Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/sww/sww.go

@@ -20,6 +20,8 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
@@ -38,7 +40,7 @@ import (
 const shutdownTimeout = 5 * time.Second
 
 // remoteLogStopTimeout is how long, as waf stops, the log lines still
-// waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has
+// waiting are sent to SWW_WAF_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
 
@@ -59,8 +61,9 @@ commands:
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
-	// LookupEnv reads an environment variable, normally os.LookupEnv.
-	LookupEnv func(string) (string, bool)
+	// Viper reads the settings, normally the viper config.NewViper returns
+	// for the process's environment.
+	Viper *viper.Viper
 	// Stdout receives the request log and the process's own messages.
 	Stdout io.Writer
 }
@@ -80,9 +83,9 @@ func Main(version string) int {
 	defer stop()
 
 	params := Params{
-		Version:   version,
-		LookupEnv: os.LookupEnv,
-		Stdout:    os.Stdout,
+		Version: version,
+		Viper:   config.NewViper(),
+		Stdout:  os.Stdout,
 	}
 
 	switch args[0] {
@@ -91,7 +94,7 @@ func Main(version string) int {
 	case "waf":
 		return RunWAF(ctx, params)
 	case "healthcheck":
-		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
+		return HealthCheck(ctx, args[1:], params.Viper, os.Stderr)
 	default:
 		return printUsage(os.Stderr)
 	}
@@ -109,16 +112,16 @@ func printUsage(w io.Writer) int {
 // ctx is done. It returns the process's exit status, 1 when waf cannot start.
 func RunWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
-	// error, which every SWW_LOG_LEVEL lets through.
+	// error, which every SWW_WAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
-		config.InstanceName(params.LookupEnv), slog.LevelError)
+		config.InstanceName(params.Viper), slog.LevelError)
 
-	cfg, err := config.FromEnvironment(params.LookupEnv)
+	cfg, err := config.FromEnvironment(params.Viper)
 	if err != nil {
 		return cannotStart(processLog, "invalid setting", err)
 	}
 
-	// While SWW_LOG_REMOTE_URL is set, every line on stdout from here on
+	// While SWW_WAF_LOG_REMOTE_URL is set, every line on stdout from here on
 	// is sent there too.
 	stdout := params.Stdout
 
@@ -152,7 +155,7 @@ func RunWAF(ctx context.Context, params Params) int {
 
 // runWAFWithSettings is the rest of RunWAF once the settings are read and
 // the process log goes where they say. remote is nil unless
-// SWW_LOG_REMOTE_URL is set.
+// SWW_WAF_LOG_REMOTE_URL is set.
 func runWAFWithSettings(
 	ctx context.Context,
 	version string,
@@ -211,7 +214,7 @@ func runWAFWithSettings(
 	if err != nil {
 		return cannotStart(
 			processLog,
-			"cannot listen on SWW_LISTEN_ADDR",
+			"cannot listen on SWW_WAF_LISTEN_ADDR",
 			err,
 		)
 	}
@@ -240,7 +243,7 @@ func cannotStart(processLog *slog.Logger, message string, err error) int {
 }
 
 // newServer returns the server waf runs, with the metrics of the alerts,
-// after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup
+// after reading the lookup database while SWW_WAF_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
@@ -334,7 +337,7 @@ func newAlertQueue(
 }
 
 // newRemoteLogSender returns a sender of the log lines to
-// SWW_LOG_REMOTE_URL, with the settings for it.
+// SWW_WAF_LOG_REMOTE_URL, with the settings for it.
 func newRemoteLogSender(cfg *config.Config) *remotelog.Sender {
 	return remotelog.New(remotelog.Params{
 		URL:      cfg.LogRemoteURL,