Rename the program to sww and its deciding daemon to discriminator (closes #218) (#221)

internal/config/config.go

@@ -1,9 +1,9 @@
-// Package config reads smallwebwaf's settings, and is the one place they are
-// read. Every setting is an environment variable. The settings of `smallwebwaf
-// servewaf` start with SWWAF_, every one of them has a default, and most can be
-// given as a file instead. Those of `smallwebwaf rproxy` start with SWRP_. Each
+// Package config reads sww's settings, and is the one place they are
+// read. Every setting is an environment variable. The settings of `sww
+// discriminator` start with SWW_, every one of them has a default, and most can be
+// given as a file instead. Those of `sww rproxy` start with SWRP_. Each
 // of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
-// since rproxy never touches disk. SMALLWEBWAF_COMMAND chooses which of the two
+// since rproxy never touches disk. SWW_COMMAND chooses which of the two
 // the image runs.
 package config
 
@@ -31,88 +31,88 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// Config is the settings of `smallwebwaf servewaf`. A time or size limit of
+// Config is the settings of `sww discriminator`. A time or size limit of
 // zero is off.
 type Config struct {
-	// ListenAddr is where servewaf listens (SWWAF_LISTEN_ADDR).
+	// ListenAddr is where discriminator listens (SWW_LISTEN_ADDR).
 	ListenAddr string
 	// InstanceName is the name every log line and alert gives as instance,
-	// and every metric carries as its label instance (SWWAF_INSTANCE_NAME),
+	// and every metric carries as its label instance (SWW_INSTANCE_NAME),
 	// by default the host's name, which docker sets to the first 12
 	// characters of the container's id.
 	InstanceName string
-	// Observe is true in observe mode, when SWWAF_MODE is observe rather
-	// than enforce: a request that SWWAF_DENY_NETS, a ban, the country
+	// Observe is true in observe mode, when SWW_MODE is observe rather
+	// than enforce: a request that SWW_DENY_NETS, a ban, the country
 	// lists, a rate limit, a rule or the Core Rule Set would refuse is
 	// allowed instead, and no ban is made.
 	Observe bool
 	// IPv6GroupPrefix is the length of the IPv6 netblock that is one client
-	// (SWWAF_IPV6_GROUP_PREFIX), from 32 to 128.
+	// (SWW_IPV6_GROUP_PREFIX), from 32 to 128.
 	IPv6GroupPrefix int
 	// MaxTrackedClients is the most clients the table of clients holds, in
-	// memory and in clients.json (SWWAF_MAX_TRACKED_CLIENTS).
+	// memory and in clients.json (SWW_MAX_TRACKED_CLIENTS).
 	MaxTrackedClients int
 	// AllowNets are the netblocks whose clients skip every check
-	// (SWWAF_ALLOW_NETS). RateLimitExemptNets are those whose clients the
-	// rate limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_NETS).
+	// (SWW_ALLOW_NETS). RateLimitExemptNets are those whose clients the
+	// rate limits neither count nor refuse (SWW_RATE_LIMIT_EXEMPT_NETS).
 	// DenyNets are those whose clients are always refused
-	// (SWWAF_DENY_NETS).
+	// (SWW_DENY_NETS).
 	AllowNets           []netip.Prefix
 	RateLimitExemptNets []netip.Prefix
 	DenyNets            []netip.Prefix
 	// RateLimitPerMinute, RateLimitPerHour and RateLimitPerDay are the
 	// most requests a client may make in a minute, an hour and a day
-	// (SWWAF_RATE_LIMIT_PER_MINUTE, SWWAF_RATE_LIMIT_PER_HOUR and
-	// SWWAF_RATE_LIMIT_PER_DAY).
+	// (SWW_RATE_LIMIT_PER_MINUTE, SWW_RATE_LIMIT_PER_HOUR and
+	// SWW_RATE_LIMIT_PER_DAY).
 	RateLimitPerMinute int64
 	RateLimitPerHour   int64
 	RateLimitPerDay    int64
 	// RateLimitExemptPaths are the path prefixes whose requests the rate
-	// limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_PATHS).
+	// limits neither count nor refuse (SWW_RATE_LIMIT_EXEMPT_PATHS).
 	// Each starts with /.
 	RateLimitExemptPaths []string
 	// BytesLimitPerMinute, BytesLimitPerHour and BytesLimitPerDay are the
 	// most bytes a client's requests may carry in a minute, an hour and a
-	// day (SWWAF_BYTES_LIMIT_PER_MINUTE, SWWAF_BYTES_LIMIT_PER_HOUR and
-	// SWWAF_BYTES_LIMIT_PER_DAY). BytesCount is which body bytes count
-	// toward them (SWWAF_BYTES_COUNT): response, request or both.
+	// day (SWW_BYTES_LIMIT_PER_MINUTE, SWW_BYTES_LIMIT_PER_HOUR and
+	// SWW_BYTES_LIMIT_PER_DAY). BytesCount is which body bytes count
+	// toward them (SWW_BYTES_COUNT): response, request or both.
 	BytesLimitPerMinute int64
 	BytesLimitPerHour   int64
 	BytesLimitPerDay    int64
 	BytesCount          string
 	// LookupSource is where each client's AS number and country are
-	// looked up (SWWAF_LOOKUP_SOURCE): geojs, file, or off for nowhere.
+	// looked up (SWW_LOOKUP_SOURCE): geojs, file, or off for nowhere.
 	// LookupDBPath is the lookup database, the IPinfo Lite file looked up
-	// in while LookupSource is file (SWWAF_LOOKUP_DB_PATH), and "" for any
+	// in while LookupSource is file (SWW_LOOKUP_DB_PATH), and "" for any
 	// other source. A request waits up to LookupTimeout for its client's
 	// first answer from GeoJS while a setting needs it
-	// (SWWAF_LOOKUP_TIMEOUT), which cannot be off. AddLookupHeaders is true
+	// (SWW_LOOKUP_TIMEOUT), which cannot be off. AddLookupHeaders is true
 	// when the app is passed the client's AS number and country in headers
-	// (SWWAF_ADD_LOOKUP_HEADERS).
+	// (SWW_ADD_LOOKUP_HEADERS).
 	LookupSource     string
 	LookupDBPath     string
 	LookupTimeout    time.Duration
 	AddLookupHeaders bool
 	// DeniedCountries are the countries whose clients are refused
-	// (SWWAF_DENIED_COUNTRIES). ExclusivelyAllowedCountries, when not
+	// (SWW_DENIED_COUNTRIES). ExclusivelyAllowedCountries, when not
 	// empty, are the only countries whose clients are let through
-	// (SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES). Both hold two-letter codes in
+	// (SWW_EXCLUSIVELY_ALLOWED_COUNTRIES). Both hold two-letter codes in
 	// capitals, as GeoJS gives them.
 	DeniedCountries             []string
 	ExclusivelyAllowedCountries []string
 	// The biased thresholds. ASNLimitPercent and CountryLimitPercent give
 	// the clients of the AS numbers and the countries they list that
 	// percentage of every rate limit and byte limit
-	// (SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT).
+	// (SWW_ASN_LIMIT_PERCENT and SWW_COUNTRY_LIMIT_PERCENT).
 	// ASNBytesPercent and CountryBytesPercent give those they list a
 	// percentage of the byte limits in place of that one
-	// (SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT). Each holds
+	// (SWW_ASN_BYTES_PERCENT and SWW_COUNTRY_BYTES_PERCENT). Each holds
 	// percentages from 0 to 100, by AS number, written as AS64496, or by
 	// country, a two-letter code in capitals, as the lookup gives them.
 	// UnknownLimitPercent is the percentage of every limit a client without
-	// a country gets (SWWAF_UNKNOWN_LIMIT_PERCENT). ASNLimitPercentURL is
+	// a country gets (SWW_UNKNOWN_LIMIT_PERCENT). ASNLimitPercentURL is
 	// where a file of AS:percent lines is fetched from, whose percentages
-	// count as those of ASNLimitPercent do (SWWAF_ASN_LIMIT_PERCENT_URL), ""
+	// count as those of ASNLimitPercent do (SWW_ASN_LIMIT_PERCENT_URL), ""
 	// while it is unset.
 	ASNLimitPercent     map[string]int64
 	CountryLimitPercent map[string]int64
@@ -121,30 +121,30 @@ type Config struct {
 	UnknownLimitPercent int64
 	ASNLimitPercentURL  string
 	// BlocklistURLs are where the blocklists are fetched from
-	// (SWWAF_BLOCKLIST_URLS). Each list, and ASNLimitPercentURL's, is
+	// (SWW_BLOCKLIST_URLS). Each list, and ASNLimitPercentURL's, is
 	// fetched again BlocklistRefresh after it was last fetched or tried
-	// (SWWAF_BLOCKLIST_REFRESH), which is never less than an hour.
+	// (SWW_BLOCKLIST_REFRESH), which is never less than an hour.
 	// BlocklistAction is what is done with a client a blocklist lists
-	// (SWWAF_BLOCKLIST_ACTION): deny, limit or log; for limit,
+	// (SWW_BLOCKLIST_ACTION): deny, limit or log; for limit,
 	// BlocklistLimitPercent is the percentage of every limit it gets.
 	BlocklistURLs         []string
 	BlocklistRefresh      time.Duration
 	BlocklistAction       string
 	BlocklistLimitPercent int64
 	// DNSBLZones are the DNSBL zones clients are asked about
-	// (SWWAF_DNSBL_ZONES), through DNSBLResolver (SWWAF_DNSBL_RESOLVER), or
+	// (SWW_DNSBL_ZONES), through DNSBLResolver (SWW_DNSBL_RESOLVER), or
 	// the host's resolver while that is the zero AddrPort.
 	// AbuseIPDBKey is the key of the AbuseIPDB account clients are checked
-	// with (SWWAF_ABUSEIPDB_KEY), "" while it is unset and none is. A score
-	// of AbuseIPDBMinScore or more is a hit (SWWAF_ABUSEIPDB_MIN_SCORE), and
+	// with (SWW_ABUSEIPDB_KEY), "" while it is unset and none is. A score
+	// of AbuseIPDBMinScore or more is a hit (SWW_ABUSEIPDB_MIN_SCORE), and
 	// at most AbuseIPDBDailyBudget checks are made a day
-	// (SWWAF_ABUSEIPDB_DAILY_BUDGET).
+	// (SWW_ABUSEIPDB_DAILY_BUDGET).
 	// ReputationAction is what is done with a client a zone's verdict lists,
-	// or whose score is a hit (SWWAF_REPUTATION_ACTION): deny, limit or log;
+	// or whose score is a hit (SWW_REPUTATION_ACTION): deny, limit or log;
 	// for limit, ReputationLimitPercent is the percentage of every limit it
 	// gets. A verdict or a score is used for ReputationCacheTTL after it was
-	// fetched (SWWAF_REPUTATION_CACHE_TTL), and a query or a check may take
-	// ReputationTimeout (SWWAF_REPUTATION_TIMEOUT). Neither can be off.
+	// fetched (SWW_REPUTATION_CACHE_TTL), and a query or a check may take
+	// ReputationTimeout (SWW_REPUTATION_TIMEOUT). Neither can be off.
 	DNSBLZones             []string
 	DNSBLResolver          netip.AddrPort
 	AbuseIPDBKey           string
@@ -155,74 +155,74 @@ type Config struct {
 	ReputationCacheTTL     time.Duration
 	ReputationTimeout      time.Duration
 	// CrowdSecDecisionsURL is where the decision list of the CrowdSec
-	// engine whose local API SWWAF_CROWDSEC_LAPI_URL names is fetched from:
+	// engine whose local API SWW_CROWDSEC_LAPI_URL names is fetched from:
 	// that URL with v1/decisions added to its path, "" while it is unset and
 	// none is. CrowdSecKey is the key the engine is asked with
-	// (SWWAF_CROWDSEC_LAPI_KEY).
+	// (SWW_CROWDSEC_LAPI_KEY).
 	CrowdSecDecisionsURL string
 	CrowdSecKey          string
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
-	// (SWWAF_BAN_RESPONSE). It answers a banned client, a request that
-	// breaks a rate limit or matches a ban rule, SWWAF_DENY_NETS and the
+	// (SWW_BAN_RESPONSE). It answers a banned client, a request that
+	// breaks a rate limit or matches a ban rule, SWW_DENY_NETS and the
 	// country lists.
 	BanResponse int
 	// LimitBanDuration is the ban for a first broken rate limit
-	// (SWWAF_LIMIT_BAN_DURATION). A limit broken again within
+	// (SWW_LIMIT_BAN_DURATION). A limit broken again within
 	// LimitBanRepeatWindow after the last ban ended bans for three times
-	// as long as that ban (SWWAF_LIMIT_BAN_REPEAT_WINDOW), and a ban that
+	// as long as that ban (SWW_LIMIT_BAN_REPEAT_WINDOW), and a ban that
 	// would be longer than MaxBanDuration is permanent instead
-	// (SWWAF_MAX_BAN_DURATION). None of them can be off.
+	// (SWW_MAX_BAN_DURATION). None of them can be off.
 	LimitBanDuration     time.Duration
 	LimitBanRepeatWindow time.Duration
 	MaxBanDuration       time.Duration
 	// AttackBanDuration is the ban for a first clear sign of attack
-	// (SWWAF_ATTACK_BAN_DURATION). It cannot be off.
+	// (SWW_ATTACK_BAN_DURATION). It cannot be off.
 	AttackBanDuration time.Duration
-	// MaxBans is the most bans held (SWWAF_MAX_BANS).
+	// MaxBans is the most bans held (SWW_MAX_BANS).
 	MaxBans int
 	// BanScopeV4Prefix is the length of the netblock around an IPv4
-	// client that a ban covers (SWWAF_BAN_SCOPE_V4_PREFIX).
+	// client that a ban covers (SWW_BAN_SCOPE_V4_PREFIX).
 	BanScopeV4Prefix int
 	// StateDir is the directory of the state files, an absolute path
-	// (SWWAF_STATE_DIR). bans.json is written StateWriteDelay after a ban
-	// is made (SWWAF_STATE_WRITE_DELAY), and every state file every
-	// StateCounterInterval (SWWAF_STATE_COUNTER_INTERVAL). Neither can be
+	// (SWW_STATE_DIR). bans.json is written StateWriteDelay after a ban
+	// is made (SWW_STATE_WRITE_DELAY), and every state file every
+	// StateCounterInterval (SWW_STATE_COUNTER_INTERVAL). Neither can be
 	// off.
 	StateDir             string
 	StateWriteDelay      time.Duration
 	StateCounterInterval time.Duration
 	// LogRequestHeaders are the request headers whose values the request
-	// log gives, in lower case (SWWAF_LOG_REQUEST_HEADERS).
+	// log gives, in lower case (SWW_LOG_REQUEST_HEADERS).
 	LogRequestHeaders []string
 	// LogLevel is the least severe of the process's own messages that are
-	// written (SWWAF_LOG_LEVEL). It holds back no request log line.
+	// written (SWW_LOG_LEVEL). It holds back no request log line.
 	LogLevel slog.Level
 	// AdminToken is the bearer token an admin sends for the ban endpoints
-	// and /_smallwebwaf/clients/<ip> (SWWAF_ADMIN_TOKEN), "" while it is
+	// and /_sww/clients/<ip> (SWW_ADMIN_TOKEN), "" while it is
 	// unset and they are off.
 	AdminToken string
 	// MetricsToken is the bearer token a scraper sends for the metrics
-	// (SWWAF_METRICS_TOKEN), "" while it is unset and the metrics are off.
+	// (SWW_METRICS_TOKEN), "" while it is unset and the metrics are off.
 	// MetricsTopN is how many AS numbers and how many countries get series
-	// of their own in the metrics (SWWAF_METRICS_TOP_N).
+	// of their own in the metrics (SWW_METRICS_TOP_N).
 	MetricsToken string
 	MetricsTopN  int
-	// RulesDir is the directory of the rule files (SWWAF_RULES_DIR), read
-	// unless RulesEnabled is false (SWWAF_RULES_ENABLED).
+	// RulesDir is the directory of the rule files (SWW_RULES_DIR), read
+	// unless RulesEnabled is false (SWW_RULES_ENABLED).
 	RulesDir     string
 	RulesEnabled bool
-	// WAFMode is what the Core Rule Set does (SWWAF_WAF_MODE): WAFModeOff,
+	// WAFMode is what the Core Rule Set does (SWW_WAF_MODE): WAFModeOff,
 	// WAFModeDetect or WAFModeBlock. WAFParanoiaLevel is its paranoia
-	// level, from 1 to 4 (SWWAF_WAF_PARANOIA_LEVEL), and
+	// level, from 1 to 4 (SWW_WAF_PARANOIA_LEVEL), and
 	// WAFAnomalyThreshold the anomaly score at which a request is a match
-	// (SWWAF_WAF_ANOMALY_THRESHOLD), 0 while it is off. WAFDisabledRules
-	// are the ids of its rules switched off (SWWAF_WAF_DISABLED_RULES),
+	// (SWW_WAF_ANOMALY_THRESHOLD), 0 while it is off. WAFDisabledRules
+	// are the ids of its rules switched off (SWW_WAF_DISABLED_RULES),
 	// WAFExemptPaths the path prefixes it does not inspect
-	// (SWWAF_WAF_EXEMPT_PATHS), and WAFBodyLimit the most of a request body
-	// it reads (SWWAF_WAF_BODY_LIMIT), 0 while it is off and it reads none.
+	// (SWW_WAF_EXEMPT_PATHS), and WAFBodyLimit the most of a request body
+	// it reads (SWW_WAF_BODY_LIMIT), 0 while it is off and it reads none.
 	// CoreRuleSetExclusionsFile is the path of the file of its exclusions
-	// (SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while there is none.
+	// (SWW_CORE_RULE_SET_EXCLUSIONS_FILE), "" while there is none.
 	WAFMode                   string
 	WAFParanoiaLevel          int
 	WAFAnomalyThreshold       int
@@ -231,21 +231,21 @@ type Config struct {
 	WAFBodyLimit              int64
 	CoreRuleSetExclusionsFile string
 	// TrapPaths are the paths a request for which is a clear sign of
-	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
+	// attack (SWW_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that servewaf may refuse after a rule file or Core Rule Set match; one
-	// more breaks a limit (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
+	// that discriminator may refuse after a rule file or Core Rule Set match; one
+	// more breaks a limit (SWW_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
-	// (SWWAF_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
+	// (SWW_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
 	// LogRemoteTLSCAs are the certificates a syslog+tls endpoint's
-	// certificate must chain to (SWWAF_LOG_REMOTE_TLS_CA_FILE), nil while
+	// certificate must chain to (SWW_LOG_REMOTE_TLS_CA_FILE), nil while
 	// it is unset and the host's own are used. LogRemoteBuffer is the most
-	// lines held while they wait to be sent (SWWAF_LOG_REMOTE_BUFFER).
+	// lines held while they wait to be sent (SWW_LOG_REMOTE_BUFFER).
 	// LogRemoteFacility is the number of the syslog facility
-	// (SWWAF_LOG_REMOTE_FACILITY), and LogRemoteAppName the APP-NAME
-	// (SWWAF_LOG_REMOTE_APP_NAME, by default InstanceName), of the records
+	// (SWW_LOG_REMOTE_FACILITY), and LogRemoteAppName the APP-NAME
+	// (SWW_LOG_REMOTE_APP_NAME, by default InstanceName), of the records
 	// the lines are sent in.
 	LogRemoteURL      *url.URL
 	LogRemoteTLSCAs   *x509.CertPool
@@ -253,18 +253,18 @@ type Config struct {
 	LogRemoteFacility int
 	LogRemoteAppName  string
 	// AlertWebhookURL is where each alert is posted as JSON
-	// (SWWAF_ALERT_WEBHOOK_URL), nil while it is unset. AlertWebhookHeaders
-	// are sent with each (SWWAF_ALERT_WEBHOOK_HEADERS).
+	// (SWW_ALERT_WEBHOOK_URL), nil while it is unset. AlertWebhookHeaders
+	// are sent with each (SWW_ALERT_WEBHOOK_HEADERS).
 	// AlertSlackWebhookURL is the Slack incoming webhook each alert is
-	// posted to as a message (SWWAF_ALERT_SLACK_WEBHOOK_URL), and
+	// posted to as a message (SWW_ALERT_SLACK_WEBHOOK_URL), and
 	// AlertNtfyURL the ntfy topic each is published to
-	// (SWWAF_ALERT_NTFY_URL), each nil while it is unset; AlertNtfyToken,
-	// unless empty, is sent to ntfy with each (SWWAF_ALERT_NTFY_TOKEN).
+	// (SWW_ALERT_NTFY_URL), each nil while it is unset; AlertNtfyToken,
+	// unless empty, is sent to ntfy with each (SWW_ALERT_NTFY_TOKEN).
 	// With none of the three URLs set, no alert is sent. AlertEvents are
-	// the events alerts are sent for (SWWAF_ALERT_EVENTS). A repeat of an
-	// alert within AlertCooldown is held back (SWWAF_ALERT_COOLDOWN), and
+	// the events alerts are sent for (SWW_ALERT_EVENTS). A repeat of an
+	// alert within AlertCooldown is held back (SWW_ALERT_COOLDOWN), and
 	// so is an alert past AlertMaxPerHour in an hour, for the hour's
-	// summary (SWWAF_ALERT_MAX_PER_HOUR); 0 is off for both.
+	// summary (SWW_ALERT_MAX_PER_HOUR); 0 is off for both.
 	AlertWebhookURL      *url.URL
 	AlertWebhookHeaders  http.Header
 	AlertSlackWebhookURL *url.URL
@@ -274,14 +274,14 @@ type Config struct {
 	AlertCooldown        time.Duration
 	AlertMaxPerHour      int
 	// The anomaly thresholds, which only raise alerts: the most requests
-	// and bytes a minute and an hour per client (SWWAF_ANOMALY_CLIENT_*),
-	// per netblock around a client (SWWAF_ANOMALY_NET_*), per AS number
-	// (SWWAF_ANOMALY_ASN_*), for the whole service (SWWAF_ANOMALY_TOTAL_*)
-	// and per named netblock (SWWAF_WATCH_*), each 0 while it is off.
+	// and bytes a minute and an hour per client (SWW_ANOMALY_CLIENT_*),
+	// per netblock around a client (SWW_ANOMALY_NET_*), per AS number
+	// (SWW_ANOMALY_ASN_*), for the whole service (SWW_ANOMALY_TOTAL_*)
+	// and per named netblock (SWW_WATCH_*), each 0 while it is off.
 	// AnomalyNetV4Prefix and AnomalyNetV6Prefix are the lengths of the
-	// netblock around a client (SWWAF_ANOMALY_NET_V4_PREFIX and
-	// SWWAF_ANOMALY_NET_V6_PREFIX), and WatchNets the named netblocks
-	// (SWWAF_WATCH_NETS).
+	// netblock around a client (SWW_ANOMALY_NET_V4_PREFIX and
+	// SWW_ANOMALY_NET_V6_PREFIX), and WatchNets the named netblocks
+	// (SWW_WATCH_NETS).
 	AnomalyClient      anomaly.Thresholds
 	AnomalyNet         anomaly.Thresholds
 	AnomalyASN         anomaly.Thresholds
@@ -300,7 +300,7 @@ type Config struct {
 // off.
 const off = "off"
 
-// The values of SWWAF_WAF_MODE.
+// The values of SWW_WAF_MODE.
 const (
 	// WAFModeOff runs no request through the Core Rule Set.
 	WAFModeOff = off
@@ -310,8 +310,8 @@ const (
 	WAFModeBlock = "block"
 )
 
-// fileSource is the SWWAF_LOOKUP_SOURCE that looks clients up in the
-// lookup database, the file SWWAF_LOOKUP_DB_PATH names.
+// fileSource is the SWW_LOOKUP_SOURCE that looks clients up in the
+// lookup database, the file SWW_LOOKUP_DB_PATH names.
 const fileSource = "file"
 
 const (
@@ -321,7 +321,7 @@ const (
 	gibibyte = 1 << 30
 	ipv4Bits = 32
 	ipv6Bits = 128
-	// minIPv6GroupPrefix is the shortest SWWAF_IPV6_GROUP_PREFIX, the
+	// minIPv6GroupPrefix is the shortest SWW_IPV6_GROUP_PREFIX, the
 	// netblock a provider is usually given: a shorter one would make one
 	// client of the customers of several providers.
 	minIPv6GroupPrefix = 32
@@ -330,7 +330,7 @@ const (
 	// maxParanoiaLevel is the Core Rule Set's highest paranoia level.
 	maxParanoiaLevel = 4
 	// firstSetupRuleID to lastSetupRuleID are the ids the Core Rule Set
-	// keeps for the rules that set it up, which smallwebwaf's own rules
+	// keeps for the rules that set it up, which sww's own rules
 	// have too (see internal/waf). Switching one off would undo a change
 	// that no setting undoes.
 	firstSetupRuleID = 900000
@@ -338,7 +338,7 @@ const (
 	// masked is what the log shows for a token that is set, and in place of
 	// a secret in another setting.
 	masked = "********"
-	// defaultListenAddr is the default of SWWAF_LISTEN_ADDR and
+	// defaultListenAddr is the default of SWW_LISTEN_ADDR and
 	// SWRP_LISTEN_ADDR, and defaultUpstreamURL that of SWRP_UPSTREAM_URL.
 	defaultListenAddr  = ":8080"
 	defaultUpstreamURL = "http://127.0.0.1:8081"
@@ -367,14 +367,14 @@ var (
 	errHeaderTakenOut = errors.New(
 		"is taken out of every request by Go's HTTP server, so it can never " +
 			"be logged")
-	errOnBothLists     = errors.New("is in SWWAF_DENIED_COUNTRIES too")
+	errOnBothLists     = errors.New("is in SWW_DENIED_COUNTRIES too")
 	errNotLookupSource = errors.New("is not geojs, file or off")
 	errNeedsLookups    = errors.New("it needs each client looked up")
 	errNeedsDBPath     = errors.New("it names the file to look clients up in")
 	errDBPathUnused    = errors.New("only file reads it")
 	errOver64K         = errors.New(
-		"is more than 64K, the most servewaf gets of a body")
-	errNotCommand           = errors.New("is not rproxy or servewaf")
+		"is more than 64K, the most discriminator gets of a body")
+	errNotCommand           = errors.New("is not rproxy or discriminator")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -390,7 +390,7 @@ var (
 	errNotNamedNetblock = errors.New(
 		"is not a name, = and a netblock, such as office=203.0.113.0/24")
 	errNotAbsolutePath = errors.New(
-		"is not an absolute path, such as /var/lib/smallwebwaf")
+		"is not an absolute path, such as /var/lib/sww")
 	errShortToken    = errors.New("is shorter than 32 characters")
 	errNotMode       = errors.New("is not enforce or observe")
 	errNotBytesCount = errors.New("is not response, request or both")
@@ -404,7 +404,7 @@ var (
 		"is not the id of a Core Rule Set rule, a whole number such as 942100")
 	errSetupRuleID = errors.New(
 		"is from 900000 to 900999, the ids of the rules that set the Core Rule Set " +
-			"up and of smallwebwaf's own, which cannot be switched off")
+			"up and of sww's own, which cannot be switched off")
 	errNotBoolean      = errors.New("is not true or false")
 	errNotLogRemoteURL = errors.New(
 		"is not syslog+udp, syslog+tcp or syslog+tls with a host and a port, " +
@@ -416,7 +416,7 @@ var (
 	errSetTwice      = errors.New("set only one of them")
 	errNotWebhookURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
-			"such as https://alerts.example/smallwebwaf")
+			"such as https://alerts.example/sww")
 	errNotWebhookHeader = errors.New(
 		"is not a header name followed by : and the header's value, " +
 			"such as Authorization:Bearer <token>")
@@ -435,7 +435,7 @@ var (
 	errNotListURL  = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as https://www.spamhaus.org/drop/drop.txt")
-	errInBlocklistURLs = errors.New("is in SWWAF_BLOCKLIST_URLS too")
+	errInBlocklistURLs = errors.New("is in SWW_BLOCKLIST_URLS too")
 	errNotAnHourOrMore = errors.New("is not a duration of 1h or more, such as 24h")
 	errNotAction       = errors.New(
 		"is not deny, limit:<percent> such as limit:25, or log")
@@ -450,7 +450,7 @@ var (
 	errNeedsLAPIKey  = errors.New("the engine answers no request without it")
 	errLAPIKeyUnused = errors.New("it is sent only to the engine at that URL")
 	errAnotherList   = errors.New(
-		"is in SWWAF_BLOCKLIST_URLS or is SWWAF_ASN_LIMIT_PERCENT_URL too")
+		"is in SWW_BLOCKLIST_URLS or is SWW_ASN_LIMIT_PERCENT_URL too")
 )
 
 // FromEnvironment reads the settings with lookupEnv, normally
@@ -463,104 +463,104 @@ var (
 func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
-		ListenAddr:           env.address("SWWAF_LISTEN_ADDR"),
+		ListenAddr:           env.address("SWW_LISTEN_ADDR"),
 		InstanceName:         env.instanceName(),
-		Observe:              env.observe("SWWAF_MODE", "enforce"),
-		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWWAF_IPV6_GROUP_PREFIX", "64"),
-		MaxTrackedClients:    env.numberNotOff("SWWAF_MAX_TRACKED_CLIENTS", "20000"),
-		AllowNets:            env.netblocks("SWWAF_ALLOW_NETS", ""),
-		RateLimitExemptNets:  env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
-		DenyNets:             env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:   env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "120"),
-		RateLimitPerHour:     env.count("SWWAF_RATE_LIMIT_PER_HOUR", "1500"),
-		RateLimitPerDay:      env.count("SWWAF_RATE_LIMIT_PER_DAY", "6000"),
-		RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
-		BytesLimitPerMinute:  env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "off"),
-		BytesLimitPerHour:    env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "50G"),
-		BytesLimitPerDay:     env.size("SWWAF_BYTES_LIMIT_PER_DAY", "100G"),
-		BytesCount:           env.bytesCount("SWWAF_BYTES_COUNT", "both"),
-		LookupSource:         env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
-		LookupDBPath:         env.value("SWWAF_LOOKUP_DB_PATH", ""),
-		LookupTimeout:        env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "800ms"),
-		AddLookupHeaders:     env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
-		DeniedCountries:      env.countries("SWWAF_DENIED_COUNTRIES", ""),
+		Observe:              env.observe("SWW_MODE", "enforce"),
+		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWW_IPV6_GROUP_PREFIX", "64"),
+		MaxTrackedClients:    env.numberNotOff("SWW_MAX_TRACKED_CLIENTS", "20000"),
+		AllowNets:            env.netblocks("SWW_ALLOW_NETS", ""),
+		RateLimitExemptNets:  env.netblocks("SWW_RATE_LIMIT_EXEMPT_NETS", ""),
+		DenyNets:             env.netblocks("SWW_DENY_NETS", ""),
+		RateLimitPerMinute:   env.count("SWW_RATE_LIMIT_PER_MINUTE", "120"),
+		RateLimitPerHour:     env.count("SWW_RATE_LIMIT_PER_HOUR", "1500"),
+		RateLimitPerDay:      env.count("SWW_RATE_LIMIT_PER_DAY", "6000"),
+		RateLimitExemptPaths: env.pathPrefixes("SWW_RATE_LIMIT_EXEMPT_PATHS", ""),
+		BytesLimitPerMinute:  env.size("SWW_BYTES_LIMIT_PER_MINUTE", "off"),
+		BytesLimitPerHour:    env.size("SWW_BYTES_LIMIT_PER_HOUR", "50G"),
+		BytesLimitPerDay:     env.size("SWW_BYTES_LIMIT_PER_DAY", "100G"),
+		BytesCount:           env.bytesCount("SWW_BYTES_COUNT", "both"),
+		LookupSource:         env.lookupSource("SWW_LOOKUP_SOURCE", "geojs"),
+		LookupDBPath:         env.value("SWW_LOOKUP_DB_PATH", ""),
+		LookupTimeout:        env.durationNotOff("SWW_LOOKUP_TIMEOUT", "800ms"),
+		AddLookupHeaders:     env.boolean("SWW_ADD_LOOKUP_HEADERS", "false"),
+		DeniedCountries:      env.countries("SWW_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
-			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
-		ASNLimitPercent:      env.percents("SWWAF_ASN_LIMIT_PERCENT", ParseASN),
-		CountryLimitPercent:  env.percents("SWWAF_COUNTRY_LIMIT_PERCENT", parseCountry),
-		ASNBytesPercent:      env.percents("SWWAF_ASN_BYTES_PERCENT", ParseASN),
-		CountryBytesPercent:  env.percents("SWWAF_COUNTRY_BYTES_PERCENT", parseCountry),
-		UnknownLimitPercent:  env.percent("SWWAF_UNKNOWN_LIMIT_PERCENT", "100"),
-		ASNLimitPercentURL:   env.listURL("SWWAF_ASN_LIMIT_PERCENT_URL"),
-		BlocklistURLs:        env.listURLs("SWWAF_BLOCKLIST_URLS"),
-		BlocklistRefresh:     env.refresh("SWWAF_BLOCKLIST_REFRESH", "24h"),
-		DNSBLZones:           env.zones("SWWAF_DNSBL_ZONES"),
-		DNSBLResolver:        env.resolver("SWWAF_DNSBL_RESOLVER"),
-		AbuseIPDBKey:         env.secret("SWWAF_ABUSEIPDB_KEY"),
-		AbuseIPDBMinScore:    env.percent("SWWAF_ABUSEIPDB_MIN_SCORE", "75"),
-		AbuseIPDBDailyBudget: env.numberNotOff("SWWAF_ABUSEIPDB_DAILY_BUDGET", "900"),
-		ReputationCacheTTL:   env.durationNotOff("SWWAF_REPUTATION_CACHE_TTL", "24h"),
-		ReputationTimeout:    env.durationNotOff("SWWAF_REPUTATION_TIMEOUT", "2s"),
-		CrowdSecDecisionsURL: env.crowdSecDecisionsURL("SWWAF_CROWDSEC_LAPI_URL"),
-		CrowdSecKey:          env.secret("SWWAF_CROWDSEC_LAPI_KEY"),
-		BanResponse:          env.banResponse("SWWAF_BAN_RESPONSE", "403"),
-		LimitBanDuration:     env.durationNotOff("SWWAF_LIMIT_BAN_DURATION", "1h"),
-		LimitBanRepeatWindow: env.durationNotOff("SWWAF_LIMIT_BAN_REPEAT_WINDOW", "24h"),
-		MaxBanDuration:       env.durationNotOff("SWWAF_MAX_BAN_DURATION", "7d"),
-		AttackBanDuration:    env.durationNotOff("SWWAF_ATTACK_BAN_DURATION", "7d"),
-		MaxBans:              env.numberNotOff("SWWAF_MAX_BANS", "5000"),
-		BanScopeV4Prefix:     env.v4Prefix("SWWAF_BAN_SCOPE_V4_PREFIX", "32"),
-		StateDir:             env.absolutePath("SWWAF_STATE_DIR", "/var/lib/smallwebwaf"),
-		StateWriteDelay:      env.durationNotOff("SWWAF_STATE_WRITE_DELAY", "10s"),
-		StateCounterInterval: env.durationNotOff("SWWAF_STATE_COUNTER_INTERVAL", "15m"),
-		LogRequestHeaders: env.headerNames("SWWAF_LOG_REQUEST_HEADERS",
+			"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
+		ASNLimitPercent:      env.percents("SWW_ASN_LIMIT_PERCENT", ParseASN),
+		CountryLimitPercent:  env.percents("SWW_COUNTRY_LIMIT_PERCENT", parseCountry),
+		ASNBytesPercent:      env.percents("SWW_ASN_BYTES_PERCENT", ParseASN),
+		CountryBytesPercent:  env.percents("SWW_COUNTRY_BYTES_PERCENT", parseCountry),
+		UnknownLimitPercent:  env.percent("SWW_UNKNOWN_LIMIT_PERCENT", "100"),
+		ASNLimitPercentURL:   env.listURL("SWW_ASN_LIMIT_PERCENT_URL"),
+		BlocklistURLs:        env.listURLs("SWW_BLOCKLIST_URLS"),
+		BlocklistRefresh:     env.refresh("SWW_BLOCKLIST_REFRESH", "24h"),
+		DNSBLZones:           env.zones("SWW_DNSBL_ZONES"),
+		DNSBLResolver:        env.resolver("SWW_DNSBL_RESOLVER"),
+		AbuseIPDBKey:         env.secret("SWW_ABUSEIPDB_KEY"),
+		AbuseIPDBMinScore:    env.percent("SWW_ABUSEIPDB_MIN_SCORE", "75"),
+		AbuseIPDBDailyBudget: env.numberNotOff("SWW_ABUSEIPDB_DAILY_BUDGET", "900"),
+		ReputationCacheTTL:   env.durationNotOff("SWW_REPUTATION_CACHE_TTL", "24h"),
+		ReputationTimeout:    env.durationNotOff("SWW_REPUTATION_TIMEOUT", "2s"),
+		CrowdSecDecisionsURL: env.crowdSecDecisionsURL("SWW_CROWDSEC_LAPI_URL"),
+		CrowdSecKey:          env.secret("SWW_CROWDSEC_LAPI_KEY"),
+		BanResponse:          env.banResponse("SWW_BAN_RESPONSE", "403"),
+		LimitBanDuration:     env.durationNotOff("SWW_LIMIT_BAN_DURATION", "1h"),
+		LimitBanRepeatWindow: env.durationNotOff("SWW_LIMIT_BAN_REPEAT_WINDOW", "24h"),
+		MaxBanDuration:       env.durationNotOff("SWW_MAX_BAN_DURATION", "7d"),
+		AttackBanDuration:    env.durationNotOff("SWW_ATTACK_BAN_DURATION", "7d"),
+		MaxBans:              env.numberNotOff("SWW_MAX_BANS", "5000"),
+		BanScopeV4Prefix:     env.v4Prefix("SWW_BAN_SCOPE_V4_PREFIX", "32"),
+		StateDir:             env.absolutePath("SWW_STATE_DIR", "/var/lib/sww"),
+		StateWriteDelay:      env.durationNotOff("SWW_STATE_WRITE_DELAY", "10s"),
+		StateCounterInterval: env.durationNotOff("SWW_STATE_COUNTER_INTERVAL", "15m"),
+		LogRequestHeaders: env.headerNames("SWW_LOG_REQUEST_HEADERS",
 			"accept,accept-language,accept-encoding,content-type,origin,range"),
-		LogLevel:            env.logLevel("SWWAF_LOG_LEVEL", "info"),
-		AdminToken:          env.token("SWWAF_ADMIN_TOKEN"),
-		MetricsToken:        env.token("SWWAF_METRICS_TOKEN"),
-		MetricsTopN:         env.numberNotOff("SWWAF_METRICS_TOP_N", "50"),
-		RulesDir:            env.value("SWWAF_RULES_DIR", "/etc/smallwebwaf/rules.d"),
-		RulesEnabled:        env.boolean("SWWAF_RULES_ENABLED", "true"),
-		WAFMode:             env.wafMode("SWWAF_WAF_MODE", WAFModeBlock),
-		WAFParanoiaLevel:    env.paranoiaLevel("SWWAF_WAF_PARANOIA_LEVEL", "1"),
-		WAFAnomalyThreshold: env.numberOrOff("SWWAF_WAF_ANOMALY_THRESHOLD", "5"),
-		WAFDisabledRules: env.ruleIDs("SWWAF_WAF_DISABLED_RULES",
+		LogLevel:            env.logLevel("SWW_LOG_LEVEL", "info"),
+		AdminToken:          env.token("SWW_ADMIN_TOKEN"),
+		MetricsToken:        env.token("SWW_METRICS_TOKEN"),
+		MetricsTopN:         env.numberNotOff("SWW_METRICS_TOP_N", "50"),
+		RulesDir:            env.value("SWW_RULES_DIR", "/etc/sww/rules.d"),
+		RulesEnabled:        env.boolean("SWW_RULES_ENABLED", "true"),
+		WAFMode:             env.wafMode("SWW_WAF_MODE", WAFModeBlock),
+		WAFParanoiaLevel:    env.paranoiaLevel("SWW_WAF_PARANOIA_LEVEL", "1"),
+		WAFAnomalyThreshold: env.numberOrOff("SWW_WAF_ANOMALY_THRESHOLD", "5"),
+		WAFDisabledRules: env.ruleIDs("SWW_WAF_DISABLED_RULES",
 			"920340,920420,920440,920640,930130,930140"),
-		WAFExemptPaths: env.pathPrefixes("SWWAF_WAF_EXEMPT_PATHS", ""),
-		WAFBodyLimit:   env.wafBodyLimit("SWWAF_WAF_BODY_LIMIT", off),
+		WAFExemptPaths: env.pathPrefixes("SWW_WAF_EXEMPT_PATHS", ""),
+		WAFBodyLimit:   env.wafBodyLimit("SWW_WAF_BODY_LIMIT", off),
 		CoreRuleSetExclusionsFile: env.filePath(
-			"SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE"),
-		TrapPaths:            env.trapPaths("SWWAF_TRAP_PATHS"),
-		ErrorBurstThreshold:  env.count("SWWAF_ERROR_BURST_THRESHOLD", "30"),
-		LogRemoteURL:         env.logRemoteURL("SWWAF_LOG_REMOTE_URL"),
-		LogRemoteTLSCAs:      env.certificates("SWWAF_LOG_REMOTE_TLS_CA_FILE"),
-		LogRemoteBuffer:      env.numberNotOff("SWWAF_LOG_REMOTE_BUFFER", "10000"),
-		LogRemoteFacility:    env.facility("SWWAF_LOG_REMOTE_FACILITY", "local0"),
-		AlertWebhookURL:      env.webhookURL("SWWAF_ALERT_WEBHOOK_URL"),
-		AlertWebhookHeaders:  env.webhookHeaders("SWWAF_ALERT_WEBHOOK_HEADERS"),
-		AlertSlackWebhookURL: env.webhookURL("SWWAF_ALERT_SLACK_WEBHOOK_URL"),
-		AlertNtfyURL:         env.webhookURL("SWWAF_ALERT_NTFY_URL"),
-		AlertNtfyToken:       env.secret("SWWAF_ALERT_NTFY_TOKEN"),
-		AlertEvents: env.alertEvents("SWWAF_ALERT_EVENTS",
+			"SWW_CORE_RULE_SET_EXCLUSIONS_FILE"),
+		TrapPaths:            env.trapPaths("SWW_TRAP_PATHS"),
+		ErrorBurstThreshold:  env.count("SWW_ERROR_BURST_THRESHOLD", "30"),
+		LogRemoteURL:         env.logRemoteURL("SWW_LOG_REMOTE_URL"),
+		LogRemoteTLSCAs:      env.certificates("SWW_LOG_REMOTE_TLS_CA_FILE"),
+		LogRemoteBuffer:      env.numberNotOff("SWW_LOG_REMOTE_BUFFER", "10000"),
+		LogRemoteFacility:    env.facility("SWW_LOG_REMOTE_FACILITY", "local0"),
+		AlertWebhookURL:      env.webhookURL("SWW_ALERT_WEBHOOK_URL"),
+		AlertWebhookHeaders:  env.webhookHeaders("SWW_ALERT_WEBHOOK_HEADERS"),
+		AlertSlackWebhookURL: env.webhookURL("SWW_ALERT_SLACK_WEBHOOK_URL"),
+		AlertNtfyURL:         env.webhookURL("SWW_ALERT_NTFY_URL"),
+		AlertNtfyToken:       env.secret("SWW_ALERT_NTFY_TOKEN"),
+		AlertEvents: env.alertEvents("SWW_ALERT_EVENTS",
 			strings.Join(alerts.Events(), ",")),
-		AlertCooldown:      env.duration("SWWAF_ALERT_COOLDOWN", "15m"),
-		AlertMaxPerHour:    env.numberOrOff("SWWAF_ALERT_MAX_PER_HOUR", "60"),
-		AnomalyClient:      env.thresholds("SWWAF_ANOMALY_CLIENT_"),
-		AnomalyNet:         env.thresholds("SWWAF_ANOMALY_NET_"),
-		AnomalyASN:         env.thresholds("SWWAF_ANOMALY_ASN_"),
-		AnomalyTotal:       env.thresholds("SWWAF_ANOMALY_TOTAL_"),
-		AnomalyWatch:       env.thresholds("SWWAF_WATCH_"),
-		AnomalyNetV4Prefix: env.v4Prefix("SWWAF_ANOMALY_NET_V4_PREFIX", "24"),
-		AnomalyNetV6Prefix: env.v6Prefix("SWWAF_ANOMALY_NET_V6_PREFIX", "48"),
-		WatchNets:          env.namedNetblocks("SWWAF_WATCH_NETS"),
+		AlertCooldown:      env.duration("SWW_ALERT_COOLDOWN", "15m"),
+		AlertMaxPerHour:    env.numberOrOff("SWW_ALERT_MAX_PER_HOUR", "60"),
+		AnomalyClient:      env.thresholds("SWW_ANOMALY_CLIENT_"),
+		AnomalyNet:         env.thresholds("SWW_ANOMALY_NET_"),
+		AnomalyASN:         env.thresholds("SWW_ANOMALY_ASN_"),
+		AnomalyTotal:       env.thresholds("SWW_ANOMALY_TOTAL_"),
+		AnomalyWatch:       env.thresholds("SWW_WATCH_"),
+		AnomalyNetV4Prefix: env.v4Prefix("SWW_ANOMALY_NET_V4_PREFIX", "24"),
+		AnomalyNetV6Prefix: env.v6Prefix("SWW_ANOMALY_NET_V6_PREFIX", "48"),
+		WatchNets:          env.namedNetblocks("SWW_WATCH_NETS"),
 	}
 
-	cfg.LogRemoteAppName = env.appName("SWWAF_LOG_REMOTE_APP_NAME",
+	cfg.LogRemoteAppName = env.appName("SWW_LOG_REMOTE_APP_NAME",
 		cfg.InstanceName, cfg.LogRemoteURL != nil)
 	cfg.BlocklistAction, cfg.BlocklistLimitPercent = env.action(
-		"SWWAF_BLOCKLIST_ACTION", "deny")
+		"SWW_BLOCKLIST_ACTION", "deny")
 	cfg.ReputationAction, cfg.ReputationLimitPercent = env.action(
-		"SWWAF_REPUTATION_ACTION", "limit:25")
+		"SWW_REPUTATION_ACTION", "limit:25")
 
 	env.checkInstanceNameForNtfy(cfg.InstanceName, cfg.AlertNtfyURL != nil)
 	env.checkLookupDBPath(cfg)
@@ -577,33 +577,33 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	return cfg, nil
 }
 
-// Command reads only SMALLWEBWAF_COMMAND, the command the image runs and its
-// health check checks: rproxy when it is unset or empty, or servewaf. It cannot
+// Command reads only SWW_COMMAND, the command the image runs and its
+// health check checks: rproxy when it is unset or empty, or discriminator. It cannot
 // be given as a file. Any other value is an error that names the setting.
 func Command(lookupEnv func(string) (string, bool)) (string, error) {
-	command, _ := lookupEnv("SMALLWEBWAF_COMMAND")
+	command, _ := lookupEnv("SWW_COMMAND")
 
 	switch command {
 	case "", "rproxy":
 		return "rproxy", nil
-	case "servewaf":
+	case "discriminator":
 		return command, nil
 	default:
-		return "", fmt.Errorf("SMALLWEBWAF_COMMAND: %q %w", command, errNotCommand)
+		return "", fmt.Errorf("SWW_COMMAND: %q %w", command, errNotCommand)
 	}
 }
 
-// ServeWAFListenAddr reads only SWWAF_LISTEN_ADDR, which may be given as a
-// file, as FromEnvironment does. The health check in servewaf's container needs
+// DiscriminatorListenAddr reads only SWW_LISTEN_ADDR, which may be given as a
+// file, as FromEnvironment does. The health check in discriminator's container needs
 // no other setting, so it reads no other, nor a file that another names.
-func ServeWAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
+func DiscriminatorListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
 	env := &environment{lookupEnv: lookupEnv}
-	listenAddr := env.address("SWWAF_LISTEN_ADDR")
+	listenAddr := env.address("SWW_LISTEN_ADDR")
 
 	return listenAddr, env.err
 }
 
-// InstanceName reads only SWWAF_INSTANCE_NAME, which may be given as a
+// InstanceName reads only SWW_INSTANCE_NAME, which may be given as a
 // file, as FromEnvironment does, so that the line saying a setting is
 // invalid carries it too. A file that cannot be read gives the default
 // here, and FromEnvironment then stops the start over it.
@@ -961,30 +961,30 @@ func (e *environment) lookupSource(name, defaultValue string) string {
 	return source
 }
 
-// checkLookupDBPath refuses SWWAF_LOOKUP_SOURCE=file without
-// SWWAF_LOOKUP_DB_PATH, and SWWAF_LOOKUP_DB_PATH with any other source:
+// checkLookupDBPath refuses SWW_LOOKUP_SOURCE=file without
+// SWW_LOOKUP_DB_PATH, and SWW_LOOKUP_DB_PATH with any other source:
 // one source at a time.
 func (e *environment) checkLookupDBPath(cfg *Config) {
 	switch {
 	case cfg.LookupSource == fileSource && cfg.LookupDBPath == "":
-		e.check("SWWAF_LOOKUP_SOURCE", fmt.Errorf(
-			"is file while SWWAF_LOOKUP_DB_PATH is unset; %w", errNeedsDBPath))
+		e.check("SWW_LOOKUP_SOURCE", fmt.Errorf(
+			"is file while SWW_LOOKUP_DB_PATH is unset; %w", errNeedsDBPath))
 	case cfg.LookupSource != fileSource && cfg.LookupDBPath != "":
-		e.check("SWWAF_LOOKUP_DB_PATH", fmt.Errorf(
-			"is set while SWWAF_LOOKUP_SOURCE is %s; %w", cfg.LookupSource, errDBPathUnused))
+		e.check("SWW_LOOKUP_DB_PATH", fmt.Errorf(
+			"is set while SWW_LOOKUP_SOURCE is %s; %w", cfg.LookupSource, errDBPathUnused))
 	}
 }
 
 // checkCountriesAndLookups refuses a country on both country lists, and,
-// while SWWAF_LOOKUP_SOURCE is off, each setting that needs clients looked
-// up: the country lists, SWWAF_ADD_LOOKUP_HEADERS, the biased thresholds,
-// SWWAF_ASN_LIMIT_PERCENT_URL among them, of which
-// SWWAF_UNKNOWN_LIMIT_PERCENT needs them only below 100, where it lowers a
+// while SWW_LOOKUP_SOURCE is off, each setting that needs clients looked
+// up: the country lists, SWW_ADD_LOOKUP_HEADERS, the biased thresholds,
+// SWW_ASN_LIMIT_PERCENT_URL among them, of which
+// SWW_UNKNOWN_LIMIT_PERCENT needs them only below 100, where it lowers a
 // limit, and the anomaly thresholds per AS number.
 func (e *environment) checkCountriesAndLookups(cfg *Config) {
 	for _, country := range cfg.ExclusivelyAllowedCountries {
 		if slices.Contains(cfg.DeniedCountries, country) {
-			e.check("SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES",
+			e.check("SWW_EXCLUSIVELY_ALLOWED_COUNTRIES",
 				fmt.Errorf("%q %w", country, errOnBothLists))
 		}
 	}
@@ -997,52 +997,52 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 		name string
 		set  bool
 	}{
-		{"SWWAF_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
-		{"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
-		{"SWWAF_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
-		{"SWWAF_ASN_LIMIT_PERCENT", len(cfg.ASNLimitPercent) > 0},
-		{"SWWAF_COUNTRY_LIMIT_PERCENT", len(cfg.CountryLimitPercent) > 0},
-		{"SWWAF_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
-		{"SWWAF_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
-		{"SWWAF_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
-		{"SWWAF_ASN_LIMIT_PERCENT_URL", cfg.ASNLimitPercentURL != ""},
-		{"SWWAF_ANOMALY_ASN_REQUESTS_PER_MINUTE", cfg.AnomalyASN.RequestsPerMinute > 0},
-		{"SWWAF_ANOMALY_ASN_REQUESTS_PER_HOUR", cfg.AnomalyASN.RequestsPerHour > 0},
-		{"SWWAF_ANOMALY_ASN_BYTES_PER_MINUTE", cfg.AnomalyASN.BytesPerMinute > 0},
-		{"SWWAF_ANOMALY_ASN_BYTES_PER_HOUR", cfg.AnomalyASN.BytesPerHour > 0},
+		{"SWW_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
+		{"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
+		{"SWW_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
+		{"SWW_ASN_LIMIT_PERCENT", len(cfg.ASNLimitPercent) > 0},
+		{"SWW_COUNTRY_LIMIT_PERCENT", len(cfg.CountryLimitPercent) > 0},
+		{"SWW_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
+		{"SWW_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
+		{"SWW_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
+		{"SWW_ASN_LIMIT_PERCENT_URL", cfg.ASNLimitPercentURL != ""},
+		{"SWW_ANOMALY_ASN_REQUESTS_PER_MINUTE", cfg.AnomalyASN.RequestsPerMinute > 0},
+		{"SWW_ANOMALY_ASN_REQUESTS_PER_HOUR", cfg.AnomalyASN.RequestsPerHour > 0},
+		{"SWW_ANOMALY_ASN_BYTES_PER_MINUTE", cfg.AnomalyASN.BytesPerMinute > 0},
+		{"SWW_ANOMALY_ASN_BYTES_PER_HOUR", cfg.AnomalyASN.BytesPerHour > 0},
 	} {
 		if setting.set {
-			e.check(setting.name, fmt.Errorf("is set while SWWAF_LOOKUP_SOURCE is off; %w",
+			e.check(setting.name, fmt.Errorf("is set while SWW_LOOKUP_SOURCE is off; %w",
 				errNeedsLookups))
 		}
 	}
 }
 
-// checkASNLimitPercentURL refuses SWWAF_ASN_LIMIT_PERCENT_URL naming a
+// checkASNLimitPercentURL refuses SWW_ASN_LIMIT_PERCENT_URL naming a
 // blocklist too: the file at a URL is fetched as one list or the other.
 func (e *environment) checkASNLimitPercentURL(cfg *Config) {
 	if slices.Contains(cfg.BlocklistURLs, cfg.ASNLimitPercentURL) {
-		e.check("SWWAF_ASN_LIMIT_PERCENT_URL",
+		e.check("SWW_ASN_LIMIT_PERCENT_URL",
 			fmt.Errorf("%q %w", cfg.ASNLimitPercentURL, errInBlocklistURLs))
 	}
 }
 
-// checkCrowdSec refuses SWWAF_CROWDSEC_LAPI_URL without
-// SWWAF_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
+// checkCrowdSec refuses SWW_CROWDSEC_LAPI_URL without
+// SWW_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
 // that is fetched as another list too.
 func (e *environment) checkCrowdSec(cfg *Config) {
 	decisionsURL := cfg.CrowdSecDecisionsURL
 
 	switch {
 	case decisionsURL != "" && cfg.CrowdSecKey == "":
-		e.check("SWWAF_CROWDSEC_LAPI_URL", fmt.Errorf(
-			"is set while SWWAF_CROWDSEC_LAPI_KEY is unset; %w", errNeedsLAPIKey))
+		e.check("SWW_CROWDSEC_LAPI_URL", fmt.Errorf(
+			"is set while SWW_CROWDSEC_LAPI_KEY is unset; %w", errNeedsLAPIKey))
 	case decisionsURL == "" && cfg.CrowdSecKey != "":
-		e.check("SWWAF_CROWDSEC_LAPI_KEY", fmt.Errorf(
-			"is set while SWWAF_CROWDSEC_LAPI_URL is unset; %w", errLAPIKeyUnused))
+		e.check("SWW_CROWDSEC_LAPI_KEY", fmt.Errorf(
+			"is set while SWW_CROWDSEC_LAPI_URL is unset; %w", errLAPIKeyUnused))
 	case decisionsURL != "" && (slices.Contains(cfg.BlocklistURLs, decisionsURL) ||
 		decisionsURL == cfg.ASNLimitPercentURL):
-		e.check("SWWAF_CROWDSEC_LAPI_URL", fmt.Errorf("gives the decision list %q, which %w",
+		e.check("SWW_CROWDSEC_LAPI_URL", fmt.Errorf("gives the decision list %q, which %w",
 			decisionsURL, errAnotherList))
 	}
 }
@@ -1241,14 +1241,14 @@ func (e *environment) facility(name, defaultValue string) int {
 	return number
 }
 
-// instanceName reads SWWAF_INSTANCE_NAME, by default the host's name. It
+// instanceName reads SWW_INSTANCE_NAME, by default the host's name. It
 // must be valid UTF-8: the metrics library panics on a label that is not.
 func (e *environment) instanceName() string {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
 
-	value := e.value("SWWAF_INSTANCE_NAME", hostname)
+	value := e.value("SWW_INSTANCE_NAME", hostname)
 	if !utf8.ValidString(value) {
-		e.check("SWWAF_INSTANCE_NAME", fmt.Errorf("%q %w", value, errNotUTF8))
+		e.check("SWW_INSTANCE_NAME", fmt.Errorf("%q %w", value, errNotUTF8))
 	}
 
 	return value
@@ -1270,7 +1270,7 @@ func (e *environment) appName(name, instanceName string, sending bool) string {
 	case set:
 		e.check(name, fmt.Errorf("%q %w", value, errNotAppName))
 	case sending:
-		e.check(name, fmt.Errorf("is unset, and SWWAF_INSTANCE_NAME %q, its default, %w",
+		e.check(name, fmt.Errorf("is unset, and SWW_INSTANCE_NAME %q, its default, %w",
 			value, errNotAppName))
 	}
 
@@ -1278,19 +1278,19 @@ func (e *environment) appName(name, instanceName string, sending bool) string {
 }
 
 // checkInstanceNameForNtfy refuses an instance name that holds a control
-// character while ntfySet, SWWAF_ALERT_NTFY_URL being set: ntfy is sent
+// character while ntfySet, SWW_ALERT_NTFY_URL being set: ntfy is sent
 // the instance name in a header, which cannot hold one.
 func (e *environment) checkInstanceNameForNtfy(instanceName string, ntfySet bool) {
 	if ntfySet && strings.ContainsFunc(instanceName, unicode.IsControl) {
-		e.check("SWWAF_INSTANCE_NAME", fmt.Errorf(
-			"%q %w, and is sent to ntfy in a header while SWWAF_ALERT_NTFY_URL is set",
+		e.check("SWW_INSTANCE_NAME", fmt.Errorf(
+			"%q %w, and is sent to ntfy in a header while SWW_ALERT_NTFY_URL is set",
 			instanceName, errControlCharacter))
 	}
 }
 
 // webhookURL reads a setting that is a URL each alert is posted to:
-// SWWAF_ALERT_WEBHOOK_URL, SWWAF_ALERT_SLACK_WEBHOOK_URL or
-// SWWAF_ALERT_NTFY_URL. Unset or empty, it is nil, and no alert is posted
+// SWW_ALERT_WEBHOOK_URL, SWW_ALERT_SLACK_WEBHOOK_URL or
+// SWW_ALERT_NTFY_URL. Unset or empty, it is nil, and no alert is posted
 // there. The log shows ******** in place of its path and query, and an
 // error shows none of it, since a webhook or an ntfy topic can carry its
 // secret there.
@@ -1410,7 +1410,7 @@ func parseSize(value string) (int64, error) {
 }
 
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 64K, since servewaf
+// reads: a size as parseSize reads it, or off, but at most 64K, since discriminator
 // gets no more of a body than that.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)
@@ -1739,7 +1739,7 @@ func parseCountry(value string) (string, error) {
 
 // ParseASN reads an AS number such as AS64496, in either case, and
 // returns it as the lookup gives it: AS and the number, in capitals and
-// without leading zeros. The file SWWAF_ASN_LIMIT_PERCENT_URL names is
+// without leading zeros. The file SWW_ASN_LIMIT_PERCENT_URL names is
 // read with it too.
 func ParseASN(value string) (string, error) {
 	digits, hasAS := strings.CutPrefix(strings.ToUpper(value), "AS")
@@ -1793,7 +1793,7 @@ func parsePercents(
 }
 
 // ParsePercent reads a percentage, a whole number from 0 to 100. The file
-// SWWAF_ASN_LIMIT_PERCENT_URL names is read with it too.
+// SWW_ASN_LIMIT_PERCENT_URL names is read with it too.
 func ParsePercent(value string) (int64, error) {
 	percent, err := strconv.ParseInt(value, 10, 64)
 	if err != nil || percent < 0 || percent > 100 {
@@ -2013,7 +2013,7 @@ const (
 	maxLabelLength = 63
 	// labelChars are the characters a label of a DNS zone may hold.
 	labelChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"
-	// dnsPort is the port a resolver is asked on when SWWAF_DNSBL_RESOLVER
+	// dnsPort is the port a resolver is asked on when SWW_DNSBL_RESOLVER
 	// gives none.
 	dnsPort = 53
 )