Caches of outside APIs live in /var/cache/sww (closes #314)

Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice.

A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups.

Model: opus-5-5

share/sww.run

@@ -11,7 +11,10 @@ main() {
     local command="${SWW_COMMAND:-rproxy}"
     case "$command" in
         rproxy) ;;
-        waf) give_state_dir_to_sww ;;
+        waf)
+            give_state_dir_to_sww
+            make_cache_dir_for_sww
+            ;;
         *)
             printf 'SWW_COMMAND: "%s" is not rproxy or waf\n' \
                 "$command" >&2
@@ -31,19 +34,34 @@ main() {
 # reports a directory it cannot write.
 give_state_dir_to_sww() {
     local dir
-    if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
+    if dir="$(setting SWW_STATE_DIR /var/lib/sww)" &&
+        [[ "$dir" == /* && -d "$dir" ]]; then
         chown -R sww:sww "$dir" || true
     fi
 }
 
-# state_dir prints SWW_STATE_DIR, /var/lib/sww when it is unset,
-# or what is in the file SWW_STATE_DIR_FILE names, less every newline at
-# its end. It fails when both are set or the file cannot be read.
-state_dir() {
-    if [[ ! -v SWW_STATE_DIR_FILE ]]; then
-        printf '%s\n' "${SWW_STATE_DIR-/var/lib/sww}"
-    elif [[ ! -v SWW_STATE_DIR ]]; then
-        cat -- "$SWW_STATE_DIR_FILE" 2>/dev/null
+# make_cache_dir_for_sww makes the cache directory, SWW_CACHE_DIR in
+# either form, and gives it and every file in it to the sww user, as
+# give_state_dir_to_sww does the state directory. Unlike that one, it is
+# made when it is missing, since the cache files need no volume. As there,
+# a setting that cannot be read or is not an absolute path changes
+# nothing, and a failure does not end the script.
+make_cache_dir_for_sww() {
+    local dir
+    if dir="$(setting SWW_CACHE_DIR /var/cache/sww)" && [[ "$dir" == /* ]]; then
+        { mkdir -p -- "$dir" && chown -R sww:sww "$dir"; } || true
+    fi
+}
+
+# setting prints the setting named $1, $2 when it is unset, or what is in
+# the file the setting $1_FILE names, less every newline at its end. It
+# fails when both are set or the file cannot be read.
+setting() {
+    local name="$1" file_name="$1_FILE"
+    if [[ ! -v "$file_name" ]]; then
+        printf '%s\n' "${!name-$2}"
+    elif [[ ! -v "$name" ]]; then
+        cat -- "${!file_name}" 2>/dev/null
     else
         return 1
     fi