Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/config/config_test.go

@@ -17,106 +17,109 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/config/configtest"
 )
 
 // The settings, by name.
 const (
-	listenAddr           = "SWW_LISTEN_ADDR"
-	mode                 = "SWW_MODE"
-	ipv6GroupPrefix      = "SWW_IPV6_GROUP_PREFIX"
-	maxTrackedClients    = "SWW_MAX_TRACKED_CLIENTS"
-	allowNets            = "SWW_ALLOW_NETS"
-	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
-	denyNets             = "SWW_DENY_NETS"
-	rateLimitPerMinute   = "SWW_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerHour     = "SWW_RATE_LIMIT_PER_HOUR"
-	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths = "SWW_RATE_LIMIT_EXEMPT_PATHS"
-	bytesLimitPerMinute  = "SWW_BYTES_LIMIT_PER_MINUTE"
-	bytesLimitPerHour    = "SWW_BYTES_LIMIT_PER_HOUR"
-	bytesLimitPerDay     = "SWW_BYTES_LIMIT_PER_DAY"
-	bytesCount           = "SWW_BYTES_COUNT"
-	lookupSource         = "SWW_LOOKUP_SOURCE"
-	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
-	lookupTimeout        = "SWW_LOOKUP_TIMEOUT"
-	addLookupHeaders     = "SWW_ADD_LOOKUP_HEADERS"
-	allowedCountries     = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	tagLists             = "SWW_TAG_LISTS"
-	tagDeny              = "SWW_TAG_DENY"
-	tagLimitPercent      = "SWW_TAG_LIMIT_PERCENT"
-	asnBytesPercent      = "SWW_ASN_BYTES_PERCENT"
-	countryBytesPercent  = "SWW_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent  = "SWW_UNKNOWN_LIMIT_PERCENT"
-	asnLimitPercentURL   = "SWW_ASN_LIMIT_PERCENT_URL"
-	blocklistURLs        = "SWW_BLOCKLIST_URLS"
-	blocklistRefresh     = "SWW_BLOCKLIST_REFRESH"
-	blocklistAction      = "SWW_BLOCKLIST_ACTION"
-	dnsblZones           = "SWW_DNSBL_ZONES"
-	dnsblResolver        = "SWW_DNSBL_RESOLVER"
-	abuseIPDBKey         = "SWW_ABUSEIPDB_KEY"
-	abuseIPDBMinScore    = "SWW_ABUSEIPDB_MIN_SCORE"
-	abuseIPDBDailyBudget = "SWW_ABUSEIPDB_DAILY_BUDGET"
-	reputationAction     = "SWW_REPUTATION_ACTION"
-	reputationCacheTTL   = "SWW_REPUTATION_CACHE_TTL"
-	reputationTimeout    = "SWW_REPUTATION_TIMEOUT"
-	routeWatchURL        = "SWW_ROUTEWATCH_URL"
-	crowdSecURL          = "SWW_CROWDSEC_LAPI_URL"
-	crowdSecKey          = "SWW_CROWDSEC_LAPI_KEY"
-	banResponse          = "SWW_BAN_RESPONSE"
-	limitBanDuration     = "SWW_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow = "SWW_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration       = "SWW_MAX_BAN_DURATION"
-	attackBanDuration    = "SWW_ATTACK_BAN_DURATION"
-	maxBans              = "SWW_MAX_BANS"
-	banScopeV4Prefix     = "SWW_BAN_SCOPE_V4_PREFIX"
-	stateDir             = "SWW_STATE_DIR"
-	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
-	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
-	adminToken           = "SWW_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	metricsToken         = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN          = "SWW_METRICS_TOP_N"
-	instanceName         = "SWW_INSTANCE_NAME"
-	logRequestHeaders    = "SWW_LOG_REQUEST_HEADERS"
-	logLevel             = "SWW_LOG_LEVEL"
-	rulesDir             = "SWW_RULES_DIR"
-	rulesEnabled         = "SWW_RULES_ENABLED"
-	wafMode              = "SWW_WAF_MODE"
-	wafParanoiaLevel     = "SWW_WAF_PARANOIA_LEVEL"
-	wafAnomalyThreshold  = "SWW_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules     = "SWW_WAF_DISABLED_RULES"
-	wafExemptPaths       = "SWW_WAF_EXEMPT_PATHS"
-	wafBodyLimit         = "SWW_WAF_BODY_LIMIT"
-	exclusionsFile       = "SWW_CORE_RULE_SET_EXCLUSIONS_FILE"
-	trapPaths            = "SWW_TRAP_PATHS"
-	errorBurstThreshold  = "SWW_ERROR_BURST_THRESHOLD"
-	logRemoteURL         = "SWW_LOG_REMOTE_URL"
-	logRemoteTLSCAFile   = "SWW_LOG_REMOTE_TLS_CA_FILE"
-	logRemoteBuffer      = "SWW_LOG_REMOTE_BUFFER"
-	logRemoteFacility    = "SWW_LOG_REMOTE_FACILITY"
-	logRemoteAppName     = "SWW_LOG_REMOTE_APP_NAME"
-	alertWebhookURL      = "SWW_ALERT_WEBHOOK_URL"
-	alertWebhookHeaders  = "SWW_ALERT_WEBHOOK_HEADERS"
-	alertSlackWebhookURL = "SWW_ALERT_SLACK_WEBHOOK_URL"
-	alertNtfyURL         = "SWW_ALERT_NTFY_URL"
-	alertNtfyToken       = "SWW_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
-	alertEvents          = "SWW_ALERT_EVENTS"
-	alertCooldown        = "SWW_ALERT_COOLDOWN"
-	alertMaxPerHour      = "SWW_ALERT_MAX_PER_HOUR"
-	anomalyNetV4Prefix   = "SWW_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix   = "SWW_ANOMALY_NET_V6_PREFIX"
-	watchNets            = "SWW_WATCH_NETS"
+	listenAddr           = "SWW_WAF_LISTEN_ADDR"
+	mode                 = "SWW_WAF_MODE"
+	ipv6GroupPrefix      = "SWW_WAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWW_WAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWW_WAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWW_WAF_DENY_NETS"
+	rateLimitPerMinute   = "SWW_WAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerHour     = "SWW_WAF_RATE_LIMIT_PER_HOUR"
+	rateLimitPerDay      = "SWW_WAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWW_WAF_RATE_LIMIT_EXEMPT_PATHS"
+	bytesLimitPerMinute  = "SWW_WAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour    = "SWW_WAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay     = "SWW_WAF_BYTES_LIMIT_PER_DAY"
+	bytesCount           = "SWW_WAF_BYTES_COUNT"
+	lookupSource         = "SWW_WAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWW_WAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWW_WAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWW_WAF_ADD_LOOKUP_HEADERS"
+	allowedCountries     = "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	tagLists             = "SWW_WAF_TAG_LISTS"
+	tagDeny              = "SWW_WAF_TAG_DENY"
+	tagLimitPercent      = "SWW_WAF_TAG_LIMIT_PERCENT"
+	asnBytesPercent      = "SWW_WAF_ASN_BYTES_PERCENT"
+	countryBytesPercent  = "SWW_WAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent  = "SWW_WAF_UNKNOWN_LIMIT_PERCENT"
+	asnLimitPercentURL   = "SWW_WAF_ASN_LIMIT_PERCENT_URL"
+	blocklistURLs        = "SWW_WAF_BLOCKLIST_URLS"
+	blocklistRefresh     = "SWW_WAF_BLOCKLIST_REFRESH"
+	blocklistAction      = "SWW_WAF_BLOCKLIST_ACTION"
+	dnsblZones           = "SWW_WAF_DNSBL_ZONES"
+	dnsblResolver        = "SWW_WAF_DNSBL_RESOLVER"
+	abuseIPDBKey         = "SWW_WAF_ABUSEIPDB_KEY"
+	abuseIPDBMinScore    = "SWW_WAF_ABUSEIPDB_MIN_SCORE"
+	abuseIPDBDailyBudget = "SWW_WAF_ABUSEIPDB_DAILY_BUDGET"
+	reputationAction     = "SWW_WAF_REPUTATION_ACTION"
+	reputationCacheTTL   = "SWW_WAF_REPUTATION_CACHE_TTL"
+	reputationTimeout    = "SWW_WAF_REPUTATION_TIMEOUT"
+	routeWatchURL        = "SWW_WAF_ROUTEWATCH_URL"
+	crowdSecURL          = "SWW_WAF_CROWDSEC_LAPI_URL"
+	crowdSecKey          = "SWW_WAF_CROWDSEC_LAPI_KEY"
+	banResponse          = "SWW_WAF_BAN_RESPONSE"
+	limitBanDuration     = "SWW_WAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWW_WAF_MAX_BAN_DURATION"
+	attackBanDuration    = "SWW_WAF_ATTACK_BAN_DURATION"
+	maxBans              = "SWW_WAF_MAX_BANS"
+	banScopeV4Prefix     = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
+	stateDir             = "SWW_WAF_STATE_DIR"
+	stateWriteDelay      = "SWW_WAF_STATE_WRITE_DELAY"
+	stateCounterInterval = "SWW_WAF_STATE_COUNTER_INTERVAL"
+	adminToken           = "SWW_WAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	metricsToken         = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN          = "SWW_WAF_METRICS_TOP_N"
+	instanceName         = "SWW_WAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWW_WAF_LOG_REQUEST_HEADERS"
+	logLevel             = "SWW_WAF_LOG_LEVEL"
+	rulesDir             = "SWW_WAF_RULES_DIR"
+	rulesEnabled         = "SWW_WAF_RULES_ENABLED"
+	wafMode              = "SWW_WAF_CORE_RULE_SET_MODE"
+	wafParanoiaLevel     = "SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL"
+	wafAnomalyThreshold  = "SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD"
+	wafDisabledRules     = "SWW_WAF_CORE_RULE_SET_DISABLED_RULES"
+	wafExemptPaths       = "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS"
+	wafBodyLimit         = "SWW_WAF_CORE_RULE_SET_BODY_LIMIT"
+	exclusionsFile       = "SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE"
+	trapPaths            = "SWW_WAF_TRAP_PATHS"
+	errorBurstThreshold  = "SWW_WAF_ERROR_BURST_THRESHOLD"
+	logRemoteURL         = "SWW_WAF_LOG_REMOTE_URL"
+	logRemoteTLSCAFile   = "SWW_WAF_LOG_REMOTE_TLS_CA_FILE"
+	logRemoteBuffer      = "SWW_WAF_LOG_REMOTE_BUFFER"
+	logRemoteFacility    = "SWW_WAF_LOG_REMOTE_FACILITY"
+	logRemoteAppName     = "SWW_WAF_LOG_REMOTE_APP_NAME"
+	alertWebhookURL      = "SWW_WAF_ALERT_WEBHOOK_URL"
+	alertWebhookHeaders  = "SWW_WAF_ALERT_WEBHOOK_HEADERS"
+	alertSlackWebhookURL = "SWW_WAF_ALERT_SLACK_WEBHOOK_URL"
+	alertNtfyURL         = "SWW_WAF_ALERT_NTFY_URL"
+	alertNtfyToken       = "SWW_WAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
+	alertEvents          = "SWW_WAF_ALERT_EVENTS"
+	alertCooldown        = "SWW_WAF_ALERT_COOLDOWN"
+	alertMaxPerHour      = "SWW_WAF_ALERT_MAX_PER_HOUR"
+	anomalyNetV4Prefix   = "SWW_WAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix   = "SWW_WAF_ANOMALY_NET_V6_PREFIX"
+	watchNets            = "SWW_WAF_WATCH_NETS"
 )
 
 // The anomaly thresholds: each of the prefixes below, which name a scope,
 // followed by each of the four ends.
 const (
-	anomalyClient = "SWW_ANOMALY_CLIENT_"
-	anomalyNet    = "SWW_ANOMALY_NET_"
-	anomalyASN    = "SWW_ANOMALY_ASN_"
-	anomalyTotal  = "SWW_ANOMALY_TOTAL_"
-	watch         = "SWW_WATCH_"
+	anomalyClient = "SWW_WAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWW_WAF_ANOMALY_NET_"
+	anomalyASN    = "SWW_WAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWW_WAF_ANOMALY_TOTAL_"
+	watch         = "SWW_WAF_WATCH_"
 
 	requestsPerMinute = "REQUESTS_PER_MINUTE"
 	requestsPerHour   = "REQUESTS_PER_HOUR"
@@ -157,21 +160,21 @@ func loggedAnomalyDefaults() map[string]string {
 	return logged
 }
 
-// defaultAlertEvents is the default of SWW_ALERT_EVENTS, and
-// defaultAlertCooldown that of SWW_ALERT_COOLDOWN.
+// defaultAlertEvents is the default of SWW_WAF_ALERT_EVENTS, and
+// defaultAlertCooldown that of SWW_WAF_ALERT_COOLDOWN.
 const (
 	defaultAlertEvents = "ban,permanent_ban,waf_block,anomaly,reputation_hit," +
 		"source_failure,file_error"
 	defaultAlertCooldown = "15m"
 )
 
-// defaultReputationCacheTTL is the default of SWW_REPUTATION_CACHE_TTL.
+// defaultReputationCacheTTL is the default of SWW_WAF_REPUTATION_CACHE_TTL.
 const defaultReputationCacheTTL = "24h"
 
-// defaultWAFDisabledRules is the default of SWW_WAF_DISABLED_RULES.
+// defaultWAFDisabledRules is the default of SWW_WAF_CORE_RULE_SET_DISABLED_RULES.
 const defaultWAFDisabledRules = "920340,920420,920440,920640,930130,930140"
 
-// defaultLogRequestHeaders is the default of SWW_LOG_REQUEST_HEADERS.
+// defaultLogRequestHeaders is the default of SWW_WAF_LOG_REQUEST_HEADERS.
 const defaultLogRequestHeaders = "accept,accept-language,accept-encoding," +
 	"content-type,origin,range"
 
@@ -196,8 +199,8 @@ const (
 	otherToken = "fedcba9876543210fedcba9876543210"
 )
 
-// instance is an SWW_INSTANCE_NAME that is a valid app name too, and
-// remoteURL an SWW_LOG_REMOTE_URL, for the tests that send the lines.
+// instance is an SWW_WAF_INSTANCE_NAME that is a valid app name too, and
+// remoteURL an SWW_WAF_LOG_REMOTE_URL, for the tests that send the lines.
 const (
 	instance  = "fsn1app1/blog"
 	remoteURL = "syslog+udp://192.0.2.1:514"
@@ -212,7 +215,7 @@ const enabled = "true"
 // disabled is false, as a setting's value.
 const disabled = "false"
 
-// defaultLookupSource is the default of SWW_LOOKUP_SOURCE, and
+// defaultLookupSource is the default of SWW_WAF_LOOKUP_SOURCE, and
 // fileSource the source that is the lookup database.
 const (
 	defaultLookupSource = "geojs"
@@ -222,18 +225,16 @@ const (
 // environment is a set of environment variables, for FromEnvironment.
 type environment map[string]string
 
-// lookupEnv reads one of the variables, as os.LookupEnv does.
-func (e environment) lookupEnv(name string) (string, bool) {
-	value, ok := e[name]
-
-	return value, ok
+// viper returns a viper holding each of the variables.
+func (e environment) viper() *viper.Viper {
+	return configtest.Viper(e)
 }
 
 // fromEnvironment reads the settings from env, which must be valid.
 func fromEnvironment(t *testing.T, env environment) *config.Config {
 	t.Helper()
 
-	cfg, err := config.FromEnvironment(env.lookupEnv)
+	cfg, err := config.FromEnvironment(env.viper())
 	if err != nil {
 		t.Fatalf("settings %v: %v", env, err)
 	}
@@ -462,7 +463,7 @@ func TestPathPrefixNotStartingWithSlashStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	_, err := config.FromEnvironment(
-		environment{rateLimitExemptPaths: "/favicon.ico,assets/"}.lookupEnv)
+		environment{rateLimitExemptPaths: "/favicon.ico,assets/"}.viper())
 
 	want := rateLimitExemptPaths + `: "assets/" is not a path prefix ` +
 		`starting with /, such as /assets/`
@@ -517,7 +518,7 @@ func TestInvalidTrapPathOrErrorBurstThresholdStopsTheStart(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -646,7 +647,7 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -771,7 +772,7 @@ func TestInvalidRemoteLogSettingStopsTheStart(t *testing.T) {
 		{logRemoteAppName, ""}, {logRemoteAppName, "my app"},
 		{logRemoteAppName, "gitéa"}, {logRemoteAppName, strings.Repeat("a", 49)},
 	} {
-		_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 		if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
 			t.Errorf("%s=%q: error %v, want one naming it", tc.name, tc.value, err)
 		}
@@ -788,7 +789,7 @@ func TestRemoteLogCAFileWithoutCertificateStopsTheStart(t *testing.T) {
 		t.Fatalf("write %s: %v", caFile, err)
 	}
 
-	_, err = config.FromEnvironment(environment{logRemoteTLSCAFile: caFile}.lookupEnv)
+	_, err = config.FromEnvironment(environment{logRemoteTLSCAFile: caFile}.viper())
 
 	want := logRemoteTLSCAFile + `: "` + caFile + `" holds no PEM certificate`
 	if err == nil || err.Error() != want {
@@ -803,7 +804,7 @@ func TestInstanceNameNotAnAppNameStopsTheStartOnlyWhileSending(t *testing.T) {
 
 	sending := environment{logRemoteURL: remoteURL, instanceName: spaced}
 
-	_, err := config.FromEnvironment(sending.lookupEnv)
+	_, err := config.FromEnvironment(sending.viper())
 
 	want := logRemoteAppName + `: is unset, and ` + instanceName +
 		` "fsn1 app1", its default, is not 1 to 48 printable ASCII characters ` +
@@ -833,7 +834,7 @@ func TestAppNameSetStopsTheStartWhileSending(t *testing.T) {
 		logRemoteURL:     remoteURL,
 		instanceName:     instance,
 		logRemoteAppName: "my app",
-	}.lookupEnv)
+	}.viper())
 
 	want := logRemoteAppName + `: "my app" is not 1 to 48 printable ASCII ` +
 		`characters without a space, such as blog`
@@ -964,7 +965,7 @@ func TestWebhookHeadersAreLoggedMaskedAndNeverShown(t *testing.T) {
 	// An item that is not a header is named by its place, not shown.
 	_, err := config.FromEnvironment(environment{
 		alertWebhookHeaders: "X-Team:ops," + secret,
-	}.lookupEnv)
+	}.viper())
 
 	want := alertWebhookHeaders + ": item 2 is not a header name followed by : " +
 		"and the header's value, such as Authorization:Bearer <token>"
@@ -1001,7 +1002,7 @@ func TestWebhookURLIsLoggedWithoutItsPathOrQueryAndNeverShown(t *testing.T) {
 		"ftp://hooks.example/services/" + secret,
 		"https://hooks.example/services/%zz" + secret,
 	} {
-		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.viper())
 
 		want := alertWebhookURL + ": is not an http or https URL without a user or " +
 			"a fragment, such as https://alerts.example/sww"
@@ -1052,7 +1053,7 @@ func TestNtfyTokenWithAControlCharacterStopsTheStartWithoutShowingIt(t *testing.
 		"set":       {alertNtfyToken: token + "\r"},
 		"in a file": {alertNtfyToken + "_FILE": writeFile(t, token+"\r\n")},
 	} {
-		_, err := config.FromEnvironment(env.lookupEnv)
+		_, err := config.FromEnvironment(env.viper())
 
 		want := alertNtfyToken + ": holds a control character, such as the " +
 			"carriage return of a Windows line end"
@@ -1069,7 +1070,7 @@ func TestInstanceNameWithAControlCharacterStopsTheStartOnlyWithNtfySet(t *testin
 
 	_, err := config.FromEnvironment(environment{
 		instanceName: name, alertNtfyURL: "https://ntfy.example/sww-alerts",
-	}.lookupEnv)
+	}.viper())
 
 	want := instanceName + `: "fsn1app1\r" holds a control character, such as the ` +
 		`carriage return of a Windows line end, and is sent to ntfy in a header ` +
@@ -1094,7 +1095,7 @@ func TestInstanceNameNotUTF8StopsTheStart(t *testing.T) {
 		"set":       {instanceName: latin1},
 		"in a file": {instanceName + "_FILE": writeFile(t, latin1+"\n")},
 	} {
-		_, err := config.FromEnvironment(env.lookupEnv)
+		_, err := config.FromEnvironment(env.viper())
 
 		want := instanceName + `: "caf\xe9" is not valid UTF-8`
 		if err == nil || err.Error() != want {
@@ -1109,9 +1110,10 @@ func TestCodeInAllowedCountriesAndTagDenyStopsTheStart(t *testing.T) {
 	_, err := config.FromEnvironment(environment{
 		tagDeny:          "country=cn,country=ru",
 		allowedCountries: "de,RU",
-	}.lookupEnv)
+	}.viper())
 	if err == nil {
-		t.Fatal("ru in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES and SWW_TAG_DENY was accepted")
+		t.Fatal("ru in SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES and " +
+			"SWW_WAF_TAG_DENY was accepted")
 	}
 
 	if !strings.HasPrefix(err.Error(), allowedCountries+": ") ||
@@ -1171,7 +1173,7 @@ func TestLookupDBPathGoesWithTheFileSourceAlone(t *testing.T) {
 			lookupDBPath + ": is set while " + lookupSource + " is off; only file reads it",
 		},
 	} {
-		_, err := config.FromEnvironment(tc.env.lookupEnv)
+		_, err := config.FromEnvironment(tc.env.viper())
 		if err == nil || err.Error() != tc.want {
 			t.Errorf("settings %v: error %v, want %s", tc.env, err, tc.want)
 		}
@@ -1200,7 +1202,7 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 
 			_, err := config.FromEnvironment(environment{
 				lookupSource: off, name: value,
-			}.lookupEnv)
+			}.viper())
 			if err == nil || !strings.HasPrefix(err.Error(), name+": ") ||
 				!strings.Contains(err.Error(), lookupSource+" is off") {
 				t.Errorf("error %v, want one naming %s and %s", err, name, lookupSource)
@@ -1209,7 +1211,7 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 	}
 
 	// Set empty, the lists need nothing looked up, and nor does
-	// SWW_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, a tag the
+	// SWW_WAF_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, a tag the
 	// lookup does not give, an anomaly threshold per AS number that is off,
 	// any other anomaly threshold, or a blocklist.
 	env := environment{
@@ -1351,7 +1353,7 @@ func TestInvalidAnomalySettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1445,14 +1447,14 @@ func TestRouteWatchURLAndPrefixTags(t *testing.T) {
 		{environment{lookupSource: off, routeWatchURL: rw, tagDeny: "country=DE"}, tagDeny},
 		{environment{lookupSource: off, tagDeny: "asn=64496"}, tagDeny},
 	} {
-		_, err := config.FromEnvironment(stopped.env.lookupEnv)
+		_, err := config.FromEnvironment(stopped.env.viper())
 		if err == nil || !strings.HasPrefix(err.Error(), stopped.name+": ") {
 			t.Errorf("%v gave the error %v, want one naming %s", stopped.env, err, stopped.name)
 		}
 	}
 
 	badURL := environment{routeWatchURL: "ftp://routewatch.example"}
-	_, err := config.FromEnvironment(badURL.lookupEnv)
+	_, err := config.FromEnvironment(badURL.viper())
 
 	want := routeWatchURL + `: "ftp://routewatch.example" is not an http or https URL ` +
 		"without a user or a fragment, such as https://routewatch.example"
@@ -1507,7 +1509,7 @@ func TestTagThatNoRequestCanGetIsToldApartFromOneItCan(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(tc.env.lookupEnv)
+			_, err := config.FromEnvironment(tc.env.viper())
 
 			switch {
 			case tc.want == "" && err != nil:
@@ -1545,7 +1547,7 @@ func TestErrorOfATagSettingLeavesOutAZoneKey(t *testing.T) {
 		{tagLimitPercent, tag + ":50," + tag + " :25", twice},
 		{tagLimitPercent, tag + ":50,,", emptyItem},
 	} {
-		_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 		want := tc.name + ": " + tc.want
 		if err == nil || err.Error() != want {
@@ -1567,7 +1569,7 @@ func TestTagListURLFetchedAsAnotherListStopsTheStart(t *testing.T) {
 		{"the file of AS:percent lines", asnURL, environment{asnLimitPercentURL: asnURL}},
 		{
 			"the CrowdSec decision list", lapi + "/v1/decisions",
-			environment{"SWW_CROWDSEC_LAPI_URL": lapi, "SWW_CROWDSEC_LAPI_KEY": "key"},
+			environment{"SWW_WAF_CROWDSEC_LAPI_URL": lapi, "SWW_WAF_CROWDSEC_LAPI_KEY": "key"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -1575,10 +1577,10 @@ func TestTagListURLFetchedAsAnotherListStopsTheStart(t *testing.T) {
 
 			tc.env[tagLists] = "dup=" + tc.listURL
 
-			want := tagLists + `: "` + tc.listURL + `" is in SWW_BLOCKLIST_URLS, is ` +
-				"SWW_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too"
+			want := tagLists + `: "` + tc.listURL + `" is in SWW_WAF_BLOCKLIST_URLS, is ` +
+				"SWW_WAF_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too"
 
-			_, err := config.FromEnvironment(tc.env.lookupEnv)
+			_, err := config.FromEnvironment(tc.env.viper())
 			if err == nil || err.Error() != want {
 				t.Errorf("error %v, want %s", err, want)
 			}
@@ -1647,7 +1649,7 @@ func TestInvalidBiasedThresholdStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1665,7 +1667,7 @@ const (
 	asnURL  = "https://lists.example/asn.txt"
 )
 
-// The actions of SWW_BLOCKLIST_ACTION, as Config gives them.
+// The actions of SWW_WAF_BLOCKLIST_ACTION, as Config gives them.
 const (
 	actionDeny  = "deny"
 	actionLimit = "limit"
@@ -1744,7 +1746,7 @@ func TestInvalidReputationSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1759,9 +1761,9 @@ func TestASNLimitPercentURLThatIsABlocklistStopsTheStart(t *testing.T) {
 
 	_, err := config.FromEnvironment(environment{
 		blocklistURLs: dropURL + "," + asnURL, asnLimitPercentURL: asnURL,
-	}.lookupEnv)
+	}.viper())
 
-	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWW_BLOCKLIST_URLS too`
+	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWW_WAF_BLOCKLIST_URLS too`
 	if err == nil || err.Error() != want {
 		t.Errorf("error %v, want %s", err, want)
 	}
@@ -1886,7 +1888,7 @@ func TestInvalidDNSBLSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1954,7 +1956,7 @@ func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
 		{spamhaus + "," + otherZone, `"` + spamhausMasked + `" is listed twice`},
 		{spamhaus + ",,", "has an empty item in its list"},
 	} {
-		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.viper())
 
 		want := dnsblZones + ": " + tc.want
 		if err == nil || err.Error() != want {
@@ -2007,7 +2009,7 @@ func TestInvalidAbuseIPDBSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -2064,7 +2066,7 @@ func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		notLAPIURL = " is not an http or https URL without a user or a fragment, " +
 			"such as http://172.17.0.1:8080"
 		anotherList = `gives the decision list "` + lapi + `/v1/decisions", which is in ` +
-			`SWW_BLOCKLIST_URLS or is SWW_ASN_LIMIT_PERCENT_URL too`
+			`SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too`
 	)
 
 	for _, tc := range []struct {
@@ -2121,7 +2123,7 @@ func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(tc.env.lookupEnv)
+			_, err := config.FromEnvironment(tc.env.viper())
 			if err == nil || err.Error() != tc.want {
 				t.Errorf("error %v, want %s", err, tc.want)
 			}
@@ -2274,14 +2276,14 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 
 // wantExploitTagStopsTheStartWithRulesAndCoreRuleSetOff checks that with rule
 // files off, and either setting turning off the Core Rule Set, the tag
-// exploitsignature in SWW_TAG_DENY stops the start.
+// exploitsignature in SWW_WAF_TAG_DENY stops the start.
 func wantExploitTagStopsTheStartWithRulesAndCoreRuleSetOff(t *testing.T) {
 	t.Helper()
 
 	for _, name := range []string{wafMode, wafAnomalyThreshold} {
 		_, err := config.FromEnvironment(environment{
 			tagDeny: exploitTag, rulesEnabled: disabled, name: off,
-		}.lookupEnv)
+		}.viper())
 		if err == nil || !strings.HasPrefix(err.Error(), tagDeny+": ") {
 			t.Errorf("%s=off with rule files off gave the error %v, want one naming %s",
 				name, err, tagDeny)
@@ -2314,7 +2316,7 @@ func wantStartStopped(t *testing.T, invalid []struct{ name, value string }) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 			if err == nil {
 				t.Fatalf("%s=%q was accepted", tc.name, tc.value)
 			}
@@ -2339,7 +2341,7 @@ func TestHostOrTransferEncodingStopsTheStart(t *testing.T) {
 		t.Run(value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{logRequestHeaders: value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{logRequestHeaders: value}.viper())
 			if err == nil || err.Error() != logRequestHeaders+": "+want {
 				t.Errorf("error %v, want %s: %s", err, logRequestHeaders, want)
 			}
@@ -2356,7 +2358,7 @@ func TestShortTokenStopsTheStartWithoutShowingIt(t *testing.T) {
 			t.Run(name+"="+value, func(t *testing.T) {
 				t.Parallel()
 
-				_, err := config.FromEnvironment(environment{name: value}.lookupEnv)
+				_, err := config.FromEnvironment(environment{name: value}.viper())
 
 				want := name + ": is shorter than 32 characters"
 				if err == nil || err.Error() != want {
@@ -2412,7 +2414,7 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 
 	_, err := config.FromEnvironment(environment{
 		bytesLimitPerMinute + "_FILE": writeFile(t, "lots\n"),
-	}.lookupEnv)
+	}.viper())
 
 	want := bytesLimitPerMinute + `: "lots" is not a size such as 512K, 100M or 5G, or off`
 	if err == nil || err.Error() != want {
@@ -2423,7 +2425,7 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 		logRemoteURL:               remoteURL,
 		instanceName:               instance,
 		logRemoteAppName + "_FILE": writeFile(t, "my app\n"),
-	}.lookupEnv)
+	}.viper())
 
 	want = logRemoteAppName + `: "my app" is not 1 to 48 printable ASCII ` +
 		`characters without a space, such as blog`
@@ -2438,7 +2440,7 @@ func TestSettingAndItsFileBothSetStopsTheStart(t *testing.T) {
 	_, err := config.FromEnvironment(environment{
 		metricsToken:           token,
 		metricsToken + "_FILE": writeFile(t, token),
-	}.lookupEnv)
+	}.viper())
 
 	want := metricsToken + ": is set, and so is " + metricsToken +
 		"_FILE; set only one of them"
@@ -2453,7 +2455,7 @@ func TestUnreadableSettingFileStopsTheStart(t *testing.T) {
 	dir := t.TempDir()
 
 	for _, path := range []string{filepath.Join(dir, "missing"), dir} {
-		_, err := config.FromEnvironment(environment{metricsToken + "_FILE": path}.lookupEnv)
+		_, err := config.FromEnvironment(environment{metricsToken + "_FILE": path}.viper())
 
 		want := metricsToken + "_FILE: cannot be read: "
 		if err == nil || !strings.HasPrefix(err.Error(), want) {