Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

script/example-app

@@ -1,25 +1,25 @@
 #!/bin/sh
 # script/example-app: build the image, and on it the example app in
 # deploy/example-app, then run the app's container, with rproxy in it, and
-# discriminator in a container of its own with a volume for the state files. It
+# waf in a container of its own with a volume for the state files. It
 # checks:
 #   - that the health checks pass;
 #   - that a request is served through rproxy, and a second one in a minute
 #     bans the client;
 #   - that a probe for /.env bans another client, which its next request bans
 #     for good;
-#   - that only discriminator's container changes the state directory's owner;
-#   - that the app still answers through rproxy with discriminator stopped, and
-#     that once discriminator has started again, bans apply again;
+#   - that only waf's container changes the state directory's owner;
+#   - that the app still answers through rproxy with waf stopped, and
+#     that once waf has started again, bans apply again;
 #   - that `sv stop` stops rproxy in order, and `docker stop` stops each
 #     container without having to kill it;
-#   - that a new discriminator container on the same volume still refuses the banned
+#   - that a new waf container on the same volume still refuses the banned
 #     client;
-#   - that a discriminator container with its state files on a new volume mounted at
+#   - that a waf container with its state files on a new volume mounted at
 #     the directory SWW_STATE_DIR_FILE names becomes healthy;
-#   - that one whose SWW_STATE_DIR does not exist logs discriminator's message
+#   - that one whose SWW_STATE_DIR does not exist logs waf's message
 #     about it.
-# discriminator runs with SWW_LOOKUP_SOURCE=off, so that no address is sent to
+# waf runs with SWW_LOOKUP_SOURCE=off, so that no address is sent to
 # GeoJS. The containers, the network, the volumes and both images are removed
 # however the script ends. Building the app needs network access, for nixpkgs'
 # binary cache. script/check does not run this.
@@ -35,7 +35,7 @@ IMAGE="$NAME-base"
 APP_IMAGE="$NAME-app"
 NETWORK="$NAME"
 APP="$NAME-app-container"
-DISCRIMINATOR="$NAME-discriminator"
+WAF="$NAME-waf"
 VOLUME="$NAME-state"
 # The volumes of the container whose state directory SWW_STATE_DIR_FILE
 # names: its state files, and the file that names their directory.
@@ -43,7 +43,7 @@ MOVED_VOLUME="$NAME-moved-state"
 SETTINGS_VOLUME="$NAME-settings"
 
 cleanup() {
-    docker rm --force "$APP" "$DISCRIMINATOR" >/dev/null 2>&1 || true
+    docker rm --force "$APP" "$WAF" >/dev/null 2>&1 || true
     docker network rm "$NETWORK" >/dev/null 2>&1 || true
     docker volume rm --force "$VOLUME" "$MOVED_VOLUME" "$SETTINGS_VOLUME" \
         >/dev/null 2>&1 || true
@@ -53,8 +53,8 @@ cleanup() {
 fail() {
     echo "example-app: $*; the app container's output:" >&2
     docker logs "$APP" >&2 || true
-    echo "example-app: discriminator's output:" >&2
-    docker logs "$DISCRIMINATOR" >&2 || true
+    echo "example-app: waf's output:" >&2
+    docker logs "$WAF" >&2 || true
     exit 1
 }
 
@@ -87,49 +87,49 @@ logged() {
     done
 }
 
-# start_discriminator: run discriminator from the image, with the state files on the
+# start_waf: run waf from the image, with the state files on the
 # volume, a rate limit of one request a minute and no client looked up, and wait
 # until it is healthy.
-start_discriminator() {
-    docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \
+start_waf() {
+    docker run --detach --name "$WAF" --network "$NETWORK" \
         --volume "$VOLUME:/var/lib/sww" \
-        --env SWW_COMMAND=discriminator \
+        --env SWW_COMMAND=waf \
         --env SWW_RATE_LIMIT_PER_MINUTE=1 \
         --env SWW_LOOKUP_SOURCE=off \
         "$IMAGE" >/dev/null
-    wait_for "discriminator's health check did not pass" healthy "$DISCRIMINATOR"
+    wait_for "waf's health check did not pass" healthy "$WAF"
 }
 
 # start_app: run the app's container, with rproxy in it, and wait until it is
 # healthy.
 start_app() {
     docker run --detach --name "$APP" --network "$NETWORK" --publish 127.0.0.1::8080 \
-        --env SWRP_WAF_BACKEND="http://$DISCRIMINATOR:8080" \
+        --env SWRP_WAF_BACKEND="http://$WAF:8080" \
         "$APP_IMAGE" >/dev/null
     wait_for "the app's health check did not pass" healthy "$APP"
     address="$(docker port "$APP" 8080/tcp)"
 }
 
-# start_moved_discriminator: run discriminator with the state files on a new volume at
+# start_moved_waf: run waf with the state files on a new volume at
 # /srv/state, which SWW_STATE_DIR_FILE names in a file only the sww
 # user can read, as under "Settings given as files" in docs/settings.md, and
-# wait until it is healthy. discriminator can write the new volume only once the run
+# wait until it is healthy. waf can write the new volume only once the run
 # script has given it to that user.
-start_moved_discriminator() {
+start_moved_waf() {
     docker volume create "$MOVED_VOLUME" >/dev/null
     docker volume create "$SETTINGS_VOLUME" >/dev/null
     docker run --rm --volume "$SETTINGS_VOLUME:/settings" \
         --entrypoint bash "$IMAGE" -c 'echo /srv/state > /settings/state-dir &&
             chown sww:sww /settings/state-dir &&
             chmod 0400 /settings/state-dir'
-    docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \
+    docker run --detach --name "$WAF" --network "$NETWORK" \
         --volume "$MOVED_VOLUME:/srv/state" \
         --volume "$SETTINGS_VOLUME:/etc/sww/settings:ro" \
-        --env SWW_COMMAND=discriminator \
+        --env SWW_COMMAND=waf \
         --env SWW_STATE_DIR_FILE=/etc/sww/settings/state-dir \
         --env SWW_LOOKUP_SOURCE=off \
         "$IMAGE" >/dev/null
-    wait_for "discriminator's health check did not pass" healthy "$DISCRIMINATOR"
+    wait_for "waf's health check did not pass" healthy "$WAF"
 }
 
 # status_from <client> <path>: print the status a request for path from client,
@@ -169,87 +169,87 @@ main() {
 
     docker network create "$NETWORK" >/dev/null
     docker volume create "$VOLUME" >/dev/null
-    start_discriminator
+    start_waf
     start_app
     echo "example-app: the health checks pass"
 
-    [ "$(owner_of_state_dir "$DISCRIMINATOR")" = sww ] ||
-        fail "discriminator's container did not give the state directory to sww"
+    [ "$(owner_of_state_dir "$WAF")" = sww ] ||
+        fail "waf's container did not give the state directory to sww"
     [ "$(owner_of_state_dir "$APP")" = root ] ||
         fail "the app's container changed the state directory's owner"
-    echo "example-app: only discriminator's container changes the state directory's owner"
+    echo "example-app: only waf's container changes the state directory's owner"
 
     page="$(curl --fail --silent --show-error --max-time 10 "http://$address/")" ||
         fail "no answer on port 8080"
     [ "$page" = "hello from the example app" ] || fail "port 8080 answered $page"
-    wait_for "discriminator logged no request it allowed" \
-        logged "$DISCRIMINATOR" '"action":"forward"' '"discriminator_line":"report"'
+    wait_for "waf logged no request it allowed" \
+        logged "$WAF" '"action":"forward"' '"waf_line":"report"'
     echo "example-app: rproxy passes a request to the app and its answer back"
 
     refused || fail "a second request in a minute was not refused"
-    wait_for "discriminator logged no ban" \
-        logged "$DISCRIMINATOR" '"action":"client_is_rate_limited"'
+    wait_for "waf logged no ban" \
+        logged "$WAF" '"action":"client_is_rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
     refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
-    wait_for "discriminator logged no ban for the probe" \
-        logged "$DISCRIMINATOR" '"action":"temporarily_banned"' '"rule_ids":["env-file"]'
+    wait_for "waf logged no ban for the probe" \
+        logged "$WAF" '"action":"temporarily_banned"' '"rule_ids":["env-file"]'
     refused_from 203.0.113.9 / || fail "the client of the probe was let through"
     wait_for "the client's next request did not make its ban permanent" \
-        logged "$DISCRIMINATOR" '"action":"permanently_banned"' '"ban_expires":"permanent"'
+        logged "$WAF" '"action":"permanently_banned"' '"ban_expires":"permanent"'
     echo "example-app: a probe for /.env bans the client, its next request for good"
 
-    docker exec "$DISCRIMINATOR" sv stop sww >/dev/null ||
-        fail "sv stop sww failed in discriminator's container"
-    wait_for "discriminator did not stop in order" logged "$DISCRIMINATOR" '"msg":"stopped"'
+    docker exec "$WAF" sv stop sww >/dev/null ||
+        fail "sv stop sww failed in waf's container"
+    wait_for "waf did not stop in order" logged "$WAF" '"msg":"stopped"'
     [ "$(status_from 203.0.113.9 /)" = 200 ] ||
-        fail "with discriminator stopped, the app did not answer through rproxy"
+        fail "with waf stopped, the app did not answer through rproxy"
     wait_for "rproxy logged no request SWRP_DEFAULT_DISPOSITION decided" \
         logged "$APP" '"default_disposition":true'
     docker exec "$APP" /usr/local/bin/sww healthcheck ||
-        fail "with discriminator stopped, the app's health check failed"
-    echo "example-app: with discriminator stopped, the app answers through rproxy"
+        fail "with waf stopped, the app's health check failed"
+    echo "example-app: with waf stopped, the app answers through rproxy"
 
-    docker exec "$DISCRIMINATOR" sv start sww >/dev/null ||
-        fail "sv start sww failed in discriminator's container"
-    wait_for "once discriminator had started again, the ban did not apply" \
+    docker exec "$WAF" sv start sww >/dev/null ||
+        fail "sv start sww failed in waf's container"
+    wait_for "once waf had started again, the ban did not apply" \
         refused_from 203.0.113.9 /
-    echo "example-app: once discriminator has started again, bans apply again"
+    echo "example-app: once waf has started again, bans apply again"
 
     docker exec "$APP" sv stop sww >/dev/null ||
         fail "sv stop sww failed in the app's container"
     wait_for "rproxy did not stop in order" logged "$APP" '"msg":"stopped"'
     echo "example-app: sv stop stops rproxy in order"
 
-    for container in "$APP" "$DISCRIMINATOR"; do
+    for container in "$APP" "$WAF"; do
         docker stop "$container" >/dev/null
         status="$(docker inspect --format '{{.State.ExitCode}}' "$container")"
         [ "$status" = 0 ] || fail "docker stop left exit status $status"
     done
     echo "example-app: docker stop stops each container in order"
 
-    docker rm "$APP" "$DISCRIMINATOR" >/dev/null
-    start_discriminator
+    docker rm "$APP" "$WAF" >/dev/null
+    start_waf
     start_app
-    refused || fail "the new discriminator container let the banned client through"
-    wait_for "discriminator logged no request refused under the ban" \
-        logged "$DISCRIMINATOR" '"action":"temporarily_banned"'
-    echo "example-app: a new discriminator container on the same volume keeps the ban"
+    refused || fail "the new waf container let the banned client through"
+    wait_for "waf logged no request refused under the ban" \
+        logged "$WAF" '"action":"temporarily_banned"'
+    echo "example-app: a new waf container on the same volume keeps the ban"
 
-    docker rm --force "$DISCRIMINATOR" >/dev/null
-    start_moved_discriminator
+    docker rm --force "$WAF" >/dev/null
+    start_moved_waf
     echo "example-app: the run script gives the state files' directory named" \
         "by SWW_STATE_DIR_FILE to the sww user"
 
-    docker rm --force "$DISCRIMINATOR" >/dev/null
-    docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \
-        --env SWW_COMMAND=discriminator \
+    docker rm --force "$WAF" >/dev/null
+    docker run --detach --name "$WAF" --network "$NETWORK" \
+        --env SWW_COMMAND=waf \
         --env SWW_STATE_DIR=/srv/missing \
         --env SWW_LOOKUP_SOURCE=off \
         "$IMAGE" >/dev/null
-    wait_for "discriminator did not report the missing state directory" \
-        logged "$DISCRIMINATOR" "SWW_STATE_DIR cannot be written"
-    echo "example-app: discriminator reports a state directory that does not exist"
+    wait_for "waf did not report the missing state directory" \
+        logged "$WAF" "SWW_STATE_DIR cannot be written"
+    echo "example-app: waf reports a state directory that does not exist"
 }
 
 main "$@"

script/run

@@ -1,9 +1,9 @@
 #!/bin/sh
-# script/run: build bin/sww with script/build and run discriminator and
+# script/run: build bin/sww with script/build and run waf and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
 # SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# discriminator listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
+# waf listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
 # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
 # SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
 # and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d,
@@ -13,14 +13,14 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-DISCRIMINATOR=""
+WAF=""
 RPROXY=""
 
-# stop_both: stop what runs, and wait for it, so that discriminator writes its state
+# stop_both: stop what runs, and wait for it, so that waf writes its state
 # files.
 stop_both() {
     trap '' HUP INT TERM
-    kill $DISCRIMINATOR $RPROXY 2>/dev/null || true
+    kill $WAF $RPROXY 2>/dev/null || true
     wait || true
 }
 
@@ -42,8 +42,8 @@ main() {
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM
 
-    "$ROOT/bin/sww" discriminator &
-    DISCRIMINATOR=$!
+    "$ROOT/bin/sww" waf &
+    WAF=$!
     "$ROOT/bin/sww" rproxy &
     RPROXY=$!
     wait "$RPROXY"