Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/config/rproxy_test.go

@@ -10,20 +10,21 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/config/configtest"
 )
 
 // rproxy's settings, by name, and their values in these tests.
 const (
-	wafBackend        = "SWRP_WAF_BACKEND"
-	rproxyTimeout     = "SWRP_TIMEOUT_MS"
-	rproxyDefault     = "SWRP_DEFAULT_DISPOSITION"
-	rproxyListen      = "SWRP_LISTEN_ADDR"
-	rproxyUpstream    = "SWRP_UPSTREAM_URL"
-	rproxyTrusted     = "SWRP_TRUSTED_PROXIES"
-	rproxyMaxRequest  = "SWRP_MAX_REQUEST_SIZE"
-	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
-	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
-	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
+	wafBackend        = "SWW_RPROXY_WAF_BACKEND"
+	rproxyTimeout     = "SWW_RPROXY_TIMEOUT_MS"
+	rproxyDefault     = "SWW_RPROXY_DEFAULT_DISPOSITION"
+	rproxyListen      = "SWW_RPROXY_LISTEN_ADDR"
+	rproxyUpstream    = "SWW_RPROXY_UPSTREAM_URL"
+	rproxyTrusted     = "SWW_RPROXY_TRUSTED_PROXIES"
+	rproxyMaxRequest  = "SWW_RPROXY_MAX_REQUEST_SIZE"
+	rproxyMaxResponse = "SWW_RPROXY_MAX_RESPONSE_SIZE"
+	rproxyRequestTime = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
+	rproxyAnswerTime  = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
 	backendURL        = "http://waf:8080"
 	rproxyDefaultAddr = ":8080"
 	rproxyDefaultApp  = "http://127.0.0.1:8081"
@@ -32,11 +33,7 @@ const (
 
 // rproxyConfig reads rproxy's settings from env.
 func rproxyConfig(env map[string]string) (*config.RProxy, error) {
-	return config.RProxyFromEnvironment(func(name string) (string, bool) {
-		value, ok := env[name]
-
-		return value, ok
-	})
+	return config.RProxyFromEnvironment(configtest.Viper(env))
 }
 
 func TestRProxyDefaults(t *testing.T) {
@@ -177,31 +174,41 @@ func TestRProxyNeedsItsBackend(t *testing.T) {
 	}
 }
 
-func TestRProxyReadsNoFile(t *testing.T) {
+func TestRProxySettingReadFromFile(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "backend")
 
-	err := os.WriteFile(path, []byte("http://from-a-file:8080\n"), 0o600)
+	err := os.WriteFile(path, []byte(backendURL+"\n"), 0o600)
 	if err != nil {
 		t.Fatalf("write: %v", err)
 	}
 
-	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
-	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
-		t.Errorf("error %v, want %s still required", err, wafBackend)
-	}
-
-	cfg, err := rproxyConfig(map[string]string{
-		wafBackend:              backendURL,
-		rproxyTimeout + "_FILE": "/nonexistent/timeout",
-	})
+	cfg, err := rproxyConfig(map[string]string{wafBackend + "_FILE": path})
 	if err != nil {
-		t.Fatalf("settings: %v, with the file left unread", err)
+		t.Fatalf("settings: %v", err)
 	}
 
-	if cfg.Timeout != 2*time.Second {
-		t.Errorf("timeout %v, want the default", cfg.Timeout)
+	if cfg.WAFBackend.String() != backendURL {
+		t.Errorf("backend %v, want %s", cfg.WAFBackend, backendURL)
+	}
+}
+
+func TestRProxyUnreadableSettingFileStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	for _, path := range []string{filepath.Join(dir, "missing"), dir} {
+		_, err := rproxyConfig(map[string]string{
+			wafBackend:              backendURL,
+			rproxyTimeout + "_FILE": path,
+		})
+
+		want := rproxyTimeout + "_FILE: cannot be read: "
+		if err == nil || !strings.HasPrefix(err.Error(), want) {
+			t.Errorf("%s: error %v, want one starting %s", path, err, want)
+		}
 	}
 }