Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

internal/sww/sww.go

@@ -1,9 +1,9 @@
 // Package sww runs the sww process, as the command it is given.
-// `sww discriminator` reads the settings, the rule files, the lookup database
+// `sww waf` reads the settings, the rule files, the lookup database
 // and the state files, answers rproxy's questions until it is told to stop, and
 // then stops in an orderly way, writing the state files. `sww rproxy`
 // reads rproxy's settings alone, and runs the reverse proxy in front of one app
-// that asks discriminator about each request. `sww healthcheck` is the
+// that asks waf about each request. `sww healthcheck` is the
 // container's health check.
 package sww
 
@@ -23,13 +23,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/state"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // shutdownTimeout is how long requests in progress may take to finish
@@ -37,7 +37,7 @@ import (
 // runit and docker wait a little longer before they kill the process.
 const shutdownTimeout = 5 * time.Second
 
-// remoteLogStopTimeout is how long, as discriminator stops, the log lines still
+// remoteLogStopTimeout is how long, as waf stops, the log lines still
 // waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
@@ -51,11 +51,11 @@ const usage = `usage: sww <command>
 
 commands:
   rproxy          the reverse proxy in front of one app
-  discriminator   decides for rproxy, and keeps bans, counters and history
+  waf             decides for rproxy, and keeps bans, counters and history
   healthcheck     the container's health check
 `
 
-// Params are what RunDiscriminator and RunRProxy need from the process.
+// Params are what RunWAF and RunRProxy need from the process.
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
@@ -66,7 +66,7 @@ type Params struct {
 }
 
 // Main runs the command os.Args names, and returns the process's exit status.
-// `sww rproxy` and `sww discriminator` run until SIGTERM or SIGINT.
+// `sww rproxy` and `sww waf` run until SIGTERM or SIGINT.
 // With no command, or one it does not know, it prints the commands and returns
 // usageStatus.
 func Main(version string) int {
@@ -84,8 +84,8 @@ func Main(version string) int {
 	switch args[0] {
 	case "rproxy":
 		return RunRProxy(ctx, params)
-	case "discriminator":
-		return RunDiscriminator(ctx, params)
+	case "waf":
+		return RunWAF(ctx, params)
 	case "healthcheck":
 		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
 	default:
@@ -100,10 +100,10 @@ func printUsage(w io.Writer) int {
 	return usageStatus
 }
 
-// RunDiscriminator is `sww discriminator`: it reads the settings, the rule files,
+// RunWAF is `sww waf`: it reads the settings, the rule files,
 // the lookup database and the state files, then serves requests until ctx is
-// done. It returns the process's exit status, 1 when discriminator cannot start.
-func RunDiscriminator(ctx context.Context, params Params) int {
+// done. It returns the process's exit status, 1 when waf cannot start.
+func RunWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWW_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
@@ -151,7 +151,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 		return 1
 	}
 
-	crs, err := discriminator.NewCoreRuleSet(cfg)
+	crs, err := waf.NewCoreRuleSet(cfg)
 	if err != nil {
 		processLog.Error("cannot use the Core Rule Set", "error", err.Error())
 
@@ -191,14 +191,14 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
 }
 
-// newServer returns the server discriminator runs, with the metrics of the alerts,
+// newServer returns the server waf runs, with the metrics of the alerts,
 // after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	crs *coreruleset.CoreRuleSet,
-) (*discriminator.Server, error) {
+) (*waf.Server, error) {
 	var lookupFile *lookup.File
 
 	if cfg.LookupSource == "file" {
@@ -215,7 +215,7 @@ func newServer(
 		}
 	}
 
-	server := discriminator.New(discriminator.Params{
+	server := waf.New(waf.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -239,7 +239,7 @@ func newServer(
 // loadStateFiles reads the state files into the parts of server and into
 // alertQueue, as state.Load does.
 func loadStateFiles(
-	cfg *config.Config, server *discriminator.Server, alertQueue *alerts.Queue,
+	cfg *config.Config, server *waf.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
@@ -325,7 +325,7 @@ func startSending(
 // shutdownTimeout to finish, and writes every state file, alerts.json with
 // the alerts still waiting.
 func serve(
-	ctx context.Context, server *discriminator.Server, listener net.Listener,
+	ctx context.Context, server *waf.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {