch:      server.RouteWatch,
 		Alerts:          alertQueue,
 		Anomalies:       server.Anomalies,
 		Now:             now,
@@ -317,13 +319,13 @@ func startSending(
 	}
 }
 
-// serve serves requests on listener, writes the state files as they are
-// due, takes in an admin's edits of them, reads the rule files again as
+// serve serves requests on listener, writes the state and cache files as they
+// are due, takes in an admin's edits of them, reads the rule files again as
 // they change, and the lookup database when it is replaced, fetches the
 // lists the settings name by URL as they are due, and sends the alerts,
 // until ctx is done. Then it gives the requests in progress
-// shutdownTimeout to finish, and writes every state file, alerts.json with
-// the alerts still waiting.
+// shutdownTimeout to finish, and writes every state and cache file,
+// alerts.json with the alerts still waiting.
 func serve(
 	ctx context.Context, server *waf.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
@@ -393,7 +395,7 @@ func serve(
 
 	err = files.WriteAll()
 	if err != nil {
-		processLog.Error("writing the state files failed", "error", err.Error())
+		processLog.Error("writing the state and cache files failed", "error", err.Error())
 
 		return 1
 	}

internal/sww/sww_test.go

@@ -38,6 +38,7 @@ const (
 	stateDir             = "SWW_STATE_DIR"
 	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
+	cacheDir             = "SWW_CACHE_DIR"
 	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
 	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
 	rulesDir             = "SWW_RULES_DIR"
@@ -160,6 +161,12 @@ func run(ctx context.Context, env map[string]string, out *output) int {
 				return "off", true
 			}
 
+			// The cache files go beside the state files unless the test
+			// says otherwise.
+			if !ok && name == cacheDir {
+				return env[stateDir], env[stateDir] != ""
+			}
+
 			return value, ok
 		},
 		Stdout: out,
@@ -699,7 +706,7 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	}
 }
 
-func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T) {
+func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
 	t.Parallel()
 
 	const (
@@ -732,10 +739,11 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	t.Cleanup(server.Close)
 
 	torURL, dropURL := server.URL+torPath, server.URL+dropPath
-	dir := t.TempDir()
+	cache := t.TempDir()
 	env := map[string]string{
 		listenAddr:           localhost + ":0",
-		stateDir:             dir,
+		stateDir:             t.TempDir(),
+		cacheDir:             cache,
 		rulesDir:             t.TempDir(),
 		metricsToken:         token,
 		instanceName:         instance,
@@ -755,7 +763,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 
 	// Restarted with drop.txt named after it and the server answering, tor.txt
-	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
+	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in lists.json,
 	// while drop.txt, never tried, is fetched at once. Lists are fetched in the
 	// order named, so once drop.txt refuses the client, tor.txt has had its turn.
 	failing.Store(false)
@@ -773,8 +781,8 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	}
 
 	// After another restart, with the server failing, the copy of drop.txt
-	// kept in reputation.json, its copyright line included, refuses the
-	// client from the first request.
+	// kept in lists.json, its copyright line included, refuses the client
+	// from the first request.
 	failing.Store(true)
 
 	out = runUntilStopped(t, env, func(url string) {
@@ -782,16 +790,16 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 	wantDeniedByList(t, out.line(t, "type", "request"), dropURL)
 
-	path := filepath.Join(dir, "reputation.json")
+	path := filepath.Join(cache, "lists.json")
 
 	kept, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
 	if err != nil || !strings.Contains(string(kept), `"`+copyright+`"`) {
-		t.Errorf("reputation.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
+		t.Errorf("lists.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
 			err)
 	}
 }
 
-func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
+func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
 	t.Parallel()
 
 	const bouncerKey = "crowdsec-key-0123456789abcdef"
@@ -814,10 +822,11 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		}))
 	t.Cleanup(engine.Close)
 
-	dir := t.TempDir()
+	dir, cache := t.TempDir(), t.TempDir()
 	env := map[string]string{
 		listenAddr:              localhost + ":0",
 		stateDir:                dir,
+		cacheDir:                cache,
 		rulesDir:                t.TempDir(),
 		"SWW_CROWDSEC_LAPI_URL": engine.URL,
 		"SWW_CROWDSEC_LAPI_KEY": bouncerKey,
@@ -836,7 +845,7 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		t.Errorf("bans.json holds %v, want the ban for crowdsec on %s", ban, placed)
 	}
 
-	// Restarted with the engine down, the copy kept in reputation.json bans
+	// Restarted with the engine down, the copy kept in lists.json bans
 	// another client in the netblock from its first request.
 	down.Store(true)
 
@@ -844,22 +853,25 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
 	})
 
-	// The key is in neither run's output, nor in a state file.
-	files := []string{"bans.json", "reputation.json", "clients.json"}
+	// The key is in neither run's output, nor in a state or cache file.
+	files := []string{
+		filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
+		filepath.Join(cache, "lists.json"),
+	}
 	shown := make([]string, 0, len(files)+2)
 	shown = append(shown, first.text(), second.text())
 
-	for _, name := range files {
-		data, err := os.ReadFile(filepath.Join(dir, name)) //nolint:gosec // the test's
+	for _, path := range files {
+		data, err := os.ReadFile(path) //nolint:gosec // the test's
 		if err != nil {
-			t.Fatalf("read %s: %v", name, err)
+			t.Fatalf("read %s: %v", path, err)
 		}
 
 		shown = append(shown, string(data))
 	}
 
 	if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
-		t.Errorf("the key is shown in the output or the state files:\n%s", all)
+		t.Errorf("the key is shown in the output or the state and cache files:\n%s", all)
 	}
 }
 
@@ -1207,6 +1219,29 @@ func TestUnwritableStateDirStopsTheStart(t *testing.T) {
 		"SWW_STATE_DIR cannot be written: ")
 }
 
+func TestUnwritableCacheDirStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	ctx, stop := context.WithTimeout(t.Context(), waitLimit)
+	defer stop()
+
+	out := &output{}
+
+	status := run(ctx, map[string]string{
+		listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
+		cacheDir: filepath.Join(t.TempDir(), "missing"),
+	}, out)
+	if status != 1 {
+		t.Fatalf("exit status %d, want 1", status)
+	}
+
+	line := out.line(t, "msg", "cannot use the state and cache files")
+	if message, _ := line["error"].(string); !strings.HasPrefix(message,
+		"SWW_CACHE_DIR cannot be written: ") {
+		t.Errorf("start refused with %q, want SWW_CACHE_DIR named", message)
+	}
+}
+
 // wantStartRefused runs sww with its state files in dir, and
 // checks that it stops at start, with an error that starts with want. If
 // it starts instead, it is stopped after waitLimit.
@@ -1225,7 +1260,7 @@ func wantStartRefused(t *testing.T, dir, want string) {
 		t.Fatalf("exit status %d, want 1", status)
 	}
 
-	line := out.line(t, "msg", "cannot use the state files")
+	line := out.line(t, "msg", "cannot use the state and cache files")
 	message, _ := line["error"].(string)
 
 	if !strings.HasPrefix(message, want) {

internal/sww/waf_test.go

@@ -67,6 +67,7 @@ func TestMainRunsWAF(t *testing.T) {
 		commandForMain+"="+wafCommand,
 		listenAddr+"="+localhost+":0",
 		stateDir+"="+dir,
+		cacheDir+"="+dir,
 		rulesDir+"="+t.TempDir(),
 		lookupSource+"=off")