rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over HTTP/1.1, and passes what servewaf allows to the app within its limits. Any other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION decides only when servewaf cannot be connected to, does not answer at all, or does not answer within SWRP_TIMEOUT_MS. A method SPEC.md does not list gets 405. Duplication: internal/rproxy copies passing-on code from internal/proxy until #172 removes the originals. Rule suppressed: gosec G704 and G705; gosec at internal/smallwebwaf/rproxy_test.go:431; tagliatelle at internal/requestlog/requestlog.go:201; paralleltest on one test. Judgement call: an answer over 1 MiB, or with a status below 200, gets 502. Judgement call: every target not starting with one / gets 400. Model: opus-5-5
2026-11-05 04:07:40 +00:00
parent 2eeea136e8
commit e0b71be0f7
23 changed files with 6181 additions and 59 deletions
@@ -51,3 +51,9 @@ curl -H "Authorization: Bearer $TOKEN" \

 `smallwebwaf servewaf` answers these endpoints at its own address. No check runs
 on those requests (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).
+
+## `rproxy`
+
+`smallwebwaf rproxy` answers only the health check, at its own address. It asks
+`servewaf` about any other request under `/_smallwebwaf/` (see "`rproxy`" in
+[`SPEC.md`](../SPEC.md)).