Read every setting through viper (closes #211)

servewaf's and rproxy's settings are read through viper, bound to the same environment variable names as before, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set, as it did. The _FILE forms, their errors, and rproxy reading no file form are unchanged, and the settings tests pass set into a viper instead of a lookup function.

Model: deepseek-v4-pro

internal/rproxy/rproxy_test.go

@@ -18,6 +18,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
@@ -341,6 +343,17 @@ func startServer(
 	return addr, out, server
 }
 
+// viperFrom returns a viper Set with each of settings, as the viper
+// config.NewViper returns one bound to a process's environment.
+func viperFrom(settings map[string]string) *viper.Viper {
+	v := viper.New()
+	for name, value := range settings {
+		v.Set(name, value)
+	}
+
+	return v
+}
+
 // startServerLogging is startServer with rproxy's request lines going to
 // requestLog and its process lines to processLog.
 func startServerLogging(
@@ -354,11 +367,7 @@ func startServerLogging(
 	}
 	maps.Copy(settings, env)
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
-		value, ok := settings[name]
-
-		return value, ok
-	})
+	cfg, err := config.RProxyFromEnvironment(viperFrom(settings))
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}