Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

internal/alerts/alerts.go

@@ -36,9 +36,9 @@ import (
 
 // The events an alert is for, as SWWAF_ALERT_EVENTS names them.
 const (
-	// EventBan is a ban smallwebwaf made.
+	// EventBan is a ban sww made.
 	EventBan = "ban"
-	// EventPermanentBan is a permanent ban smallwebwaf made, or a ban it
+	// EventPermanentBan is a permanent ban sww made, or a ban it
 	// made permanent.
 	EventPermanentBan = "permanent_ban"
 	// EventAnomaly is a count of requests or bytes over an anomaly
@@ -52,11 +52,11 @@ const (
 	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
 	// is a hit.
 	EventReputationHit = "reputation_hit"
-	// EventSourceFailure is GeoJS failing or refusing smallwebwaf, a fetch
+	// EventSourceFailure is GeoJS failing or refusing sww, a fetch
 	// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
 	// failing or refused, or the day's AbuseIPDB checks used up.
 	EventSourceFailure = "source_failure"
-	// EventFileError is a rule file or state file edited while smallwebwaf
+	// EventFileError is a rule file or state file edited while sww
 	// runs that does not parse, a replacement of the lookup database that
 	// cannot be read, or a state file that cannot be written.
 	EventFileError = "file_error"
@@ -151,7 +151,7 @@ type Params struct {
 // Alert is one alert, as the webhook is sent it and alerts.json holds it,
 // with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
 // Country are, for a ban, the client's as the ban's notes give them. Host is
-// the site of the request that raised the alert, while one servewaf serves
+// the site of the request that raised the alert, while one discriminator serves
 // many sites, and "" otherwise.
 //
 //nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case
@@ -683,7 +683,7 @@ func (d *destination) run(ctx context.Context) {
 
 				d.processLog.Warn("gave up an alert "+d.setting+" refused",
 					"event", alert.Event, "error", err.Error())
-			case ctx.Err() == nil: // not cut off as smallwebwaf stops
+			case ctx.Err() == nil: // not cut off as sww stops
 				d.failed.Add(1)
 
 				retryDelay = min(max(retryDelayFactor*retryDelay, firstRetryDelay),

internal/alerts/alerts_test.go

@@ -34,9 +34,9 @@ const (
 	// webhookURL is where the alerts are posted, slackURL the Slack
 	// incoming webhook, and ntfyURL the ntfy topic. ntfyToken is the ntfy
 	// token of the tests that set one.
-	webhookURL = "https://alerts.example/smallwebwaf?team=ops"
+	webhookURL = "https://alerts.example/sww?team=ops"
 	slackURL   = "https://hooks.slack.example/services/T0123/B4567/abcdef"
-	ntfyURL    = "https://ntfy.example/smallwebwaf-alerts"
+	ntfyURL    = "https://ntfy.example/sww-alerts"
 	ntfyToken  = "tk_0123456789abcdefghijklmnopq"
 	// instance is the instance name every alert gives.
 	instance = "fsn1app1/blog"
@@ -1320,12 +1320,12 @@ func anAlertForEachEvent() []eventMessage {
 				Event:  alerts.EventFileError,
 				Reason: "a rule file has an error, and the rules stay as they were",
 				Detail: map[string]any{
-					"file": "/etc/smallwebwaf/rules.d/50-app.rules", "error": "line 2: no action",
+					"file": "/etc/sww/rules.d/50-app.rules", "error": "line 2: no action",
 				},
 			},
 			"fsn1app1/blog: file_error", "high warning",
 			"a rule file has an error, and the rules stay as they were\n" +
-				"file: /etc/smallwebwaf/rules.d/50-app.rules\nerror: line 2: no action",
+				"file: /etc/sww/rules.d/50-app.rules\nerror: line 2: no action",
 		},
 	}
 }

internal/bans/admin_test.go

@@ -33,7 +33,7 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	third := netip.MustParsePrefix("203.0.113.3/32")
 
 	// Seen longest ago, a netblock with two of an admin's bans alone, and
-	// then one with an admin's ban before a ban smallwebwaf made: the one
+	// then one with an admin's ban before a ban sww made: the one
 	// ban counted toward MaxBans.
 	ledger.Load([]bans.Ban{
 		{Netblock: adminsOnly, Start: midnight().Add(-3 * time.Hour), Cause: bans.CauseAdmin},
@@ -48,7 +48,7 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	})
 	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 2})
 
-	// A new ban drops the ban smallwebwaf made, and only that one.
+	// A new ban drops the ban sww made, and only that one.
 	ledger.BanForLimit(second, midnight(), bans.Notes{})
 	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 1})
 
@@ -114,7 +114,7 @@ func TestEarlierBansCountABanAnAdminKeepsOnce(t *testing.T) {
 	}
 }
 
-func TestReasonOfTheBansSmallwebwafMakes(t *testing.T) {
+func TestReasonOfTheBansSwwMakes(t *testing.T) {
 	t.Parallel()
 
 	ledger := bans.New(defaultRules())
@@ -226,7 +226,7 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 		t.Fatalf("%d bans made by an admin after the start's, want none", got)
 	}
 
-	// The admin keeps the ban smallwebwaf made, keeps the one read at the
+	// The admin keeps the ban sww made, keeps the one read at the
 	// start, and adds one without a cause: that one alone is made.
 	kept := made
 	kept.Cause = bans.CauseAdmin

internal/bans/bans.go

@@ -1,4 +1,4 @@
-// Package bans is the ban ledger: the bans smallwebwaf makes on the
+// Package bans is the ban ledger: the bans sww makes on the
 // netblocks of clients that break a rate limit, a byte limit or the error
 // burst, show a clear sign of attack or are listed by the CrowdSec
 // decision list, and
@@ -21,14 +21,14 @@ import (
 
 // The causes of bans.
 const (
-	// CauseLimit is a ban smallwebwaf made for a broken limit.
+	// CauseLimit is a ban sww made for a broken limit.
 	CauseLimit = "limit"
-	// CauseAttack is a ban smallwebwaf made for a clear sign of attack.
+	// CauseAttack is a ban sww made for a clear sign of attack.
 	CauseAttack = "attack"
-	// CauseAdmin is a ban an admin made, or one smallwebwaf made that an
+	// CauseAdmin is a ban an admin made, or one sww made that an
 	// admin keeps. It is never dropped.
 	CauseAdmin = "admin"
-	// CauseCrowdSec is a ban smallwebwaf made for a client the CrowdSec
+	// CauseCrowdSec is a ban sww made for a client the CrowdSec
 	// decision list lists. It ends when CrowdSec's decision does.
 	CauseCrowdSec = "crowdsec"
 )
@@ -70,7 +70,7 @@ type Ban struct {
 	Expires time.Time
 	// Cause is CauseLimit, CauseAttack, CauseAdmin or CauseCrowdSec.
 	Cause string
-	// Reason is a short text: for a ban smallwebwaf made, the limit broken,
+	// Reason is a short text: for a ban sww made, the limit broken,
 	// the rule that matched or the scenario of CrowdSec's decision; for an
 	// admin's, what the admin wrote.
 	Reason string
@@ -581,7 +581,7 @@ func (l *Ledger) Load(bans []Ban) {
 }
 
 // LoadEdit is Load for an admin's edit of bans.json, taken in while
-// smallwebwaf runs. Each ban in it whose cause is CauseAdmin, and which
+// sww runs. Each ban in it whose cause is CauseAdmin, and which
 // the ledger did not hold, with the same netblock and start, is one the
 // admin made, and is counted among the bans made.
 func (l *Ledger) LoadEdit(bans []Ban) {

internal/bans/snapshot_test.go

@@ -173,7 +173,7 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 	t.Parallel()
 
-	// A 9-hour ban smallwebwaf made, the third in a row, and an admin's
+	// A 9-hour ban sww made, the third in a row, and an admin's
 	// 1-hour ban added to bans.json over it, with no cause and no notes.
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	nineHours := bans.Ban{

internal/config/config.go

@@ -1,9 +1,9 @@
-// Package config reads smallwebwaf's settings, and is the one place they are
-// read. Every setting is an environment variable. The settings of `smallwebwaf
-// servewaf` start with SWWAF_, every one of them has a default, and most can be
-// given as a file instead. Those of `smallwebwaf rproxy` start with SWRP_. Each
+// Package config reads sww's settings, and is the one place they are
+// read. Every setting is an environment variable. The settings of `sww
+// discriminator` start with SWWAF_, every one of them has a default, and most can be
+// given as a file instead. Those of `sww rproxy` start with SWRP_. Each
 // of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
-// since rproxy never touches disk. SMALLWEBWAF_COMMAND chooses which of the two
+// since rproxy never touches disk. SWW_COMMAND chooses which of the two
 // the image runs.
 package config
 
@@ -31,10 +31,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// Config is the settings of `smallwebwaf servewaf`. A time or size limit of
+// Config is the settings of `sww discriminator`. A time or size limit of
 // zero is off.
 type Config struct {
-	// ListenAddr is where servewaf listens (SWWAF_LISTEN_ADDR).
+	// ListenAddr is where discriminator listens (SWWAF_LISTEN_ADDR).
 	ListenAddr string
 	// InstanceName is the name every log line and alert gives as instance,
 	// and every metric carries as its label instance (SWWAF_INSTANCE_NAME),
@@ -199,7 +199,7 @@ type Config struct {
 	// written (SWWAF_LOG_LEVEL). It holds back no request log line.
 	LogLevel slog.Level
 	// AdminToken is the bearer token an admin sends for the ban endpoints
-	// and /_smallwebwaf/clients/<ip> (SWWAF_ADMIN_TOKEN), "" while it is
+	// and /_sww/clients/<ip> (SWWAF_ADMIN_TOKEN), "" while it is
 	// unset and they are off.
 	AdminToken string
 	// MetricsToken is the bearer token a scraper sends for the metrics
@@ -231,7 +231,7 @@ type Config struct {
 	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that servewaf may refuse after a rule file or Core Rule Set match; one
+	// that discriminator may refuse after a rule file or Core Rule Set match; one
 	// more breaks a limit (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
@@ -327,7 +327,7 @@ const (
 	// maxParanoiaLevel is the Core Rule Set's highest paranoia level.
 	maxParanoiaLevel = 4
 	// firstSetupRuleID to lastSetupRuleID are the ids the Core Rule Set
-	// keeps for the rules that set it up, which smallwebwaf's own rules
+	// keeps for the rules that set it up, which sww's own rules
 	// have too (see internal/waf). Switching one off would undo a change
 	// that no setting undoes.
 	firstSetupRuleID = 900000
@@ -370,8 +370,8 @@ var (
 	errNeedsDBPath     = errors.New("it names the file to look clients up in")
 	errDBPathUnused    = errors.New("only file reads it")
 	errOver64K         = errors.New(
-		"is more than 64K, the most servewaf gets of a body")
-	errNotCommand           = errors.New("is not rproxy or servewaf")
+		"is more than 64K, the most discriminator gets of a body")
+	errNotCommand           = errors.New("is not rproxy or discriminator")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -387,7 +387,7 @@ var (
 	errNotNamedNetblock = errors.New(
 		"is not a name, = and a netblock, such as office=203.0.113.0/24")
 	errNotAbsolutePath = errors.New(
-		"is not an absolute path, such as /var/lib/smallwebwaf")
+		"is not an absolute path, such as /var/lib/sww")
 	errShortToken    = errors.New("is shorter than 32 characters")
 	errNotMode       = errors.New("is not enforce or observe")
 	errNotBytesCount = errors.New("is not response, request or both")
@@ -401,7 +401,7 @@ var (
 		"is not the id of a Core Rule Set rule, a whole number such as 942100")
 	errSetupRuleID = errors.New(
 		"is from 900000 to 900999, the ids of the rules that set the Core Rule Set " +
-			"up and of smallwebwaf's own, which cannot be switched off")
+			"up and of sww's own, which cannot be switched off")
 	errNotBoolean      = errors.New("is not true or false")
 	errNotLogRemoteURL = errors.New(
 		"is not syslog+udp, syslog+tcp or syslog+tls with a host and a port, " +
@@ -413,7 +413,7 @@ var (
 	errSetTwice      = errors.New("set only one of them")
 	errNotWebhookURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
-			"such as https://alerts.example/smallwebwaf")
+			"such as https://alerts.example/sww")
 	errNotWebhookHeader = errors.New(
 		"is not a header name followed by : and the header's value, " +
 			"such as Authorization:Bearer <token>")
@@ -507,7 +507,7 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		AttackBanDuration:    env.durationNotOff("SWWAF_ATTACK_BAN_DURATION", "7d"),
 		MaxBans:              env.numberNotOff("SWWAF_MAX_BANS", "5000"),
 		BanScopeV4Prefix:     env.v4Prefix("SWWAF_BAN_SCOPE_V4_PREFIX", "32"),
-		StateDir:             env.absolutePath("SWWAF_STATE_DIR", "/var/lib/smallwebwaf"),
+		StateDir:             env.absolutePath("SWWAF_STATE_DIR", "/var/lib/sww"),
 		StateWriteDelay:      env.durationNotOff("SWWAF_STATE_WRITE_DELAY", "10s"),
 		StateCounterInterval: env.durationNotOff("SWWAF_STATE_COUNTER_INTERVAL", "15m"),
 		LogRequestHeaders: env.headerNames("SWWAF_LOG_REQUEST_HEADERS",
@@ -516,7 +516,7 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		AdminToken:          env.token("SWWAF_ADMIN_TOKEN"),
 		MetricsToken:        env.token("SWWAF_METRICS_TOKEN"),
 		MetricsTopN:         env.numberNotOff("SWWAF_METRICS_TOP_N", "50"),
-		RulesDir:            env.value("SWWAF_RULES_DIR", "/etc/smallwebwaf/rules.d"),
+		RulesDir:            env.value("SWWAF_RULES_DIR", "/etc/sww/rules.d"),
 		RulesEnabled:        env.boolean("SWWAF_RULES_ENABLED", "true"),
 		WAFMode:             env.wafMode("SWWAF_WAF_MODE", WAFModeBlock),
 		WAFParanoiaLevel:    env.paranoiaLevel("SWWAF_WAF_PARANOIA_LEVEL", "1"),
@@ -572,26 +572,26 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	return cfg, nil
 }
 
-// Command reads only SMALLWEBWAF_COMMAND, the command the image runs and its
-// health check checks: rproxy when it is unset or empty, or servewaf. It cannot
+// Command reads only SWW_COMMAND, the command the image runs and its
+// health check checks: rproxy when it is unset or empty, or discriminator. It cannot
 // be given as a file. Any other value is an error that names the setting.
 func Command(lookupEnv func(string) (string, bool)) (string, error) {
-	command, _ := lookupEnv("SMALLWEBWAF_COMMAND")
+	command, _ := lookupEnv("SWW_COMMAND")
 
 	switch command {
 	case "", "rproxy":
 		return "rproxy", nil
-	case "servewaf":
+	case "discriminator":
 		return command, nil
 	default:
-		return "", fmt.Errorf("SMALLWEBWAF_COMMAND: %q %w", command, errNotCommand)
+		return "", fmt.Errorf("SWW_COMMAND: %q %w", command, errNotCommand)
 	}
 }
 
-// ServeWAFListenAddr reads only SWWAF_LISTEN_ADDR, which may be given as a
-// file, as FromEnvironment does. The health check in servewaf's container needs
+// DiscriminatorListenAddr reads only SWWAF_LISTEN_ADDR, which may be given as a
+// file, as FromEnvironment does. The health check in discriminator's container needs
 // no other setting, so it reads no other, nor a file that another names.
-func ServeWAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
+func DiscriminatorListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	listenAddr := env.address("SWWAF_LISTEN_ADDR")
 
@@ -1395,7 +1395,7 @@ func parseSize(value string) (int64, error) {
 }
 
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 64K, since servewaf
+// reads: a size as parseSize reads it, or off, but at most 64K, since discriminator
 // gets no more of a body than that.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)

internal/config/config_test.go

@@ -254,12 +254,12 @@ func TestDefaults(t *testing.T) {
 		AttackBanDuration:    7 * 24 * time.Hour,
 		MaxBans:              5000,
 		BanScopeV4Prefix:     32,
-		StateDir:             "/var/lib/smallwebwaf",
+		StateDir:             "/var/lib/sww",
 		StateWriteDelay:      10 * time.Second,
 		StateCounterInterval: 15 * time.Minute,
 		MetricsToken:         "",
 		MetricsTopN:          50,
-		RulesDir:             "/etc/smallwebwaf/rules.d",
+		RulesDir:             "/etc/sww/rules.d",
 		RulesEnabled:         true,
 	})
 	wantLookupSettings(t, cfg, config.Config{
@@ -588,7 +588,7 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 	const (
 		notParanoiaLevel = " is not a paranoia level, from 1 to 4"
 		setupRule        = " is from 900000 to 900999, the ids of the rules that set " +
-			"the Core Rule Set up and of smallwebwaf's own, which cannot be switched off"
+			"the Core Rule Set up and of sww's own, which cannot be switched off"
 	)
 
 	for _, tc := range []struct{ name, value, want string }{
@@ -627,10 +627,11 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafBodyLimit, "128KB",
 			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
 		},
-		{wafBodyLimit, "65K", `"65K" is more than 64K, the most servewaf gets of a body`},
+		{wafBodyLimit, "65K", `"65K" is more than 64K, the most discriminator ` +
+			`gets of a body`},
 		{
 			wafBodyLimit, "65537",
-			`"65537" is more than 64K, the most servewaf gets of a body`,
+			`"65537" is more than 64K, the most discriminator gets of a body`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
@@ -856,7 +857,7 @@ func TestAlertSettingsAsSet(t *testing.T) {
 	const (
 		webhook = "https://alerts.example:8443/hooks/waf?team=ops"
 		slack   = "https://hooks.slack.example/services/T0123/B4567/abcdef"
-		ntfy    = "https://ntfy.example/smallwebwaf-alerts"
+		ntfy    = "https://ntfy.example/sww-alerts"
 		token   = "tk_0123456789abcdefghijklmnopq"
 	)
 
@@ -904,17 +905,17 @@ func TestInvalidAlertSettingStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	wantStartStopped(t, []struct{ name, value string }{
-		{alertWebhookURL, "alerts.example/smallwebwaf"},
+		{alertWebhookURL, "alerts.example/sww"},
 		{alertWebhookURL, "ftp://alerts.example/"},
-		{alertWebhookURL, "https:///smallwebwaf"},
+		{alertWebhookURL, "https:///sww"},
 		{alertWebhookURL, "https://user:password@alerts.example/"},
 		{alertWebhookURL, "https://alerts.example/#top"},
 		{alertWebhookURL, "https://alerts.example:0/"},
 		{alertWebhookURL, "https://alerts.example:65536/"},
 		{alertSlackWebhookURL, "hooks.slack.example/services/T0123"},
 		{alertSlackWebhookURL, "https://user:password@hooks.slack.example/"},
-		{alertNtfyURL, "ntfy://ntfy.example/smallwebwaf-alerts"},
-		{alertNtfyURL, "https://ntfy.example/smallwebwaf-alerts#top"},
+		{alertNtfyURL, "ntfy://ntfy.example/sww-alerts"},
+		{alertNtfyURL, "https://ntfy.example/sww-alerts#top"},
 		{alertWebhookHeaders, "Authorization"},
 		{alertWebhookHeaders, "X Team:ops"},
 		{alertWebhookHeaders, ":ops"},
@@ -994,7 +995,7 @@ func TestWebhookURLIsLoggedWithoutItsPathOrQueryAndNeverShown(t *testing.T) {
 		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.lookupEnv)
 
 		want := alertWebhookURL + ": is not an http or https URL without a user or " +
-			"a fragment, such as https://alerts.example/smallwebwaf"
+			"a fragment, such as https://alerts.example/sww"
 		if err == nil || err.Error() != want {
 			t.Errorf("error %v, want %s", err, want)
 		}
@@ -1008,7 +1009,7 @@ func TestSlackAndNtfySettingsAreLoggedWithoutTheirSecrets(t *testing.T) {
 
 	cfg := fromEnvironment(t, environment{
 		alertSlackWebhookURL: "https://hooks.slack.example/services/T0123/B4567/abcdef",
-		alertNtfyURL:         "https://ntfy.example/smallwebwaf-alerts",
+		alertNtfyURL:         "https://ntfy.example/sww-alerts",
 		alertNtfyToken:       token,
 	})
 
@@ -1027,7 +1028,7 @@ func TestSlackAndNtfySettingsAreLoggedWithoutTheirSecrets(t *testing.T) {
 		}
 	}
 
-	for _, secret := range []string{"T0123", "smallwebwaf-alerts", token} {
+	for _, secret := range []string{"T0123", "sww-alerts", token} {
 		if strings.Contains(logged, secret) {
 			t.Errorf("%s in the settings logged: %s", secret, logged)
 		}
@@ -1058,7 +1059,7 @@ func TestInstanceNameWithAControlCharacterStopsTheStartOnlyWithNtfySet(t *testin
 	const name = "fsn1app1\r"
 
 	_, err := config.FromEnvironment(environment{
-		instanceName: name, alertNtfyURL: "https://ntfy.example/smallwebwaf-alerts",
+		instanceName: name, alertNtfyURL: "https://ntfy.example/sww-alerts",
 	}.lookupEnv)
 
 	want := instanceName + `: "fsn1app1\r" holds a control character, such as the ` +
@@ -2039,7 +2040,7 @@ func TestInvalidBanOrStateValueStopsTheStart(t *testing.T) {
 		{maxBanDuration, off}, {maxBanDuration, "1w"}, {attackBanDuration, off},
 		{maxBans, off}, {maxBans, "0"}, {maxBans, "5K"},
 		{banScopeV4Prefix, "33"}, {banScopeV4Prefix, "-1"}, {banScopeV4Prefix, "/24"},
-		{stateDir, ""}, {stateDir, "state"}, {stateDir, "./var/lib/smallwebwaf"},
+		{stateDir, ""}, {stateDir, "state"}, {stateDir, "./var/lib/sww"},
 		{stateWriteDelay, off}, {stateWriteDelay, "0s"},
 		{stateCounterInterval, off}, {stateCounterInterval, "15"},
 	})
@@ -2310,7 +2311,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		attackBanDuration:    "7d",
 		maxBans:              "5000",
 		banScopeV4Prefix:     "32",
-		stateDir:             "/var/lib/smallwebwaf",
+		stateDir:             "/var/lib/sww",
 		stateWriteDelay:      "10s",
 		stateCounterInterval: "15m",
 		adminToken:           "",
@@ -2319,7 +2320,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		instanceName:         hostname,
 		logRequestHeaders:    defaultLogRequestHeaders,
 		logLevel:             "info",
-		rulesDir:             "/etc/smallwebwaf/rules.d",
+		rulesDir:             "/etc/sww/rules.d",
 		rulesEnabled:         "true",
 		wafMode:              config.WAFModeBlock,
 		wafParanoiaLevel:     "1",

internal/config/rproxy.go

@@ -12,7 +12,7 @@ import (
 	"time"
 )
 
-// RProxy is the settings of `smallwebwaf rproxy`. A size or time limit of zero
+// RProxy is the settings of `sww rproxy`. A size or time limit of zero
 // is off.
 type RProxy struct {
 	// ListenAddr is where rproxy listens (SWRP_LISTEN_ADDR).
@@ -22,12 +22,12 @@ type RProxy struct {
 	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
 	// (SWRP_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
-	// WAFBackend is servewaf's URL (SWRP_WAF_BACKEND).
+	// WAFBackend is discriminator's URL (SWRP_WAF_BACKEND).
 	WAFBackend *url.URL
-	// Timeout is how long rproxy waits for servewaf's answer to a question,
+	// Timeout is how long rproxy waits for discriminator's answer to a question,
 	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
-	// DefaultDisposition is what is done with a request when servewaf cannot be
+	// DefaultDisposition is what is done with a request when discriminator cannot be
 	// connected to, does not answer at all, or does not answer within Timeout:
 	// allow or deny (SWRP_DEFAULT_DISPOSITION).
 	DefaultDisposition string
@@ -50,7 +50,7 @@ type RProxy struct {
 
 var (
 	errNeedsWAFBackend = errors.New(
-		"is required: it is servewaf's URL, such as http://servewaf:8080")
+		"is required: it is discriminator's URL, such as http://discriminator:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
 	errNotMilliseconds = errors.New(
 		"is not a whole number of milliseconds above zero, such as 2000")
@@ -124,7 +124,7 @@ func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 
-// wafBackend reads the setting that is servewaf's URL, which must be set.
+// wafBackend reads the setting that is discriminator's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
 	if value == "" {
@@ -139,7 +139,7 @@ func (e *environment) wafBackend(name string) *url.URL {
 	return backend
 }
 
-// disposition reads the setting that is what is done with a request when servewaf
+// disposition reads the setting that is what is done with a request when discriminator
 // cannot be connected to, does not answer at all, or does not answer in time:
 // allow or deny.
 func (e *environment) disposition(name, defaultValue string) string {

internal/config/rproxy_test.go

@@ -24,7 +24,7 @@ const (
 	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
 	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
 	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
-	backendURL        = "http://servewaf:8080"
+	backendURL        = "http://discriminator:8080"
 	rproxyDefaultAddr = ":8080"
 	rproxyDefaultApp  = "http://127.0.0.1:8081"
 	notASize          = "a lot"
@@ -114,8 +114,8 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		name, value string
 	}{
 		{wafBackend, ""},
-		{wafBackend, "servewaf:8080"},
-		{wafBackend, "http://servewaf:8080/path"},
+		{wafBackend, "discriminator:8080"},
+		{wafBackend, "http://discriminator:8080/path"},
 		{rproxyTimeout, "0"},
 		{rproxyTimeout, "-1"},
 		{rproxyTimeout, off},

internal/discriminator/admin.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"bytes"
@@ -49,7 +49,7 @@ func (rq *request) answerHealth() {
 	_, _ = io.WriteString(rq.out, "ok\n")
 }
 
-// answerAdmin answers a request for one of servewaf's own endpoints. Each
+// answerAdmin answers a request for one of discriminator's own endpoints. Each
 // needs a token, sent as Authorization: Bearer <token>: the metrics
 // SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without it is
 // refused with 401. An endpoint whose token is unset answers 404, as any other
@@ -250,7 +250,7 @@ type clientAnswer struct {
 	Bans   []state.BanEntry  `json:"bans"`
 }
 
-// showClient answers GET ClientsPath<ip> with what servewaf knows of the client:
+// showClient answers GET ClientsPath<ip> with what discriminator knows of the client:
 // its counters, its history, which holds its country as last looked up and its
 // offences, and its bans with their notes.
 func (rq *request) showClient() {

internal/discriminator/admin_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"encoding/json"
@@ -10,9 +10,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
@@ -86,13 +86,13 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		}
 	}
 
-	// Any other request under /_smallwebwaf/ is not found.
+	// Any other request under /_sww/ is not found.
 	for _, e := range []adminEndpoint{
-		{http.MethodPut, servewaf.BansPath, banOtherClient},
-		{http.MethodDelete, servewaf.BansPath, ""},
-		{http.MethodGet, servewaf.BansPath + "/" + otherClient, ""},
-		{http.MethodPost, servewaf.ClientsPath + otherClient, ""},
-		{http.MethodGet, strings.TrimSuffix(servewaf.ClientsPath, "/"), ""},
+		{http.MethodPut, discriminator.BansPath, banOtherClient},
+		{http.MethodDelete, discriminator.BansPath, ""},
+		{http.MethodGet, discriminator.BansPath + "/" + otherClient, ""},
+		{http.MethodPost, discriminator.ClientsPath + otherClient, ""},
+		{http.MethodGet, strings.TrimSuffix(discriminator.ClientsPath, "/"), ""},
 	} {
 		s.admin(e.method, e.path, e.body, http.StatusNotFound)
 	}
@@ -118,8 +118,8 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 		Reason:   "probes for logins",
 	}
 
-	wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK),
-		want)
+	wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, banOtherClient,
+		http.StatusOK), want)
 
 	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	if line.BanExpires != requestlog.FormatTime(expires) {
@@ -129,7 +129,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -138,13 +138,13 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	lifted := clk.Now()
 	want.Lifted = &lifted
 
-	wantBans(t, s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "",
+	wantBans(t, s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "", http.StatusNotFound)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -181,7 +181,8 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, body, http.StatusOK), want)
+		wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, body, http.StatusOK),
+			want)
 	}
 }
 
@@ -250,7 +251,8 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 			"request body too large",
 		},
 	} {
-		got := s.admin(http.MethodPost, servewaf.BansPath, tc.body, http.StatusBadRequest)
+		got := s.admin(http.MethodPost, discriminator.BansPath, tc.body,
+			http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
 			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
 		}
@@ -283,7 +285,8 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 			Bans   []state.BanEntry  `json:"bans"`
 		}
 
-		decode(t, s.admin(http.MethodGet, servewaf.ClientsPath+addr, "", http.StatusOK), &got)
+		decode(t, s.admin(http.MethodGet, discriminator.ClientsPath+addr, "",
+			http.StatusOK), &got)
 
 		if got.Client == nil {
 			t.Fatalf("%s: no client", addr)
@@ -305,13 +308,15 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 
 	// Of an address no request came from and no ban covers, nothing is
 	// known.
-	got := s.admin(http.MethodGet, servewaf.ClientsPath+"198.51.100.99", "", http.StatusOK)
+	got := s.admin(http.MethodGet, discriminator.ClientsPath+"198.51.100.99", "",
+		http.StatusOK)
 	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
-	s.admin(http.MethodGet, servewaf.ClientsPath+"203.0.113", "", http.StatusBadRequest)
-	s.admin(http.MethodDelete, servewaf.BansPath+"/203.0.113.0/24", "",
+	s.admin(http.MethodGet, discriminator.ClientsPath+"203.0.113", "",
+		http.StatusBadRequest)
+	s.admin(http.MethodDelete, discriminator.BansPath+"/203.0.113.0/24", "",
 		http.StatusBadRequest)
 }
 
@@ -342,14 +347,14 @@ type adminEndpoint struct {
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {
 	return []adminEndpoint{
-		{http.MethodGet, servewaf.BansPath, ""},
-		{http.MethodPost, servewaf.BansPath, banOtherClient},
-		{http.MethodDelete, servewaf.BansPath + "/" + otherClient, ""},
-		{http.MethodGet, servewaf.ClientsPath + otherClient, ""},
+		{http.MethodGet, discriminator.BansPath, ""},
+		{http.MethodPost, discriminator.BansPath, banOtherClient},
+		{http.MethodDelete, discriminator.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, discriminator.ClientsPath + otherClient, ""},
 	}
 }
 
-// admin sends a request with method for path, with body, to servewaf's own
+// admin sends a request with method for path, with body, to discriminator's own
 // address, with the admin token, and checks that it is answered with status, its
 // log line's action admin. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
@@ -365,7 +370,7 @@ func (s *sender) adminRequest(
 ) answer {
 	s.t.Helper()
 
-	req := newRequest(s.t, method, s.serveWAFAddr, path, strings.NewReader(body))
+	req := newRequest(s.t, method, s.discriminatorAddr, path, strings.NewReader(body))
 	if authorization != "" {
 		req.Header.Set("Authorization", authorization)
 	}

internal/discriminator/alerts_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"maps"
@@ -10,8 +10,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -201,7 +201,7 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 // never sent them, and returns the queue they wait in as well.
 func startWithAlerts(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
 	t.Helper()
 
 	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
@@ -210,21 +210,21 @@ func startWithAlerts(
 // startAppWithAlerts is startWithAlerts in front of the app handler.
 func startAppWithAlerts(
 	t *testing.T, handler http.HandlerFunc, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
 	t.Helper()
 
 	app := startApp(t, handler)
 	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
 	settings := map[string]string{
 		trustedProxies:  trustLocalhost,
-		alertWebhookURL: "https://alerts.example/smallwebwaf",
+		alertWebhookURL: "https://alerts.example/sww",
 		instanceName:    alertInstance,
 	}
 	maps.Copy(settings, env)
 
 	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
 
-	s := &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}
+	s := &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}
 
 	return s, clk, server, queue
 }

internal/discriminator/anomaly_internal_test.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"net/netip"

internal/discriminator/anomaly_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"maps"
@@ -13,9 +13,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The anomaly thresholds: the prefix of a scope followed by the end of a
@@ -319,7 +319,7 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// kept.
 	geojsURL, _, release := startHeldGeoJS(t)
 
-	var server atomic.Pointer[servewaf.Server]
+	var server atomic.Pointer[discriminator.Server]
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()

internal/discriminator/answertime_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"fmt"
@@ -15,16 +15,16 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
 	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
-	// servewaf has to answer.
+	// discriminator has to answer.
 	answerTimeLimit = 2 * time.Second
 	// defaultLookupWait is the default of SWWAF_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
@@ -33,7 +33,7 @@ const (
 	headerFieldLimit = 100
 	// cookieHeader is the header the cookie limit counts.
 	cookieHeader = "Cookie"
-	// tooLarge is how servewaf refuses a request over the header limits.
+	// tooLarge is how discriminator refuses a request over the header limits.
 	tooLarge = http.StatusRequestHeaderFieldsTooLarge
 	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
 	// that unansweredGeoJSURL names too.
@@ -56,7 +56,7 @@ func cookies(count int) string {
 }
 
 // fillHeaders adds headers to a question until the checks see total header
-// fields: all but ClientHeader and PeerHeader, which servewaf removes. Go's
+// fields: all but ClientHeader and PeerHeader, which discriminator removes. Go's
 // client sends nothing else but Host, which the limit does not count, once
 // User-Agent is set.
 func fillHeaders(req *http.Request, total int) {
@@ -70,7 +70,7 @@ func fillHeaders(req *http.Request, total int) {
 func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	t.Parallel()
 
-	s := startServeWAF(t, "", map[string]string{wafMode: block})
+	s := startDiscriminator(t, "", map[string]string{wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 
@@ -81,7 +81,7 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 
-	wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
@@ -136,7 +136,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s := startServeWAF(t, "", map[string]string{wafMode: block})
+			s := startDiscriminator(t, "", map[string]string{wafMode: block})
 			req := s.question(siteA, client, "/")
 			tc.make(req)
 
@@ -144,13 +144,13 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			line := s.out.requestLine(t)
 
 			if tc.refused {
-				wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+				wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
 				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 
 				return
 			}
 
-			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 			if line.DurationWAF == nil {
@@ -171,11 +171,11 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
 
-			s := startServeWAF(t, "", env)
+			s := startDiscriminator(t, "", env)
 			req := s.question(siteA, client, "/")
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
 		})
 	}
 }
@@ -183,17 +183,17 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 
-	s := startServeWAF(t, "", map[string]string{wafMode: block, allowNets: client})
+	s := startDiscriminator(t, "", map[string]string{wafMode: block, allowNets: client})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow)
 }
 
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	t.Parallel()
 
-	s := startServeWAF(t, "", map[string]string{mode: observe, wafMode: block})
+	s := startDiscriminator(t, "", map[string]string{mode: observe, wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 
@@ -204,7 +204,7 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
@@ -216,7 +216,7 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	t.Parallel()
 
-	s := startServeWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
+	s := startDiscriminator(t, "", map[string]string{rateLimitPerMinute: "1"})
 	ask := func() answer {
 		req := s.question(siteA, client, "/")
 		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
@@ -224,8 +224,8 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 		return do(t, req)
 	}
 
-	wantDisposition(t, ask(), tooLarge, servewaf.DispositionDeny)
-	wantDisposition(t, ask(), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, ask(), tooLarge, discriminator.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
 	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
@@ -243,13 +243,13 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s := startServeWAF(t, "", map[string]string{
+			s := startDiscriminator(t, "", map[string]string{
 				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
 			})
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
 			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
 		})
 	}
@@ -259,13 +259,13 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
-	s := startServeWAF(t, geojsURL, map[string]string{
+	s := startDiscriminator(t, geojsURL, map[string]string{
 		unknownLimitPercent: "0", lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
@@ -275,14 +275,14 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	}
 
 	// The client is under no ban, and GeoJS places it in a country.
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, discriminator.DispositionAllow)
 }
 
 func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
-	s := startServeWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
+	s := startDiscriminator(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
 	s.server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
 		Answered: s.clock.Now(), Used: s.clock.Now(),
@@ -291,7 +291,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
 }
 
@@ -299,14 +299,14 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
-	s := startServeWAF(t, geojsURL, map[string]string{
+	s := startDiscriminator(t, geojsURL, map[string]string{
 		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 
 	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 	if asn != asnDE || country != "DE" {
@@ -315,18 +315,18 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	}
 }
 
-// newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
+// newDiscriminatorInBubble makes a discriminator for a synctest bubble: GeoJS never
 // answers, a setting needs its answer, and everything is at its default but
 // for env. No request to it may use the network.
-func newServeWAFInBubble(
+func newDiscriminatorInBubble(
 	t *testing.T, env map[string]string,
-) (*servewaf.Server, *output) {
+) (*discriminator.Server, *output) {
 	t.Helper()
 
 	settings := map[string]string{deniedCountries: "KP"}
 	maps.Copy(settings, env)
 
-	server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now, settings)
+	server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now, settings)
 
 	return server, out
 }
@@ -334,13 +334,13 @@ func newServeWAFInBubble(
 // askDirectly hands a question about a request from client straight to server,
 // as change leaves it, and returns the answer's status and how long it took.
 func askDirectly(
-	t *testing.T, server *servewaf.Server, change func(*http.Request),
+	t *testing.T, server *discriminator.Server, change func(*http.Request),
 ) (int, time.Duration) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
-	req.Header.Set(servewaf.ClientHeader, client)
+	req.Header.Set(discriminator.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
 	change(req)
 
@@ -353,17 +353,17 @@ func askDirectly(
 }
 
 // banClient bans client at now.
-func banClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+func banClient(_ *testing.T, server *discriminator.Server, now time.Time) {
 	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
 }
 
 // countClient counts one request from client at now for the rate limits.
-func countClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+func countClient(_ *testing.T, server *discriminator.Server, now time.Time) {
 	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
 }
 
 // listClient puts client on the blocklist at dropURL.
-func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
+func listClient(t *testing.T, server *discriminator.Server, now time.Time) {
 	t.Helper()
 
 	err := server.Lists.Load([]reputation.List{{
@@ -375,13 +375,13 @@ func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
 }
 
 // decideOnClient puts client on the CrowdSec decision list.
-func decideOnClient(t *testing.T, server *servewaf.Server, now time.Time) {
+func decideOnClient(t *testing.T, server *discriminator.Server, now time.Time) {
 	t.Helper()
 	loadDecisions(t, server, now, clientsDecision)
 }
 
 // leaveAsItIs prepares nothing.
-func leaveAsItIs(*testing.T, *servewaf.Server, time.Time) {}
+func leaveAsItIs(*testing.T, *discriminator.Server, time.Time) {}
 
 func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	t.Parallel()
@@ -392,7 +392,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		prepare func(t *testing.T, server *discriminator.Server, now time.Time)
 		// cookie is the request's Cookie header.
 		cookie string
 		status int
@@ -435,7 +435,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, so that a request that does not wait takes no time at all.
 			synctest.Test(t, func(t *testing.T) {
-				server, out := newServeWAFInBubble(t, tc.env)
+				server, out := newDiscriminatorInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 
 				status, took := askDirectly(t, server, func(req *http.Request) {
@@ -463,7 +463,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		prepare func(t *testing.T, server *discriminator.Server, now time.Time)
 		status  int
 		action  string
 	}{
@@ -492,7 +492,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 			t.Parallel()
 
 			synctest.Test(t, func(t *testing.T) {
-				server, out := newServeWAFInBubble(t, tc.env)
+				server, out := newDiscriminatorInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 
 				status, took := askDirectly(t, server, func(*http.Request) {})
@@ -508,7 +508,9 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 	}
 }
 
-func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testing.T) {
+func TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	held, askedGeoJS, _ := startHeldGeoJS(t)
@@ -521,10 +523,12 @@ func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testin
 
 	t.Cleanup(func() { _ = resolver.Close() })
 
-	server, out, _ := newServeWAFWith(t, func(params servewaf.Params) *servewaf.Server {
+	server, out, _ := newDiscriminatorWith(t, func(
+		params discriminator.Params,
+	) *discriminator.Server {
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 
-		return servewaf.New(params)
+		return discriminator.New(params)
 	}, held, time.Now, map[string]string{
 		deniedCountries: "KP", wafMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),

internal/discriminator/bans.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"net/http"
@@ -83,7 +83,7 @@ func (rq *request) countBytes() {
 }
 
 // countRefusal counts the request for the error burst once it has been
-// answered, if servewaf refused it after a rule file match, a trap path or a
+// answered, if discriminator refused it after a rule file match, a trap path or a
 // Core Rule Set match, and in observe mode if enforce mode would have: more than
 // SWWAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
 // break a limit. A client in SWWAF_ALLOW_NETS, which the checks skip, is

internal/discriminator/bans_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"bufio"
@@ -15,8 +15,8 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -352,7 +352,7 @@ func TestMaxBansDropsTheBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
 }
 
-// clock is the time a test sets, by which smallwebwaf counts requests and
+// clock is the time a test sets, by which sww counts requests and
 // makes bans.
 type clock struct {
 	mu  sync.Mutex
@@ -375,14 +375,14 @@ func (c *clock) advance(d time.Duration) {
 	c.now = c.now.Add(d)
 }
 
-// startWithClock starts servewaf, and rproxy in front of an app that answers 200,
+// startWithClock starts discriminator, and rproxy in front of an app that answers 200,
 // with the settings in env on top of trusting localhost's
 // X-Forwarded-For, clients' AS numbers and countries looked up at
 // geojsURL, and a clock set to midnight, the start of a bucket in every
 // window.
 func startWithClock(
 	t *testing.T, geojsURL string, env map[string]string,
-) (*sender, *clock, *servewaf.Server) {
+) (*sender, *clock, *discriminator.Server) {
 	t.Helper()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
@@ -392,19 +392,20 @@ func startWithClock(
 
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
 
-	return &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}, clk, server
+	return &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}, clk, server
 }
 
 // sender sends requests to rproxy one after another, each on a connection of its
-// own, and checks each one's answer and log line. serveWAFAddr is where servewaf's
-// own endpoints are, which adminRequest asks. Every request servewaf gets must
-// come through the sender, since the log lines are matched to them in order.
+// own, and checks each one's answer and log line. discriminatorAddr is where
+// discriminator's own endpoints are, which adminRequest asks. Every request
+// discriminator gets must come through the sender, since the log lines are
+// matched to them in order.
 type sender struct {
-	t            *testing.T
-	addr         string
-	serveWAFAddr string
-	out          *output
-	sent         int
+	t                 *testing.T
+	addr              string
+	discriminatorAddr string
+	out               *output
+	sent              int
 }
 
 // get sends a GET request for / from the client at from.

internal/discriminator/biased.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"sneak.berlin/go/smallwebwaf/internal/config"

internal/discriminator/biased_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"fmt"
@@ -15,9 +15,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The biased thresholds.
@@ -280,7 +280,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
 			map[string]string{unknownLimitPercent: "0"})
 
 		// Once the time the request waits for its answer is up, the client
@@ -319,7 +319,7 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
-				server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+				server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
 					map[string]string{lookupTimeout: timeout.String(), tc.setting: tc.value})
 				began := time.Now()
 
@@ -419,7 +419,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 // clock.
 func startWithLookups(
 	t *testing.T, env map[string]string,
-) (*sender, *servewaf.Server, *alerts.Queue) {
+) (*sender, *discriminator.Server, *alerts.Queue) {
 	t.Helper()
 
 	s, _, server, queue := startWithLookupsAndClock(t, env)
@@ -434,7 +434,7 @@ func startWithLookups(
 // country, and no other address.
 func startWithLookupsAndClock(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
 	t.Helper()
 
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
@@ -463,11 +463,13 @@ func (s *sender) uploadFrom(from string) logLine {
 // serveFromDE hands a question about a request from fromDE with method and body
 // straight to server's handler, without the network, and returns once it is
 // answered.
-func serveFromDE(t *testing.T, server *servewaf.Server, method string, body io.Reader) {
+func serveFromDE(
+	t *testing.T, server *discriminator.Server, method string, body io.Reader,
+) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.Header.Set(servewaf.ClientHeader, fromDE)
+	req.Header.Set(discriminator.ClientHeader, fromDE)
 	req.Header.Set(requestIDHeader, "the-id")
 
 	server.Handler.ServeHTTP(httptest.NewRecorder(), req)

internal/discriminator/bytelimits_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"bufio"
@@ -92,7 +92,7 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 
 			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
-			wantMetric(t, s.scrape(), `smallwebwaf_rate_limit_hits_total{`+
+			wantMetric(t, s.scrape(), `sww_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
 		})
 	}

internal/discriminator/client.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"crypto/rand"

internal/discriminator/coreruleset.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"time"

internal/discriminator/coreruleset_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"io"
@@ -367,10 +367,10 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`smallwebwaf_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
+		`sww_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
 	wantMetric(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`, 3)
-	wantMetric(t, metrics, `smallwebwaf_requests_total{action="waf_blocked",`+
+		`sww_offences_total{instance="app",kind="waf_blocked"}`, 3)
+	wantMetric(t, metrics, `sww_requests_total{action="waf_blocked",`+
 		`instance="app",status_class="4xx"}`, 3)
 }
 
@@ -394,9 +394,9 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`smallwebwaf_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
+		`sww_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
 	wantNoSeries(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`)
+		`sww_offences_total{instance="app",kind="waf_blocked"}`)
 }
 
 func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {

internal/discriminator/countries.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"slices"

internal/discriminator/countries_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"encoding/json"
@@ -350,7 +350,7 @@ const (
 )
 
 // geojsAnswer is an answer of GeoJS about one address, with the fields
-// smallwebwaf reads.
+// sww reads.
 //
 //nolint:tagliatelle // GeoJS's own names
 type geojsAnswer struct {

internal/discriminator/crowdsec_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"
@@ -9,9 +9,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The CrowdSec settings, and the tests' engine, which is never asked: each
@@ -87,11 +87,11 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	metrics := s.scrape()
 	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
 
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="crowdsec",`+
+	wantMetric(t, metrics, `sww_bans_made_total{cause="crowdsec",`+
 		`instance="`+alertInstance+`"}`, 1)
-	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 1)
-	wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
-	wantMetric(t, metrics, "smallwebwaf_reputation_last_fetch_timestamp_seconds"+labels,
+	wantMetric(t, metrics, "sww_reputation_hits_total"+labels, 1)
+	wantMetric(t, metrics, "sww_reputation_failures_total"+labels, 0)
+	wantMetric(t, metrics, "sww_reputation_last_fetch_timestamp_seconds"+labels,
 		float64(fetched.Unix()))
 }
 
@@ -168,7 +168,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 // decisionsURL, answer, the engine's answer, fetched at fetched, as
 // reputation.json would at start.
 func loadDecisions(
-	t *testing.T, server *servewaf.Server, fetched time.Time, answer string,
+	t *testing.T, server *discriminator.Server, fetched time.Time, answer string,
 ) {
 	t.Helper()
 

internal/discriminator/discriminator.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"bytes"
@@ -17,18 +17,18 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The headers of rproxy's question and of servewaf's answer, as
-// "servewaf" in SPEC.md gives them.
+// The headers of rproxy's question and of discriminator's answer, as
+// "discriminator" in SPEC.md gives them.
 const (
 	// ClientHeader marks a request as rproxy's question, and gives the
 	// visitor's address.
-	ClientHeader = "X-Smallwebwaf-Client"
+	ClientHeader = "X-Sww-Client"
 	// PeerHeader gives the address of rproxy's own TCP peer.
-	PeerHeader = "X-Smallwebwaf-Peer"
+	PeerHeader = "X-Sww-Peer"
 	// ContentLengthHeader gives the body length the visitor announced.
-	ContentLengthHeader = "X-Smallwebwaf-Content-Length"
-	// DispositionHeader gives servewaf's answer.
-	DispositionHeader = "X-Smallwebwaf-Disposition"
+	ContentLengthHeader = "X-Sww-Content-Length"
+	// DispositionHeader gives discriminator's answer.
+	DispositionHeader = "X-Sww-Disposition"
 )
 
 // The values of DispositionHeader.
@@ -40,14 +40,14 @@ const (
 	DispositionDeny = "deny"
 	// DispositionClose tells rproxy to close the visitor's connection
 	// without an answer, which SWWAF_BAN_RESPONSE asks for when it is close.
-	// servewaf closing the question's connection instead would read as
-	// servewaf being down, and rproxy would then let the request through.
+	// discriminator closing the question's connection instead would read as
+	// discriminator being down, and rproxy would then let the request through.
 	DispositionClose = "close"
 )
 
-// ReportPath is where rproxy sends the report of each request servewaf
+// ReportPath is where rproxy sends the report of each request discriminator
 // answered.
-const ReportPath = "/_smallwebwaf/report"
+const ReportPath = "/_sww/report"
 
 // QuestionBodyMaxBytes is the most of a visitor's body a question carries.
 const QuestionBodyMaxBytes = 64 << 10
@@ -76,11 +76,11 @@ const (
 	// maxReportedMilliseconds is the longest duration a report may give,
 	// about 31 years, so that it fits a time.Duration.
 	maxReportedMilliseconds = 1e12
-	// serveWAFTimeout bounds how long a request to servewaf takes to arrive,
-	// and its answer to leave, and serveWAFIdleTimeout how long a kept-open
-	// connection waits for its next request.
-	serveWAFTimeout     = 60 * time.Second
-	serveWAFIdleTimeout = 120 * time.Second
+	// discriminatorTimeout bounds how long a request to discriminator takes to
+	// arrive, and its answer to leave, and discriminatorIdleTimeout how long a
+	// kept-open connection waits for its next request.
+	discriminatorTimeout     = 60 * time.Second
+	discriminatorIdleTimeout = 120 * time.Second
 )
 
 var (
@@ -103,7 +103,7 @@ type Report struct {
 	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
 }
 
-// New returns the server `smallwebwaf servewaf` runs. It answers
+// New returns the server `sww discriminator` runs. It answers
 // rproxy's questions, takes rproxy's reports and answers its own endpoints. It
 // passes nothing to an app. rproxy applies the size and time limits to the
 // visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
@@ -117,9 +117,9 @@ func New(params Params) *Server {
 			Addr:         params.Config.ListenAddr,
 			Handler:      h,
 			ErrorLog:     slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn),
-			ReadTimeout:  serveWAFTimeout,
-			WriteTimeout: serveWAFTimeout,
-			IdleTimeout:  serveWAFIdleTimeout,
+			ReadTimeout:  discriminatorTimeout,
+			WriteTimeout: discriminatorTimeout,
+			IdleTimeout:  discriminatorIdleTimeout,
 		},
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
@@ -133,8 +133,9 @@ func New(params Params) *Server {
 	}
 }
 
-// ServeHTTP handles one request to servewaf: a request carrying ClientHeader is
-// rproxy's question, and any other is for servewaf itself.
+// ServeHTTP handles one request to discriminator: a request carrying
+// ClientHeader is rproxy's question, and any other is for discriminator
+// itself.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if len(r.Header.Values(ClientHeader)) > 0 {
 		h.answerQuestion(w, r)
@@ -150,7 +151,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // its client: it is over the header limits, a blocklist lists its client while
 // SWWAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
 // over a whole rate limit. In observe mode, which refuses nothing, none is.
-// rproxy lets a request through when servewaf answers too late.
+// rproxy lets a request through when discriminator answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 	if rq.h.config.Observe {
 		return false
@@ -165,7 +166,7 @@ func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 			rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now))
 }
 
-// overHeaderLimits reports whether servewaf refuses the request for its
+// overHeaderLimits reports whether discriminator refuses the request for its
 // headers: it has more than maxHeaderFields fields, each value of a header sent
 // twice being one, or more than maxCookies cookies, each part of a Cookie header
 // between semicolons being one unless it is empty or only spaces and tabs. The
@@ -212,7 +213,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 	defer rq.finish()
 
 	rq.site = r.Host
-	rq.line.ServeWAFLine = requestlog.ServeWAFLineDecision
+	rq.line.DiscriminatorLine = requestlog.DiscriminatorLineDecision
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()
 	underOwnPrefix := strings.HasPrefix(r.URL.Path, adminPrefix)
@@ -238,7 +239,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// The app never sees this prefix. servewaf's own endpoints are at its
+	// The app never sees this prefix. discriminator's own endpoints are at its
 	// own address, so this answers as a path with no endpoint does.
 	rq.line.Action = requestlog.ActionAdmin
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
@@ -246,7 +247,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 }
 
 // readQuestion returns the visitor's address and the body a question carries,
-// and whether servewaf takes the question. It answers a question it does not
+// and whether discriminator takes the question. It answers a question it does not
 // take with 400 and no disposition, which rproxy treats as it treats no
 // answer. The id of a question it takes is held from here on, without a
 // decision yet, so that another question with that id is refused while this
@@ -289,7 +290,7 @@ func (h *handler) readQuestion(
 
 	held, _ := h.awaitingReport.ContainsOrAdd(id, nil)
 	if held {
-		h.refuseQuestion(w, requestIDHeader+" is the id of a request servewaf holds")
+		h.refuseQuestion(w, requestIDHeader+" is the id of a request discriminator holds")
 
 		return netip.Addr{}, nil, false
 	}
@@ -297,14 +298,15 @@ func (h *handler) readQuestion(
 	return client, body, true
 }
 
-// refuseQuestion answers a question servewaf does not take, for reason.
+// refuseQuestion answers a question discriminator does not take, for reason.
 func (h *handler) refuseQuestion(w http.ResponseWriter, reason string) {
 	h.processLog.Warn("a question is refused", "reason", reason)
 	http.Error(w, reason, http.StatusBadRequest)
 }
 
 // asTheVisitorSentIt returns a copy of r, a question, as the checks and the
-// log line are to see it: without the headers rproxy adds for servewaf, with
+// log line are to see it: without the headers rproxy adds for discriminator,
+// with
 // body, which has been read of r, and with the length the visitor announced,
 // as -1 when it announced none. The question's own length covers only the part
 // of the body it carries.
@@ -372,7 +374,7 @@ func (rq *request) deny(r refusal) {
 	http.Error(rq.out, http.StatusText(r.status), r.status)
 }
 
-// answerOwnEndpoint answers a request to servewaf's own address. No check
+// answerOwnEndpoint answers a request to discriminator's own address. No check
 // runs on it: the address is on the private network, where the peers are
 // rproxy and the admin's tools, not visitors.
 func (h *handler) answerOwnEndpoint(w http.ResponseWriter, r *http.Request) {
@@ -487,7 +489,7 @@ func (h *handler) finishWith(held *decision, report Report) {
 		requestBytes: report.RequestBytes,
 	}
 
-	rq.line.ServeWAFLine = requestlog.ServeWAFLineReport
+	rq.line.DiscriminatorLine = requestlog.DiscriminatorLineReport
 	rq.line.Status = report.Status
 	rq.line.RequestBytes = report.RequestBytes
 	rq.line.ResponseBytes = report.ResponseBytes

internal/discriminator/errorburst_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"maps"
@@ -10,14 +10,14 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
 
-// refused is a request the tests here send, which servewaf refuses after a rule
+// refused is a request the tests here send, which discriminator refuses after a rule
 // file match.
 type refused int
 
@@ -51,7 +51,7 @@ func (r refused) send(s *sender, from string) logLine {
 // SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
-) (*sender, *clock, *servewaf.Server) {
+) (*sender, *clock, *discriminator.Server) {
 	t.Helper()
 
 	settings := map[string]string{
@@ -156,12 +156,12 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 	}
 
 	metrics := s.scrape()
-	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
 		`kind="refusals",window="minute"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
+	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 3)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
+		`sww_offences_total{instance="app",kind="rule_blocked"}`, 3)
+	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 1)
 }
 
 func TestErrorBurstIsNotLoweredForAClientWithLowerLimits(t *testing.T) {

internal/discriminator/health_test.go

@@ -1,11 +1,11 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"
 	"testing"
 
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
@@ -21,7 +21,7 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+		got := s.adminRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+

internal/discriminator/history_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"io"
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
@@ -45,7 +45,7 @@ func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
 		Requests:  4,
 		Forwarded: 2,
 		Refused:   2,
-		// The app answers with no body, smallwebwaf with its status text.
+		// The app answers with no body, sww with its status text.
 		ResponseBytes: 2 * int64(len("Forbidden\n")),
 		Responses:     ratelimit.Responses{Status2xx: 2, Status4xx: 2},
 		Offences:      ratelimit.Offences{Limit: 1},
@@ -100,8 +100,9 @@ func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 
 	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
-	s.adminRequest("", http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized)
+	s.adminRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK)
+	s.adminRequest("", http.MethodGet, discriminator.MetricsPath, "",
+		http.StatusUnauthorized)
 	s.scrape()
 
 	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
@@ -115,7 +116,7 @@ func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
 
-	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
+	wantStatus(t, get(t, addr, "/_sww/nothing"), http.StatusNotFound)
 	out.endedLine(t)
 
 	history := historyOf(t, server, localhost)
@@ -126,7 +127,9 @@ func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 }
 
 // historyOf returns the history of the client at addr.
-func historyOf(t *testing.T, server *servewaf.Server, addr string) ratelimit.History {
+func historyOf(
+	t *testing.T, server *discriminator.Server, addr string,
+) ratelimit.History {
 	t.Helper()
 
 	client := netip.MustParsePrefix(addr + "/32")

internal/discriminator/lookup.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"context"

internal/discriminator/lookup_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"
@@ -162,7 +162,7 @@ func TestASNumberAndNameInTheLogLineTheHistoryTheBanNotesAndTheAlert(t *testing.
 	addr, out, server, queue := startProxyWithAlerts(t, app.URL, geojsURL, clk.Now,
 		map[string]string{
 			trustedProxies:     trustLocalhost,
-			alertWebhookURL:    "https://alerts.example/smallwebwaf",
+			alertWebhookURL:    "https://alerts.example/sww",
 			rateLimitPerMinute: "1",
 		})
 	s := &sender{t: t, addr: addr, out: out}
@@ -379,13 +379,13 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	// clock of the test's own: the wait lasts exactly as long as it should,
 	// however slowly the test process runs. Nothing in it may wait on the
 	// network, which would keep that clock from moving on: the request is
-	// handed to servewaf's handler, and GeoJS is one that never answers.
+	// handed to discriminator's handler, and GeoJS is one that never answers.
 	synctest.Test(t, func(t *testing.T) {
 		// Not the default. The exclusive list needs the answer, and the app
 		// is never reached.
 		const timeout = 3 * time.Second
 
-		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
 			map[string]string{
 				lookupTimeout:    timeout.String(),
 				allowedCountries: "DE",

internal/discriminator/metrics_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"io"
@@ -11,9 +11,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -32,7 +32,7 @@ func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{bearer, "Bearer ", ""} {
-		s.adminRequest(authorization, http.MethodGet, servewaf.MetricsPath, "",
+		s.adminRequest(authorization, http.MethodGet, discriminator.MetricsPath, "",
 			http.StatusNotFound)
 	}
 }
@@ -46,18 +46,19 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		method, path, authorization string
 		status                      int
 	}{
-		{http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized},
+		{http.MethodGet, discriminator.MetricsPath, "", http.StatusUnauthorized},
 		{
-			http.MethodGet, servewaf.MetricsPath, "Bearer " + strings.ToUpper(token),
+			http.MethodGet, discriminator.MetricsPath, "Bearer " + strings.ToUpper(token),
 			http.StatusUnauthorized,
 		},
-		{http.MethodGet, servewaf.MetricsPath, "Basic " + token, http.StatusUnauthorized},
-		{http.MethodGet, servewaf.MetricsPath, bearer, http.StatusOK},
-		{http.MethodGet, servewaf.MetricsPath, "bearer " + token, http.StatusOK},
-		{http.MethodPost, servewaf.MetricsPath, bearer, http.StatusNotFound},
-		{http.MethodGet, servewaf.MetricsPath + "/", bearer, http.StatusNotFound},
-		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
-		{http.MethodPost, servewaf.HealthPath, "", http.StatusNotFound},
+		{http.MethodGet, discriminator.MetricsPath, "Basic " + token,
+			http.StatusUnauthorized},
+		{http.MethodGet, discriminator.MetricsPath, bearer, http.StatusOK},
+		{http.MethodGet, discriminator.MetricsPath, "bearer " + token, http.StatusOK},
+		{http.MethodPost, discriminator.MetricsPath, bearer, http.StatusNotFound},
+		{http.MethodGet, discriminator.MetricsPath + "/", bearer, http.StatusNotFound},
+		{http.MethodGet, "/_sww/bans", bearer, http.StatusNotFound},
+		{http.MethodPost, discriminator.HealthPath, "", http.StatusNotFound},
 	} {
 		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
 
@@ -68,7 +69,7 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		}
 
 		if tc.status == http.StatusOK &&
-			!strings.Contains(string(got.body), "# TYPE smallwebwaf_requests_total counter") {
+			!strings.Contains(string(got.body), "# TYPE sww_requests_total counter") {
 			t.Errorf("the metrics are\n%s", got.body)
 		}
 	}
@@ -86,7 +87,7 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 
 	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
 	wantStatus(t, got, http.StatusOK)
-	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
+	wantStatus(t, get(t, addr, "/_sww/nothing"), http.StatusNotFound)
 	out.endedLines(t, 2)
 
 	forward := `{action="forward",instance="app",status_class="2xx"}`
@@ -94,17 +95,17 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 
 	// The request for the metrics is itself under way.
 	metrics := scrape(t, server.Addr)
-	wantMetric(t, metrics, "smallwebwaf_requests_total"+forward, 1)
-	wantMetric(t, metrics, "smallwebwaf_requests_total"+notFound, 1)
-	wantMetric(t, metrics, "smallwebwaf_request_bytes_total"+forward, 3)
-	wantMetric(t, metrics, "smallwebwaf_response_bytes_total"+forward, 5)
-	wantMetric(t, metrics, "smallwebwaf_response_bytes_total"+notFound,
+	wantMetric(t, metrics, "sww_requests_total"+forward, 1)
+	wantMetric(t, metrics, "sww_requests_total"+notFound, 1)
+	wantMetric(t, metrics, "sww_request_bytes_total"+forward, 3)
+	wantMetric(t, metrics, "sww_response_bytes_total"+forward, 5)
+	wantMetric(t, metrics, "sww_response_bytes_total"+notFound,
 		float64(len("Not Found\n")))
 	wantMetric(t, metrics,
-		`smallwebwaf_request_duration_seconds_count{instance="app"}`, 2)
+		`sww_request_duration_seconds_count{instance="app"}`, 2)
 	wantMetric(t, metrics,
-		`smallwebwaf_upstream_duration_seconds_count{instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_requests_in_flight{instance="app"}`, 1)
+		`sww_upstream_duration_seconds_count{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_requests_in_flight{instance="app"}`, 1)
 	metric(t, metrics, `go_goroutines{instance="app"}`)
 	metric(t, metrics, `process_start_time_seconds{instance="app"}`)
 }
@@ -132,16 +133,16 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`smallwebwaf_requests_total{action="denied",instance="app",status_class="none"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+		`sww_requests_total{action="denied",instance="app",status_class="none"}`, 1)
+	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
 		`kind="requests",window="minute"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_active_bans{instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 0)
+	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
+	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_active_bans{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_permanent_bans{instance="app"}`, 0)
 
 	clk.advance(time.Hour)
-	wantMetric(t, s.scrape(), `smallwebwaf_active_bans{instance="app"}`, 0)
+	wantMetric(t, s.scrape(), `sww_active_bans{instance="app"}`, 0)
 
 	// A limit broken again right after would ban for three hours, longer
 	// than SWWAF_MAX_BAN_DURATION, so the ban is permanent.
@@ -149,14 +150,14 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	s.get(client, 0, requestlog.ActionRateLimited)
 
 	metrics = s.scrape()
-	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
 		`kind="requests",window="minute"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_active_bans{instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 2)
+	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 2)
+	wantMetric(t, metrics, `sww_active_bans{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_permanent_bans{instance="app"}`, 1)
 	// denied and client.
-	wantMetric(t, metrics, `smallwebwaf_tracked_clients{instance="app"}`, 2)
+	wantMetric(t, metrics, `sww_tracked_clients{instance="app"}`, 2)
 }
 
 func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
@@ -167,7 +168,7 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 		adminToken:   adminSecret,
 	})
 
-	const admins = `smallwebwaf_bans_made_total{cause="admin",instance="app"}`
+	const admins = `sww_bans_made_total{cause="admin",instance="app"}`
 
 	wantMetric(t, s.scrape(), admins, 0)
 
@@ -180,7 +181,7 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 	wantMetric(t, s.scrape(), admins, 1)
 
 	// And a ban made through the endpoint.
-	s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK)
+	s.admin(http.MethodPost, discriminator.BansPath, banOtherClient, http.StatusOK)
 	wantMetric(t, s.scrape(), admins, 2)
 }
 
@@ -233,25 +234,25 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 	lines++
 
 	wantMetric(t, metrics,
-		`smallwebwaf_country_requests_total{country="KP",instance="app"}`, 3)
+		`sww_country_requests_total{country="KP",instance="app"}`, 3)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_requests_total{country="DE",instance="app"}`, 2)
+		`sww_country_requests_total{country="DE",instance="app"}`, 2)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_requests_total{country="other",instance="app"}`, 1)
+		`sww_country_requests_total{country="other",instance="app"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_list_refusals_total{country="KP",instance="app"}`, 3)
+		`sww_country_list_refusals_total{country="KP",instance="app"}`, 3)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_request_bytes_total{country="KP",instance="app"}`, 0)
+		`sww_country_request_bytes_total{country="KP",instance="app"}`, 0)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_request_bytes_total{country="DE",instance="app"}`, 6)
+		`sww_country_request_bytes_total{country="DE",instance="app"}`, 6)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_response_bytes_total{country="KP",instance="app"}`,
+		`sww_country_response_bytes_total{country="KP",instance="app"}`,
 		float64(3*len("Forbidden\n")))
 	wantMetric(t, metrics,
-		`smallwebwaf_country_response_bytes_total{country="other",instance="app"}`,
+		`sww_country_response_bytes_total{country="other",instance="app"}`,
 		float64(len("hello")))
 	wantNoSeries(t, metrics,
-		`smallwebwaf_country_requests_total{country="FR",instance="app"}`)
+		`sww_country_requests_total{country="FR",instance="app"}`)
 
 	// Once FR is busier than DE, it takes DE's place: its series counts
 	// from then on, and DE's is gone.
@@ -259,15 +260,15 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 
 	metrics = scrape(t, server.Addr)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_requests_total{country="KP",instance="app"}`, 3)
+		`sww_country_requests_total{country="KP",instance="app"}`, 3)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_requests_total{country="FR",instance="app"}`, 2)
+		`sww_country_requests_total{country="FR",instance="app"}`, 2)
 	wantMetric(t, metrics,
-		`smallwebwaf_country_requests_total{country="other",instance="app"}`, 2)
+		`sww_country_requests_total{country="other",instance="app"}`, 2)
 	wantNoSeries(t, metrics,
-		`smallwebwaf_country_requests_total{country="DE",instance="app"}`)
+		`sww_country_requests_total{country="DE",instance="app"}`)
 	wantNoSeries(t, metrics,
-		`smallwebwaf_country_request_bytes_total{country="DE",instance="app"}`)
+		`sww_country_request_bytes_total{country="DE",instance="app"}`)
 }
 
 func TestMetricsByASNumberKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
@@ -298,15 +299,15 @@ func TestMetricsByASNumberKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`smallwebwaf_asn_requests_total{asn="AS64501",instance="app"}`, 2)
+		`sww_asn_requests_total{asn="AS64501",instance="app"}`, 2)
 	wantMetric(t, metrics,
-		`smallwebwaf_asn_requests_total{asn="other",instance="app"}`, 1)
+		`sww_asn_requests_total{asn="other",instance="app"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_asn_request_bytes_total{asn="AS64501",instance="app"}`, 0)
+		`sww_asn_request_bytes_total{asn="AS64501",instance="app"}`, 0)
 	wantMetric(t, metrics,
-		`smallwebwaf_asn_response_bytes_total{asn="other",instance="app"}`, 0)
+		`sww_asn_response_bytes_total{asn="other",instance="app"}`, 0)
 	wantNoSeries(t, metrics,
-		`smallwebwaf_asn_requests_total{asn="AS64502",instance="app"}`)
+		`sww_asn_requests_total{asn="AS64502",instance="app"}`)
 }
 
 func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
@@ -337,16 +338,16 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, server.Addr)
 
-	for metric(t, metrics, `smallwebwaf_geojs_failures_total{instance="app"}`) == 0 &&
+	for metric(t, metrics, `sww_geojs_failures_total{instance="app"}`) == 0 &&
 		time.Now().Before(deadline) {
 		time.Sleep(pollInterval)
 
 		metrics = scrape(t, server.Addr)
 	}
 
-	wantMetric(t, metrics, `smallwebwaf_geojs_requests_total{instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_geojs_failures_total{instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_geojs_unanswered_total{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_geojs_requests_total{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_geojs_failures_total{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_geojs_unanswered_total{instance="app"}`, 1)
 }
 
 // keptAnswer returns GeoJS's answer that the client at addr is in
@@ -360,12 +361,12 @@ func keptAnswer(addr, country string) lookup.Answer {
 	}
 }
 
-// scrape asks servewaf at addr for the metrics, with the token, and returns
+// scrape asks discriminator at addr for the metrics, with the token, and returns
 // them.
 func scrape(t *testing.T, addr string) string {
 	t.Helper()
 
-	req := newRequest(t, http.MethodGet, addr, servewaf.MetricsPath, http.NoBody)
+	req := newRequest(t, http.MethodGet, addr, discriminator.MetricsPath, http.NoBody)
 	req.Header.Set("Authorization", bearer)
 
 	got := do(t, req)
@@ -380,14 +381,14 @@ func scrape(t *testing.T, addr string) string {
 func (s *sender) scrape() string {
 	s.t.Helper()
 
-	return string(s.adminRequest(bearer, http.MethodGet, servewaf.MetricsPath, "",
+	return string(s.adminRequest(bearer, http.MethodGet, discriminator.MetricsPath, "",
 		http.StatusOK).body)
 }
 
 // metric returns the value of series in metrics, which are in the
 // Prometheus text format. series is a name and its labels in the order of
 // their names, such as
-// smallwebwaf_offences_total{instance="app",kind="limit"}. It fails the
+// sww_offences_total{instance="app",kind="limit"}. It fails the
 // test if there is no such series.
 func metric(t *testing.T, metrics, series string) float64 {
 	t.Helper()

internal/discriminator/observe_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"

internal/discriminator/proxy.go

@@ -1,7 +1,7 @@
-// Package servewaf is the server the servewaf command runs. It answers rproxy's
-// questions, takes rproxy's reports and answers its own endpoints, and writes a
-// log line for each.
-package servewaf
+// Package discriminator is the server the discriminator command runs. It answers
+// rproxy's questions, takes rproxy's reports and answers its own endpoints, and
+// writes a log line for each.
+package discriminator
 
 import (
 	"io"
@@ -23,31 +23,32 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// adminPrefix starts the path of each of servewaf's own endpoints. The app never
+// adminPrefix starts the path of each of discriminator's own endpoints. The app never
 // sees a path under it.
-const adminPrefix = "/_smallwebwaf/"
+const adminPrefix = "/_sww/"
 
-// HealthPath is the health endpoint of servewaf and of rproxy, which the
+// HealthPath is the health endpoint of discriminator and of rproxy, which the
 // container's health check asks.
-const HealthPath = "/_smallwebwaf/healthz"
+const HealthPath = "/_sww/healthz"
 
 // MetricsPath is where the metrics are, for a request that carries
 // SWWAF_METRICS_TOKEN.
-const MetricsPath = "/_smallwebwaf/metrics"
+const MetricsPath = "/_sww/metrics"
 
 // BansPath is where an admin lists and adds bans, and, followed by / and
 // a client's address, lifts them, with SWWAF_ADMIN_TOKEN.
-const BansPath = "/_smallwebwaf/bans"
+const BansPath = "/_sww/bans"
 
-// ClientsPath is where an admin asks what servewaf knows of a client, by the
-// client's address after it, with SWWAF_ADMIN_TOKEN.
-const ClientsPath = "/_smallwebwaf/clients/"
+// ClientsPath is where an admin asks what discriminator knows of a client, by
+// the client's address after it, with SWWAF_ADMIN_TOKEN.
+const ClientsPath = "/_sww/clients/"
 
 // Params are what New needs.
 type Params struct {
 	Config *config.Config
 	// RequestLog receives two JSON lines per question, one at its decision and
-	// one when its report comes, and one per request to servewaf's own endpoints.
+	// one when its report comes, and one per request to discriminator's own
+	// endpoints.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
@@ -67,7 +68,7 @@ type Params struct {
 	// Rules are the rule files' rules, which each request is checked
 	// against.
 	Rules *rules.Files
-	// Alerts receive the alert for each ban servewaf makes or makes
+	// Alerts receive the alert for each ban discriminator makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
 	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
 	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
@@ -77,7 +78,7 @@ type Params struct {
 	Alerts *alerts.Queue
 }
 
-// Server is the server servewaf runs, with the parts whose state the state
+// Server is the server discriminator runs, with the parts whose state the state
 // files keep, the lookup database, nil unless SWWAF_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
 // AbuseIPDB's scores and checks spent, and the metrics.
@@ -227,7 +228,7 @@ func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
 	return coreRuleSet
 }
 
-// handler is servewaf's handler. It holds what every request shares; what
+// handler is discriminator's handler. It holds what every request shares; what
 // belongs to one request is in a request.
 type handler struct {
 	config      *config.Config

internal/discriminator/proxy_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"bufio"
@@ -17,11 +17,11 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -90,13 +90,13 @@ const off = "off"
 // on is the value that switches a setting that takes true or false on.
 const on = "true"
 
-// output collects what smallwebwaf writes on stdout.
+// output collects what sww writes on stdout.
 type output struct {
 	mu  sync.Mutex
 	buf bytes.Buffer
 }
 
-// Write adds lines smallwebwaf writes.
+// Write adds lines sww writes.
 func (o *output) Write(p []byte) (int, error) {
 	o.mu.Lock()
 	defer o.mu.Unlock()
@@ -175,9 +175,9 @@ func (o *output) requestLine(t *testing.T) logLine {
 	return o.requestLines(t, 1)[0]
 }
 
-// endedLines waits for count requests that went through rproxy, or to servewaf's
+// endedLines waits for count requests that went through rproxy, or to discriminator's
 // own endpoints, to have ended, and returns the last log line of each, in the
-// order servewaf took them. A question's last line is the one its report writes.
+// order discriminator took them. A question's last line is the one its report writes.
 func (o *output) endedLines(t *testing.T, count int) []logLine {
 	t.Helper()
 
@@ -187,7 +187,7 @@ func (o *output) endedLines(t *testing.T, count int) []logLine {
 
 		ended := len(found) >= count
 		for _, line := range found[:min(count, len(found))] {
-			if line.ServeWAFLine == requestlog.ServeWAFLineDecision {
+			if line.DiscriminatorLine == requestlog.DiscriminatorLineDecision {
 				ended = false
 			}
 		}
@@ -205,7 +205,7 @@ func (o *output) endedLines(t *testing.T, count int) []logLine {
 }
 
 // lastLines returns the last request log line written so far of each request,
-// in the order servewaf took them.
+// in the order discriminator took them.
 func (o *output) lastLines(t *testing.T) []logLine {
 	t.Helper()
 
@@ -271,9 +271,9 @@ func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 	return server
 }
 
-// startProxy starts servewaf, and rproxy in front of the app at appURL, each with
+// startProxy starts discriminator, and rproxy in front of the app at appURL, each with
 // the settings in env on top of the defaults, and returns where rproxy listens
-// and what servewaf writes.
+// and what discriminator writes.
 func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
 	t.Helper()
 
@@ -293,14 +293,14 @@ func startProxyWithGeoJS(
 }
 
 // startProxyWithClock is startProxyWithGeoJS with requests counted and
-// bans made by the time now tells, and returns servewaf's server as well, whose
-// Addr is where servewaf listens. Unless env sets SWWAF_RULES_DIR, it is an empty
+// bans made by the time now tells, and returns discriminator's server as well, whose
+// Addr is where discriminator listens. Unless env sets SWWAF_RULES_DIR, it is an empty
 // directory, of no rules, and unless it sets SWWAF_INSTANCE_NAME, that is app,
 // the label instance of every metric.
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *servewaf.Server) {
+) (string, *output, *discriminator.Server) {
 	t.Helper()
 
 	addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env)
@@ -309,14 +309,14 @@ func startProxyWithClock(
 }
 
 // startProxyWithAlerts is startProxyWithClock, and returns the queue of
-// the alerts servewaf raises as well, as newServeWAF makes them.
+// the alerts discriminator raises as well, as newDiscriminator makes them.
 func startProxyWithAlerts(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *servewaf.Server, *alerts.Queue) {
+) (string, *output, *discriminator.Server, *alerts.Queue) {
 	t.Helper()
 
-	server, out, alertQueue := newServeWAF(t, geojsURL, now, env)
+	server, out, alertQueue := newDiscriminator(t, geojsURL, now, env)
 	serve(t, server)
 
 	return startRProxy(t, server.Addr, appURL, env), out, server, alertQueue
@@ -324,7 +324,7 @@ func startProxyWithAlerts(
 
 // serve serves server on a port of its own until the test ends, and sets its
 // Addr to where it listens.
-func serve(t *testing.T, server *servewaf.Server) {
+func serve(t *testing.T, server *discriminator.Server) {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -343,17 +343,17 @@ func serve(t *testing.T, server *servewaf.Server) {
 	})
 }
 
-// startRProxy starts rproxy in front of the app at appURL, asking the servewaf
-// at serveWAFAddr, with the settings in env on top of the defaults, and returns
+// startRProxy starts rproxy in front of the app at appURL, asking the discriminator
+// at discriminatorAddr, with the settings in env on top of the defaults, and returns
 // where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless
 // env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide.
 func startRProxy(
-	t *testing.T, serveWAFAddr, appURL string, env map[string]string,
+	t *testing.T, discriminatorAddr, appURL string, env map[string]string,
 ) string {
 	t.Helper()
 
 	settings := map[string]string{
-		"SWRP_WAF_BACKEND":  "http://" + serveWAFAddr,
+		"SWRP_WAF_BACKEND":  "http://" + discriminatorAddr,
 		"SWRP_UPSTREAM_URL": appURL,
 		"SWRP_TIMEOUT_MS":   "60000",
 	}
@@ -390,7 +390,8 @@ func startRProxy(
 	return listener.Addr().String()
 }
 
-// newServeWAF makes servewaf's server, without starting it, and returns it, what
+// newDiscriminator makes discriminator's server, without starting it, and
+// returns it, what
 // it writes, and the queue of the alerts it raises, as the settings in env make
 // it. No alert is sent from the queue: they wait in it, for the test to look at.
 // With no geojsURL, there is no stand-in for GeoJS to look clients up at, and
@@ -399,19 +400,19 @@ func startRProxy(
 // at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off unless
 // env sets it, so that only the tests of the Core Rule Set have their requests
 // inspected by it.
-func newServeWAF(
+func newDiscriminator(
 	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
-) (*servewaf.Server, *output, *alerts.Queue) {
+) (*discriminator.Server, *output, *alerts.Queue) {
 	t.Helper()
 
-	return newServeWAFWith(t, servewaf.New, geojsURL, now, env)
+	return newDiscriminatorWith(t, discriminator.New, geojsURL, now, env)
 }
 
-// newServeWAFWith is newServeWAF for the server build makes.
-func newServeWAFWith(
-	t *testing.T, build func(servewaf.Params) *servewaf.Server,
+// newDiscriminatorWith is newDiscriminator for the server build makes.
+func newDiscriminatorWith(
+	t *testing.T, build func(discriminator.Params) *discriminator.Server,
 	geojsURL string, now func() time.Time, env map[string]string,
-) (*servewaf.Server, *output, *alerts.Queue) {
+) (*discriminator.Server, *output, *alerts.Queue) {
 	t.Helper()
 
 	settings := map[string]string{
@@ -463,7 +464,7 @@ func newServeWAFWith(
 		}
 	}
 
-	server := build(servewaf.Params{
+	server := build(discriminator.Params{
 		Config:       cfg,
 		RequestLog:   out,
 		ProcessLog:   processLog,
@@ -507,7 +508,7 @@ func readAnswer(res *http.Response) answer {
 	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
 }
 
-// newRequest makes a request for path to addr, where rproxy or servewaf listens.
+// newRequest makes a request for path to addr, where rproxy or discriminator listens.
 func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
 	t.Helper()
 

internal/discriminator/ratelimits_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"

internal/discriminator/reputation.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"context"

internal/discriminator/reputation_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"fmt"
@@ -15,10 +15,10 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The reputation settings.
@@ -299,13 +299,13 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 		labels := `{instance="` + alertInstance + `",source="` + listURL + `"}`
 
 		if want.hits == 0 {
-			wantNoSeries(t, metrics, "smallwebwaf_reputation_hits_total"+labels)
+			wantNoSeries(t, metrics, "sww_reputation_hits_total"+labels)
 		} else {
-			wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, want.hits)
+			wantMetric(t, metrics, "sww_reputation_hits_total"+labels, want.hits)
 		}
 
-		wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
-		wantMetric(t, metrics, "smallwebwaf_reputation_last_fetch_timestamp_seconds"+labels,
+		wantMetric(t, metrics, "sww_reputation_failures_total"+labels, 0)
+		wantMetric(t, metrics, "sww_reputation_last_fetch_timestamp_seconds"+labels,
 			want.fetched)
 	}
 }
@@ -537,9 +537,9 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 	for _, zone := range []string{dnsblZone, otherZone} {
 		labels := `{instance="` + alertInstance + `",source="` + zone + `"}`
 
-		wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
-		wantMetric(t, metrics, "smallwebwaf_reputation_queries_total"+labels, 0)
-		wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
+		wantMetric(t, metrics, "sww_reputation_hits_total"+labels, 2)
+		wantMetric(t, metrics, "sww_reputation_queries_total"+labels, 0)
+		wantMetric(t, metrics, "sww_reputation_failures_total"+labels, 0)
 	}
 }
 
@@ -567,7 +567,7 @@ func TestZoneKeyIsMaskedInTheLogTheAlertAndTheMetrics(t *testing.T) {
 	}
 
 	metrics := s.scrape()
-	wantMetric(t, metrics, `smallwebwaf_reputation_hits_total{instance="`+
+	wantMetric(t, metrics, `sww_reputation_hits_total{instance="`+
 		alertInstance+`",source="`+masked+`"}`, 1)
 
 	for name, shown := range map[string]string{
@@ -617,7 +617,7 @@ const (
 // AbuseIPDB.
 const abuseipdb = reputation.AbuseIPDBSource
 
-// abuseIPDBURL is where newServeWAF has clients checked with AbuseIPDB: at
+// abuseIPDBURL is where newDiscriminator has clients checked with AbuseIPDB: at
 // abuseIPDBStandIn, which TestMain registers with Go's default transport,
 // through which AbuseIPDB is asked.
 const abuseIPDBURL = "abuseipdb://stand-in/api/v2/check"
@@ -863,10 +863,10 @@ func TestAbuseIPDBHitRaisesAnAlertWithTheScoreOncePerCooldownAndIsCounted(
 	metrics := s.scrape()
 	labels := `{instance="` + alertInstance + `",source="` + abuseipdb + `"}`
 
-	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
-	wantMetric(t, metrics, "smallwebwaf_reputation_queries_total"+labels, 0)
-	wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
-	wantMetric(t, metrics, "smallwebwaf_reputation_daily_budget_remaining"+labels, 900)
+	wantMetric(t, metrics, "sww_reputation_hits_total"+labels, 2)
+	wantMetric(t, metrics, "sww_reputation_queries_total"+labels, 0)
+	wantMetric(t, metrics, "sww_reputation_failures_total"+labels, 0)
+	wantMetric(t, metrics, "sww_reputation_daily_budget_remaining"+labels, 900)
 }
 
 func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
@@ -887,7 +887,7 @@ func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 0)
 
-	wantNoSeries(t, s.scrape(), `smallwebwaf_reputation_daily_budget_remaining{`+
+	wantNoSeries(t, s.scrape(), `sww_reputation_daily_budget_remaining{`+
 		`instance="`+alertInstance+`",source="`+abuseipdb+`"}`)
 }
 
@@ -975,7 +975,7 @@ func verdictsFetched() time.Time {
 // verdictsFetched, as reputation.json would at start: one that lists the
 // client from each zone listedBy gives for it, and one that does not from
 // each other zone.
-func loadVerdicts(server *servewaf.Server, listedBy map[string][]string) {
+func loadVerdicts(server *discriminator.Server, listedBy map[string][]string) {
 	verdicts := make([]reputation.Verdict, 0, len(listedBy)*len(server.DNSBL.Zones()))
 
 	for client, zones := range listedBy {
@@ -993,7 +993,7 @@ func loadVerdicts(server *servewaf.Server, listedBy map[string][]string) {
 // loadScores puts into server's AbuseIPDB the score scores gives each
 // client, an IPv4 address, fetched at verdictsFetched, as reputation.json
 // would at start.
-func loadScores(server *servewaf.Server, scores map[string]int64) {
+func loadScores(server *discriminator.Server, scores map[string]int64) {
 	kept := make([]reputation.Score, 0, len(scores))
 	for client, score := range scores {
 		kept = append(kept, reputation.Score{
@@ -1007,7 +1007,7 @@ func loadScores(server *servewaf.Server, scores map[string]int64) {
 
 // wantAbuseIPDBChecks checks how many clients server has checked with
 // AbuseIPDB.
-func wantAbuseIPDBChecks(t *testing.T, server *servewaf.Server, want int) {
+func wantAbuseIPDBChecks(t *testing.T, server *discriminator.Server, want int) {
 	t.Helper()
 
 	if got := server.AbuseIPDB.Checked(); got != want {
@@ -1017,7 +1017,7 @@ func wantAbuseIPDBChecks(t *testing.T, server *servewaf.Server, want int) {
 
 // loadLists puts copies of lists into server's lists, by URL, each with
 // its lines, fetched at listsFetched, as reputation.json would at start.
-func loadLists(t *testing.T, server *servewaf.Server, copies map[string][]string) {
+func loadLists(t *testing.T, server *discriminator.Server, copies map[string][]string) {
 	t.Helper()
 
 	lists := make([]reputation.List, 0, len(copies))

internal/discriminator/request.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"context"
@@ -17,7 +17,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
-// refusal is servewaf refusing a request: the status the visitor is to get, 0
+// refusal is discriminator refusing a request: the status the visitor is to get, 0
 // to close its connection without an answer, and the action the log line names.
 type refusal struct {
 	status int
@@ -25,7 +25,7 @@ type refusal struct {
 }
 
 // decision is what the checks note of a request: its log line, and what
-// counting the request needs once it has ended. servewaf keeps a copy of it
+// counting the request needs once it has ended. discriminator keeps a copy of it
 // until the request's report comes. It holds no credentials, since the log line
 // never does, and neither the request's objects nor their bodies.
 type decision struct {
@@ -34,7 +34,7 @@ type decision struct {
 	// requestURI is the path with the query, as a ban's notes keep it.
 	requestURI string
 	// site is, for a question, the host the visitor asked for, which the
-	// alerts name, since one servewaf serves many sites.
+	// alerts name, since one discriminator serves many sites.
 	site string
 	// allowed is true for a question answered with DispositionAllow.
 	allowed bool
@@ -63,7 +63,7 @@ type decision struct {
 	reputation []bans.ReputationHit
 }
 
-// request is one request to servewaf, from the moment its headers have been
+// request is one request to discriminator, from the moment its headers have been
 // read to its log line.
 type request struct {
 	decision
@@ -425,7 +425,7 @@ func (rq *request) answerAtTheEnd() (lookup.Answer, bool) {
 	return rq.h.geojs.Kept(rq.h.clientGroup(rq.client))
 }
 
-// responseWriter is servewaf's answer to a request. It notes the status and
+// responseWriter is discriminator's answer to a request. It notes the status and
 // size for the log line, and the first error writing the answer.
 type responseWriter struct {
 	http.ResponseWriter

internal/discriminator/requestlog_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"io"
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -104,7 +104,7 @@ func wantFullLine(t *testing.T, line logLine) {
 	headers := map[string]string{"accept": "text/html", "x-custom": "one, two"}
 
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Type: requestType, DiscriminatorLine: requestlog.DiscriminatorLineReport,
 		Time: line.Time, Instance: instance,
 		ClientIP: ipv6Client, Method: http.MethodPost, Scheme: secure,
 		Host: appHost, Path: "/full", Protocol: protocol,
@@ -130,7 +130,7 @@ func wantBareLine(t *testing.T, line logLine) {
 	t.Helper()
 
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Type: requestType, DiscriminatorLine: requestlog.DiscriminatorLineReport,
 		Time: line.Time, Instance: instance,
 		ClientIP: localhost, Method: http.MethodPost, Scheme: plain,
 		Host: appHost, Path: "/bare", Protocol: protocol,
@@ -220,7 +220,7 @@ func TestTimingsAreInOrder(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 	refused := out.endedLines(t, 2)[1]
 
-	wantStatus(t, get(t, server.Addr, servewaf.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, server.Addr, discriminator.HealthPath), http.StatusOK)
 	health := out.endedLines(t, 3)[2]
 
 	// A request passed to the app has every timing; one refused, none of

internal/discriminator/rulefiles_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"
@@ -196,18 +196,18 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`smallwebwaf_rule_matches_total{action="block",instance="app",rule_id="blocked"}`, 1)
+		`sww_rule_matches_total{action="block",instance="app",rule_id="blocked"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_rule_matches_total{action="ban",instance="app",rule_id="probe"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_rules_loaded{instance="app"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_requests_total{action="rule_blocked",`+
+		`sww_rule_matches_total{action="ban",instance="app",rule_id="probe"}`, 1)
+	wantMetric(t, metrics, `sww_rules_loaded{instance="app"}`, 2)
+	wantMetric(t, metrics, `sww_requests_total{action="rule_blocked",`+
 		`instance="app",status_class="4xx"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="attack"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="attack",instance="app"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 0)
-	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 1)
+		`sww_offences_total{instance="app",kind="rule_blocked"}`, 1)
+	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="attack"}`, 1)
+	wantMetric(t, metrics, `sww_bans_made_total{cause="attack",instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 0)
+	wantMetric(t, metrics, `sww_permanent_bans{instance="app"}`, 1)
 }
 
 // writeRules writes content as a rule file into a new directory, and

internal/discriminator/rules.go

@@ -1,4 +1,4 @@
-package servewaf
+package discriminator
 
 import (
 	"slices"

internal/discriminator/staticlists_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"
@@ -157,9 +157,9 @@ type sentRequest struct {
 	action string
 }
 
-// wantAnswers sends requests to smallwebwaf at addr one after another and
+// wantAnswers sends requests to sww at addr one after another and
 // checks each one's answer and log line. They must be the first requests
-// smallwebwaf is sent, since the log lines are matched to them in order.
+// sww is sent, since the log lines are matched to them in order.
 func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest) {
 	t.Helper()
 

internal/discriminator/trappaths_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package discriminator_test
 
 import (
 	"net/http"

internal/lookup/file.go

@@ -51,7 +51,7 @@ type File struct {
 }
 
 // record is what the lookup database holds about a network, of the fields
-// smallwebwaf reads.
+// sww reads.
 type record struct {
 	ASN         string `maxminddb:"asn"`
 	ASName      string `maxminddb:"as_name"`

internal/lookup/lookuptest/lookuptest.go

@@ -17,7 +17,7 @@ import (
 const fileMode = 0o600
 
 // Network is what a lookup database holds about a netblock, of the fields
-// smallwebwaf reads: its AS number, such as AS64496, the AS's name, and
+// sww reads: its AS number, such as AS64496, the AS's name, and
 // its country, such as DE.
 type Network struct {
 	ASN     string

internal/metrics/busiest.go

@@ -41,7 +41,7 @@ type busiest struct {
 // for the topN busiest countries.
 func newCountries(topN int) *busiest {
 	countries := newBusiest(topN, "country", "the client's country")
-	countries.refused = counterVec("smallwebwaf_country_list_refusals_total",
+	countries.refused = counterVec("sww_country_list_refusals_total",
 		"Requests the country lists refused, by the client's country.",
 		[]string{"country"})
 
@@ -61,11 +61,11 @@ func newBusiest(topN int, label, description string) *busiest {
 
 	return &busiest{
 		topN: topN,
-		requests: counterVec("smallwebwaf_"+label+"_requests_total",
+		requests: counterVec("sww_"+label+"_requests_total",
 			"Requests, by "+description+".", by),
-		requestBytes: counterVec("smallwebwaf_"+label+"_request_bytes_total",
+		requestBytes: counterVec("sww_"+label+"_request_bytes_total",
 			"Request body bytes, by "+description+".", by),
-		responseBytes: counterVec("smallwebwaf_"+label+"_response_bytes_total",
+		responseBytes: counterVec("sww_"+label+"_response_bytes_total",
 			"Response body bytes, by "+description+".", by),
 		seen: map[string]int64{},
 		top:  map[string]bool{},

internal/metrics/metrics.go

@@ -1,4 +1,4 @@
-// Package metrics keeps smallwebwaf's Prometheus metrics, as
+// Package metrics keeps sww's Prometheus metrics, as
 // docs/metrics.md lists them, and serves them in the Prometheus text
 // format, as the "Metrics endpoint" section of SPEC.md requires. No
 // metric carries a client's address.
@@ -22,7 +22,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
-// Metrics are smallwebwaf's metrics. They are safe for concurrent use.
+// Metrics are sww's metrics. They are safe for concurrent use.
 type Metrics struct {
 	// registry gives every metric registered with it the label instance.
 	registry prometheus.Registerer
@@ -76,60 +76,60 @@ func New(topN int, instanceName string) *Metrics {
 			prometheus.Labels{"instance": instanceName}, registry),
 		handler: promhttp.HandlerFor(registry, promhttp.HandlerOpts{}),
 		inFlight: prometheus.NewGauge(prometheus.GaugeOpts{
-			Name: "smallwebwaf_requests_in_flight",
+			Name: "sww_requests_in_flight",
 			Help: "Requests under way.",
 		}),
-		requests: counterVec("smallwebwaf_requests_total",
+		requests: counterVec("sww_requests_total",
 			"Requests, by the class of their status and their action.", byStatus),
-		requestBytes: counterVec("smallwebwaf_request_bytes_total",
+		requestBytes: counterVec("sww_request_bytes_total",
 			"Request body bytes, by the class of the status and the action.",
 			byStatus),
-		responseBytes: counterVec("smallwebwaf_response_bytes_total",
+		responseBytes: counterVec("sww_response_bytes_total",
 			"Response body bytes, by the class of the status and the action.",
 			byStatus),
 		requestDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
-			Name: "smallwebwaf_request_duration_seconds",
+			Name: "sww_request_duration_seconds",
 			Help: "How long requests took, from their arrival to their end.",
 		}),
 		upstreamDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
-			Name: "smallwebwaf_upstream_duration_seconds",
+			Name: "sww_upstream_duration_seconds",
 			Help: "How long requests passed to the app took, from then to their end.",
 		}),
-		rateLimitHits: counterVec("smallwebwaf_rate_limit_hits_total",
+		rateLimitHits: counterVec("sww_rate_limit_hits_total",
 			"Requests that broke a rate limit, a byte limit or the error burst, by "+
 				"its window and its kind, requests, bytes or refusals.",
 			[]string{"window", "kind"}),
-		offences: counterVec("smallwebwaf_offences_total",
+		offences: counterVec("sww_offences_total",
 			"Offences, by kind.", []string{"kind"}),
-		wafMatches: counterVec("smallwebwaf_waf_matches_total",
+		wafMatches: counterVec("sww_waf_matches_total",
 			"Requests that matched a rule of the Core Rule Set, by SWWAF_WAF_MODE "+
 				"and the rule's id.", []string{"mode", "rule_id"}),
 		countries: newCountries(topN),
 		asns:      newASNs(topN),
 		GeoJSRequests: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "smallwebwaf_geojs_requests_total",
+			Name: "sww_geojs_requests_total",
 			Help: "Requests to GeoJS.",
 		}),
 		GeoJSFailures: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "smallwebwaf_geojs_failures_total",
+			Name: "sww_geojs_failures_total",
 			Help: "Requests to GeoJS that failed.",
 		}),
 		GeoJSUnanswered: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "smallwebwaf_geojs_unanswered_total",
+			Name: "sww_geojs_unanswered_total",
 			Help: "Requests that needed their client's answer from GeoJS and " +
 				"went on without it, because GeoJS had not given it in time.",
 		}),
-		stateFileWrites: counterVec("smallwebwaf_state_file_writes_total",
+		stateFileWrites: counterVec("sww_state_file_writes_total",
 			"Writes of each state file.", byFile),
-		stateFileWriteFailures: counterVec("smallwebwaf_state_file_write_failures_total",
+		stateFileWriteFailures: counterVec("sww_state_file_write_failures_total",
 			"Writes of each state file that failed.", byFile),
-		stateFileLastWrite: gaugeVec("smallwebwaf_state_file_last_write_timestamp_seconds",
+		stateFileLastWrite: gaugeVec("sww_state_file_last_write_timestamp_seconds",
 			"When each state file was last written, in seconds since 1970.", byFile),
-		stateFileSize: gaugeVec("smallwebwaf_state_file_size_bytes",
+		stateFileSize: gaugeVec("sww_state_file_size_bytes",
 			"The size of each state file, as it was last written.", byFile),
-		stateFileEditsTakenIn: counterVec("smallwebwaf_state_file_edits_taken_in_total",
+		stateFileEditsTakenIn: counterVec("sww_state_file_edits_taken_in_total",
 			"Edits of each state file taken in while running.", byFile),
-		stateFileEditsSetAside: counterVec("smallwebwaf_state_file_edits_set_aside_total",
+		stateFileEditsSetAside: counterVec("sww_state_file_edits_set_aside_total",
 			"Edits of each state file renamed to <name>.bad because they did not parse.",
 			byFile),
 	}
@@ -161,7 +161,7 @@ func (m *Metrics) AddBansAndClients(
 		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
 	} {
 		m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
-			Name:        "smallwebwaf_bans_made_total",
+			Name:        "sww_bans_made_total",
 			Help:        "Bans made, by cause.",
 			ConstLabels: prometheus.Labels{"cause": cause},
 		}, func() float64 {
@@ -171,7 +171,7 @@ func (m *Metrics) AddBansAndClients(
 
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "smallwebwaf_active_bans",
+			Name: "sww_active_bans",
 			Help: "Bans active now, the permanent ones included.",
 		}, func() float64 {
 			active, _ := ledger.Count(now())
@@ -179,7 +179,7 @@ func (m *Metrics) AddBansAndClients(
 			return float64(active)
 		}),
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "smallwebwaf_permanent_bans",
+			Name: "sww_permanent_bans",
 			Help: "Permanent bans not lifted.",
 		}, func() float64 {
 			_, permanent := ledger.Count(now())
@@ -187,7 +187,7 @@ func (m *Metrics) AddBansAndClients(
 			return float64(permanent)
 		}),
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "smallwebwaf_tracked_clients",
+			Name: "sww_tracked_clients",
 			Help: "Clients in the table of clients.",
 		}, func() float64 {
 			return float64(limiter.Len())
@@ -200,13 +200,13 @@ func (m *Metrics) AddBansAndClients(
 // ruleFiles, read as the metrics are asked for. It is called once, before
 // RuleMatched.
 func (m *Metrics) AddRules(ruleFiles *rules.Files) {
-	m.ruleMatches = counterVec("smallwebwaf_rule_matches_total",
+	m.ruleMatches = counterVec("sww_rule_matches_total",
 		"Requests that matched a rule of the rule files, by its id and action.",
 		[]string{"rule_id", "action"})
 
 	m.registry.MustRegister(m.ruleMatches,
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "smallwebwaf_rules_loaded",
+			Name: "sww_rules_loaded",
 			Help: "Rules loaded from the rule files.",
 		}, func() float64 {
 			return float64(ruleFiles.Len())
@@ -219,20 +219,20 @@ func (m *Metrics) AddRules(ruleFiles *rules.Files) {
 func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 	m.registry.MustRegister(
 		prometheus.NewCounterFunc(prometheus.CounterOpts{
-			Name: "smallwebwaf_remote_log_lines_sent_total",
+			Name: "sww_remote_log_lines_sent_total",
 			Help: "Log lines sent to SWWAF_LOG_REMOTE_URL.",
 		}, func() float64 {
 			return float64(remote.Sent())
 		}),
 		prometheus.NewCounterFunc(prometheus.CounterOpts{
-			Name: "smallwebwaf_remote_log_lines_dropped_total",
+			Name: "sww_remote_log_lines_dropped_total",
 			Help: "Log lines dropped: the oldest in a full buffer, and those " +
 				"whose sending failed.",
 		}, func() float64 {
 			return float64(remote.Dropped())
 		}),
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "smallwebwaf_remote_log_buffer_depth",
+			Name: "sww_remote_log_buffer_depth",
 			Help: "Log lines in the buffer, waiting to be sent.",
 		}, func() float64 {
 			return float64(remote.Depth())
@@ -248,13 +248,13 @@ func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 func (m *Metrics) AddLookupFile(lastRead func() time.Time, readFailures func() int) {
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "smallwebwaf_lookup_database_last_read_timestamp_seconds",
+			Name: "sww_lookup_database_last_read_timestamp_seconds",
 			Help: "When the lookup database in use was read, in seconds since 1970.",
 		}, func() float64 {
 			return float64(lastRead().Unix())
 		}),
 		prometheus.NewCounterFunc(prometheus.CounterOpts{
-			Name: "smallwebwaf_lookup_database_read_failures_total",
+			Name: "sww_lookup_database_read_failures_total",
 			Help: "Replacements of the lookup database that could not be read.",
 		}, func() float64 {
 			return float64(readFailures())
@@ -275,7 +275,7 @@ const sourceLabel = "source"
 // copy in use was fetched, and for a zone, the queries made and those that
 // failed. It is called once, before ReputationHit.
 func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL) {
-	m.reputationHits = counterVec("smallwebwaf_reputation_hits_total",
+	m.reputationHits = counterVec("sww_reputation_hits_total",
 		"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
 			"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
 		[]string{sourceLabel})
@@ -294,7 +294,7 @@ func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL
 		m.addReputationFailures(source, func() int { return lists.Failures(listURL) })
 		m.registry.MustRegister(
 			prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-				Name: "smallwebwaf_reputation_last_fetch_timestamp_seconds",
+				Name: "sww_reputation_last_fetch_timestamp_seconds",
 				Help: "When the copy of the list in use was fetched, in seconds since " +
 					"1970, or 0 while there is none.",
 				ConstLabels: source,
@@ -321,7 +321,7 @@ func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	m.addReputationFailures(source, abuseIPDB.Failures)
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name:        "smallwebwaf_reputation_daily_budget_remaining",
+			Name:        "sww_reputation_daily_budget_remaining",
 			Help:        "Checks of the day's SWWAF_ABUSEIPDB_DAILY_BUDGET not yet spent.",
 			ConstLabels: source,
 		}, func() float64 {
@@ -348,21 +348,21 @@ func (m *Metrics) AddAlerts(queue *alerts.Queue) {
 
 		m.registry.MustRegister(
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name:        "smallwebwaf_alerts_sent_total",
+				Name:        "sww_alerts_sent_total",
 				Help:        "Alerts the destination took.",
 				ConstLabels: destination,
 			}, func() float64 {
 				return float64(queue.Counts(name).Sent)
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name:        "smallwebwaf_alerts_failed_total",
+				Name:        "sww_alerts_failed_total",
 				Help:        "Requests to the destination that failed.",
 				ConstLabels: destination,
 			}, func() float64 {
 				return float64(queue.Counts(name).Failed)
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name: "smallwebwaf_alerts_suppressed_total",
+				Name: "sww_alerts_suppressed_total",
 				Help: "Alerts held back: repeats within SWWAF_ALERT_COOLDOWN, and " +
 					"alerts past SWWAF_ALERT_MAX_PER_HOUR, for the hour's summary.",
 				ConstLabels: destination,
@@ -370,7 +370,7 @@ func (m *Metrics) AddAlerts(queue *alerts.Queue) {
 				return float64(queue.Suppressed())
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name: "smallwebwaf_alerts_dropped_total",
+				Name: "sww_alerts_dropped_total",
 				Help: "Alerts dropped, the oldest first, from a full queue, and " +
 					"alerts given up as the destination refused them.",
 				ConstLabels: destination,
@@ -467,7 +467,7 @@ func (m *Metrics) StateFileWritten(name string, size int, err error) {
 }
 
 // StateFileEditTakenIn counts an admin's edit of the state file name
-// taken in while smallwebwaf runs.
+// taken in while sww runs.
 func (m *Metrics) StateFileEditTakenIn(name string) {
 	m.stateFileEditsTakenIn.WithLabelValues(name).Inc()
 }
@@ -506,7 +506,7 @@ func (m *Metrics) count(
 // zone, or of the checks of clients with AbuseIPDB, which count tells.
 func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
 	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
-		Name:        "smallwebwaf_reputation_queries_total",
+		Name:        "sww_reputation_queries_total",
 		Help:        "Queries to the DNSBL zone, or checks of clients with AbuseIPDB.",
 		ConstLabels: source,
 	}, func() float64 {
@@ -519,7 +519,7 @@ func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() in
 // that failed, which count tells.
 func (m *Metrics) addReputationFailures(source prometheus.Labels, count func() int) {
 	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
-		Name: "smallwebwaf_reputation_failures_total",
+		Name: "sww_reputation_failures_total",
 		Help: "Fetches of the list, queries to the DNSBL zone, or checks with " +
 			"AbuseIPDB, that failed.",
 		ConstLabels: source,

internal/ratelimit/history_test.go

@@ -23,7 +23,7 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 		{Forwarded: true, Status: 502, ResponseBytes: 12},
 		// Closed without an answer: refused, and no response.
 		{Refused: true, Status: 0},
-		// Answered 404 for a path under /_smallwebwaf/: neither forwarded nor
+		// Answered 404 for a path under /_sww/: neither forwarded nor
 		// refused.
 		{Status: 404},
 	} {

internal/ratelimit/ratelimit.go

@@ -25,7 +25,7 @@ const (
 	KindRequests = "requests"
 	// KindBytes is a byte limit, on a client's bytes.
 	KindBytes = "bytes"
-	// KindRefusals is the error burst, on a client's requests smallwebwaf
+	// KindRefusals is the error burst, on a client's requests sww
 	// refused after a rule file match or for a missing or wrong token.
 	KindRefusals = "refusals"
 )
@@ -92,9 +92,9 @@ type History struct {
 	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those servewaf allowed,
+	// Requests are all the client's requests: Forwarded those discriminator allowed,
 	// Refused those it refused, and neither those for a path under
-	// /_smallwebwaf/.
+	// /_sww/.
 	Requests  int64 `json:"requests"`
 	Forwarded int64 `json:"forwarded"`
 	Refused   int64 `json:"refused"`
@@ -135,8 +135,8 @@ type Offences struct {
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Forwarded is true for a request servewaf allowed, and Refused for one it
-	// refused. Both are false for a request for a path under /_smallwebwaf/.
+	// Forwarded is true for a request discriminator allowed, and Refused for one it
+	// refused. Both are false for a request for a path under /_sww/.
 	Forwarded bool
 	Refused   bool
 	// Status is what the client was sent, 0 if nothing was.
@@ -258,7 +258,7 @@ func (l *Limiter) CountBytes(
 	return l.count(client, now, 0, bytes, percent)
 }
 
-// CountRefusal counts a request from client at now that smallwebwaf
+// CountRefusal counts a request from client at now that sww
 // refused after a rule file or Core Rule Set match or for a missing or
 // wrong token, and reports whether the client's refusals in the minute
 // that ends at now, this one included, are more than threshold, which

internal/remotelog/remotelog.go

@@ -1,4 +1,4 @@
-// Package remotelog sends the lines smallwebwaf writes on stdout to the
+// Package remotelog sends the lines sww writes on stdout to the
 // remote log endpoint, SWWAF_LOG_REMOTE_URL, as the "Request log" section
 // of SPEC.md describes: each line as the message of an RFC 5424 syslog
 // record, over UDP, TCP or TLS. Lines wait in a bounded buffer, so a slow

internal/remotelog/remotelog_test.go

@@ -612,7 +612,7 @@ func testCertificate(t *testing.T) (tls.Certificate, *x509.CertPool) {
 
 	template := &x509.Certificate{
 		SerialNumber:          big.NewInt(1),
-		Subject:               pkix.Name{CommonName: "smallwebwaf test CA"},
+		Subject:               pkix.Name{CommonName: "sww test CA"},
 		NotBefore:             time.Date(1999, 12, 31, 0, 0, 0, 0, time.UTC),
 		NotAfter:              time.Date(2000, 1, 2, 0, 0, 0, 0, time.UTC),
 		IsCA:                  true,

internal/reputation/abuseipdb_test.go

@@ -397,7 +397,7 @@ func TestMetricsCountTheChecksTheFailuresAndTheBudgetLeft(t *testing.T) {
 			"failures_total":         "1",
 			"daily_budget_remaining": "3",
 		} {
-			line := "\nsmallwebwaf_reputation_" + series +
+			line := "\nsww_reputation_" + series +
 				`{instance="app",source="abuseipdb"} ` + want + "\n"
 			if !strings.Contains(scraped, line) {
 				t.Errorf("metrics\n%s\nwant%s", scraped, line)
@@ -581,7 +581,7 @@ func wantScore(
 
 // hitFrom is checker's Hit for a request from address, offender or not.
 // Its client is address for an IPv4 address, and its /64 for an IPv6 one,
-// as smallwebwaf counts clients.
+// as sww counts clients.
 func hitFrom(
 	t *testing.T, checker *reputation.AbuseIPDB, address string, offender bool,
 ) (int64, bool) {

internal/reputation/dnsbl_test.go

@@ -311,7 +311,7 @@ func TestMetricsCountEachZonesQueriesAndThoseThatFailed(t *testing.T) {
 			"queries_total" + `{instance="app",source="` + otherZone + `"}`:  "1",
 			"failures_total" + `{instance="app",source="` + otherZone + `"}`: "1",
 		} {
-			line := "\nsmallwebwaf_reputation_" + series + " " + want + "\n"
+			line := "\nsww_reputation_" + series + " " + want + "\n"
 			if !strings.Contains(scraped.Body.String(), line) {
 				t.Errorf("metrics\n%s\nwant%s", scraped.Body.String(), line)
 			}

internal/reputation/reputation.go

@@ -371,7 +371,7 @@ func (l *Lists) due(listURL string) time.Time {
 // fetch fetches the list at listURL, and notes the try. A good copy takes
 // the place of the one held. A failure leaves that in use, and is counted,
 // logged and raised as a source_failure alert. A fetch cut off as ctx
-// ends, as smallwebwaf stops, is no failure, but is still noted as a try,
+// ends, as sww stops, is no failure, but is still noted as a try,
 // so that a restart waits for it: the server may have had its request.
 func (l *Lists) fetch(ctx context.Context, listURL string) {
 	lines, err := l.get(ctx, listURL)

internal/requestlog/requestlog.go

@@ -1,6 +1,6 @@
-// Package requestlog writes the lines smallwebwaf prints on stdout: one
-// JSON object per request, two from servewaf and a short one from rproxy, marked
-// "type":"request", and the process's own messages as JSON lines marked
+// Package requestlog writes the lines sww prints on stdout: one
+// JSON object per request, two from discriminator and a short one from rproxy,
+// marked "type":"request", and the process's own messages as JSON lines marked
 // "type":"process".
 package requestlog
 
@@ -14,10 +14,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
-// The action a request line names: what servewaf did with the request.
+// The action a request line names: what discriminator did with the request.
 const (
-	// ActionForward is a request servewaf allowed, which rproxy passes to the
-	// app.
+	// ActionForward is a request discriminator allowed, which rproxy passes to
+	// the app.
 	ActionForward = "forward"
 	// ActionTooLarge is a request over the header limits.
 	ActionTooLarge = "too_large"
@@ -42,8 +42,8 @@ const (
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
-	// ActionAdmin is a request servewaf answered at one of its own endpoints,
-	// or a question about a path under /_smallwebwaf/.
+	// ActionAdmin is a request discriminator answered at one of its own
+	// endpoints, or a question about a path under /_sww/.
 	ActionAdmin = "admin"
 )
 
@@ -56,14 +56,14 @@ const OffenceLimit = "limit"
 // that broke the error burst.
 const LimitHitErrorBurst = "error_burst"
 
-// The servewaf_line a request line names, which says which of servewaf's two
-// lines about a question it is.
+// The discriminator_line a request line names, which says which of
+// discriminator's two lines about a question it is.
 const (
-	// ServeWAFLineDecision is servewaf's line at its decision.
-	ServeWAFLineDecision = "decision"
-	// ServeWAFLineReport is servewaf's line when rproxy's report comes, with
-	// the decision's fields and the report's together.
-	ServeWAFLineReport = "report"
+	// DiscriminatorLineDecision is discriminator's line at its decision.
+	DiscriminatorLineDecision = "decision"
+	// DiscriminatorLineReport is discriminator's line when rproxy's report
+	// comes, with the decision's fields and the report's together.
+	DiscriminatorLineReport = "report"
 )
 
 // timeLayout is RFC 3339 with milliseconds.
@@ -76,9 +76,9 @@ const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Line struct {
 	Type string `json:"type"`
-	// ServeWAFLine is ServeWAFLineDecision or ServeWAFLineReport on servewaf's
-	// two lines about a question.
-	ServeWAFLine string `json:"servewaf_line,omitempty"`
+	// DiscriminatorLine is DiscriminatorLineDecision or DiscriminatorLineReport
+	// on discriminator's two lines about a question.
+	DiscriminatorLine string `json:"discriminator_line,omitempty"`
 
 	// The standard web log fields. Scheme is how the client reached rproxy, or
 	// the trusted proxy in front of it.
@@ -98,7 +98,7 @@ type Line struct {
 	UserAgent     string `json:"user_agent"`
 
 	// Request detail. RequestID is the id rproxy made for the request, or for a
-	// request to servewaf's own endpoints a new one. ForwardedFor is the
+	// request to discriminator's own endpoints a new one. ForwardedFor is the
 	// X-Forwarded-For header as received. ClientGroup is the netblock the
 	// client is counted as. ASN, ASName and Country are the client's AS
 	// number, AS name and country, as looked up.
@@ -118,8 +118,8 @@ type Line struct {
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
 	HasCookie        bool              `json:"has_cookie,omitempty"`
 
-	// Response detail, of servewaf's own answer. Aborted is true when rproxy, or
-	// the admin's tool, went away before the answer.
+	// Response detail, of discriminator's own answer. Aborted is true when
+	// rproxy, or the admin's tool, went away before the answer.
 	ResponseContentType string `json:"response_content_type,omitempty"`
 	Aborted             bool   `json:"aborted,omitempty"`
 
@@ -128,7 +128,7 @@ type Line struct {
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
 	// ActionBanned, ActionCountryDenied, ActionRateLimited,
-	// ActionRuleBlocked, ActionWAFBlocked, or, in servewaf, ActionTooLarge
+	// ActionRuleBlocked, ActionWAFBlocked, or, in discriminator, ActionTooLarge
 	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// LimitPercent and LimitPercentSetting are, for a request the rate
@@ -201,7 +201,7 @@ type RProxyLine struct {
 	// if that is sooner. DurationResponse runs from then until the answer ends.
 	DurationRequest  float64 `json:"duration_request"`
 	DurationResponse float64 `json:"duration_response"`
-	// Disposition is the valid disposition servewaf answered or, while
+	// Disposition is the valid disposition discriminator answered or, while
 	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`

internal/rproxy/client.go

@@ -18,7 +18,7 @@ const (
 )
 
 // peerAddress is the address of the request's TCP peer, normally traefik, without
-// any IPv6 zone, which servewaf refuses.
+// any IPv6 zone, which discriminator refuses.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
@@ -34,7 +34,7 @@ func peerAddress(r *http.Request) netip.Addr {
 // address outside them is the visitor; if every address in it is inside, the
 // leftmost is, and with no header, the peer. An entry that is not an address
 // ends the reading, since nothing to its left can be believed. The visitor's
-// address never has an IPv6 zone, which servewaf refuses.
+// address never has an IPv6 zone, which discriminator refuses.
 func clientAddress(
 	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
 ) netip.Addr {

internal/rproxy/discriminator.go

@@ -11,15 +11,15 @@ import (
 	"net/http"
 	"strings"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 )
 
-// answerBodyMaxBytes is the most of the body of servewaf's answer that is read.
+// answerBodyMaxBytes is the most of the body of discriminator's answer that is read.
 // It is far above any answer's.
 const answerBodyMaxBytes = 1 << 20
 
 // reportAnswerMaxBytes is the most of the answer to a report that is read,
-// which has no body when servewaf takes the report.
+// which has no body when discriminator takes the report.
 const reportAnswerMaxBytes = 4 << 10
 
 var (
@@ -27,21 +27,22 @@ var (
 	errReportRefused = errors.New("the report was answered")
 )
 
-// servewafAnswer is what servewaf answered to a question.
-type servewafAnswer struct {
+// discriminatorAnswer is what discriminator answered to a question.
+type discriminatorAnswer struct {
 	status int
 	header http.Header
 	body   []byte
 }
 
-// noteAnswer notes what servewaf answered. An answer without a valid disposition
-// notes nothing, and no report is due for it: servewaf holds no decision to report
+// noteAnswer notes what discriminator answered. An answer without a valid disposition
+// notes nothing, and no report is due for it: discriminator holds no decision to report
 // on.
-func (rq *request) noteAnswer(answer *servewafAnswer) {
-	disposition := answer.header.Get(servewaf.DispositionHeader)
+func (rq *request) noteAnswer(answer *discriminatorAnswer) {
+	disposition := answer.header.Get(discriminator.DispositionHeader)
 
 	switch disposition {
-	case servewaf.DispositionAllow, servewaf.DispositionDeny, servewaf.DispositionClose:
+	case discriminator.DispositionAllow, discriminator.DispositionDeny,
+		discriminator.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
@@ -54,27 +55,27 @@ func (rq *request) noteAnswer(answer *servewafAnswer) {
 func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	switch {
 	case ctx.Err() != nil:
-		// The visitor went away while servewaf was being asked. servewaf has not
+		// The visitor went away while discriminator was being asked. discriminator has not
 		// failed, and nothing is noted. This panic has Go's server close the
 		// connection without an answer, and log nothing; the deferred finish still
 		// runs.
 		panic(http.ErrAbortHandler)
 	case errors.Is(err, errCannotPassOn):
-		rq.h.processLog.Warn("servewaf's answer is dropped", "error", err.Error())
+		rq.h.processLog.Warn("discriminator's answer is dropped", "error", err.Error())
 		rq.answer(http.StatusBadGateway)
 	default:
-		// servewaf cannot be connected to, does not answer at all, or does not answer
-		// within SWRP_TIMEOUT_MS. A request that keeps servewaf busy past
-		// SWRP_TIMEOUT_MS, like any request while servewaf is overloaded, gets
+		// discriminator cannot be connected to, does not answer at all, or does not answer
+		// within SWRP_TIMEOUT_MS. A request that keeps discriminator busy past
+		// SWRP_TIMEOUT_MS, like any request while discriminator is overloaded, gets
 		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
-		// whenever servewaf is slow. Making such requests hard to send is
+		// whenever discriminator is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
-		rq.h.processLog.Warn("servewaf gave no answer", "error", err.Error())
+		rq.h.processLog.Warn("discriminator gave no answer", "error", err.Error())
 
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
 
-		if rq.disposition == servewaf.DispositionAllow {
+		if rq.disposition == discriminator.DispositionAllow {
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
@@ -82,10 +83,10 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	}
 }
 
-// ask sends servewaf the question, and returns its answer, which must have come
+// ask sends discriminator the question, and returns its answer, which must have come
 // whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
 // away.
-func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
+func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
 	defer cancel()
 
@@ -94,7 +95,7 @@ func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
 		return nil, err
 	}
 
-	res, err := rq.h.serveWAFTransport.RoundTrip(question)
+	res, err := rq.h.discriminatorTransport.RoundTrip(question)
 	if err != nil {
 		return nil, fmt.Errorf("send the question: %w", err)
 	}
@@ -119,17 +120,17 @@ func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
 		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
 	}
 
-	return &servewafAnswer{res.StatusCode, res.Header, body}, nil
+	return &discriminatorAnswer{res.StatusCode, res.Header, body}, nil
 }
 
-// canBeAsked reports whether Go's client can send servewaf r as the visitor sent
+// canBeAsked reports whether Go's client can send discriminator r as the visitor sent
 // it. It cannot send these as they came:
 //   - a target that does not start with /, or that starts with //;
-//   - an empty Host, for which it sends servewaf's own address;
+//   - an empty Host, for which it sends discriminator's own address;
 //   - a Host holding an IPv6 zone, which it removes;
 //   - more than one User-Agent, of which it sends the first;
 //   - an empty User-Agent, which it leaves out, the one case that still goes to
-//     servewaf.
+//     discriminator.
 func canBeAsked(r *http.Request) bool {
 	target, host := r.RequestURI, r.Host
 	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
@@ -169,13 +170,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	question.TransferEncoding = in.TransferEncoding
 
 	question.Header = in.Header.Clone()
-	question.Header.Set(servewaf.ClientHeader, rq.client.String())
-	question.Header.Set(servewaf.PeerHeader, rq.peer.String())
-	question.Header.Del(servewaf.ContentLengthHeader)
+	question.Header.Set(discriminator.ClientHeader, rq.client.String())
+	question.Header.Set(discriminator.PeerHeader, rq.peer.String())
+	question.Header.Del(discriminator.ContentLengthHeader)
 
 	announced := in.Header.Get("Content-Length")
 	if announced != "" {
-		question.Header.Set(servewaf.ContentLengthHeader, announced)
+		question.Header.Set(discriminator.ContentLengthHeader, announced)
 	}
 
 	question.Header.Set(requestIDHeader, rq.id)
@@ -190,13 +191,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	return question, nil
 }
 
-// answerWith gives the visitor servewaf's answer, less its disposition.
-func (rq *request) answerWith(answer *servewafAnswer) {
+// answerWith gives the visitor discriminator's answer, less its disposition.
+func (rq *request) answerWith(answer *discriminatorAnswer) {
 	rq.prepareOwnAnswer(rq.requestDeadline())
 
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
-	header.Del(servewaf.DispositionHeader)
+	header.Del(discriminator.DispositionHeader)
 
 	// Go's server adds a Content-Type it guesses from the body to a response whose
 	// headers have no Content-Type key. The key with no value sends none.
@@ -207,10 +208,10 @@ func (rq *request) answerWith(answer *servewafAnswer) {
 	rq.send(answer.status, answer.body)
 }
 
-// sendReport sends servewaf report on a goroutine of its own, so that the
+// sendReport sends discriminator report on a goroutine of its own, so that the
 // visitor does not wait for it. The report goes on after ctx, the request's own
 // context, has ended.
-func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
+func (h *handler) sendReport(ctx context.Context, report *discriminator.Report) {
 	h.reportsMu.Lock()
 	defer h.reportsMu.Unlock()
 
@@ -226,9 +227,9 @@ func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
 	})
 }
 
-// postReport posts report to servewaf, and waits for its answer for up to
+// postReport posts report to discriminator, and waits for its answer for up to
 // SWRP_TIMEOUT_MS.
-func (h *handler) postReport(ctx context.Context, report *servewaf.Report) error {
+func (h *handler) postReport(ctx context.Context, report *discriminator.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {
 		return fmt.Errorf("encode the report: %w", err)
@@ -245,7 +246,7 @@ func (h *handler) postReport(ctx context.Context, report *servewaf.Report) error
 
 	req.Header.Set("Content-Type", "application/json")
 
-	res, err := h.serveWAFTransport.RoundTrip(req)
+	res, err := h.discriminatorTransport.RoundTrip(req)
 	if err != nil {
 		return fmt.Errorf("send the report: %w", err)
 	}

internal/rproxy/limits_test.go

@@ -16,9 +16,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // post is the start of a POST whose headers end with what follows it.
@@ -58,7 +58,7 @@ func TestServerHasTheFixedLimits(t *testing.T) {
 	}
 }
 
-func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
+func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -71,7 +71,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
@@ -100,7 +100,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	standIn := startDiscriminator(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestSize: "1K",
@@ -109,7 +109,7 @@ func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 		bytes.NewReader(make([]byte, 1025))))
 	if got.status != http.StatusForbidden {
-		t.Errorf("answered %+v, want servewaf's 403", got)
+		t.Errorf("answered %+v, want discriminator's 403", got)
 	}
 }
 
@@ -132,7 +132,7 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 
 			var asked atomic.Bool
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				asked.Store(true)
 				greet(w, r)
@@ -165,7 +165,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("announced, is refused", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startServeWAF(t, allow)
+		standIn := startDiscriminator(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
 			_, _ = io.WriteString(w, large)
@@ -187,7 +187,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("not announced, is cut off", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startServeWAF(t, allow)
+		standIn := startDiscriminator(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = io.WriteString(w, large[:1])
 			_ = http.NewResponseController(w).Flush()
@@ -217,7 +217,7 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.
 
 	const announced = "2048"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
@@ -240,7 +240,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 				setting: "off",
@@ -251,7 +251,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 				strings.NewReader("a body"))))
 
-			if got := get(t, addr, servewaf.HealthPath); got.status != http.StatusOK {
+			if got := get(t, addr, discriminator.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
@@ -270,7 +270,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
 				maxRequestTime: "500",
@@ -289,7 +289,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("servewaf was asked")
+				t.Error("discriminator was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -300,7 +300,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -314,7 +314,7 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	}
 
 	if len(standIn.questions) != 0 {
-		t.Error("servewaf was asked")
+		t.Error("discriminator was asked")
 	}
 }
 
@@ -334,7 +334,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -365,7 +365,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("servewaf was asked")
+				t.Error("discriminator was asked")
 			}
 		})
 	}
@@ -404,7 +404,7 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 		announced = 100 * questionBodyMaxBytes
 	)
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
@@ -448,13 +448,13 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 		name, target string
 		status       int
 	}{
-		{"servewaf's deny", "/", http.StatusForbidden},
+		{"discriminator's deny", "/", http.StatusForbidden},
 		{"rproxy's own 400", "x:admin", http.StatusBadRequest},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			standIn := startDiscriminator(t, deny)
 			app := startApp(t, greet)
 			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
 				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
@@ -484,7 +484,7 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
@@ -553,7 +553,7 @@ func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t),
 		map[string]string{maxRequestTime: "3000"})
 
@@ -580,7 +580,7 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		<-release
 	})
@@ -607,7 +607,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 	const start = "the start"
 
 	release := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, start)
 		_ = http.NewResponseController(w).Flush()
@@ -656,7 +656,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		part := make([]byte, writeSize)
 
@@ -693,7 +693,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
@@ -709,7 +709,7 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
@@ -732,7 +732,7 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 
 	working := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
@@ -773,7 +773,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 
 	const answer = "the end of a long answer"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		_ = http.NewResponseController(w).Flush()
@@ -802,14 +802,14 @@ func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing
 		{"a deny", post, http.StatusForbidden},
 		{
 			"the health check",
-			"GET " + servewaf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			"GET " + discriminator.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			standIn := startDiscriminator(t, deny)
 			app := startApp(t, greet)
 			// The time limit is long enough for a loaded host to read the first part of
 			// the body before it runs out.

internal/rproxy/question_test.go

@@ -12,11 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 )
 
 // questionBodyMaxBytes is the most of a body a question carries.
-const questionBodyMaxBytes = servewaf.QuestionBodyMaxBytes
+const questionBodyMaxBytes = discriminator.QuestionBodyMaxBytes
 
 // chunked is the encoding of a body whose length the visitor did not announce.
 const chunked = "chunked"
@@ -29,7 +29,7 @@ const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
 func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -42,9 +42,9 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	req.Header.Set(forwardedForHeader, "198.51.100.1")
 	req.Header.Set(forwardedProtoHeader, "gopher")
 	req.Header.Set(requestIDHeader, "the-visitor's")
-	req.Header.Set(servewaf.ClientHeader, "198.51.100.2")
-	req.Header.Set(servewaf.PeerHeader, "198.51.100.3")
-	req.Header.Set(servewaf.ContentLengthHeader, "12345")
+	req.Header.Set(discriminator.ClientHeader, "198.51.100.2")
+	req.Header.Set(discriminator.PeerHeader, "198.51.100.3")
+	req.Header.Set(discriminator.ContentLengthHeader, "12345")
 	// Go's client then sends no User-Agent, so that one in the question would be
 	// Go's own.
 	req.Header["User-Agent"] = nil
@@ -68,8 +68,8 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	want.Set(forwardedForHeader, "198.51.100.1")
 	want.Set(forwardedProtoHeader, "http")
 	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
-	want.Set(servewaf.ClientHeader, localhost)
-	want.Set(servewaf.PeerHeader, localhost)
+	want.Set(discriminator.ClientHeader, localhost)
+	want.Set(discriminator.PeerHeader, localhost)
 
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
 		t.Errorf("the question's headers are %v, want %v", asked.header, want)
@@ -93,7 +93,7 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			forwarded := make(chan http.Header, 1)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				forwarded <- r.Header.Clone()
@@ -110,8 +110,8 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			wantGreeting(t, visit(t, req))
 
 			asked := standIn.question(t)
-			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
-				asked.header.Get(servewaf.PeerHeader) != localhost ||
+			if asked.header.Get(discriminator.ClientHeader) != tc.client ||
+				asked.header.Get(discriminator.PeerHeader) != localhost ||
 				asked.header.Get(forwardedForHeader) != visitor ||
 				asked.header.Get(forwardedProtoHeader) != tc.proto {
 				t.Errorf("the question's headers are %v", asked.header)
@@ -157,7 +157,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32,10.0.0.0/8",
@@ -167,7 +167,8 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 			req.Header[forwardedForHeader] = tc.header
 			wantGreeting(t, visit(t, req))
 
-			if got := standIn.question(t).header.Get(servewaf.ClientHeader); got != tc.client {
+			if got := standIn.question(t).header.Get(discriminator.ClientHeader); got !=
+				tc.client {
 				t.Errorf("the question names %s, want %s", got, tc.client)
 			}
 		})
@@ -182,7 +183,7 @@ func randomBytes(n int) []byte {
 	return body
 }
 
-func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
+func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) {
 	t.Parallel()
 
 	for _, size := range []int{
@@ -197,7 +198,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 				t.Parallel()
 
 				body := randomBytes(size)
-				standIn := startServeWAF(t, allow)
+				standIn := startDiscriminator(t, allow)
 				received := make(chan []byte, 1)
 				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 					whole, _ := io.ReadAll(r.Body)
@@ -243,7 +244,7 @@ func wantQuestionBody(
 			len(want))
 	}
 
-	values := asked.header.Values(servewaf.ContentLengthHeader)
+	values := asked.header.Values(discriminator.ContentLengthHeader)
 
 	if announced {
 		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
@@ -264,7 +265,7 @@ func wantQuestionBody(
 func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	standIn := startDiscriminator(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -275,7 +276,7 @@ func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 		strings.Repeat("x", questionBodyMaxBytes))
 
 	if status := readStatus(t, conn); status != http.StatusForbidden {
-		t.Errorf("status %d, want servewaf's 403", status)
+		t.Errorf("status %d, want discriminator's 403", status)
 	}
 
 	if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes {
@@ -306,14 +307,14 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startServeWAF(t, deny)
+				standIn := startDiscriminator(t, deny)
 				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 				conn := dial(t, addr)
 				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
 
 				if status := readStatus(t, conn); status != http.StatusForbidden {
-					t.Errorf("status %d, want servewaf's 403", status)
+					t.Errorf("status %d, want discriminator's 403", status)
 				}
 
 				asked := standIn.question(t)
@@ -334,7 +335,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
@@ -353,7 +354,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("servewaf was asked")
+				t.Error("discriminator was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -361,7 +362,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 	}
 }
 
-func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
+func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 	t.Parallel()
 
 	for _, method := range []string{
@@ -372,7 +373,7 @@ func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 			t.Parallel()
 
 			reached := make(chan string, 1)
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
@@ -384,7 +385,7 @@ func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 			}
 
 			if asked := standIn.question(t); asked.method != method {
-				t.Errorf("servewaf was asked about %s", asked.method)
+				t.Errorf("discriminator was asked about %s", asked.method)
 			}
 
 			if atApp := <-reached; atApp != method {
@@ -394,7 +395,7 @@ func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 	}
 }
 
-func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
+func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 	t.Parallel()
 
 	const host = "Host: site.example\r\n\r\n"
@@ -416,7 +417,7 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			standIn := startDiscriminator(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -434,7 +435,7 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("servewaf was asked")
+				t.Error("discriminator was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -442,12 +443,12 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 	}
 }
 
-func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
+func TestAHostWithAPercentSignButNoBracketGoesToDiscriminator(t *testing.T) {
 	t.Parallel()
 
 	const host = "a%b"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -468,7 +469,7 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	const want = "http"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
@@ -497,7 +498,7 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			standIn := startDiscriminator(t, deny)
 			app := startApp(t, greet)
 			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32",
@@ -510,8 +511,8 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 
 			asked := standIn.question(t)
-			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
-				asked.header.Get(servewaf.PeerHeader) != tc.peer {
+			if asked.header.Get(discriminator.ClientHeader) != tc.client ||
+				asked.header.Get(discriminator.PeerHeader) != tc.peer {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 

internal/rproxy/request.go

@@ -16,16 +16,16 @@ import (
 	"sync/atomic"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
 // soon as it arrives.
 const flushAfterEachWrite time.Duration = -1
 
-// reportStatusMax is the highest status servewaf takes in a report. An app can
+// reportStatusMax is the highest status discriminator takes in a report. An app can
 // send a higher one, up to 999, and the visitor gets that as it is.
 const reportStatusMax = 599
 
@@ -49,14 +49,14 @@ type request struct {
 	peerTrusted bool
 	start       time.Time
 
-	// disposition is what is done with the request: servewaf's valid disposition,
+	// disposition is what is done with the request: discriminator's valid disposition,
 	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
 	disposition string
-	// answered is true when servewaf gave disposition, which makes a report due,
+	// answered is true when discriminator gave disposition, which makes a report due,
 	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
 	answered  bool
 	byDefault bool
-	// asn and country are servewaf's X-Client-ASN and X-Client-Country, for the
+	// asn and country are discriminator's X-Client-ASN and X-Client-Country, for the
 	// app.
 	asn, country string
 
@@ -122,14 +122,14 @@ func (rq *request) answerHealth() {
 // visitor too slow to send it is answered 408. For a malformed chunk, or a
 // visitor that went away or stopped its sending side, the connection is closed
 // without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
-// read, so that servewaf is asked first; passToApp then refuses it.
+// read, so that discriminator is asked first; passToApp then refuses it.
 func (rq *request) readFirstPartOfBody() bool {
 	if rq.body == nil {
 		return true
 	}
 
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
-	held, err := io.ReadAll(io.LimitReader(rq.body, servewaf.QuestionBodyMaxBytes))
+	held, err := io.ReadAll(io.LimitReader(rq.body, discriminator.QuestionBodyMaxBytes))
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
@@ -192,7 +192,7 @@ func (rq *request) forward(ctx context.Context) {
 // rewrite makes the request the app receives: the visitor's request, unchanged,
 // sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
 // without any X-Client-ASN or X-Client-Country the visitor sent, and with
-// servewaf's.
+// discriminator's.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	upstream := rq.h.config.UpstreamURL
 	pr.Out.URL.Scheme = upstream.Scheme
@@ -312,7 +312,7 @@ func (rq *request) answer(status int) {
 // handler has returned, after finish has written the log line and sent the report.
 // Without Content-Length, the flush would send the body in chunks, the last of
 // which would still wait for the handler. A HEAD's answer has no body, so any
-// Content-Length it has stays as servewaf gave it.
+// Content-Length it has stays as discriminator gave it.
 func (rq *request) send(status int, body []byte) {
 	if rq.in.Method != http.MethodHead {
 		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
@@ -347,7 +347,7 @@ func (rq *request) refuse(status int) {
 	}
 }
 
-// finish ends the request's time limits, writes its log line and, if servewaf
+// finish ends the request's time limits, writes its log line and, if discriminator
 // answered the question, sends the report. ctx is the request's own context.
 func (rq *request) finish(ctx context.Context) {
 	rq.stopTimers()
@@ -384,7 +384,7 @@ func (rq *request) finish(ctx context.Context) {
 		return
 	}
 
-	report := &servewaf.Report{
+	report := &discriminator.Report{
 		RequestID:     rq.id,
 		Status:        min(rq.out.status, reportStatusMax),
 		RequestBytes:  requestBytes,

internal/rproxy/rproxy.go

@@ -1,10 +1,10 @@
-// Package rproxy is the reverse proxy in front of one app that asks servewaf
-// about each request. It passes a request servewaf allows to the app and the
+// Package rproxy is the reverse proxy in front of one app that asks discriminator
+// about each request. It passes a request discriminator allows to the app and the
 // app's answer back, within the size and time limits. Any other answer from
-// servewaf goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
-// decides only when servewaf cannot be connected to, does not answer at all, or
+// discriminator goes to the visitor as discriminator gave it. SWRP_DEFAULT_DISPOSITION
+// decides only when discriminator cannot be connected to, does not answer at all, or
 // does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
-// method it does not pass on, or one it cannot put to servewaf as the visitor
+// method it does not pass on, or one it cannot put to discriminator as the visitor
 // sent it. It keeps nothing between requests and never touches disk. "rproxy" in
 // SPEC.md says what it does.
 package rproxy
@@ -22,10 +22,10 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 )
 
-// How rproxy keeps connections to the app and to servewaf open between
+// How rproxy keeps connections to the app and to discriminator open between
 // requests.
 const (
 	idleConns       = 100
@@ -45,9 +45,9 @@ const (
 	idleTimeout = 120 * time.Second
 )
 
-// adminPrefix starts the path of every request for smallwebwaf itself, which
+// adminPrefix starts the path of every request for sww itself, which
 // never reaches the app.
-const adminPrefix = "/_smallwebwaf/"
+const adminPrefix = "/_sww/"
 
 // allowedMethods lists the methods rproxy passes on, as an Allow header gives
 // them. It answers any other method 405 itself.
@@ -62,14 +62,14 @@ type Params struct {
 	ProcessLog *slog.Logger
 }
 
-// Server is the server `smallwebwaf rproxy` runs.
+// Server is the server `sww rproxy` runs.
 type Server struct {
 	*http.Server
 
 	h *handler
 }
 
-// New returns the server `smallwebwaf rproxy` runs. Go's server itself refuses
+// New returns the server `sww rproxy` runs. Go's server itself refuses
 // a request line and headers over requestHeaderMaxBytes, with 431, closes a
 // connection idle for idleTimeout, and applies SWRP_MAX_REQUEST_TIME_MS while
 // the headers arrive. The handler applies the time and size limits from then
@@ -78,14 +78,14 @@ func New(params Params) *Server {
 	backend := params.Config.WAFBackend
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	h := &handler{
-		config:            params.Config,
-		requestLog:        params.RequestLog,
-		processLog:        params.ProcessLog,
-		errorLog:          errorLog,
-		transport:         newTransport(),
-		serveWAFTransport: newServeWAFTransport(),
+		config:                 params.Config,
+		requestLog:             params.RequestLog,
+		processLog:             params.ProcessLog,
+		errorLog:               errorLog,
+		transport:              newTransport(),
+		discriminatorTransport: newDiscriminatorTransport(),
 		reportURL: (&url.URL{
-			Scheme: backend.Scheme, Host: backend.Host, Path: servewaf.ReportPath,
+			Scheme: backend.Scheme, Host: backend.Host, Path: discriminator.ReportPath,
 		}).String(),
 	}
 
@@ -120,10 +120,10 @@ type handler struct {
 	requestLog io.Writer
 	processLog *slog.Logger
 	errorLog   *log.Logger
-	// transport carries requests to the app, and serveWAFTransport questions and
-	// reports to servewaf.
-	transport         http.RoundTripper
-	serveWAFTransport http.RoundTripper
+	// transport carries requests to the app, and discriminatorTransport questions and
+	// reports to discriminator.
+	transport              http.RoundTripper
+	discriminatorTransport http.RoundTripper
 	// reportURL is where the reports go.
 	reportURL string
 	// reports waits for the reports being sent. reportsMu guards starting one
@@ -145,11 +145,12 @@ func newTransport() *http.Transport {
 	}
 }
 
-// newServeWAFTransport returns what carries questions and reports to servewaf.
+// newDiscriminatorTransport returns what carries questions and reports to
+// discriminator.
 // It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send a visitor's Upgrade
 // header, or a Connection header other than close or keep-alive, and that would
-// read as servewaf giving no answer.
-func newServeWAFTransport() *http.Transport {
+// read as discriminator giving no answer.
+func newDiscriminatorTransport() *http.Transport {
 	transport := newTransport()
 	transport.Protocols = new(http.Protocols)
 	transport.Protocols.SetHTTP1(true)
@@ -158,15 +159,15 @@ func newServeWAFTransport() *http.Transport {
 }
 
 // ServeHTTP handles one request: it answers the health check itself, refuses a
-// request with a method it does not pass on or one it cannot put to servewaf as
+// request with a method it does not pass on or one it cannot put to discriminator as
 // the visitor sent it, and for any other request reads the first part of the
-// body, asks servewaf, and does what the answer says. Once the answer has ended,
+// body, asks discriminator, and does what the answer says. Once the answer has ended,
 // it writes the request's log line and sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
 
-	if r.Method == http.MethodGet && r.URL.Path == servewaf.HealthPath {
+	if r.Method == http.MethodGet && r.URL.Path == discriminator.HealthPath {
 		rq.answerHealth()
 
 		return
@@ -199,9 +200,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq.noteAnswer(answer)
 
 	switch rq.disposition {
-	case servewaf.DispositionAllow:
+	case discriminator.DispositionAllow:
 		rq.passToApp(r.Context())
-	case servewaf.DispositionClose:
+	case discriminator.DispositionClose:
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)
@@ -211,7 +212,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
-// it from the app. servewaf answers a path under adminPrefix itself, so such a
+// it from the app. discriminator answers a path under adminPrefix itself, so such a
 // request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {

internal/rproxy/rproxy_test.go

@@ -19,9 +19,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -54,27 +54,27 @@ const (
 
 // The headers the tests set and look at.
 const (
-	dispositionHeader    = servewaf.DispositionHeader
+	dispositionHeader    = discriminator.DispositionHeader
 	forwardedForHeader   = "X-Forwarded-For"
 	forwardedProtoHeader = "X-Forwarded-Proto"
 	requestIDHeader      = "X-Request-ID"
 	asnHeader            = "X-Client-Asn"
 	countryHeader        = "X-Client-Country"
 	contentLengthHeader  = "Content-Length"
-	// fromServeWAFHeader is a header the stand-in for servewaf adds to a deny.
-	fromServeWAFHeader = "X-From-Servewaf"
+	// fromDiscriminatorHeader is a header the stand-in for discriminator adds to a deny.
+	fromDiscriminatorHeader = "X-From-Servewaf"
 	// addedHeaderValue is the value of a header a test adds to an answer, to see it
 	// reach the visitor.
 	addedHeaderValue = "yes"
 )
 
-// What the stand-in for servewaf answers.
+// What the stand-in for discriminator answers.
 const (
-	dispositionAllow = servewaf.DispositionAllow
-	dispositionDeny  = servewaf.DispositionDeny
-	dispositionClose = servewaf.DispositionClose
+	dispositionAllow = discriminator.DispositionAllow
+	dispositionDeny  = discriminator.DispositionDeny
+	dispositionClose = discriminator.DispositionClose
 	// deniedBody is the body of a deny.
-	deniedBody = "refused by servewaf"
+	deniedBody = "refused by discriminator"
 )
 
 // output collects what rproxy writes on stdout.
@@ -158,7 +158,7 @@ func (l heldLog) Write(p []byte) (int, error) {
 	return len(p), nil
 }
 
-// question is what the stand-in for servewaf received as a question.
+// question is what the stand-in for discriminator received as a question.
 type question struct {
 	method, target, host string
 	header               http.Header
@@ -167,26 +167,26 @@ type question struct {
 	transferEncoding     []string
 }
 
-// serveWAF is a stand-in for servewaf that answers each question as answer
-// does, and keeps the questions and the reports it gets.
-type serveWAF struct {
+// Discriminator is a stand-in for discriminator that answers each question as
+// answer does, and keeps the questions and the reports it gets.
+type Discriminator struct {
 	*httptest.Server
 
 	questions chan question
-	reports   chan servewaf.Report
+	reports   chan discriminator.Report
 }
 
-// startServeWAF starts a stand-in for servewaf.
-func startServeWAF(t *testing.T, answer http.HandlerFunc) *serveWAF {
+// startDiscriminator starts a stand-in for discriminator.
+func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator {
 	t.Helper()
 
-	s := &serveWAF{
+	s := &Discriminator{
 		questions: make(chan question, 10),
-		reports:   make(chan servewaf.Report, 10),
+		reports:   make(chan discriminator.Report, 10),
 	}
 	s.Server = httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) == "" {
+			if r.Header.Get(discriminator.ClientHeader) == "" {
 				s.takeReport(t, w, r)
 
 				return
@@ -209,14 +209,17 @@ func startServeWAF(t *testing.T, answer http.HandlerFunc) *serveWAF {
 	return s
 }
 
-// takeReport keeps a report and answers it as servewaf does.
-func (s *serveWAF) takeReport(t *testing.T, w http.ResponseWriter, r *http.Request) {
+// takeReport keeps a report and answers it as discriminator does.
+func (s *Discriminator) takeReport(
+	t *testing.T, w http.ResponseWriter, r *http.Request,
+) {
 	t.Helper()
 
-	var report servewaf.Report
+	var report discriminator.Report
 
 	err := json.NewDecoder(r.Body).Decode(&report)
-	if err != nil || r.Method != http.MethodPost || r.URL.Path != servewaf.ReportPath {
+	if err != nil || r.Method != http.MethodPost ||
+		r.URL.Path != discriminator.ReportPath {
 		t.Errorf("%s %s is no report: %v", r.Method, r.URL.Path, err)
 	}
 
@@ -226,7 +229,7 @@ func (s *serveWAF) takeReport(t *testing.T, w http.ResponseWriter, r *http.Reque
 }
 
 // wantNoReport checks that no report comes for a moment.
-func (s *serveWAF) wantNoReport(t *testing.T) {
+func (s *Discriminator) wantNoReport(t *testing.T) {
 	t.Helper()
 
 	select {
@@ -237,7 +240,7 @@ func (s *serveWAF) wantNoReport(t *testing.T) {
 }
 
 // report waits for a report.
-func (s *serveWAF) report(t *testing.T) servewaf.Report {
+func (s *Discriminator) report(t *testing.T) discriminator.Report {
 	t.Helper()
 
 	select {
@@ -246,12 +249,12 @@ func (s *serveWAF) report(t *testing.T) servewaf.Report {
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 
-		return servewaf.Report{}
+		return discriminator.Report{}
 	}
 }
 
 // question waits for a question.
-func (s *serveWAF) question(t *testing.T) question {
+func (s *Discriminator) question(t *testing.T) question {
 	t.Helper()
 
 	select {
@@ -264,16 +267,17 @@ func (s *serveWAF) question(t *testing.T) question {
 	}
 }
 
-// startServeWAFAnsweringReports starts a stand-in for servewaf that answers each
+// startDiscriminatorAnsweringReports starts a stand-in for discriminator that
+// answers each
 // question as answer does and each report as report does, and returns its URL.
-func startServeWAFAnsweringReports(
+func startDiscriminatorAnsweringReports(
 	t *testing.T, answer, report http.HandlerFunc,
 ) string {
 	t.Helper()
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(discriminator.ClientHeader) != "" {
 				answer(w, r)
 
 				return
@@ -295,7 +299,7 @@ func allow(w http.ResponseWriter, _ *http.Request) {
 // deny answers a question with deny, status 403 and a body of its own.
 func deny(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set(dispositionHeader, dispositionDeny)
-	w.Header().Set(fromServeWAFHeader, addedHeaderValue)
+	w.Header().Set(fromDiscriminatorHeader, addedHeaderValue)
 	w.WriteHeader(http.StatusForbidden)
 	_, _ = io.WriteString(w, deniedBody)
 }
@@ -316,7 +320,7 @@ func greet(w http.ResponseWriter, r *http.Request) {
 	_, _ = io.WriteString(w, greeting)
 }
 
-// startRProxy starts rproxy with servewaf at backend and the app at appURL, and
+// startRProxy starts rproxy with discriminator at backend and the app at appURL, and
 // the settings in env on top of the defaults. It returns where rproxy listens
 // and what it writes.
 func startRProxy(
@@ -498,7 +502,7 @@ func readStatus(t *testing.T, conn net.Conn) int {
 func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, r *http.Request) {
+	standIn := startDiscriminator(t, func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set(asnHeader, "AS64496")
 		w.Header().Set(countryHeader, "DE")
 		allow(w, r)
@@ -557,7 +561,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	}
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
@@ -602,7 +606,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
@@ -641,7 +645,7 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		_, _ = io.WriteString(w, "<html>")
@@ -663,19 +667,19 @@ func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	}
 }
 
-func TestRemovesTheVisitorsLookupHeadersWhenServeWAFGivesNone(t *testing.T) {
+func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
 		name    string
 		backend func(t *testing.T) string
 	}{
-		{"servewaf allows", func(t *testing.T) string {
+		{"discriminator allows", func(t *testing.T) string {
 			t.Helper()
 
-			return startServeWAF(t, allow).URL
+			return startDiscriminator(t, allow).URL
 		}},
-		{"servewaf is down", func(*testing.T) string { return nowhere }},
+		{"discriminator is down", func(*testing.T) string { return nowhere }},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -701,10 +705,10 @@ func TestRemovesTheVisitorsLookupHeadersWhenServeWAFGivesNone(t *testing.T) {
 	}
 }
 
-func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
+func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	standIn := startDiscriminator(t, deny)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
@@ -712,8 +716,8 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusForbidden || got.body != deniedBody ||
-		got.header.Get(fromServeWAFHeader) != addedHeaderValue {
-		t.Errorf("answered %+v, want servewaf's answer", got)
+		got.header.Get(fromDiscriminatorHeader) != addedHeaderValue {
+		t.Errorf("answered %+v, want discriminator's answer", got)
 	}
 
 	if len(got.header.Values(dispositionHeader)) != 0 {
@@ -729,21 +733,21 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 
 	line := out.requestLine(t)
 	if line["disposition"] != dispositionDeny || line["default_disposition"] != nil {
-		t.Errorf("line %v, want servewaf's deny", line)
+		t.Errorf("line %v, want discriminator's deny", line)
 	}
 }
 
-func TestADeniedHeadKeepsServeWAFsContentLength(t *testing.T) {
+func TestADeniedHeadKeepsDiscriminatorsContentLength(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	standIn := startDiscriminator(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
 		got.header.Get(contentLengthHeader) != strconv.Itoa(len(deniedBody)) {
-		t.Errorf("answered %+v, want servewaf's 403 and its length", got)
+		t.Errorf("answered %+v, want discriminator's 403 and its length", got)
 	}
 }
 
@@ -758,13 +762,13 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 	}{
 		{"a deny", "GET /" + host, deniedBody, http.StatusForbidden},
 		{"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest},
-		{"the health check", "GET " + servewaf.HealthPath + host, "ok\n", http.StatusOK},
+		{"the health check", "GET " + discriminator.HealthPath + host, "ok\n", http.StatusOK},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			log := heldLog{release: make(chan struct{})}
-			standIn := startServeWAF(t, deny)
+			standIn := startDiscriminator(t, deny)
 			app := startApp(t, greet)
 			addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard)
 
@@ -794,7 +798,7 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -817,7 +821,7 @@ func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(dispositionHeader, dispositionClose)
 		w.WriteHeader(http.StatusOK)
 	})
@@ -849,7 +853,7 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 	t.Parallel()
 
-	backend := startServeWAFAnsweringReports(t,
+	backend := startDiscriminatorAnsweringReports(t,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(dispositionHeader, dispositionClose)
 		},
@@ -874,17 +878,17 @@ func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 	}
 }
 
-// answeringWith returns what starts a stand-in for servewaf that answers each
+// answeringWith returns what starts a stand-in for discriminator that answers each
 // question as answer does, and returns its URL.
 func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
 	return func(t *testing.T) string {
 		t.Helper()
 
-		return startServeWAF(t, answer).URL
+		return startDiscriminator(t, answer).URL
 	}
 }
 
-// noAnswers are the ways servewaf can leave the decision to the default.
+// noAnswers are the ways discriminator can leave the decision to the default.
 func noAnswers() map[string]func(t *testing.T) string {
 	return map[string]func(t *testing.T) string{
 		"no connection": func(*testing.T) string { return nowhere },
@@ -916,7 +920,7 @@ func noAnswers() map[string]func(t *testing.T) string {
 	}
 }
 
-func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
+func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -925,7 +929,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 	}{
 		{"a refusal", dispositionDeny, deniedBody, http.StatusForbidden},
 		{"a refusal, 429", dispositionDeny, deniedBody, http.StatusTooManyRequests},
-		{"servewaf's 400", "", "refused\n", http.StatusBadRequest},
+		{"discriminator's 400", "", "refused\n", http.StatusBadRequest},
 		{"a 500", "", "broken\n", http.StatusInternalServerError},
 		{"a 503 denied", dispositionDeny, "busy\n", http.StatusServiceUnavailable},
 		{"no header", "", "who knows\n", http.StatusOK},
@@ -935,12 +939,12 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+				standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
 					if tc.disposition != "" {
 						w.Header().Set(dispositionHeader, tc.disposition)
 					}
 
-					w.Header().Set(fromServeWAFHeader, addedHeaderValue)
+					w.Header().Set(fromDiscriminatorHeader, addedHeaderValue)
 					w.WriteHeader(tc.status)
 					_, _ = io.WriteString(w, tc.body)
 				})
@@ -953,8 +957,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 
 				got := get(t, addr, "/")
 				if got.status != tc.status || got.body != tc.body ||
-					got.header.Get(fromServeWAFHeader) != addedHeaderValue {
-					t.Errorf("answered %+v, want servewaf's answer", got)
+					got.header.Get(fromDiscriminatorHeader) != addedHeaderValue {
+					t.Errorf("answered %+v, want discriminator's answer", got)
 				}
 
 				if len(got.header.Values(dispositionHeader)) != 0 {
@@ -966,8 +970,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 					t.Errorf("line %v, want status %d and no default", line, tc.status)
 				}
 
-				if out.has("servewaf gave no answer") {
-					t.Error("rproxy warned that servewaf gave no answer")
+				if out.has("discriminator gave no answer") {
+					t.Error("rproxy warned that discriminator gave no answer")
 				}
 			})
 		}
@@ -977,14 +981,14 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadRequest {
-		t.Errorf("answered %+v, want servewaf's 400", got)
+		t.Errorf("answered %+v, want discriminator's 400", got)
 	}
 
 	if line := out.requestLine(t); line["disposition"] != nil {
@@ -997,7 +1001,7 @@ func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = io.WriteString(w, "<html>broken")
@@ -1015,7 +1019,7 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	const size = 1 << 20
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
@@ -1023,15 +1027,16 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusInternalServerError || len(got.body) != size {
-		t.Errorf("answered %d with %d bytes, want servewaf's 500 with %d",
+		t.Errorf("answered %d with %d bytes, want discriminator's 500 with %d",
 			got.status, len(got.body), size)
 	}
 }
 
-// startServeWAFWriting starts a stand-in for servewaf that reads each question and
+// startDiscriminatorWriting starts a stand-in for discriminator that reads
+// each question and
 // answers it with text, as it is, and returns its URL. It can send what Go's
 // server would not.
-func startServeWAFWriting(t *testing.T, text string) string {
+func startDiscriminatorWriting(t *testing.T, text string) string {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -1101,7 +1106,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 		"a status below 100": func(t *testing.T) string {
 			t.Helper()
 
-			return startServeWAFWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
+			return startDiscriminatorWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
 		},
 		"a 101 that holds its connection open": answeringWith(switchAndHold),
 	} {
@@ -1126,7 +1131,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 					t.Errorf("line %v, want status 502 and no disposition", line)
 				}
 
-				out.waitFor(t, "servewaf's answer is dropped")
+				out.waitFor(t, "discriminator's answer is dropped")
 			})
 		}
 	}
@@ -1135,7 +1140,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, overOneMiB(dispositionDeny))
+	standIn := startDiscriminator(t, overOneMiB(dispositionDeny))
 	addr, out := startRProxy(t, standIn.URL, nowhere, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
@@ -1192,14 +1197,14 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
 	}
 }
 
-func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
+func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T) {
 	t.Parallel()
 
 	for _, disposition := range []string{dispositionAllow, dispositionDeny} {
 		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+			standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) {
 				<-r.Context().Done()
 			})
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
@@ -1222,8 +1227,8 @@ func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
 				t.Errorf("line %v, want status 0 and no disposition", line)
 			}
 
-			if out.has("servewaf gave no answer") {
-				t.Error("rproxy warned that servewaf gave no answer")
+			if out.has("discriminator gave no answer") {
+				t.Error("rproxy warned that discriminator gave no answer")
 			}
 
 			standIn.wantNoReport(t)
@@ -1238,13 +1243,13 @@ func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
 	wantGreeting(t, get(t, addr, "/"))
-	out.waitFor(t, "servewaf gave no answer")
+	out.waitFor(t, "discriminator gave no answer")
 }
 
 func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+	standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
 	})
 	app := startApp(t, greet)
@@ -1265,35 +1270,35 @@ func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
 	})
 	addr, _ := startRProxy(t, nowhere, app.URL, nil)
 
-	got := get(t, addr, "/_smallwebwaf/metrics")
+	got := get(t, addr, "/_sww/metrics")
 	if got.status != http.StatusNotFound {
 		t.Errorf("answered %+v, want 404", got)
 	}
 }
 
-func TestHealthCheckIsAnsweredWhileServeWAFIsDown(t *testing.T) {
+func TestHealthCheckIsAnsweredWhileDiscriminatorIsDown(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
-	got := get(t, addr, servewaf.HealthPath)
+	got := get(t, addr, discriminator.HealthPath)
 	if got.status != http.StatusOK || got.body != "ok\n" {
 		t.Errorf("answered %+v, want ok", got)
 	}
 
 	line := out.requestLine(t)
-	if line["path"] != servewaf.HealthPath || line["disposition"] != nil {
+	if line["path"] != discriminator.HealthPath || line["disposition"] != nil {
 		t.Errorf("line %v, want one with no disposition", line)
 	}
 
-	// With servewaf up too, it is not asked.
+	// With discriminator up too, it is not asked.
 	addr, _ = startRProxy(t, standIn.URL, app.URL, nil)
-	get(t, addr, servewaf.HealthPath)
+	get(t, addr, discriminator.HealthPath)
 
 	if len(standIn.questions) != 0 {
-		t.Error("servewaf was asked about the health check")
+		t.Error("discriminator was asked about the health check")
 	}
 }
 
@@ -1301,7 +1306,7 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	backend := startServeWAFAnsweringReports(t, deny,
+	backend := startDiscriminatorAnsweringReports(t, deny,
 		func(w http.ResponseWriter, r *http.Request) {
 			select {
 			case <-release:
@@ -1336,16 +1341,16 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 		_ = res.Body.Close()
 
 		if res.StatusCode != http.StatusForbidden {
-			t.Errorf("status %d, want servewaf's 403", res.StatusCode)
+			t.Errorf("status %d, want discriminator's 403", res.StatusCode)
 		}
 	}
 }
 
-func TestAReportServeWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
+func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	backend := startServeWAFAnsweringReports(t, allow,
+	backend := startDiscriminatorAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			<-release
 
@@ -1365,10 +1370,10 @@ func TestAReportServeWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
 	out.waitFor(t, "a report is dropped")
 }
 
-func TestAReportServeWAFRefusesIsDroppedWithAWarning(t *testing.T) {
+func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) {
 	t.Parallel()
 
-	backend := startServeWAFAnsweringReports(t, allow,
+	backend := startDiscriminatorAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusBadRequest)
 		})
@@ -1383,7 +1388,7 @@ func TestAReportServeWAFRefusesIsDroppedWithAWarning(t *testing.T) {
 func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 	t.Parallel()
 
-	backend := startServeWAFAnsweringReports(t, allow, switchAndHold)
+	backend := startDiscriminatorAnsweringReports(t, allow, switchAndHold)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
 		timeoutSetting: "60000",
@@ -1396,7 +1401,7 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, out, server := startServer(t, standIn.URL, app.URL, nil)
 
@@ -1412,7 +1417,7 @@ func TestReportGivesWhatHappened(t *testing.T) {
 
 	const body = "the visitor's body"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -1442,7 +1447,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(discriminator.ClientHeader) != "" {
 				allow(w, r)
 
 				return
@@ -1497,7 +1502,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, echoAfterUpgrade)
 	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime:  "2000",
@@ -1552,7 +1557,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 
 	const goodbye = "sent after the visitor stopped sending\n"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1610,7 +1615,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 //nolint:paralleltest // see above
 func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 	closed := make(chan error, 1)
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1681,7 +1686,7 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 
 	const fromTraefik = "an-id-from-traefik"
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
@@ -1711,7 +1716,7 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 		body  = "the visitor's body"
 	)
 
-	standIn := startServeWAF(t, allow)
+	standIn := startDiscriminator(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 

internal/rules/rules.go

@@ -106,13 +106,13 @@ type Params struct {
 	// and no rule loaded.
 	Enabled bool
 	// ProcessLog receives how many rules were read, and the error in a
-	// rule file edited while smallwebwaf runs.
+	// rule file edited while sww runs.
 	ProcessLog *slog.Logger
 	// Alerts receive a file_error alert for that error.
 	Alerts *alerts.Queue
 }
 
-// Files are the rule files of a running smallwebwaf, and the rules read
+// Files are the rule files of a running sww, and the rules read
 // from them. They are safe for concurrent use.
 type Files struct {
 	params Params

internal/rules/rules_test.go

@@ -601,7 +601,7 @@ func wantRefused(t *testing.T, dir, want string) {
 }
 
 // get returns a GET request for target, a path and an optional query, as
-// smallwebwaf's server reads it, without a user agent.
+// sww's server reads it, without a user agent.
 func get(t *testing.T, target string) *http.Request {
 	t.Helper()
 

internal/state/state.go

@@ -1,4 +1,4 @@
-// Package state keeps smallwebwaf's state in JSON files in
+// Package state keeps sww's state in JSON files in
 // SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md requires
 // and docs/state-files.md lists them:
 // bans.json holds the bans, clients.json each client's counters and
@@ -8,7 +8,7 @@
 // cooldowns, the hour under way, the alerts waiting for each destination
 // and the anomaly counters. Load
 // reads them at start, Watch takes in an admin's edit of one while
-// smallwebwaf runs, and Run and WriteAll write them. The disk is read and
+// sww runs, and Run and WriteAll write them. The disk is read and
 // written outside the parts' locks, which are held only to take a
 // snapshot or to put in what a file holds, so that no request waits on
 // the disk.
@@ -44,7 +44,7 @@ import (
 // version is the version of the files' format, the only one read.
 const version = 1
 
-// fileMode lets the smallwebwaf user alone read and write the files, which
+// fileMode lets the sww user alone read and write the files, which
 // hold visitors' addresses.
 const fileMode = 0o600
 
@@ -81,7 +81,7 @@ type Params struct {
 	CounterInterval time.Duration
 	// Ledger, Limiter, GeoJS, Lists, DNSBL, AbuseIPDB, Alerts and Anomalies
 	// hold the state. Alerts also receive a file_error alert for an edit set
-	// aside, and for a write that fails while smallwebwaf runs.
+	// aside, and for a write that fails while sww runs.
 	Ledger    *bans.Ledger
 	Limiter   *ratelimit.Limiter
 	GeoJS     *lookup.GeoJS
@@ -101,7 +101,7 @@ type Params struct {
 	Metrics *metrics.Metrics
 }
 
-// Files are the state files of a running smallwebwaf.
+// Files are the state files of a running sww.
 type Files struct {
 	params Params
 
@@ -110,7 +110,7 @@ type Files struct {
 	// it.
 	mu sync.Mutex
 	// sums are the SHA-256 sums of what each file held, by name, when
-	// smallwebwaf last read or wrote it. A file that holds anything else
+	// sww last read or wrote it. A file that holds anything else
 	// has been edited since.
 	sums map[string][sha256.Size]byte
 }
@@ -241,7 +241,7 @@ func (f *Files) Run(ctx context.Context) {
 	}
 }
 
-// WriteAll writes every state file, as smallwebwaf stops. A file that
+// WriteAll writes every state file, as sww stops. A file that
 // fails does not keep the others from being written.
 func (f *Files) WriteAll() error {
 	return errors.Join(f.writeFile(bansJSON), f.writeFile(clientsJSON),
@@ -250,7 +250,7 @@ func (f *Files) WriteAll() error {
 
 // Watch watches Dir until ctx is done, and takes in an admin's edit of a
 // state file as soon as it is saved: what the file holds replaces what
-// smallwebwaf held for it. An edit that does not parse is left for the
+// sww held for it. An edit that does not parse is left for the
 // file's next write, which sets it aside, since a file can be read while
 // an editor is still writing it. If Dir cannot be watched, that is
 // logged, and an edit is taken in only before its file is written.
@@ -310,7 +310,7 @@ func (f *Files) logFailure(name string, err error) {
 }
 
 // fileChanged takes in what the state file name holds, as Watch sees it
-// change, if that is an edit made since smallwebwaf last read or wrote
+// change, if that is an edit made since sww last read or wrote
 // the file. A file that cannot be read or does not parse is left for its
 // next write.
 func (f *Files) fileChanged(name string) {
@@ -326,7 +326,7 @@ func (f *Files) fileChanged(name string) {
 }
 
 // takeInEdit takes in data, an edit of the state file name, as takeIn
-// does, and counts and logs it. Every edit taken in while smallwebwaf
+// does, and counts and logs it. Every edit taken in while sww
 // runs, by Watch or by a write, is taken in here. An edit that does not
 // parse is neither counted nor logged, and takeIn's error returned.
 func (f *Files) takeInEdit(name string, data []byte) error {
@@ -356,8 +356,8 @@ func (f *Files) read(name string) (int, error) {
 }
 
 // readChanged returns what the state file name holds, and whether that
-// has changed since smallwebwaf last read or wrote the file, as it has
-// for a file smallwebwaf never read or wrote. A missing file has not
+// has changed since sww last read or wrote the file, as it has
+// for a file sww never read or wrote. A missing file has not
 // changed: it is written again at its next write.
 func (f *Files) readChanged(name string) ([]byte, bool, error) {
 	path := filepath.Join(f.params.Dir, name)
@@ -377,7 +377,7 @@ func (f *Files) readChanged(name string) ([]byte, bool, error) {
 // takeIn parses data, what the state file name holds, puts it into the
 // part that keeps that state, in place of what the part held, and returns
 // how many entries the file holds. edit is whether data is an admin's
-// edit taken in while smallwebwaf runs, rather than the file read at the
+// edit taken in while sww runs, rather than the file read at the
 // start. An error names the file and, where the JSON decoder tells it,
 // the line and column, or else the entry.
 func (f *Files) takeIn(name string, data []byte, edit bool) (int, error) {
@@ -491,8 +491,8 @@ func (f *Files) takeInAlerts(path string, data []byte) (int, error) {
 	return entries, nil
 }
 
-// writeFile writes the state file name from what smallwebwaf holds. An
-// edit made since smallwebwaf last read or wrote the file is taken in
+// writeFile writes the state file name from what sww holds. An
+// edit made since sww last read or wrote the file is taken in
 // first, so that it is not overwritten, or set aside if it does not
 // parse. A file that cannot be read, or an edit that cannot be set
 // aside, is left as it is, and the write given up. Every write is counted
@@ -561,7 +561,7 @@ func (f *Files) setAside(name string, parseErr error) error {
 	return nil
 }
 
-// encode returns the state file name as smallwebwaf writes it, from a
+// encode returns the state file name as sww writes it, from a
 // snapshot of the part that keeps that state.
 func (f *Files) encode(name string) ([]byte, error) {
 	switch name {
@@ -965,7 +965,7 @@ func parse(path string, data []byte, file stateFile) error {
 
 	err := json.Unmarshal(data, &header)
 	if err == nil && header.Version != version {
-		err = fmt.Errorf("%w %d, where this smallwebwaf reads version %d",
+		err = fmt.Errorf("%w %d, where this sww reads version %d",
 			errVersion, header.Version, version)
 	}
 

internal/state/state_test.go

@@ -122,7 +122,7 @@ const filledAlertsJSON = `{
         {
             "event": "file_error",
             "netblock": "",
-            "file": "/var/lib/smallwebwaf/bans.json",
+            "file": "/var/lib/sww/bans.json",
             "sent": "2026-10-06T00:00:00Z",
             "suppressed_repeats": 0
         },
@@ -169,7 +169,7 @@ const filledAlertsJSON = `{
                 "reason": "writing the state files failed",
                 "detail": {
                     "error": "no space left on device",
-                    "file": "/var/lib/smallwebwaf/bans.json"
+                    "file": "/var/lib/sww/bans.json"
                 },
                 "suppressed_repeats": 0
             }
@@ -1165,13 +1165,13 @@ func TestWritesAreCountedInTheMetrics(t *testing.T) {
 	)
 
 	got := scrape(t, params)
-	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+ofBans, 1)
-	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+ofClients, 1)
-	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+ofBans, 0)
-	wantMetric(t, got, "smallwebwaf_state_file_size_bytes"+ofBans,
+	wantMetric(t, got, "sww_state_file_writes_total"+ofBans, 1)
+	wantMetric(t, got, "sww_state_file_writes_total"+ofClients, 1)
+	wantMetric(t, got, "sww_state_file_write_failures_total"+ofBans, 0)
+	wantMetric(t, got, "sww_state_file_size_bytes"+ofBans,
 		float64(len(permanentBansJSON)))
 
-	written := metric(t, got, "smallwebwaf_state_file_last_write_timestamp_seconds"+ofBans)
+	written := metric(t, got, "sww_state_file_last_write_timestamp_seconds"+ofBans)
 	if written < float64(time.Now().Add(-time.Hour).Unix()) {
 		t.Errorf("bans.json was last written at %v, not by that write", written)
 	}
@@ -1192,10 +1192,10 @@ func TestWritesAreCountedInTheMetrics(t *testing.T) {
 	}
 
 	got = scrape(t, params)
-	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+ofBans, 2)
-	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+ofBans, 1)
-	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+ofClients, 0)
-	wantMetric(t, got, "smallwebwaf_state_file_size_bytes"+ofBans,
+	wantMetric(t, got, "sww_state_file_writes_total"+ofBans, 2)
+	wantMetric(t, got, "sww_state_file_write_failures_total"+ofBans, 1)
+	wantMetric(t, got, "sww_state_file_write_failures_total"+ofClients, 0)
+	wantMetric(t, got, "sww_state_file_size_bytes"+ofBans,
 		float64(len(permanentBansJSON)))
 }
 
@@ -1486,7 +1486,7 @@ func TestBanWithoutACauseTakenInAsAnAdmins(t *testing.T) {
 			"and the reason %q", written, err, reason)
 	}
 
-	// Taken in while smallwebwaf runs, a ban on another netblock is an
+	// Taken in while sww runs, a ban on another netblock is an
 	// admin's too, and one made since the start.
 	watch(t, files, lines)
 	edit(t, dir, bansJSON, adminsBansJSON("198.51.100.0/24"))
@@ -1549,7 +1549,7 @@ func TestBrokenEditSetAsideAtTheNextWrite(t *testing.T) {
 
 	watch(t, files, lines)
 
-	// While smallwebwaf runs, the broken edit is left as it is: an edit
+	// While sww runs, the broken edit is left as it is: an edit
 	// of clients.json, made after it and taken in, shows that it has been
 	// seen.
 	edit(t, dir, bansJSON, broken)
@@ -1558,7 +1558,7 @@ func TestBrokenEditSetAsideAtTheNextWrite(t *testing.T) {
 	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
 
 	// The next write sets it aside, logged with where the error is, and
-	// writes bans.json again from what smallwebwaf still holds.
+	// writes bans.json again from what sww still holds.
 	err = files.WriteAll()
 	if err != nil {
 		t.Fatalf("write: %v", err)
@@ -1613,7 +1613,7 @@ func TestEditsTakenInAreCountedInTheMetrics(t *testing.T) {
 	wantTakenIn(t, lines, dir, bansJSON)
 
 	wantMetric(t, scrape(t, params),
-		`smallwebwaf_state_file_edits_taken_in_total{file="bans.json",instance="app"}`, 2)
+		`sww_state_file_edits_taken_in_total{file="bans.json",instance="app"}`, 2)
 }
 
 func TestEditTakenInByAWriteIsLoggedAsWatchLogsIt(t *testing.T) {
@@ -1678,7 +1678,7 @@ func TestEditsSetAsideAreCountedInTheMetrics(t *testing.T) {
 	}
 
 	wantMetric(t, scrape(t, params),
-		`smallwebwaf_state_file_edits_set_aside_total{file="bans.json",instance="app"}`, 1)
+		`sww_state_file_edits_set_aside_total{file="bans.json",instance="app"}`, 1)
 }
 
 func TestDirectoryThatCannotBeWatchedIsLogged(t *testing.T) {
@@ -1854,7 +1854,7 @@ func fill(params state.Params) {
 	params.Alerts.Raise(alerts.Alert{
 		Event: alerts.EventFileError, Reason: "writing the state files failed",
 		Detail: map[string]any{
-			"file": "/var/lib/smallwebwaf/bans.json", "error": "no space left on device",
+			"file": "/var/lib/sww/bans.json", "error": "no space left on device",
 		},
 	})
 	params.Alerts.Raise(alerts.Alert{
@@ -2178,7 +2178,7 @@ func scrape(t *testing.T, params state.Params) string {
 }
 
 // metric returns the value of series in text, the metrics, such as
-// smallwebwaf_state_file_writes_total{file="bans.json",instance="app"}, or
+// sww_state_file_writes_total{file="bans.json",instance="app"}, or
 // fails the test if there is no such series.
 func metric(t *testing.T, text, series string) float64 {
 	t.Helper()
@@ -2210,8 +2210,8 @@ func wantWriteFailed(t *testing.T, params state.Params, name string) {
 	got := scrape(t, params)
 	file := `{file="` + name + `",instance="app"}`
 
-	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+file, 1)
-	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+file, 1)
+	wantMetric(t, got, "sww_state_file_writes_total"+file, 1)
+	wantMetric(t, got, "sww_state_file_write_failures_total"+file, 1)
 }
 
 // wantMetric checks the value of series in text, the metrics, as metric

internal/sww/discriminator_test.go

@@ -1,4 +1,4 @@
-package smallwebwaf_test
+package sww_test
 
 import (
 	"bytes"
@@ -14,14 +14,14 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
-	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/sww"
 )
 
 // commandForMain, while set in the environment, has this test binary run Main
 // with the command it gives, in place of the tests, so that a test can run
 // Main in a process of its own.
-const commandForMain = "SMALLWEBWAF_TEST_COMMAND"
+const commandForMain = "SWW_TEST_COMMAND"
 
 func TestMain(m *testing.M) {
 	command, set := os.LookupEnv(commandForMain)
@@ -29,12 +29,12 @@ func TestMain(m *testing.M) {
 		os.Exit(m.Run())
 	}
 
-	os.Args = strings.Fields("smallwebwaf " + command)
+	os.Args = strings.Fields("sww " + command)
 
-	os.Exit(smallwebwaf.Main(testVersion))
+	os.Exit(sww.Main(testVersion))
 }
 
-func TestMainRunsServeWAF(t *testing.T) {
+func TestMainRunsDiscriminator(t *testing.T) {
 	t.Parallel()
 
 	binary, err := os.Executable()
@@ -50,7 +50,7 @@ func TestMainRunsServeWAF(t *testing.T) {
 	cmd.Stdout = out
 
 	cmd.Env = append(os.Environ(),
-		commandForMain+"="+serveWAFCommand,
+		commandForMain+"="+discriminatorCommand,
 		listenAddr+"="+localhost+":0",
 		stateDir+"="+t.TempDir(),
 		rulesDir+"="+t.TempDir(),
@@ -67,7 +67,7 @@ func TestMainRunsServeWAF(t *testing.T) {
 	})
 
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	ask(t, addr, "/", http.StatusOK, servewaf.DispositionAllow)
+	ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow)
 
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
@@ -108,7 +108,7 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
 				t.Errorf("exit status %d (%v), want 2", code, err)
 			}
 
-			for _, name := range []string{"rproxy", serveWAFCommand, "healthcheck"} {
+			for _, name := range []string{"rproxy", discriminatorCommand, "healthcheck"} {
 				if !strings.Contains(stderr.String(), name) {
 					t.Errorf("stderr %q does not name %s", stderr.String(), name)
 				}
@@ -121,7 +121,7 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
 	}
 }
 
-// ask sends servewaf at addr rproxy's question about a request for path from
+// ask sends discriminator at addr rproxy's question about a request for path from
 // placed, checks the answer's status and disposition, and closes it.
 func ask(t *testing.T, addr, path string, status int, disposition string) {
 	t.Helper()
@@ -132,7 +132,7 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 		t.Fatalf("new request: %v", err)
 	}
 
-	req.Header.Set(servewaf.ClientHeader, placed)
+	req.Header.Set(discriminator.ClientHeader, placed)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}
@@ -147,16 +147,16 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 	_ = res.Body.Close()
 
 	if res.StatusCode != status ||
-		res.Header.Get(servewaf.DispositionHeader) != disposition {
+		res.Header.Get(discriminator.DispositionHeader) != disposition {
 		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
-			res.Header.Get(servewaf.DispositionHeader), status, disposition)
+			res.Header.Get(discriminator.DispositionHeader), status, disposition)
 	}
 }
 
-// runServeWAF runs `smallwebwaf servewaf` with the settings in env, has use
+// runDiscriminator runs `sww discriminator` with the settings in env, has use
 // send it requests at the address it listens on, stops it as SIGTERM does, and
 // checks that it stopped in order.
-func runServeWAF(t *testing.T, env map[string]string, use func(addr string)) {
+func runDiscriminator(t *testing.T, env map[string]string, use func(addr string)) {
 	t.Helper()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -183,7 +183,7 @@ func runServeWAF(t *testing.T, env map[string]string, use func(addr string)) {
 	out.line(t, "msg", "stopped")
 }
 
-func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
+func TestDiscriminatorKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 	t.Parallel()
 
 	env := map[string]string{
@@ -192,13 +192,13 @@ func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
 	}
 
-	runServeWAF(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusOK, servewaf.DispositionAllow)
+	runDiscriminator(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow)
 		// The default rule file bans a probe for this.
-		ask(t, addr, "/.env", http.StatusForbidden, servewaf.DispositionDeny)
+		ask(t, addr, "/.env", http.StatusForbidden, discriminator.DispositionDeny)
 	})
 
-	runServeWAF(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusForbidden, servewaf.DispositionDeny)
+	runDiscriminator(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusForbidden, discriminator.DispositionDeny)
 	})
 }

internal/sww/healthcheck.go

@@ -1,4 +1,4 @@
-package smallwebwaf
+package sww
 
 import (
 	"context"
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 )
 
 // healthCheckTimeout bounds the whole health check.
@@ -19,13 +19,13 @@ const healthCheckTimeout = 5 * time.Second
 
 var errHealthEndpoint = errors.New("the health endpoint answered")
 
-// HealthCheck is the container's health check. In servewaf's container, where
-// SMALLWEBWAF_COMMAND is servewaf, it returns 0 while servewaf answers its health
+// HealthCheck is the container's health check. In discriminator's container, where
+// SWW_COMMAND is discriminator, it returns 0 while discriminator answers its health
 // endpoint on 127.0.0.1, at the port in SWWAF_LISTEN_ADDR. In rproxy's container,
-// where SMALLWEBWAF_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
+// where SWW_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
 // answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
 // the app accepts connections at the address in SWRP_UPSTREAM_URL. Otherwise,
-// any other value of SMALLWEBWAF_COMMAND included, it writes why to stderr and
+// any other value of SWW_COMMAND included, it writes why to stderr and
 // returns 1. It reads no other setting, nor a file that another names, so neither
 // can fail it.
 // args are the arguments after `healthcheck`; it takes none, and given
@@ -36,7 +36,7 @@ func HealthCheck(
 ) int {
 	if len(args) > 0 {
 		_, _ = fmt.Fprintf(stderr,
-			"smallwebwaf healthcheck: unexpected argument %q\n", args[0])
+			"sww healthcheck: unexpected argument %q\n", args[0])
 
 		return 1
 	}
@@ -49,8 +49,8 @@ func HealthCheck(
 	switch {
 	case err != nil:
 		err = fmt.Errorf("invalid setting: %w", err)
-	case command == "servewaf":
-		err = checkServeWAF(ctx, lookupEnv)
+	case command == "discriminator":
+		err = checkDiscriminator(ctx, lookupEnv)
 	default:
 		err = checkRProxyAndApp(ctx, lookupEnv)
 	}
@@ -64,16 +64,18 @@ func HealthCheck(
 	return 0
 }
 
-// checkServeWAF asks servewaf's health endpoint.
-func checkServeWAF(ctx context.Context, lookupEnv func(string) (string, bool)) error {
-	listenAddr, err := config.ServeWAFListenAddr(lookupEnv)
+// checkDiscriminator asks discriminator's health endpoint.
+func checkDiscriminator(
+	ctx context.Context, lookupEnv func(string) (string, bool),
+) error {
+	listenAddr, err := config.DiscriminatorListenAddr(lookupEnv)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
 
 	err = askHealthEndpoint(ctx, listenAddr)
 	if err != nil {
-		return fmt.Errorf("ask servewaf: %w", err)
+		return fmt.Errorf("ask discriminator: %w", err)
 	}
 
 	return nil
@@ -107,7 +109,7 @@ func checkRProxyAndApp(
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
-	health := "http://" + net.JoinHostPort("127.0.0.1", port) + servewaf.HealthPath
+	health := "http://" + net.JoinHostPort("127.0.0.1", port) + discriminator.HealthPath
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody)
 	if err != nil {

internal/sww/healthcheck_internal_test.go

@@ -1,4 +1,4 @@
-package smallwebwaf
+package sww
 
 import (
 	"net/url"

internal/sww/healthcheck_test.go

@@ -1,4 +1,4 @@
-package smallwebwaf_test
+package sww_test
 
 import (
 	"bytes"
@@ -12,18 +12,18 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
+	"sneak.berlin/go/smallwebwaf/internal/sww"
 )
 
 const (
 	// commandSetting says which command a container runs, and which the health
 	// check checks.
-	commandSetting = "SMALLWEBWAF_COMMAND"
-	// serveWAFCommand is the command that runs servewaf.
-	serveWAFCommand = "servewaf"
+	commandSetting = "SWW_COMMAND"
+	// discriminatorCommand is the command that runs discriminator.
+	discriminatorCommand = "discriminator"
 )
 
-func TestHealthCheckInServeWAFsContainer(t *testing.T) {
+func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	t.Parallel()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -47,7 +47,7 @@ func TestHealthCheckInServeWAFsContainer(t *testing.T) {
 	// The container's settings: an address to listen on with an empty
 	// host part, which the health check asks at 127.0.0.1.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: serveWAFCommand, listenAddr: ":" + port,
+		commandSetting: discriminatorCommand, listenAddr: ":" + port,
 	}, 0, "")
 
 	// The health check reads that setting alone, here given as a file: a removed
@@ -59,7 +59,7 @@ func TestHealthCheckInServeWAFsContainer(t *testing.T) {
 		{"SWWAF_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
-			commandSetting:       serveWAFCommand,
+			commandSetting:       discriminatorCommand,
 			listenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 			other.name:           other.value,
 		}, 0, "")
@@ -68,10 +68,10 @@ func TestHealthCheckInServeWAFsContainer(t *testing.T) {
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: serveWAFCommand, listenAddr: ":0",
-	}, 1, "unhealthy: ask servewaf: ")
+		commandSetting: discriminatorCommand, listenAddr: ":0",
+	}, 1, "unhealthy: ask discriminator: ")
 	wantHealthCheck(t, map[string]string{
-		commandSetting: serveWAFCommand, listenAddr: "8080",
+		commandSetting: discriminatorCommand, listenAddr: "8080",
 	}, 1, "unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
 
 	stop()
@@ -90,7 +90,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	defer app.Close()
 
 	// Nothing listens at the backend. The health check asks rproxy and the app,
-	// whether or not servewaf answers.
+	// whether or not discriminator answers.
 	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
 	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
 	settings := func(more ...string) map[string]string {
@@ -106,8 +106,8 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	wantHealthCheck(t, settings(commandSetting, ""), 0, "")
 	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
 
-	// SMALLWEBWAF_COMMAND cannot be given as a file.
-	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "servewaf\n")),
+	// SWW_COMMAND cannot be given as a file.
+	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "discriminator\n")),
 		0, "")
 
 	// Another setting does not fail it, even an invalid one, and neither does
@@ -136,8 +136,8 @@ func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
 	t.Parallel()
 
 	wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1,
-		"unhealthy: invalid setting: SMALLWEBWAF_COMMAND: "+
-			"\"healthcheck\" is not rproxy or servewaf\n")
+		"unhealthy: invalid setting: SWW_COMMAND: "+
+			"\"healthcheck\" is not rproxy or discriminator\n")
 }
 
 func TestHealthCheckRefusesAnArgument(t *testing.T) {
@@ -149,9 +149,9 @@ func TestHealthCheckRefusesAnArgument(t *testing.T) {
 		return "", false
 	}
 
-	got := smallwebwaf.HealthCheck(t.Context(), []string{"now"}, noSettings, &stderr)
+	got := sww.HealthCheck(t.Context(), []string{"now"}, noSettings, &stderr)
 
-	want := "smallwebwaf healthcheck: unexpected argument \"now\"\n"
+	want := "sww healthcheck: unexpected argument \"now\"\n"
 	if got != 1 || stderr.String() != want {
 		t.Errorf("health check returned %d and wrote %q, want 1 and %q",
 			got, stderr.String(), want)
@@ -166,7 +166,7 @@ func wantHealthCheck(t *testing.T, env map[string]string, status int, message st
 
 	var stderr bytes.Buffer
 
-	got := smallwebwaf.HealthCheck(t.Context(), nil, func(name string) (string, bool) {
+	got := sww.HealthCheck(t.Context(), nil, func(name string) (string, bool) {
 		value, ok := env[name]
 
 		return value, ok

internal/sww/rproxy.go

@@ -1,4 +1,4 @@
-package smallwebwaf
+package sww
 
 import (
 	"context"
@@ -13,7 +13,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 )
 
-// RunRProxy is `smallwebwaf rproxy`: it reads rproxy's settings, then serves
+// RunRProxy is `sww rproxy`: it reads rproxy's settings, then serves
 // requests until ctx is done. Then it gives the requests in progress
 // shutdownTimeout to finish, and the reports being sent SWRP_TIMEOUT_MS. It
 // returns the process's exit status, 1 when rproxy cannot start. Its process

internal/sww/rproxy_test.go

@@ -1,4 +1,4 @@
-package smallwebwaf_test
+package sww_test
 
 import (
 	"bufio"
@@ -19,18 +19,18 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
-	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/sww"
 )
 
 const (
-	// wafBackend is the setting that names servewaf to rproxy.
+	// wafBackend is the setting that names discriminator to rproxy.
 	wafBackend = "SWRP_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
 	rproxyListenAddr = "SWRP_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
 	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
-	// rproxyTimeout is the setting that says how long rproxy waits for servewaf.
+	// rproxyTimeout is the setting that says how long rproxy waits for discriminator.
 	rproxyTimeout = "SWRP_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
@@ -38,10 +38,10 @@ const (
 	otherClient = "198.51.100.7"
 )
 
-// runRProxy runs `smallwebwaf rproxy` with the settings in env until ctx is
+// runRProxy runs `sww rproxy` with the settings in env until ctx is
 // done, and returns its exit status.
 func runRProxy(ctx context.Context, env map[string]string, out *output) int {
-	return smallwebwaf.RunRProxy(ctx, smallwebwaf.Params{
+	return sww.RunRProxy(ctx, sww.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -52,7 +52,7 @@ func runRProxy(ctx context.Context, env map[string]string, out *output) int {
 	})
 }
 
-// startRProxy runs rproxy with servewaf at backend and the app at appURL, and
+// startRProxy runs rproxy with discriminator at backend and the app at appURL, and
 // returns its URL and what it writes. It believes X-Forwarded-For from the
 // tests. It stops as the test ends, and that it stopped in order is checked.
 func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
@@ -91,10 +91,10 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 	return "http://" + addr, out
 }
 
-// startServeWAF runs servewaf with the settings in env, and returns its address
-// and URL, what it writes, and what stops it, which checks that it stopped in
-// order.
-func startServeWAF(t *testing.T, env map[string]string) (string, *output, func()) {
+// startDiscriminator runs discriminator with the settings in env, and returns
+// its address and URL, what it writes, and what stops it, which checks that it
+// stopped in order.
+func startDiscriminator(t *testing.T, env map[string]string) (string, *output, func()) {
 	t.Helper()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -113,17 +113,17 @@ func startServeWAF(t *testing.T, env map[string]string) (string, *output, func()
 		select {
 		case status := <-exited:
 			if status != 0 {
-				t.Fatalf("servewaf's exit status %d, want 0; output:\n%s", status, out.text())
+				t.Fatalf("discriminator's exit status %d, want 0; output:\n%s", status, out.text())
 			}
 		case <-time.After(waitLimit):
-			t.Fatal("servewaf still running after being told to stop")
+			t.Fatal("discriminator still running after being told to stop")
 		}
 	}
 }
 
-// serveWAFSettings are servewaf's settings with the default rule file, to listen
-// at any free port.
-func serveWAFSettings(t *testing.T) map[string]string {
+// discriminatorSettings are discriminator's settings with the default rule
+// file, to listen at any free port.
+func discriminatorSettings(t *testing.T) map[string]string {
 	t.Helper()
 
 	return map[string]string{
@@ -136,7 +136,7 @@ func serveWAFSettings(t *testing.T) map[string]string {
 func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	t.Parallel()
 
-	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
+	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
 	defer stop()
 
 	backend := "http://" + addr
@@ -151,30 +151,32 @@ func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	wantStatus(t, second+"/", placed, http.StatusForbidden)
 	wantStatus(t, second+"/", otherClient, http.StatusOK)
 
-	// One request's three lines carry one id, rproxy's with servewaf's answer.
+	// One request's three lines carry one id, rproxy's with discriminator's answer.
 	line := firstOut.line(t, "path", bannedProbe)
-	if line["disposition"] != servewaf.DispositionDeny || line["client_ip"] != placed {
+	if line["disposition"] != discriminator.DispositionDeny ||
+		line["client_ip"] != placed {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
 	id, _ := line["request_id"].(string)
-	decision := serveWAFLine(t, serveWAFOut, id, "decision")
-	report := serveWAFLine(t, serveWAFOut, id, "report")
+	decision := discriminatorLine(t, discriminatorOut, id, "decision")
+	report := discriminatorLine(t, discriminatorOut, id, "report")
 
 	if decision["host"] != line["host"] || decision["client_ip"] != placed ||
 		report["status"] != float64(http.StatusForbidden) {
-		t.Errorf("servewaf's lines are %v and %v", decision, report)
+		t.Errorf("discriminator's lines are %v and %v", decision, report)
 	}
 }
 
-// serveWAFLine waits for servewaf's line with request id and servewaf_line kind.
-func serveWAFLine(t *testing.T, out *output, id, kind string) map[string]any {
+// discriminatorLine waits for discriminator's line with request id and
+// discriminator_line kind.
+func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]any {
 	t.Helper()
 
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
 		line := out.findLine(t, func(fields map[string]any) bool {
-			return fields["request_id"] == id && fields["servewaf_line"] == kind
+			return fields["request_id"] == id && fields["discriminator_line"] == kind
 		})
 		if line != nil {
 			return line
@@ -188,11 +190,11 @@ func serveWAFLine(t *testing.T, out *output, id, kind string) map[string]any {
 	return nil
 }
 
-func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
+func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T) {
 	t.Parallel()
 
-	env := serveWAFSettings(t)
-	addr, _, stop := startServeWAF(t, env)
+	env := discriminatorSettings(t)
+	addr, _, stop := startDiscriminator(t, env)
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
 
 	// A visitor who keeps asking throughout, and is never refused.
@@ -221,11 +223,11 @@ func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
 	wantStatus(t, site+"/", placed, http.StatusForbidden)
 	stop()
 
-	// With servewaf down, the site answers, and rproxy says the default did it.
+	// With discriminator down, the site answers, and rproxy says the default did it.
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 
 	line := out.line(t, "path", "/after-stop")
-	if line["disposition"] != servewaf.DispositionAllow ||
+	if line["disposition"] != discriminator.DispositionAllow ||
 		line["default_disposition"] != true {
 		t.Errorf("rproxy's line is %v", line)
 	}
@@ -233,7 +235,7 @@ func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
 	// Back at its address, with its state files, it applies the ban again.
 	restarted := maps.Clone(env)
 	restarted[listenAddr] = addr
-	_, _, stop = startServeWAF(t, restarted)
+	_, _, stop = startDiscriminator(t, restarted)
 
 	defer stop()
 
@@ -306,10 +308,10 @@ func sendRaw(t *testing.T, site, request string) int {
 	return res.StatusCode
 }
 
-func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
+func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
 	t.Parallel()
 
-	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
+	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
 	defer stop()
 
 	site, _ := startRProxy(t, "http://"+addr, startApp(t))
@@ -318,7 +320,7 @@ func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
 	const smuggledID = "smuggled-request"
 
 	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
-		servewaf.ClientHeader + ": " + otherClient + "\r\n" +
+		discriminator.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 
 	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
@@ -334,18 +336,18 @@ func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
 		time.Sleep(pollInterval)
 	}
 
-	line := serveWAFOut.findLine(t, func(fields map[string]any) bool {
+	line := discriminatorOut.findLine(t, func(fields map[string]any) bool {
 		return fields["request_id"] == smuggledID
 	})
 	if line != nil {
-		t.Errorf("servewaf read the body as a request: %v", line)
+		t.Errorf("discriminator read the body as a request: %v", line)
 	}
 }
 
-func TestATargetThatCannotGoToServeWAFIsRefusedForABannedClient(t *testing.T) {
+func TestATargetThatCannotGoToDiscriminatorIsRefusedForABannedClient(t *testing.T) {
 	t.Parallel()
 
-	addr, _, stop := startServeWAF(t, serveWAFSettings(t))
+	addr, _, stop := startDiscriminator(t, discriminatorSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
@@ -369,7 +371,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 
 	const zoned = "2001:db8::1%eth0"
 
-	addr, _, stop := startServeWAF(t, serveWAFSettings(t))
+	addr, _, stop := startDiscriminator(t, discriminatorSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
@@ -384,7 +386,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 	}
 }
 
-func TestAStatusServeWAFDoesNotTakeIsReportedAs599(t *testing.T) {
+func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
 	t.Parallel()
 
 	const status = 799
@@ -395,7 +397,7 @@ func TestAStatusServeWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 		}))
 	t.Cleanup(app.Close)
 
-	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
+	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, app.URL)
@@ -409,13 +411,13 @@ func TestAStatusServeWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 
 	id, _ := line["request_id"].(string)
 
-	report := serveWAFLine(t, serveWAFOut, id, "report")
+	report := discriminatorLine(t, discriminatorOut, id, "report")
 	if report["status"] != 599.0 {
-		t.Errorf("servewaf's line is %v, want status 599", report)
+		t.Errorf("discriminator's line is %v, want status 599", report)
 	}
 }
 
-// startRProxyProcess runs `smallwebwaf rproxy` in a process of its own, with the
+// startRProxyProcess runs `sww rproxy` in a process of its own, with the
 // settings in env, each as NAME=value. It returns where rproxy listens, the
 // process, and what rproxy writes.
 func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output) {
@@ -453,16 +455,16 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 	return addr, cmd, out
 }
 
-func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
+func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	t.Parallel()
 
 	protocols := make(chan string, 10)
 	backend := httptest.NewUnstartedServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(discriminator.ClientHeader) != "" {
 				protocols <- r.Proto
 
-				w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionDeny)
+				w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
 			}
 		}))
@@ -472,7 +474,7 @@ func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 
 	// rproxy has no setting for the certificates it trusts, so it is told of this
 	// one as Go's client is told of any, in a process of its own.
-	certificates := filepath.Join(t.TempDir(), "servewaf.pem")
+	certificates := filepath.Join(t.TempDir(), "discriminator.pem")
 
 	err := os.WriteFile(certificates, pem.EncodeToMemory(&pem.Block{
 		Type: "CERTIFICATE", Bytes: backend.Certificate().Raw,
@@ -494,7 +496,7 @@ func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	} {
 		status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n")
 		if status != http.StatusForbidden {
-			t.Errorf("with %s: status %d, want servewaf's 403", name, status)
+			t.Errorf("with %s: status %d, want discriminator's 403", name, status)
 		}
 
 		select {
@@ -503,7 +505,7 @@ func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 				t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol)
 			}
 		case <-time.After(waitLimit):
-			t.Errorf("with %s: servewaf was not asked", name)
+			t.Errorf("with %s: discriminator was not asked", name)
 		}
 	}
 }
@@ -532,8 +534,8 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
-				w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionAllow)
+			if r.Header.Get(discriminator.ClientHeader) != "" {
+				w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow)
 
 				return
 			}
@@ -640,7 +642,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionAllow)
+			w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 
@@ -703,7 +705,7 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 		{"no backend", wafBackend, nil},
 		{
 			"another invalid", rproxyTimeout,
-			map[string]string{wafBackend: "http://servewaf:8080", rproxyTimeout: "soon"},
+			map[string]string{wafBackend: "http://discriminator:8080", rproxyTimeout: "soon"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -740,7 +742,7 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	out := &output{}
 
 	status := runRProxy(t.Context(), map[string]string{
-		wafBackend:       "http://servewaf:8080",
+		wafBackend:       "http://discriminator:8080",
 		rproxyListenAddr: taken.Addr().String(),
 	}, out)
 	if status != 1 {
@@ -757,7 +759,7 @@ func TestMainRunsRProxy(t *testing.T) {
 	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
-		"http://"+addr+servewaf.HealthPath, http.NoBody)
+		"http://"+addr+discriminator.HealthPath, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}

internal/sww/sww.go

@@ -1,11 +1,11 @@
-// Package smallwebwaf runs the smallwebwaf process, as the command it is given.
-// `smallwebwaf servewaf` reads the settings, the rule files, the lookup database
+// Package sww runs the sww process, as the command it is given.
+// `sww discriminator` reads the settings, the rule files, the lookup database
 // and the state files, answers rproxy's questions until it is told to stop, and
-// then stops in an orderly way, writing the state files. `smallwebwaf rproxy`
+// then stops in an orderly way, writing the state files. `sww rproxy`
 // reads rproxy's settings alone, and runs the reverse proxy in front of one app
-// that asks servewaf about each request. `smallwebwaf healthcheck` is the
+// that asks discriminator about each request. `sww healthcheck` is the
 // container's health check.
-package smallwebwaf
+package sww
 
 import (
 	"context"
@@ -22,39 +22,39 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
 // shutdownTimeout is how long requests in progress may take to finish
-// once smallwebwaf is told to stop, before their connections are closed.
+// once sww is told to stop, before their connections are closed.
 // runit and docker wait a little longer before they kill the process.
 const shutdownTimeout = 5 * time.Second
 
-// remoteLogStopTimeout is how long, as servewaf stops, the log lines still
+// remoteLogStopTimeout is how long, as discriminator stops, the log lines still
 // waiting are sent to SWWAF_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
 
-// usageStatus is the exit status with no command, or one smallwebwaf does not
+// usageStatus is the exit status with no command, or one sww does not
 // know.
 const usageStatus = 2
 
-// usage is what smallwebwaf prints then.
-const usage = `usage: smallwebwaf <command>
+// usage is what sww prints then.
+const usage = `usage: sww <command>
 
 commands:
   rproxy       the reverse proxy in front of one app
-  servewaf     decides for rproxy, and keeps bans, counters and history
+  discriminator     decides for rproxy, and keeps bans, counters and history
   healthcheck  the container's health check
 `
 
-// Params are what RunServeWAF and RunRProxy need from the process.
+// Params are what RunDiscriminator and RunRProxy need from the process.
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
@@ -65,7 +65,7 @@ type Params struct {
 }
 
 // Main runs the command os.Args names, and returns the process's exit status.
-// `smallwebwaf rproxy` and `smallwebwaf servewaf` run until SIGTERM or SIGINT.
+// `sww rproxy` and `sww discriminator` run until SIGTERM or SIGINT.
 // With no command, or one it does not know, it prints the commands and returns
 // usageStatus.
 func Main(version string) int {
@@ -83,8 +83,8 @@ func Main(version string) int {
 	switch args[0] {
 	case "rproxy":
 		return RunRProxy(ctx, params)
-	case "servewaf":
-		return RunServeWAF(ctx, params)
+	case "discriminator":
+		return RunDiscriminator(ctx, params)
 	case "healthcheck":
 		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
 	default:
@@ -99,10 +99,10 @@ func printUsage(w io.Writer) int {
 	return usageStatus
 }
 
-// RunServeWAF is `smallwebwaf servewaf`: it reads the settings, the rule files,
+// RunDiscriminator is `sww discriminator`: it reads the settings, the rule files,
 // the lookup database and the state files, then serves requests until ctx is
-// done. It returns the process's exit status, 1 when servewaf cannot start.
-func RunServeWAF(ctx context.Context, params Params) int {
+// done. It returns the process's exit status, 1 when discriminator cannot start.
+func RunDiscriminator(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWWAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
@@ -184,13 +184,13 @@ func RunServeWAF(ctx context.Context, params Params) int {
 	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
 }
 
-// newServer returns the server servewaf runs, with the metrics of the alerts,
+// newServer returns the server discriminator runs, with the metrics of the alerts,
 // after reading the lookup database while SWWAF_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
-) (*servewaf.Server, error) {
+) (*discriminator.Server, error) {
 	var lookupFile *lookup.File
 
 	if cfg.LookupSource == "file" {
@@ -207,7 +207,7 @@ func newServer(
 		}
 	}
 
-	server := servewaf.New(servewaf.Params{
+	server := discriminator.New(discriminator.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -230,7 +230,7 @@ func newServer(
 // loadStateFiles reads the state files into the parts of server and into
 // alertQueue, as state.Load does.
 func loadStateFiles(
-	cfg *config.Config, server *servewaf.Server, alertQueue *alerts.Queue,
+	cfg *config.Config, server *discriminator.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
@@ -286,7 +286,7 @@ func newRemoteLogSender(cfg *config.Config) *remotelog.Sender {
 // startSending runs remote until the function it returns is called, which
 // then waits at most remoteLogStopTimeout for the lines still waiting to
 // be sent. Sending goes on after ctx is done, so that the lines written
-// while smallwebwaf stops are sent too.
+// while sww stops are sent too.
 func startSending(
 	ctx context.Context, remote *remotelog.Sender, processLog *slog.Logger,
 ) func() {
@@ -316,7 +316,7 @@ func startSending(
 // shutdownTimeout to finish, and writes every state file, alerts.json with
 // the alerts still waiting.
 func serve(
-	ctx context.Context, server *servewaf.Server, listener net.Listener,
+	ctx context.Context, server *discriminator.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {

internal/sww/sww_internal_test.go

@@ -1,4 +1,4 @@
-package smallwebwaf
+package sww
 
 import (
 	"log/slog"

internal/sww/sww_test.go

@@ -1,4 +1,4 @@
-package smallwebwaf_test
+package sww_test
 
 import (
 	"bytes"
@@ -19,9 +19,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
-	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
+	"sneak.berlin/go/smallwebwaf/internal/sww"
 )
 
 const (
@@ -29,7 +29,7 @@ const (
 	waitLimit = 10 * time.Second
 	// pollInterval is how often a test looks for a line.
 	pollInterval = 10 * time.Millisecond
-	// testVersion is the version the tests give smallwebwaf.
+	// testVersion is the version the tests give sww.
 	testVersion = "test"
 	// localhost is where the tests listen.
 	localhost            = "127.0.0.1"
@@ -56,13 +56,13 @@ const (
 	placed = "203.0.113.9"
 )
 
-// output collects what smallwebwaf writes on stdout.
+// output collects what sww writes on stdout.
 type output struct {
 	mu  sync.Mutex
 	buf bytes.Buffer
 }
 
-// Write adds lines smallwebwaf writes.
+// Write adds lines sww writes.
 func (o *output) Write(p []byte) (int, error) {
 	o.mu.Lock()
 	defer o.mu.Unlock()
@@ -122,11 +122,11 @@ func (o *output) text() string {
 	return o.buf.String()
 }
 
-// run runs `smallwebwaf servewaf` with the settings in env until ctx is done,
+// run runs `sww discriminator` with the settings in env until ctx is done,
 // and returns its exit status. SWWAF_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
-	return smallwebwaf.RunServeWAF(ctx, smallwebwaf.Params{
+	return sww.RunDiscriminator(ctx, sww.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -263,7 +263,7 @@ func TestServesUntilToldToStop(t *testing.T) {
 func TestLogLevelHoldsBackTheLessSevereProcessLines(t *testing.T) {
 	t.Parallel()
 
-	// A list that cannot be fetched has a warning written once smallwebwaf
+	// A list that cannot be fetched has a warning written once sww
 	// serves, after its starting line.
 	lists := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
@@ -324,7 +324,7 @@ func TestEveryLogLineAndMetricCarriesTheInstanceName(t *testing.T) {
 	var metrics string
 
 	out := runUntilStopped(t, env, func(url string) {
-		metrics = metricsText(t, url+"_smallwebwaf/metrics", token)
+		metrics = metricsText(t, url+"_sww/metrics", token)
 	})
 
 	// The process's lines from its start to its stop, and the request's.
@@ -356,7 +356,7 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 		rulesDir:        t.TempDir(),
 		rateLimitPerDay: "2",
 		// Neither comes due in the test: the files are written as
-		// smallwebwaf stops.
+		// sww stops.
 		stateWriteDelay:      "1h",
 		stateCounterInterval: "1h",
 	}
@@ -461,13 +461,13 @@ func TestBanAddedAndLiftedThroughTheEndpointsKeptInBansJSON(t *testing.T) {
 		rulesDir:   t.TempDir(),
 		adminToken: adminSecret,
 		// Neither comes due in the test: the files are written as
-		// smallwebwaf stops.
+		// sww stops.
 		stateWriteDelay:      "1h",
 		stateCounterInterval: "1h",
 	}
 
 	runUntilStopped(t, env, func(url string) {
-		askAsAdmin(t, http.MethodPost, url+"_smallwebwaf/bans",
+		askAsAdmin(t, http.MethodPost, url+"_sww/bans",
 			`{"netblock": "203.0.113.0/24", "duration": "permanent", `+
 				`"reason": "probes for logins"}`)
 		wantStatus(t, url, "203.0.113.9", http.StatusForbidden)
@@ -484,7 +484,7 @@ func TestBanAddedAndLiftedThroughTheEndpointsKeptInBansJSON(t *testing.T) {
 	// more, and bans.json keeps it, marked lifted.
 	runUntilStopped(t, env, func(url string) {
 		wantStatus(t, url, "203.0.113.9", http.StatusForbidden)
-		askAsAdmin(t, http.MethodDelete, url+"_smallwebwaf/bans/203.0.113.9", "")
+		askAsAdmin(t, http.MethodDelete, url+"_sww/bans/203.0.113.9", "")
 		wantStatus(t, url, "203.0.113.9", http.StatusOK)
 	})
 
@@ -511,7 +511,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 		wantAllowed(t, url)
 
 		// Written once: each change would start the rule files' wait
-		// again. A file written before smallwebwaf watches the directory is
+		// again. A file written before sww watches the directory is
 		// read once it does.
 		err := os.WriteFile(filepath.Join(dir, "50-app.rules"),
 			[]byte("everything path block ^/\n"), 0o600)
@@ -583,7 +583,7 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	runUntilStopped(t, env, func(url string) {
 		wantStatus(t, url, placed, http.StatusOK)
 
-		// smallwebwaf reads the file again once it watches its directory,
+		// sww reads the file again once it watches its directory,
 		// which may be after the first replacement. Once that has taken
 		// effect, only the watch can show the next. Each takes as long as
 		// it takes, so that a slow test process cannot fail the test.
@@ -609,10 +609,10 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 
 		rename(t, replacement, path)
 
-		metrics := metricsWith(t, url+"_smallwebwaf/metrics", token,
-			`smallwebwaf_lookup_database_read_failures_total{instance="fsn1app1/blog"} 1`)
+		metrics := metricsWith(t, url+"_sww/metrics", token,
+			`sww_lookup_database_read_failures_total{instance="fsn1app1/blog"} 1`)
 		lastRead = seriesValue(t, metrics,
-			`smallwebwaf_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/blog"}`)
+			`sww_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/blog"}`)
 
 		wantStatus(t, url, placed, http.StatusOK)
 	})
@@ -668,13 +668,13 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 		// too.
 		rateLimitExemptNets: placed + "," + localhost,
 	}
-	failures := `smallwebwaf_reputation_failures_total{instance="fsn1app1/blog",` +
+	failures := `sww_reputation_failures_total{instance="fsn1app1/blog",` +
 		`source="` + torURL + `"} `
 
 	// tor.txt cannot be fetched at first, which is counted.
 	failing.Store(true)
 	runUntilStopped(t, env, func(url string) {
-		metricsWith(t, url+"_smallwebwaf/metrics", token, failures+"1")
+		metricsWith(t, url+"_sww/metrics", token, failures+"1")
 	})
 
 	// Restarted with drop.txt named after it and the server answering, tor.txt
@@ -849,7 +849,7 @@ func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 	})
 	out.line(t, "type", "request")
 
-	// smallwebwaf connected as it started, and closes the connection once
+	// sww connected as it started, and closes the connection once
 	// it has sent the lines written as it stopped.
 	conn, err := endpoint.Accept()
 	if err != nil {
@@ -907,17 +907,17 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 
 		// More than one line has been written, and the buffer holds the
 		// last.
-		metrics := metricsText(t, url+"_smallwebwaf/metrics", token)
+		metrics := metricsText(t, url+"_sww/metrics", token)
 		for _, series := range []string{
-			`smallwebwaf_remote_log_lines_sent_total{instance="fsn1app1/blog"} 0`,
-			`smallwebwaf_remote_log_buffer_depth{instance="fsn1app1/blog"} 1`,
+			`sww_remote_log_lines_sent_total{instance="fsn1app1/blog"} 0`,
+			`sww_remote_log_buffer_depth{instance="fsn1app1/blog"} 1`,
 		} {
 			if !strings.Contains(metrics, "\n"+series+"\n") {
 				t.Errorf("no %q in the metrics:\n%s", series, metrics)
 			}
 		}
 
-		const dropped = "\nsmallwebwaf_remote_log_lines_dropped_total" +
+		const dropped = "\nsww_remote_log_lines_dropped_total" +
 			`{instance="fsn1app1/blog"} `
 		if strings.Contains(metrics, dropped+"0\n") || !strings.Contains(metrics, dropped) {
 			t.Errorf("no line dropped in the metrics:\n%s", metrics)
@@ -978,8 +978,8 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 		webhook.waitFor(t, "permanent_ban", false)
 	})
 
-	// alerts.json keeps it as smallwebwaf stops, and once started again,
-	// smallwebwaf sends it.
+	// alerts.json keeps it as sww stops, and once started again,
+	// sww sends it.
 	var file struct {
 		Waiting map[string][]struct {
 			Event string `json:"event"`
@@ -1013,11 +1013,11 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 
 		const ofWebhook = `{destination="webhook",instance="fsn1app1/blog"}`
 
-		metrics := metricsWith(t, url+"_smallwebwaf/metrics", token,
-			"\nsmallwebwaf_alerts_sent_total"+ofWebhook+" 1\n")
+		metrics := metricsWith(t, url+"_sww/metrics", token,
+			"\nsww_alerts_sent_total"+ofWebhook+" 1\n")
 
 		for _, series := range []string{"failed", "suppressed", "dropped"} {
-			zero := "\nsmallwebwaf_alerts_" + series + "_total" + ofWebhook + " 0\n"
+			zero := "\nsww_alerts_" + series + "_total" + ofWebhook + " 0\n"
 			if !strings.Contains(metrics, zero) {
 				t.Errorf("no %q in the metrics:\n%s", zero, metrics)
 			}
@@ -1079,13 +1079,13 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 		// webhook, which is not set. As long as that takes, so that a slow
 		// test process cannot fail the test.
 		sent := []string{
-			"\nsmallwebwaf_alerts_sent_total{destination=\"slack\"," +
+			"\nsww_alerts_sent_total{destination=\"slack\"," +
 				"instance=\"fsn1app1/blog\"} 1\n",
-			"\nsmallwebwaf_alerts_sent_total{destination=\"ntfy\"," +
+			"\nsww_alerts_sent_total{destination=\"ntfy\"," +
 				"instance=\"fsn1app1/blog\"} 1\n",
 		}
 
-		metrics := metricsWith(t, url+"_smallwebwaf/metrics", token, sent...)
+		metrics := metricsWith(t, url+"_sww/metrics", token, sent...)
 		if strings.Contains(metrics, `destination="webhook"`) {
 			t.Errorf("the metrics give the webhook:\n%s", metrics)
 		}
@@ -1114,7 +1114,7 @@ func TestUnwritableStateDirStopsTheStart(t *testing.T) {
 		"SWWAF_STATE_DIR cannot be written: ")
 }
 
-// wantStartRefused runs smallwebwaf with its state files in dir, and
+// wantStartRefused runs sww with its state files in dir, and
 // checks that it stops at start, with an error that starts with want. If
 // it starts instead, it is stopped after waitLimit.
 func wantStartRefused(t *testing.T, dir, want string) {
@@ -1140,7 +1140,7 @@ func wantStartRefused(t *testing.T, dir, want string) {
 	}
 }
 
-// wantRulesRefused runs smallwebwaf with its rule files in dir, and
+// wantRulesRefused runs sww with its rule files in dir, and
 // checks that it stops at start, with the error want. If it starts
 // instead, it is stopped after waitLimit.
 func wantRulesRefused(t *testing.T, dir, want string) {
@@ -1178,7 +1178,7 @@ func startApp(t *testing.T) string {
 	return app.URL
 }
 
-// runUntilStopped runs `smallwebwaf servewaf` with the settings in env, has use
+// runUntilStopped runs `sww discriminator` with the settings in env, has use
 // send it requests at url, then stops it as SIGTERM does, checks that it
 // stopped in order, and returns its output.
 func runUntilStopped(
@@ -1252,7 +1252,7 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 	}
 }
 
-// wantAllowed checks that servewaf at url allows a request from localhost.
+// wantAllowed checks that discriminator at url allows a request from localhost.
 func wantAllowed(t *testing.T, url string) {
 	t.Helper()
 
@@ -1437,7 +1437,7 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 	return file.Bans[0]
 }
 
-// wantRefused checks that servewaf at url refuses a request from localhost with
+// wantRefused checks that discriminator at url refuses a request from localhost with
 // 403, the default SWWAF_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
@@ -1459,7 +1459,7 @@ func wantStatus(t *testing.T, url, from string, status int) {
 // saveUntilAnswered writes content to the state file at path, as an
 // admin saves an edit of it, until a request to url from the client at
 // from is answered with status. The file is written again before each
-// request, since smallwebwaf may not watch its directory yet when it is
+// request, since sww may not watch its directory yet when it is
 // first written. It waits as long as that takes, so that a slow test
 // process cannot fail the test.
 func saveUntilAnswered(t *testing.T, path, content, url, from string, status int) {
@@ -1614,8 +1614,8 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost
 }
 
 // statusFrom returns the status a request to url from the client at from is
-// answered with. The request serves rproxy and servewaf alike. rproxy reads the
-// client from X-Forwarded-For, and replaces the other two headers. To servewaf,
+// answered with. The request serves rproxy and discriminator alike. rproxy reads the
+// client from X-Forwarded-For, and replaces the other two headers. To discriminator,
 // they make it a question about that client.
 func statusFrom(t *testing.T, url, from string) int {
 	t.Helper()
@@ -1627,7 +1627,7 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
-	req.Header.Set(servewaf.ClientHeader, from)
+	req.Header.Set(discriminator.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}

internal/waf/waf.go

@@ -1,10 +1,10 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWWAF_WAF_BODY_LIMIT is set, with the six changes smallwebwaf
+// body while SWWAF_WAF_BODY_LIMIT is set, with the six changes sww
 // makes to it, as "Attack detection" under "Settings" in SPEC.md describes
 // them. It reads no response.
 //
-// smallwebwaf writes only to its state directory, so Coraza is built with
+// sww writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
 // file in a multipart body, Coraza then counts the bytes instead of
 // writing them to the system's temporary directory.
@@ -25,15 +25,15 @@ import (
 	"github.com/corazawaf/coraza/v3/types"
 )
 
-// directives are the Core Rule Set as smallwebwaf runs it, with the
+// directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, and bodyDirectives for %s while
-// SWWAF_WAF_BODY_LIMIT is set. Each rule smallwebwaf adds has an id from
+// SWWAF_WAF_BODY_LIMIT is set. Each rule sww adds has an id from
 // 900000 to 900999, the ids the Core Rule Set keeps for the rules that set
 // it up, which SWWAF_WAF_DISABLED_RULES refuses, so that no setting
 // switches one off. Coraza joins a line ending in \ to the next, without
 // the spaces at the start of the next.
 const directives = `
-# The engine only detects. smallwebwaf compares the request's anomaly
+# The engine only detects. sww compares the request's anomaly
 # score with SWWAF_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly

internal/waf/waf_test.go

@@ -111,7 +111,7 @@ func matched(ids ...int) waf.Result {
 	return waf.Result{RuleIDs: ids, Score: critical * len(ids)}
 }
 
-// atDefaults returns the Core Rule Set as smallwebwaf runs it by default.
+// atDefaults returns the Core Rule Set as sww runs it by default.
 func atDefaults(t *testing.T) *waf.CoreRuleSet {
 	t.Helper()
 
@@ -376,7 +376,7 @@ const (
 // injection is an SQL injection, which rule 942100 matches.
 const injection = "1' OR '1'='1"
 
-// readingBodies returns the Core Rule Set as smallwebwaf runs it by
+// readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *waf.CoreRuleSet {
 	t.Helper()