Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/sww/rproxy_test.go

@@ -19,19 +19,20 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/config/configtest"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
 	// wafBackend is the setting that names waf to rproxy.
-	wafBackend = "SWRP_WAF_BACKEND"
+	wafBackend = "SWW_RPROXY_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
-	rproxyListenAddr = "SWRP_LISTEN_ADDR"
+	rproxyListenAddr = "SWW_RPROXY_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
-	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
+	rproxyUpstreamURL = "SWW_RPROXY_UPSTREAM_URL"
 	// rproxyTimeout is the setting that says how long rproxy waits for waf.
-	rproxyTimeout = "SWRP_TIMEOUT_MS"
+	rproxyTimeout = "SWW_RPROXY_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
 	// otherClient is a client the tests do not ban.
@@ -43,12 +44,8 @@ const (
 func runRProxy(ctx context.Context, env map[string]string, out *output) int {
 	return sww.RunRProxy(ctx, sww.Params{
 		Version: testVersion,
-		LookupEnv: func(name string) (string, bool) {
-			value, ok := env[name]
-
-			return value, ok
-		},
-		Stdout: out,
+		Viper:   configtest.Viper(env),
+		Stdout:  out,
 	})
 }
 
@@ -64,10 +61,10 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 
 	go func() {
 		exited <- runRProxy(ctx, map[string]string{
-			rproxyListenAddr:       localhost + ":0",
-			"SWRP_UPSTREAM_URL":    appURL,
-			"SWRP_TRUSTED_PROXIES": localhost + "/32",
-			wafBackend:             backend,
+			rproxyListenAddr:             localhost + ":0",
+			"SWW_RPROXY_UPSTREAM_URL":    appURL,
+			"SWW_RPROXY_TRUSTED_PROXIES": localhost + "/32",
+			wafBackend:                   backend,
 		}, out)
 	}()
 
@@ -524,7 +521,7 @@ func startRProxyProcess(t *testing.T, env ...string) (string, func()) {
 
 	cmd.Env = append(os.Environ(),
 		commandForMain+"=rproxy",
-		"SWRP_LISTEN_ADDR="+localhost+":0")
+		"SWW_RPROXY_LISTEN_ADDR="+localhost+":0")
 	cmd.Env = append(cmd.Env, env...)
 
 	exited := startProcess(t, cmd)
@@ -578,7 +575,7 @@ func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 
 	addr, _ := startRProxyProcess(t,
 		wafBackend+"="+backend.URL,
-		"SWRP_UPSTREAM_URL="+startApp(t),
+		"SWW_RPROXY_UPSTREAM_URL="+startApp(t),
 		"SSL_CERT_FILE="+certificates)
 
 	for name, headers := range map[string]string{
@@ -643,10 +640,10 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	defer stop()
 
 	env := map[string]string{
-		rproxyListenAddr:    localhost + ":0",
-		"SWRP_UPSTREAM_URL": startApp(t),
-		rproxyTimeout:       "60000",
-		wafBackend:          backend.URL,
+		rproxyListenAddr:          localhost + ":0",
+		"SWW_RPROXY_UPSTREAM_URL": startApp(t),
+		rproxyTimeout:             "60000",
+		wafBackend:                backend.URL,
 	}
 	out := &output{}
 	exited := make(chan int, 1)
@@ -720,7 +717,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	const (
 		cutOffAfter     = 5 * time.Second
-		upstreamSetting = "SWRP_UPSTREAM_URL"
+		upstreamSetting = "SWW_RPROXY_UPSTREAM_URL"
 	)
 
 	asked := make(chan struct{})
@@ -842,7 +839,7 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 		t.Errorf("exit status %d, want 1", status)
 	}
 
-	out.line(t, "msg", "cannot listen on SWRP_LISTEN_ADDR")
+	out.line(t, "msg", "cannot listen on SWW_RPROXY_LISTEN_ADDR")
 }
 
 func TestMainRunsRProxy(t *testing.T) {