Caches of outside APIs live in /var/cache/sww (closes #314)

Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice.

A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups.

Model: opus-5-5

internal/waf/crowdsec_test.go

@@ -16,7 +16,7 @@ import (
 
 // The CrowdSec settings, and the tests' engine, which is never asked: each
 // test puts in the copy of its decision list, at decisionsURL, that it
-// needs, as reputation.json would at start.
+// needs, as lists.json would at start.
 const (
 	crowdSecURL  = "SWW_CROWDSEC_LAPI_URL"
 	crowdSecKey  = "SWW_CROWDSEC_LAPI_KEY"
@@ -182,7 +182,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 
 // loadDecisions puts into server's lists the copy of the decision list at
 // decisionsURL, answer, the engine's answer, fetched at fetched, as
-// reputation.json would at start.
+// lists.json would at start.
 func loadDecisions(
 	t *testing.T, server *waf.Server, fetched time.Time, answer string,
 ) {

internal/waf/proxy.go

@@ -86,8 +86,8 @@ type Params struct {
 // Server is the server waf runs, with the parts whose state the state
 // files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
-// AbuseIPDB's scores and checks spent, and the metrics. RouteWatch, nil while
-// SWW_ROUTEWATCH_URL is unset, keeps its answers in memory only.
+// AbuseIPDB's scores and checks spent, routewatch's answers, and the metrics.
+// RouteWatch is nil while SWW_ROUTEWATCH_URL is unset.
 type Server struct {
 	*http.Server
 

internal/waf/reputation_test.go

@@ -39,7 +39,7 @@ const (
 )
 
 // The lists these tests name, which are never fetched: each test puts in
-// the copies it needs, as reputation.json would at start.
+// the copies it needs, as lists.json would at start.
 const (
 	dropURL = "https://lists.example/drop.txt"
 	torURL  = "https://lists.example/tor.txt"
@@ -374,7 +374,7 @@ const (
 
 // The DNSBL zones these tests name, which are never asked about the
 // clients the tests send requests from: each test puts in the verdicts it
-// needs, as reputation.json would at start. A query a test does start is
+// needs, as dnsbl.json would at start. A query a test does start is
 // sent to noResolver, where nothing listens, so that none leaves the host.
 const (
 	dnsblZone  = "dnsbl.example"
@@ -759,7 +759,7 @@ func TestOnlyAClientThatHasCommittedAnOffenceIsCheckedWithAbuseIPDB(t *testing.T
 	clk.advance(time.Hour)
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 1)
-	waitUntil(func() bool { return len(server.AbuseIPDB.Snapshot().Scores) == 1 })
+	waitUntil(func() bool { return len(server.AbuseIPDB.Snapshot()) == 1 })
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward), abuseipdb)
 
 	s.get(fromKP, http.StatusOK, forward)
@@ -1072,7 +1072,7 @@ func verdictsFetched() time.Time {
 
 // loadVerdicts puts into server's DNSBL, for each client listedBy names,
 // a verdict of each zone SWW_DNSBL_ZONES names, fetched at
-// verdictsFetched, as reputation.json would at start: one that lists the
+// verdictsFetched, as dnsbl.json would at start: one that lists the
 // client from each zone listedBy gives for it, and one that does not from
 // each other zone.
 func loadVerdicts(server *waf.Server, listedBy map[string][]string) {
@@ -1091,8 +1091,8 @@ func loadVerdicts(server *waf.Server, listedBy map[string][]string) {
 }
 
 // loadScores puts into server's AbuseIPDB the score scores gives each
-// client, an IPv4 address, fetched at verdictsFetched, as reputation.json
-// would at start.
+// client, an IPv4 address, fetched at verdictsFetched, as
+// abuseipdb-scores.json would at start.
 func loadScores(server *waf.Server, scores map[string]int64) {
 	kept := make([]reputation.Score, 0, len(scores))
 	for client, score := range scores {
@@ -1102,7 +1102,7 @@ func loadScores(server *waf.Server, scores map[string]int64) {
 		})
 	}
 
-	server.AbuseIPDB.Load(reputation.Checks{Scores: kept})
+	server.AbuseIPDB.Load(kept)
 }
 
 // wantAbuseIPDBChecks checks how many clients server has checked with
@@ -1116,7 +1116,7 @@ func wantAbuseIPDBChecks(t *testing.T, server *waf.Server, want int) {
 }
 
 // loadLists puts copies of lists into server's lists, by URL, each with
-// its lines, fetched at listsFetched, as reputation.json would at start.
+// its lines, fetched at listsFetched, as lists.json would at start.
 func loadLists(t *testing.T, server *waf.Server, copies map[string][]string) {
 	t.Helper()