Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

The IPv6 group that is one client, the size of the table of clients and
the level of the process's own lines become settings. clientGroup reads
the group length from them, so limits, bans, history, lookups, AbuseIPDB
scores and per-client anomaly counters all follow it; ratelimit.New
takes the table size; the process logger takes the level once the
settings are read, and request lines, written apart from it, are never
held back.

Judgement call: SWWAF_IPV6_GROUP_PREFIX accepts 32 to 128, the issue's example range.

Model: opus-5-5

internal/smallwebwaf/smallwebwaf.go

@@ -70,8 +70,10 @@ func Main(version string) int {
 // state files, then serves requests until ctx is done. It returns the
 // process's exit status, 1 when smallwebwaf cannot start.
 func Run(ctx context.Context, params Params) int {
+	// Until the settings are read, the one message is an invalid setting's
+	// error, which every SWWAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
-		config.InstanceName(params.LookupEnv))
+		config.InstanceName(params.LookupEnv), slog.LevelError)
 
 	cfg, err := config.FromEnvironment(params.LookupEnv)
 	if err != nil {
@@ -89,8 +91,11 @@ func Run(ctx context.Context, params Params) int {
 	if cfg.LogRemoteURL != nil {
 		remote = newRemoteLogSender(cfg)
 		stdout = io.MultiWriter(params.Stdout, remote)
-		processLog = requestlog.NewProcessLogger(stdout, cfg.InstanceName)
+	}
 
+	processLog = requestlog.NewProcessLogger(stdout, cfg.InstanceName, cfg.LogLevel)
+
+	if remote != nil {
 		stopSending := startSending(ctx, remote, processLog)
 		defer stopSending()
 	}

internal/smallwebwaf/smallwebwaf_test.go

@@ -249,6 +249,54 @@ func TestServesUntilToldToStop(t *testing.T) {
 	out.line(t, "msg", "stopped")
 }
 
+func TestLogLevelHoldsBackTheLessSevereProcessLines(t *testing.T) {
+	t.Parallel()
+
+	// A list that cannot be fetched has a warning written once smallwebwaf
+	// serves, after its starting line.
+	lists := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}))
+	t.Cleanup(lists.Close)
+
+	ctx, stop := context.WithCancel(t.Context())
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- run(ctx, map[string]string{
+			listenAddr:             localhost + ":0",
+			stateDir:               t.TempDir(),
+			rulesDir:               t.TempDir(),
+			"SWWAF_BLOCKLIST_URLS": lists.URL + "/tor.txt",
+			"SWWAF_LOG_LEVEL":      "warn",
+		}, out)
+	}()
+
+	out.line(t, "msg", "fetching a list failed")
+	stop()
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+		}
+	case <-time.After(waitLimit):
+		t.Fatal("still running after being told to stop")
+	}
+
+	// Not one of the info lines from the start to the stop.
+	for line := range strings.Lines(out.text()) {
+		var fields map[string]any
+
+		err := json.Unmarshal([]byte(line), &fields)
+		if err != nil || fields["level"] == "INFO" {
+			t.Errorf("line %q (%v), want none at info", line, err)
+		}
+	}
+}
+
 func TestEveryLogLineAndMetricCarriesTheInstanceName(t *testing.T) {
 	t.Parallel()