Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/sww/healthcheck.go

@@ -10,6 +10,8 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -21,17 +23,17 @@ var errHealthEndpoint = errors.New("the health endpoint answered")
 
 // HealthCheck is the container's health check. In waf's container, where
 // SWW_COMMAND is waf, it returns 0 while waf answers its health
-// endpoint on 127.0.0.1, at the port in SWW_LISTEN_ADDR. In rproxy's container,
+// endpoint on 127.0.0.1, at the port in SWW_WAF_LISTEN_ADDR. In rproxy's container,
 // where SWW_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
-// answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
-// the app accepts connections at the address in SWRP_UPSTREAM_URL. Otherwise,
+// answers its health endpoint on 127.0.0.1, at the port in SWW_RPROXY_LISTEN_ADDR, and
+// the app accepts connections at the address in SWW_RPROXY_UPSTREAM_URL. Otherwise,
 // any other value of SWW_COMMAND included, it writes why to stderr and
 // returns 1. It reads no other setting, nor a file that another names, so neither
 // can fail it.
 // args are the arguments after `healthcheck`; it takes none, and given
 // one it names it on stderr and returns 1 without checking anything.
 func HealthCheck(
-	ctx context.Context, args []string, lookupEnv func(string) (string, bool),
+	ctx context.Context, args []string, v *viper.Viper,
 	stderr io.Writer,
 ) int {
 	if len(args) > 0 {
@@ -44,15 +46,15 @@ func HealthCheck(
 	ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
 	defer cancel()
 
-	command, err := config.Command(lookupEnv)
+	command, err := config.Command(v)
 
 	switch {
 	case err != nil:
 		err = fmt.Errorf("invalid setting: %w", err)
 	case command == "waf":
-		err = checkWAF(ctx, lookupEnv)
+		err = checkWAF(ctx, v)
 	default:
-		err = checkRProxyAndApp(ctx, lookupEnv)
+		err = checkRProxyAndApp(ctx, v)
 	}
 
 	if err != nil {
@@ -65,10 +67,8 @@ func HealthCheck(
 }
 
 // checkWAF asks waf's health endpoint.
-func checkWAF(
-	ctx context.Context, lookupEnv func(string) (string, bool),
-) error {
-	listenAddr, err := config.WAFListenAddr(lookupEnv)
+func checkWAF(ctx context.Context, v *viper.Viper) error {
+	listenAddr, err := config.WAFListenAddr(v)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
@@ -82,10 +82,8 @@ func checkWAF(
 }
 
 // checkRProxyAndApp asks rproxy's health endpoint, and connects to the app.
-func checkRProxyAndApp(
-	ctx context.Context, lookupEnv func(string) (string, bool),
-) error {
-	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(lookupEnv)
+func checkRProxyAndApp(ctx context.Context, v *viper.Viper) error {
+	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(v)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}