Settings given as files: the _FILE form of every setting (closes #87)

Every setting X may instead be given as a file that X_FILE names, read
once at start: its contents, less one trailing newline, are the value,
checked as X would be. X and X_FILE both set, or a file that cannot be
read, stops the start with a message naming the variable. The logged
settings name the file, and mask a token read from one.
SWWAF_LOG_REMOTE_TLS_CA_FILE, whose value is a file already, has no
_FILE form. README.md says so, with the token file example from
SPEC.md's Deployment.

Judgement call: an invalid value read from a file is named as X, not X_FILE.
Rule suppressed: gosec G304 on reading the named file, as for the CA file.

Model: opus-5-5

README.md

@@ -181,9 +181,10 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
 
 ## Settings
 
-Each setting is an environment variable, and each has a default, so none has to
-be set. A setting that is set but invalid stops the start with a message naming
-it, and the effective settings are logged at start.
+Each setting is an environment variable, or a file one names (see "Settings
+given as files" below), and each has a default, so none has to be set. A setting
+that is set but invalid stops the start with a message naming it, and the
+effective settings are logged at start.
 
 - `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens.
 - `SWWAF_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app, as `http` or
@@ -288,7 +289,8 @@ it, and the effective settings are logged at start.
 - `SWWAF_METRICS_TOKEN` (default unset): the token a scraper sends for the
   metrics, a long random value. While it is unset the metrics are off; one
   shorter than 32 characters stops the start. The settings logged at start show
-  `********` in its place.
+  `********` in its place. Given as a file, it can be kept out of the app's
+  reach (see "Settings given as files" below).
 - `SWWAF_METRICS_TOP_N` (default `50`): how many countries get series of their
   own in the metrics by country; the others are counted as `other`.
 - `SWWAF_RULES_DIR` (default `/etc/smallwebwaf/rules.d`): the directory of the
@@ -329,6 +331,36 @@ with their counters and history, and an IPv6 client is counted by its /64. A new
 client waits at most a second for its country, and at most 100,000 answers from
 GeoJS are kept, for 7 days each.
 
+### Settings given as files
+
+Any setting may instead be given as a file that holds its value: the variable
+named like the setting with `_FILE` added, such as `SWWAF_METRICS_TOKEN_FILE`,
+names the file. `smallwebwaf` reads the file once, at start. Its contents are
+the value, less one newline at their end so that a file written with `echo` or
+an editor works, and are checked as the setting's own value would be. Setting
+both the setting and its `_FILE` form, or naming a file that cannot be read,
+stops the start with a message naming the variable. The settings logged at start
+name the file, and show a token given in one as `********`, as they show one
+given directly. `SWWAF_LOG_REMOTE_TLS_CA_FILE`, whose value names a file
+already, has no `_FILE` form.
+
+The app starts with the same environment variables as `smallwebwaf`, so it can
+read a token given as one. A token given as a file is out of the app's reach
+only while the `smallwebwaf` user alone can read the file: make it on the host,
+owned by uid 65532, the `smallwebwaf` user, with mode `0400`, and mount the
+directory that holds it into the container read-only; the container sees the
+same owner and mode. For example, on the host:
+
+```sh
+mkdir -p /srv/app/tokens
+openssl rand -hex 32 > /srv/app/tokens/metrics
+chown 65532:65532 /srv/app/tokens/metrics
+chmod 0400 /srv/app/tokens/metrics
+```
+
+and for the container, `-v /srv/app/tokens:/etc/smallwebwaf/tokens:ro` and
+`-e SWWAF_METRICS_TOKEN_FILE=/etc/smallwebwaf/tokens/metrics`.
+
 ## Request log
 
 `smallwebwaf` writes one JSON object per line on stdout for every request,