rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/config/config.go

@@ -1,9 +1,10 @@
 // Package config reads smallwebwaf's settings, and is the one place they are
-// read. Every setting is an environment variable. The settings of
-// `smallwebwaf` and `smallwebwaf servewaf` start with SWWAF_, every one of them
-// has a default, and most can be given as a file instead. Those of `smallwebwaf
-// rproxy` start with SWRP_. Each of them but SWRP_WAF_BACKEND has a default, and
-// none can be given as a file, since rproxy never touches disk.
+// read. Every setting is an environment variable. The settings of `smallwebwaf
+// servewaf` start with SWWAF_, every one of them has a default, and most can be
+// given as a file instead. Those of `smallwebwaf rproxy` start with SWRP_. Each
+// of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
+// since rproxy never touches disk. SMALLWEBWAF_COMMAND chooses which of the two
+// the image runs.
 package config
 
 import (
@@ -30,13 +31,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// Config is smallwebwaf's settings. A timeout, size or rate limit of zero
-// is off.
+// Config is the settings of `smallwebwaf servewaf`. A time or size limit of
+// zero is off.
 type Config struct {
-	// ListenAddr is where smallwebwaf listens (SWWAF_LISTEN_ADDR).
+	// ListenAddr is where servewaf listens (SWWAF_LISTEN_ADDR).
 	ListenAddr string
-	// UpstreamURL is the app (SWWAF_UPSTREAM_URL).
-	UpstreamURL *url.URL
 	// InstanceName is the name every log line and alert gives as instance,
 	// and every metric carries as its label instance (SWWAF_INSTANCE_NAME),
 	// by default the host's name, which docker sets to the first 12
@@ -45,42 +44,14 @@ type Config struct {
 	// Observe is true in observe mode, when SWWAF_MODE is observe rather
 	// than enforce: a request that SWWAF_DENY_NETS, a ban, the country
 	// lists, a rate limit, a rule or the Core Rule Set would refuse is
-	// passed to the app instead, and no ban is made.
+	// allowed instead, and no ban is made.
 	Observe bool
-	// TrustedProxies are the netblocks whose X-Forwarded-For is
-	// believed (SWWAF_TRUSTED_PROXIES).
-	TrustedProxies []netip.Prefix
 	// IPv6GroupPrefix is the length of the IPv6 netblock that is one client
 	// (SWWAF_IPV6_GROUP_PREFIX), from 32 to 128.
 	IPv6GroupPrefix int
 	// MaxTrackedClients is the most clients the table of clients holds, in
 	// memory and in clients.json (SWWAF_MAX_TRACKED_CLIENTS).
 	MaxTrackedClients int
-	// ClientRequestTimeout bounds reading the whole request from the
-	// client (SWWAF_CLIENT_REQUEST_TIMEOUT).
-	ClientRequestTimeout time.Duration
-	// ClientRequestHeaderMaxBytes is the largest request line and headers
-	// a client may send (SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES). It is
-	// never off, and always more than 4K.
-	ClientRequestHeaderMaxBytes int64
-	// ClientIdleTimeout bounds how long a kept-open client connection
-	// may wait for its next request (SWWAF_CLIENT_IDLE_TIMEOUT).
-	ClientIdleTimeout time.Duration
-	// ClientResponseTimeout bounds writing the whole response to the
-	// client (SWWAF_CLIENT_RESPONSE_TIMEOUT).
-	ClientResponseTimeout time.Duration
-	// UpstreamRequestTimeout bounds connecting to the app and writing
-	// the whole request to it (SWWAF_UPSTREAM_REQUEST_TIMEOUT).
-	UpstreamRequestTimeout time.Duration
-	// UpstreamResponseTimeout bounds reading the whole response from
-	// the app (SWWAF_UPSTREAM_RESPONSE_TIMEOUT).
-	UpstreamResponseTimeout time.Duration
-	// RequestMaxBytes is the largest request body
-	// (SWWAF_REQUEST_MAX_BYTES).
-	RequestMaxBytes int64
-	// ResponseMaxBytes is the largest response body
-	// (SWWAF_RESPONSE_MAX_BYTES).
-	ResponseMaxBytes int64
 	// AllowNets are the netblocks whose clients skip every check
 	// (SWWAF_ALLOW_NETS). RateLimitExemptNets are those whose clients the
 	// rate limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_NETS).
@@ -260,9 +231,8 @@ type Config struct {
 	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that smallwebwaf may refuse after a rule file or Core Rule Set match
-	// or for a missing or wrong token; one more breaks a limit
-	// (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
+	// that servewaf may refuse after a rule file or Core Rule Set match; one
+	// more breaks a limit (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
 	// (SWWAF_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
@@ -365,8 +335,8 @@ const (
 	// masked is what the log shows for a token that is set, and in place of
 	// a secret in another setting.
 	masked = "********"
-	// defaultListenAddr and defaultUpstreamURL are the defaults of
-	// SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL.
+	// defaultListenAddr is the default of SWWAF_LISTEN_ADDR and
+	// SWRP_LISTEN_ADDR, and defaultUpstreamURL that of SWRP_UPSTREAM_URL.
 	defaultListenAddr  = ":8080"
 	defaultUpstreamURL = "http://127.0.0.1:8081"
 )
@@ -394,13 +364,14 @@ var (
 	errHeaderTakenOut = errors.New(
 		"is taken out of every request by Go's HTTP server, so it can never " +
 			"be logged")
-	errOnBothLists          = errors.New("is in SWWAF_DENIED_COUNTRIES too")
-	errNotLookupSource      = errors.New("is not geojs, file or off")
-	errNeedsLookups         = errors.New("it needs each client looked up")
-	errNeedsDBPath          = errors.New("it names the file to look clients up in")
-	errDBPathUnused         = errors.New("only file reads it")
-	errNotOver4K            = errors.New("is not a size of more than 4K, such as 32K")
-	errOver1G               = errors.New("is more than 1G, the most Coraza reads")
+	errOnBothLists     = errors.New("is in SWWAF_DENIED_COUNTRIES too")
+	errNotLookupSource = errors.New("is not geojs, file or off")
+	errNeedsLookups    = errors.New("it needs each client looked up")
+	errNeedsDBPath     = errors.New("it names the file to look clients up in")
+	errDBPathUnused    = errors.New("only file reads it")
+	errOver64K         = errors.New(
+		"is more than 64K, the most servewaf gets of a body")
+	errNotCommand           = errors.New("is not rproxy or servewaf")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -489,38 +460,27 @@ var (
 func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
-		ListenAddr:           env.address("SWWAF_LISTEN_ADDR", defaultListenAddr),
-		UpstreamURL:          env.appURL("SWWAF_UPSTREAM_URL", defaultUpstreamURL),
+		ListenAddr:           env.address("SWWAF_LISTEN_ADDR"),
 		InstanceName:         env.instanceName(),
 		Observe:              env.observe("SWWAF_MODE", "enforce"),
-		TrustedProxies:       env.netblocks("SWWAF_TRUSTED_PROXIES", privateRanges),
 		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWWAF_IPV6_GROUP_PREFIX", "64"),
 		MaxTrackedClients:    env.numberNotOff("SWWAF_MAX_TRACKED_CLIENTS", "20000"),
-		ClientRequestTimeout: env.duration("SWWAF_CLIENT_REQUEST_TIMEOUT", "60s"),
-		ClientRequestHeaderMaxBytes: env.headerSize(
-			"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES", "32K"),
-		ClientIdleTimeout:       env.duration("SWWAF_CLIENT_IDLE_TIMEOUT", "120s"),
-		ClientResponseTimeout:   env.duration("SWWAF_CLIENT_RESPONSE_TIMEOUT", "30m"),
-		UpstreamRequestTimeout:  env.duration("SWWAF_UPSTREAM_REQUEST_TIMEOUT", "60s"),
-		UpstreamResponseTimeout: env.duration("SWWAF_UPSTREAM_RESPONSE_TIMEOUT", "30m"),
-		RequestMaxBytes:         env.size("SWWAF_REQUEST_MAX_BYTES", "100M"),
-		ResponseMaxBytes:        env.size("SWWAF_RESPONSE_MAX_BYTES", "1G"),
-		AllowNets:               env.netblocks("SWWAF_ALLOW_NETS", ""),
-		RateLimitExemptNets:     env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
-		DenyNets:                env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
-		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
-		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
-		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
-		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
-		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
-		BytesLimitPerDay:        env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
-		BytesCount:              env.bytesCount("SWWAF_BYTES_COUNT", "both"),
-		LookupSource:            env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
-		LookupDBPath:            env.value("SWWAF_LOOKUP_DB_PATH", ""),
-		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "800ms"),
-		AddLookupHeaders:        env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
-		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
+		AllowNets:            env.netblocks("SWWAF_ALLOW_NETS", ""),
+		RateLimitExemptNets:  env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
+		DenyNets:             env.netblocks("SWWAF_DENY_NETS", ""),
+		RateLimitPerMinute:   env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
+		RateLimitPerHour:     env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
+		RateLimitPerDay:      env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
+		RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
+		BytesLimitPerMinute:  env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
+		BytesLimitPerHour:    env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
+		BytesLimitPerDay:     env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
+		BytesCount:           env.bytesCount("SWWAF_BYTES_COUNT", "both"),
+		LookupSource:         env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
+		LookupDBPath:         env.value("SWWAF_LOOKUP_DB_PATH", ""),
+		LookupTimeout:        env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "800ms"),
+		AddLookupHeaders:     env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
+		DeniedCountries:      env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
 			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
 		ASNLimitPercent:      env.percents("SWWAF_ASN_LIMIT_PERCENT", ParseASN),
@@ -612,22 +572,30 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	return cfg, nil
 }
 
-// ListenAddrAndUpstreamURL reads only SWWAF_LISTEN_ADDR and
-// SWWAF_UPSTREAM_URL, either of which may be given as a file, as
-// FromEnvironment does. The health check needs no other setting, so it
-// reads no other, nor a file that another names.
-func ListenAddrAndUpstreamURL(
-	lookupEnv func(string) (string, bool),
-) (string, *url.URL, error) {
-	env := &environment{lookupEnv: lookupEnv}
-	listenAddr := env.address("SWWAF_LISTEN_ADDR", defaultListenAddr)
-	upstreamURL := env.appURL("SWWAF_UPSTREAM_URL", defaultUpstreamURL)
+// Command reads only SMALLWEBWAF_COMMAND, the command the image runs and its
+// health check checks: rproxy when it is unset or empty, or servewaf. It cannot
+// be given as a file. Any other value is an error that names the setting.
+func Command(lookupEnv func(string) (string, bool)) (string, error) {
+	command, _ := lookupEnv("SMALLWEBWAF_COMMAND")
 
-	if env.err != nil {
-		return "", nil, env.err
+	switch command {
+	case "", "rproxy":
+		return "rproxy", nil
+	case "servewaf":
+		return command, nil
+	default:
+		return "", fmt.Errorf("SMALLWEBWAF_COMMAND: %q %w", command, errNotCommand)
 	}
+}
 
-	return listenAddr, upstreamURL, nil
+// ServeWAFListenAddr reads only SWWAF_LISTEN_ADDR, which may be given as a
+// file, as FromEnvironment does. The health check in servewaf's container needs
+// no other setting, so it reads no other, nor a file that another names.
+func ServeWAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
+	env := &environment{lookupEnv: lookupEnv}
+	listenAddr := env.address("SWWAF_LISTEN_ADDR")
+
+	return listenAddr, env.err
 }
 
 // InstanceName reads only SWWAF_INSTANCE_NAME, which may be given as a
@@ -709,9 +677,10 @@ func (e *environment) check(name string, err error) {
 	}
 }
 
-// address reads a setting that is an address to listen on.
-func (e *environment) address(name, defaultValue string) string {
-	address, err := parseListenAddr(e.value(name, defaultValue))
+// address reads a setting that is an address to listen on, by default
+// defaultListenAddr.
+func (e *environment) address(name string) string {
+	address, err := parseListenAddr(e.value(name, defaultListenAddr))
 	e.check(name, err)
 
 	return address
@@ -779,15 +748,6 @@ func (e *environment) wafBodyLimit(name, defaultValue string) int64 {
 	return limit
 }
 
-// headerSize reads the setting that is the largest request line and
-// headers.
-func (e *environment) headerSize(name, defaultValue string) int64 {
-	size, err := parseHeaderSize(e.value(name, defaultValue))
-	e.check(name, err)
-
-	return size
-}
-
 // count reads a setting that is a number of requests.
 func (e *environment) count(name, defaultValue string) int64 {
 	count, err := parseCount(e.value(name, defaultValue))
@@ -1434,30 +1394,17 @@ func parseSize(value string) (int64, error) {
 	return n * unit, nil
 }
 
-// parseHeaderSize reads the largest request line and headers: a size as
-// parseSize reads it, but more than 4K and never off. Go's server reads 4K
-// past the limit it is given before it refuses, so proxy.New gives it this
-// size less 4K, which must leave a limit.
-func parseHeaderSize(value string) (int64, error) {
-	size, err := parseSize(value)
-	if err != nil || size <= 4*kibibyte {
-		return 0, fmt.Errorf("%q %w", value, errNotOver4K)
-	}
-
-	return size, nil
-}
-
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 1G, since
-// Coraza, which runs the Core Rule Set, refuses to load with more.
+// reads: a size as parseSize reads it, or off, but at most 64K, since servewaf
+// gets no more of a body than that.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)
 	if err != nil {
 		return 0, err
 	}
 
-	if limit > gibibyte {
-		return 0, fmt.Errorf("%q %w", value, errOver1G)
+	if limit > 64*kibibyte {
+		return 0, fmt.Errorf("%q %w", value, errOver64K)
 	}
 
 	return limit, nil

internal/config/config_test.go

@@ -23,98 +23,88 @@ import (
 
 // The settings, by name.
 const (
-	listenAddr              = "SWWAF_LISTEN_ADDR"
-	upstreamURL             = "SWWAF_UPSTREAM_URL"
-	mode                    = "SWWAF_MODE"
-	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
-	ipv6GroupPrefix         = "SWWAF_IPV6_GROUP_PREFIX"
-	maxTrackedClients       = "SWWAF_MAX_TRACKED_CLIENTS"
-	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
-	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
-	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
-	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
-	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
-	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
-	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
-	allowNets               = "SWWAF_ALLOW_NETS"
-	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
-	denyNets                = "SWWAF_DENY_NETS"
-	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerHour        = "SWWAF_RATE_LIMIT_PER_HOUR"
-	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
-	bytesLimitPerMinute     = "SWWAF_BYTES_LIMIT_PER_MINUTE"
-	bytesLimitPerHour       = "SWWAF_BYTES_LIMIT_PER_HOUR"
-	bytesLimitPerDay        = "SWWAF_BYTES_LIMIT_PER_DAY"
-	bytesCount              = "SWWAF_BYTES_COUNT"
-	lookupSource            = "SWWAF_LOOKUP_SOURCE"
-	lookupDBPath            = "SWWAF_LOOKUP_DB_PATH"
-	lookupTimeout           = "SWWAF_LOOKUP_TIMEOUT"
-	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
-	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
-	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	asnLimitPercent         = "SWWAF_ASN_LIMIT_PERCENT"
-	countryLimitPercent     = "SWWAF_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent         = "SWWAF_ASN_BYTES_PERCENT"
-	countryBytesPercent     = "SWWAF_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent     = "SWWAF_UNKNOWN_LIMIT_PERCENT"
-	asnLimitPercentURL      = "SWWAF_ASN_LIMIT_PERCENT_URL"
-	blocklistURLs           = "SWWAF_BLOCKLIST_URLS"
-	blocklistRefresh        = "SWWAF_BLOCKLIST_REFRESH"
-	blocklistAction         = "SWWAF_BLOCKLIST_ACTION"
-	dnsblZones              = "SWWAF_DNSBL_ZONES"
-	dnsblResolver           = "SWWAF_DNSBL_RESOLVER"
-	abuseIPDBKey            = "SWWAF_ABUSEIPDB_KEY"
-	abuseIPDBMinScore       = "SWWAF_ABUSEIPDB_MIN_SCORE"
-	abuseIPDBDailyBudget    = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
-	reputationAction        = "SWWAF_REPUTATION_ACTION"
-	reputationCacheTTL      = "SWWAF_REPUTATION_CACHE_TTL"
-	reputationTimeout       = "SWWAF_REPUTATION_TIMEOUT"
-	crowdSecURL             = "SWWAF_CROWDSEC_LAPI_URL"
-	crowdSecKey             = "SWWAF_CROWDSEC_LAPI_KEY"
-	banResponse             = "SWWAF_BAN_RESPONSE"
-	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
-	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
-	maxBans                 = "SWWAF_MAX_BANS"
-	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
-	stateDir                = "SWWAF_STATE_DIR"
-	stateWriteDelay         = "SWWAF_STATE_WRITE_DELAY"
-	stateCounterInterval    = "SWWAF_STATE_COUNTER_INTERVAL"
-	adminToken              = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	metricsToken            = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN             = "SWWAF_METRICS_TOP_N"
-	instanceName            = "SWWAF_INSTANCE_NAME"
-	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
-	logLevel                = "SWWAF_LOG_LEVEL"
-	rulesDir                = "SWWAF_RULES_DIR"
-	rulesEnabled            = "SWWAF_RULES_ENABLED"
-	wafMode                 = "SWWAF_WAF_MODE"
-	wafParanoiaLevel        = "SWWAF_WAF_PARANOIA_LEVEL"
-	wafAnomalyThreshold     = "SWWAF_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules        = "SWWAF_WAF_DISABLED_RULES"
-	wafExemptPaths          = "SWWAF_WAF_EXEMPT_PATHS"
-	wafBodyLimit            = "SWWAF_WAF_BODY_LIMIT"
-	trapPaths               = "SWWAF_TRAP_PATHS"
-	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
-	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
-	logRemoteTLSCAFile      = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
-	logRemoteBuffer         = "SWWAF_LOG_REMOTE_BUFFER"
-	logRemoteFacility       = "SWWAF_LOG_REMOTE_FACILITY"
-	logRemoteAppName        = "SWWAF_LOG_REMOTE_APP_NAME"
-	alertWebhookURL         = "SWWAF_ALERT_WEBHOOK_URL"
-	alertWebhookHeaders     = "SWWAF_ALERT_WEBHOOK_HEADERS"
-	alertSlackWebhookURL    = "SWWAF_ALERT_SLACK_WEBHOOK_URL"
-	alertNtfyURL            = "SWWAF_ALERT_NTFY_URL"
-	alertNtfyToken          = "SWWAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
-	alertEvents             = "SWWAF_ALERT_EVENTS"
-	alertCooldown           = "SWWAF_ALERT_COOLDOWN"
-	alertMaxPerHour         = "SWWAF_ALERT_MAX_PER_HOUR"
-	anomalyNetV4Prefix      = "SWWAF_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix      = "SWWAF_ANOMALY_NET_V6_PREFIX"
-	watchNets               = "SWWAF_WATCH_NETS"
+	listenAddr           = "SWWAF_LISTEN_ADDR"
+	mode                 = "SWWAF_MODE"
+	ipv6GroupPrefix      = "SWWAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWWAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWWAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWWAF_DENY_NETS"
+	rateLimitPerMinute   = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerHour     = "SWWAF_RATE_LIMIT_PER_HOUR"
+	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	bytesLimitPerMinute  = "SWWAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour    = "SWWAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay     = "SWWAF_BYTES_LIMIT_PER_DAY"
+	bytesCount           = "SWWAF_BYTES_COUNT"
+	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWWAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWWAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWWAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	asnLimitPercent      = "SWWAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent  = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent      = "SWWAF_ASN_BYTES_PERCENT"
+	countryBytesPercent  = "SWWAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent  = "SWWAF_UNKNOWN_LIMIT_PERCENT"
+	asnLimitPercentURL   = "SWWAF_ASN_LIMIT_PERCENT_URL"
+	blocklistURLs        = "SWWAF_BLOCKLIST_URLS"
+	blocklistRefresh     = "SWWAF_BLOCKLIST_REFRESH"
+	blocklistAction      = "SWWAF_BLOCKLIST_ACTION"
+	dnsblZones           = "SWWAF_DNSBL_ZONES"
+	dnsblResolver        = "SWWAF_DNSBL_RESOLVER"
+	abuseIPDBKey         = "SWWAF_ABUSEIPDB_KEY"
+	abuseIPDBMinScore    = "SWWAF_ABUSEIPDB_MIN_SCORE"
+	abuseIPDBDailyBudget = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
+	reputationAction     = "SWWAF_REPUTATION_ACTION"
+	reputationCacheTTL   = "SWWAF_REPUTATION_CACHE_TTL"
+	reputationTimeout    = "SWWAF_REPUTATION_TIMEOUT"
+	crowdSecURL          = "SWWAF_CROWDSEC_LAPI_URL"
+	crowdSecKey          = "SWWAF_CROWDSEC_LAPI_KEY"
+	banResponse          = "SWWAF_BAN_RESPONSE"
+	limitBanDuration     = "SWWAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWWAF_MAX_BAN_DURATION"
+	attackBanDuration    = "SWWAF_ATTACK_BAN_DURATION"
+	maxBans              = "SWWAF_MAX_BANS"
+	banScopeV4Prefix     = "SWWAF_BAN_SCOPE_V4_PREFIX"
+	stateDir             = "SWWAF_STATE_DIR"
+	stateWriteDelay      = "SWWAF_STATE_WRITE_DELAY"
+	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
+	adminToken           = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	metricsToken         = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN          = "SWWAF_METRICS_TOP_N"
+	instanceName         = "SWWAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWWAF_LOG_REQUEST_HEADERS"
+	logLevel             = "SWWAF_LOG_LEVEL"
+	rulesDir             = "SWWAF_RULES_DIR"
+	rulesEnabled         = "SWWAF_RULES_ENABLED"
+	wafMode              = "SWWAF_WAF_MODE"
+	wafParanoiaLevel     = "SWWAF_WAF_PARANOIA_LEVEL"
+	wafAnomalyThreshold  = "SWWAF_WAF_ANOMALY_THRESHOLD"
+	wafDisabledRules     = "SWWAF_WAF_DISABLED_RULES"
+	wafExemptPaths       = "SWWAF_WAF_EXEMPT_PATHS"
+	wafBodyLimit         = "SWWAF_WAF_BODY_LIMIT"
+	trapPaths            = "SWWAF_TRAP_PATHS"
+	errorBurstThreshold  = "SWWAF_ERROR_BURST_THRESHOLD"
+	logRemoteURL         = "SWWAF_LOG_REMOTE_URL"
+	logRemoteTLSCAFile   = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
+	logRemoteBuffer      = "SWWAF_LOG_REMOTE_BUFFER"
+	logRemoteFacility    = "SWWAF_LOG_REMOTE_FACILITY"
+	logRemoteAppName     = "SWWAF_LOG_REMOTE_APP_NAME"
+	alertWebhookURL      = "SWWAF_ALERT_WEBHOOK_URL"
+	alertWebhookHeaders  = "SWWAF_ALERT_WEBHOOK_HEADERS"
+	alertSlackWebhookURL = "SWWAF_ALERT_SLACK_WEBHOOK_URL"
+	alertNtfyURL         = "SWWAF_ALERT_NTFY_URL"
+	alertNtfyToken       = "SWWAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
+	alertEvents          = "SWWAF_ALERT_EVENTS"
+	alertCooldown        = "SWWAF_ALERT_COOLDOWN"
+	alertMaxPerHour      = "SWWAF_ALERT_MAX_PER_HOUR"
+	anomalyNetV4Prefix   = "SWWAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix   = "SWWAF_ANOMALY_NET_V6_PREFIX"
+	watchNets            = "SWWAF_WATCH_NETS"
 )
 
 // The anomaly thresholds: each of the prefixes below, which name a scope,
@@ -252,33 +242,25 @@ func TestDefaults(t *testing.T) {
 	cfg := fromEnvironment(t, environment{})
 
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:                  ":8080",
-		Observe:                     false,
-		ClientRequestTimeout:        time.Minute,
-		ClientRequestHeaderMaxBytes: 32 << 10,
-		ClientIdleTimeout:           2 * time.Minute,
-		ClientResponseTimeout:       30 * time.Minute,
-		UpstreamRequestTimeout:      time.Minute,
-		UpstreamResponseTimeout:     30 * time.Minute,
-		RequestMaxBytes:             100 << 20,
-		ResponseMaxBytes:            1 << 30,
-		RateLimitPerMinute:          500,
-		RateLimitPerHour:            20000,
-		RateLimitPerDay:             300000,
-		BanResponse:                 403,
-		LimitBanDuration:            time.Hour,
-		LimitBanRepeatWindow:        24 * time.Hour,
-		MaxBanDuration:              7 * 24 * time.Hour,
-		AttackBanDuration:           7 * 24 * time.Hour,
-		MaxBans:                     5000,
-		BanScopeV4Prefix:            32,
-		StateDir:                    "/var/lib/smallwebwaf",
-		StateWriteDelay:             10 * time.Second,
-		StateCounterInterval:        15 * time.Minute,
-		MetricsToken:                "",
-		MetricsTopN:                 50,
-		RulesDir:                    "/etc/smallwebwaf/rules.d",
-		RulesEnabled:                true,
+		ListenAddr:           ":8080",
+		Observe:              false,
+		RateLimitPerMinute:   500,
+		RateLimitPerHour:     20000,
+		RateLimitPerDay:      300000,
+		BanResponse:          403,
+		LimitBanDuration:     time.Hour,
+		LimitBanRepeatWindow: 24 * time.Hour,
+		MaxBanDuration:       7 * 24 * time.Hour,
+		AttackBanDuration:    7 * 24 * time.Hour,
+		MaxBans:              5000,
+		BanScopeV4Prefix:     32,
+		StateDir:             "/var/lib/smallwebwaf",
+		StateWriteDelay:      10 * time.Second,
+		StateCounterInterval: 15 * time.Minute,
+		MetricsToken:         "",
+		MetricsTopN:          50,
+		RulesDir:             "/etc/smallwebwaf/rules.d",
+		RulesEnabled:         true,
 	})
 	wantLookupSettings(t, cfg, config.Config{
 		LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond,
@@ -288,12 +270,6 @@ func TestDefaults(t *testing.T) {
 		BytesLimitPerDay: 200 << 30, BytesCount: "both",
 	})
 
-	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
-		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
-	}
-
-	wantNetblocks(t, cfg.TrustedProxies,
-		"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
 	wantNetblocks(t, cfg.AllowNets)
 	wantNetblocks(t, cfg.RateLimitExemptNets)
 	wantNetblocks(t, cfg.DenyNets)
@@ -322,8 +298,13 @@ func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
 
 	cfg := fromEnvironment(t, environment{})
 
+	rproxy, err := rproxyConfig(map[string]string{wafBackend: backendURL})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
 	// The largest request body and the largest response, both counted.
-	largest := cfg.RequestMaxBytes + cfg.ResponseMaxBytes
+	largest := rproxy.MaxRequestSize + rproxy.MaxResponseSize
 	for _, limit := range []int64{
 		cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.BytesLimitPerDay,
 	} {
@@ -337,77 +318,54 @@ func TestValuesAsSet(t *testing.T) {
 	t.Parallel()
 
 	cfg := fromEnvironment(t, environment{
-		listenAddr:              "127.0.0.1:9000",
-		upstreamURL:             "https://app.internal:8443/",
-		mode:                    "observe",
-		trustedProxies:          " 192.0.2.1, 10.1.2.3/8 ,2001:db8::/32",
-		clientRequestTimeout:    "90s",
-		clientHeaderMaxBytes:    "8K",
-		clientIdleTimeout:       "5m",
-		clientResponseTimeout:   "7d",
-		upstreamRequestTimeout:  "1h30m",
-		upstreamResponseTimeout: off,
-		requestMaxBytes:         "512K",
-		responseMaxBytes:        "1234",
-		allowNets:               "192.0.2.7",
-		rateLimitExemptNets:     "2001:db8::/48, 10.9.8.7",
-		denyNets:                "198.51.100.0/24",
-		rateLimitPerMinute:      "60",
-		rateLimitPerHour:        "600",
-		rateLimitPerDay:         "6000",
-		deniedCountries:         "cn, RU,kp,Xk",
-		allowedCountries:        "de",
-		banResponse:             "429",
-		limitBanDuration:        "15m",
-		limitBanRepeatWindow:    "2d",
-		maxBanDuration:          "30d",
-		attackBanDuration:       "1d",
-		maxBans:                 "100",
-		banScopeV4Prefix:        "24",
-		stateDir:                "/srv/waf-state",
-		stateWriteDelay:         "500ms",
-		stateCounterInterval:    "1h",
-		metricsToken:            token,
-		metricsTopN:             "10",
-		rulesDir:                "/srv/waf-rules",
-		rulesEnabled:            "false",
+		listenAddr:           "127.0.0.1:9000",
+		mode:                 "observe",
+		allowNets:            "192.0.2.7",
+		rateLimitExemptNets:  "2001:db8::/48, 10.9.8.7",
+		denyNets:             "198.51.100.0/24",
+		rateLimitPerMinute:   "60",
+		rateLimitPerHour:     "600",
+		rateLimitPerDay:      "6000",
+		deniedCountries:      "cn, RU,kp,Xk",
+		allowedCountries:     "de",
+		banResponse:          "429",
+		limitBanDuration:     "15m",
+		limitBanRepeatWindow: "2d",
+		maxBanDuration:       "30d",
+		attackBanDuration:    "1d",
+		maxBans:              "100",
+		banScopeV4Prefix:     "24",
+		stateDir:             "/srv/waf-state",
+		stateWriteDelay:      "500ms",
+		stateCounterInterval: "1h",
+		metricsToken:         token,
+		metricsTopN:          "10",
+		rulesDir:             "/srv/waf-rules",
+		rulesEnabled:         "false",
 	})
 
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:                  "127.0.0.1:9000",
-		Observe:                     true,
-		ClientRequestTimeout:        90 * time.Second,
-		ClientRequestHeaderMaxBytes: 8 << 10,
-		ClientIdleTimeout:           5 * time.Minute,
-		ClientResponseTimeout:       7 * 24 * time.Hour,
-		UpstreamRequestTimeout:      90 * time.Minute,
-		UpstreamResponseTimeout:     0,
-		RequestMaxBytes:             512 << 10,
-		ResponseMaxBytes:            1234,
-		RateLimitPerMinute:          60,
-		RateLimitPerHour:            600,
-		RateLimitPerDay:             6000,
-		BanResponse:                 429,
-		LimitBanDuration:            15 * time.Minute,
-		LimitBanRepeatWindow:        48 * time.Hour,
-		MaxBanDuration:              30 * 24 * time.Hour,
-		AttackBanDuration:           24 * time.Hour,
-		MaxBans:                     100,
-		BanScopeV4Prefix:            24,
-		StateDir:                    "/srv/waf-state",
-		StateWriteDelay:             500 * time.Millisecond,
-		StateCounterInterval:        time.Hour,
-		MetricsToken:                token,
-		MetricsTopN:                 10,
-		RulesDir:                    "/srv/waf-rules",
-		RulesEnabled:                false,
+		ListenAddr:           "127.0.0.1:9000",
+		Observe:              true,
+		RateLimitPerMinute:   60,
+		RateLimitPerHour:     600,
+		RateLimitPerDay:      6000,
+		BanResponse:          429,
+		LimitBanDuration:     15 * time.Minute,
+		LimitBanRepeatWindow: 48 * time.Hour,
+		MaxBanDuration:       30 * 24 * time.Hour,
+		AttackBanDuration:    24 * time.Hour,
+		MaxBans:              100,
+		BanScopeV4Prefix:     24,
+		StateDir:             "/srv/waf-state",
+		StateWriteDelay:      500 * time.Millisecond,
+		StateCounterInterval: time.Hour,
+		MetricsToken:         token,
+		MetricsTopN:          10,
+		RulesDir:             "/srv/waf-rules",
+		RulesEnabled:         false,
 	})
 
-	if cfg.UpstreamURL.String() != "https://app.internal:8443/" {
-		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
-	}
-
-	wantNetblocks(t, cfg.TrustedProxies, "192.0.2.1/32", "10.0.0.0/8", "2001:db8::/32")
 	wantNetblocks(t, cfg.AllowNets, "192.0.2.7/32")
 	wantNetblocks(t, cfg.RateLimitExemptNets, "2001:db8::/48", "10.9.8.7/32")
 	wantNetblocks(t, cfg.DenyNets, "198.51.100.0/24")
@@ -581,13 +539,13 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
-				wafBodyLimit: "128K",
+				wafBodyLimit: "32K",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
 				WAFDisabledRules: []int{942100, 920350},
 				WAFExemptPaths:   []string{"/api/", "/static/"},
-				WAFBodyLimit:     128 << 10,
+				WAFBodyLimit:     32 << 10,
 			},
 		},
 		{
@@ -615,12 +573,12 @@ func TestCoreRuleSetSettings(t *testing.T) {
 	}
 }
 
-func TestWAFBodyLimitOf1G(t *testing.T) {
+func TestWAFBodyLimitOf64K(t *testing.T) {
 	t.Parallel()
 
-	cfg := fromEnvironment(t, environment{wafBodyLimit: "1G"})
-	if cfg.WAFBodyLimit != 1<<30 {
-		t.Errorf("1G read as %d", cfg.WAFBodyLimit)
+	cfg := fromEnvironment(t, environment{wafBodyLimit: "64K"})
+	if cfg.WAFBodyLimit != 64<<10 {
+		t.Errorf("64K read as %d", cfg.WAFBodyLimit)
 	}
 }
 
@@ -669,10 +627,10 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafBodyLimit, "128KB",
 			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
 		},
-		{wafBodyLimit, "2G", `"2G" is more than 1G, the most Coraza reads`},
+		{wafBodyLimit, "65K", `"65K" is more than 64K, the most servewaf gets of a body`},
 		{
-			wafBodyLimit, "1073741825",
-			`"1073741825" is more than 1G, the most Coraza reads`,
+			wafBodyLimit, "65537",
+			`"65537" is more than 64K, the most servewaf gets of a body`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
@@ -1967,45 +1925,15 @@ func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 
 	cfg := fromEnvironment(t, environment{
-		requestMaxBytes:      "3G",
-		responseMaxBytes:     off,
-		clientRequestTimeout: off,
-		clientIdleTimeout:    off,
+		bytesLimitPerMinute: "3G",
+		bytesLimitPerHour:   off,
+		alertCooldown:       off,
 	})
 
-	if cfg.RequestMaxBytes != 3<<30 || cfg.ResponseMaxBytes != 0 ||
-		cfg.ClientRequestTimeout != 0 || cfg.ClientIdleTimeout != 0 {
-		t.Errorf("3G, off, off and off read as %d, %d, %s and %s",
-			cfg.RequestMaxBytes, cfg.ResponseMaxBytes, cfg.ClientRequestTimeout,
-			cfg.ClientIdleTimeout)
-	}
-}
-
-func TestRequestHeaderMaxBytesJustOver4K(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{clientHeaderMaxBytes: "4097"})
-	if cfg.ClientRequestHeaderMaxBytes != 4097 {
-		t.Errorf("4097 read as %d", cfg.ClientRequestHeaderMaxBytes)
-	}
-}
-
-func TestRequestHeaderMaxBytesRefusalNeverOffersOff(t *testing.T) {
-	t.Parallel()
-
-	for _, value := range []string{"32KB", "0", "4K", off} {
-		t.Run(value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(
-				environment{clientHeaderMaxBytes: value}.lookupEnv)
-
-			want := clientHeaderMaxBytes + `: "` + value +
-				`" is not a size of more than 4K, such as 32K`
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
+	if cfg.BytesLimitPerMinute != 3<<30 || cfg.BytesLimitPerHour != 0 ||
+		cfg.AlertCooldown != 0 {
+		t.Errorf("3G, off and off read as %d, %d and %s",
+			cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.AlertCooldown)
 	}
 }
 
@@ -2034,34 +1962,12 @@ func TestBanResponseCloseIsZero(t *testing.T) {
 	}
 }
 
-func TestTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{trustedProxies: ""})
-	if len(cfg.TrustedProxies) != 0 {
-		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
-	}
-}
-
 func TestInvalidValueStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	wantStartStopped(t, []struct{ name, value string }{
 		{listenAddr, "8080"}, {listenAddr, ":http"}, {listenAddr, ":65536"},
-		{upstreamURL, "127.0.0.1:8081"},
-		{upstreamURL, "ftp://127.0.0.1:8081"},
-		{upstreamURL, "http://"},
-		{upstreamURL, "http://:8081"},
-		{upstreamURL, "http://127.0.0.1:0"},
-		{upstreamURL, "http://127.0.0.1:99999"},
-		{upstreamURL, "http://127.0.0.1:8081/app"},
-		{upstreamURL, "http://127.0.0.1:8081/?a=1"},
-		{upstreamURL, "http://user:secret@127.0.0.1:8081"},
 		{mode, "Observe"}, {mode, "block"}, {mode, ""},
-		{trustedProxies, "10.0.0.0/33"},
-		{trustedProxies, "traefik"},
-		{trustedProxies, "10.0.0.0/8,,192.168.0.0/16"},
-		{trustedProxies, "fe80::1%eth0"},
 		{ipv6GroupPrefix, "31"}, {ipv6GroupPrefix, "129"}, {ipv6GroupPrefix, "/64"},
 		{ipv6GroupPrefix, off}, {ipv6GroupPrefix, ""},
 		{maxTrackedClients, "0"}, {maxTrackedClients, "-1"}, {maxTrackedClients, off},
@@ -2069,19 +1975,18 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{allowNets, "192.0.2.0/24,monitoring"},
 		{rateLimitExemptNets, "2001:db8::/129"},
 		{denyNets, "198.51.100.0/24,"},
-		{clientRequestTimeout, "60"}, {clientRequestTimeout, ""},
-		{clientIdleTimeout, "0s"},
-		{clientIdleTimeout, "2 minutes"},
-		{clientResponseTimeout, "1y"},
-		{upstreamRequestTimeout, "-1s"},
-		{upstreamResponseTimeout, "0s"},
-		{upstreamResponseTimeout, "1.5d"},
-		{requestMaxBytes, "100MB"},
-		{requestMaxBytes, "100m"},
-		{requestMaxBytes, "1.5M"},
-		{responseMaxBytes, "0"},
-		{responseMaxBytes, "-5"},
-		{responseMaxBytes, "99999999999G"},
+		{alertCooldown, "60"}, {alertCooldown, ""},
+		{alertCooldown, "0s"},
+		{alertCooldown, "2 minutes"},
+		{alertCooldown, "1y"},
+		{alertCooldown, "-1s"},
+		{alertCooldown, "1.5d"},
+		{bytesLimitPerMinute, "100MB"},
+		{bytesLimitPerMinute, "100m"},
+		{bytesLimitPerMinute, "1.5M"},
+		{bytesLimitPerHour, "0"},
+		{bytesLimitPerHour, "-5"},
+		{bytesLimitPerHour, "99999999999G"},
 		{rateLimitPerMinute, ""},
 		{rateLimitPerMinute, "1K"},
 		{rateLimitPerHour, "0"},
@@ -2246,10 +2151,10 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 	t.Parallel()
 
 	_, err := config.FromEnvironment(environment{
-		requestMaxBytes + "_FILE": writeFile(t, "lots\n"),
+		bytesLimitPerMinute + "_FILE": writeFile(t, "lots\n"),
 	}.lookupEnv)
 
-	want := requestMaxBytes + `: "lots" is not a size such as 512K, 100M or 5G, or off`
+	want := bytesLimitPerMinute + `: "lots" is not a size such as 512K, 100M or 5G, or off`
 	if err == nil || err.Error() != want {
 		t.Errorf("error %v, want %s", err, want)
 	}
@@ -2354,99 +2259,89 @@ func writeFile(t *testing.T, contents string) string {
 func TestLogsEachSettingWithItsValue(t *testing.T) {
 	t.Parallel()
 
-	cfg := fromEnvironment(t, environment{clientRequestTimeout: "45s"})
+	cfg := fromEnvironment(t, environment{rateLimitPerMinute: "45"})
 	hostname, _ := os.Hostname()
 
 	want := map[string]string{
-		listenAddr:              ":8080",
-		upstreamURL:             "http://127.0.0.1:8081",
-		mode:                    "enforce",
-		trustedProxies:          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
-		ipv6GroupPrefix:         "64",
-		maxTrackedClients:       "20000",
-		clientRequestTimeout:    "45s",
-		clientHeaderMaxBytes:    "32K",
-		clientIdleTimeout:       "120s",
-		clientResponseTimeout:   "30m",
-		upstreamRequestTimeout:  "60s",
-		upstreamResponseTimeout: "30m",
-		requestMaxBytes:         "100M",
-		responseMaxBytes:        "1G",
-		allowNets:               "",
-		rateLimitExemptNets:     "",
-		denyNets:                "",
-		rateLimitPerMinute:      "500",
-		rateLimitPerHour:        "20000",
-		rateLimitPerDay:         "300000",
-		rateLimitExemptPaths:    "",
-		bytesLimitPerMinute:     "4G",
-		bytesLimitPerHour:       "20G",
-		bytesLimitPerDay:        "200G",
-		bytesCount:              "both",
-		lookupSource:            defaultLookupSource,
-		lookupDBPath:            "",
-		lookupTimeout:           "800ms",
-		addLookupHeaders:        "false",
-		deniedCountries:         "",
-		allowedCountries:        "",
-		asnLimitPercent:         "",
-		countryLimitPercent:     "",
-		asnBytesPercent:         "",
-		countryBytesPercent:     "",
-		unknownLimitPercent:     "100",
-		asnLimitPercentURL:      "",
-		blocklistURLs:           "",
-		blocklistRefresh:        "24h",
-		blocklistAction:         actionDeny,
-		dnsblZones:              "",
-		dnsblResolver:           "",
-		abuseIPDBKey:            "",
-		abuseIPDBMinScore:       "75",
-		abuseIPDBDailyBudget:    "900",
-		reputationAction:        "limit:25",
-		reputationCacheTTL:      defaultReputationCacheTTL,
-		reputationTimeout:       "2s",
-		crowdSecURL:             "",
-		crowdSecKey:             "",
-		banResponse:             "403",
-		limitBanDuration:        "1h",
-		limitBanRepeatWindow:    "24h",
-		maxBanDuration:          "7d",
-		attackBanDuration:       "7d",
-		maxBans:                 "5000",
-		banScopeV4Prefix:        "32",
-		stateDir:                "/var/lib/smallwebwaf",
-		stateWriteDelay:         "10s",
-		stateCounterInterval:    "15m",
-		adminToken:              "",
-		metricsToken:            "",
-		metricsTopN:             "50",
-		instanceName:            hostname,
-		logRequestHeaders:       defaultLogRequestHeaders,
-		logLevel:                "info",
-		rulesDir:                "/etc/smallwebwaf/rules.d",
-		rulesEnabled:            "true",
-		wafMode:                 config.WAFModeBlock,
-		wafParanoiaLevel:        "1",
-		wafAnomalyThreshold:     "5",
-		wafDisabledRules:        defaultWAFDisabledRules,
-		wafExemptPaths:          "",
-		wafBodyLimit:            off,
-		trapPaths:               "",
-		errorBurstThreshold:     "30",
-		logRemoteURL:            "",
-		logRemoteTLSCAFile:      "",
-		logRemoteBuffer:         "10000",
-		logRemoteFacility:       "local0",
-		logRemoteAppName:        hostname,
-		alertWebhookURL:         "",
-		alertWebhookHeaders:     "",
-		alertSlackWebhookURL:    "",
-		alertNtfyURL:            "",
-		alertNtfyToken:          "",
-		alertEvents:             defaultAlertEvents,
-		alertCooldown:           defaultAlertCooldown,
-		alertMaxPerHour:         "60",
+		listenAddr:           ":8080",
+		mode:                 "enforce",
+		ipv6GroupPrefix:      "64",
+		maxTrackedClients:    "20000",
+		allowNets:            "",
+		rateLimitExemptNets:  "",
+		denyNets:             "",
+		rateLimitPerMinute:   "45",
+		rateLimitPerHour:     "20000",
+		rateLimitPerDay:      "300000",
+		rateLimitExemptPaths: "",
+		bytesLimitPerMinute:  "4G",
+		bytesLimitPerHour:    "20G",
+		bytesLimitPerDay:     "200G",
+		bytesCount:           "both",
+		lookupSource:         defaultLookupSource,
+		lookupDBPath:         "",
+		lookupTimeout:        "800ms",
+		addLookupHeaders:     "false",
+		deniedCountries:      "",
+		allowedCountries:     "",
+		asnLimitPercent:      "",
+		countryLimitPercent:  "",
+		asnBytesPercent:      "",
+		countryBytesPercent:  "",
+		unknownLimitPercent:  "100",
+		asnLimitPercentURL:   "",
+		blocklistURLs:        "",
+		blocklistRefresh:     "24h",
+		blocklistAction:      actionDeny,
+		dnsblZones:           "",
+		dnsblResolver:        "",
+		abuseIPDBKey:         "",
+		abuseIPDBMinScore:    "75",
+		abuseIPDBDailyBudget: "900",
+		reputationAction:     "limit:25",
+		reputationCacheTTL:   defaultReputationCacheTTL,
+		reputationTimeout:    "2s",
+		crowdSecURL:          "",
+		crowdSecKey:          "",
+		banResponse:          "403",
+		limitBanDuration:     "1h",
+		limitBanRepeatWindow: "24h",
+		maxBanDuration:       "7d",
+		attackBanDuration:    "7d",
+		maxBans:              "5000",
+		banScopeV4Prefix:     "32",
+		stateDir:             "/var/lib/smallwebwaf",
+		stateWriteDelay:      "10s",
+		stateCounterInterval: "15m",
+		adminToken:           "",
+		metricsToken:         "",
+		metricsTopN:          "50",
+		instanceName:         hostname,
+		logRequestHeaders:    defaultLogRequestHeaders,
+		logLevel:             "info",
+		rulesDir:             "/etc/smallwebwaf/rules.d",
+		rulesEnabled:         "true",
+		wafMode:              config.WAFModeBlock,
+		wafParanoiaLevel:     "1",
+		wafAnomalyThreshold:  "5",
+		wafDisabledRules:     defaultWAFDisabledRules,
+		wafExemptPaths:       "",
+		wafBodyLimit:         off,
+		trapPaths:            "",
+		errorBurstThreshold:  "30",
+		logRemoteURL:         "",
+		logRemoteTLSCAFile:   "",
+		logRemoteBuffer:      "10000",
+		logRemoteFacility:    "local0",
+		logRemoteAppName:     hostname,
+		alertWebhookURL:      "",
+		alertWebhookHeaders:  "",
+		alertSlackWebhookURL: "",
+		alertNtfyURL:         "",
+		alertNtfyToken:       "",
+		alertEvents:          defaultAlertEvents,
+		alertCooldown:        defaultAlertCooldown,
+		alertMaxPerHour:      "60",
 	}
 	maps.Copy(want, loggedAnomalyDefaults())
 
@@ -2481,14 +2376,6 @@ func wantSettings(t *testing.T, got *config.Config, want config.Config) {
 
 	if got.ListenAddr != want.ListenAddr ||
 		got.Observe != want.Observe ||
-		got.ClientRequestTimeout != want.ClientRequestTimeout ||
-		got.ClientRequestHeaderMaxBytes != want.ClientRequestHeaderMaxBytes ||
-		got.ClientIdleTimeout != want.ClientIdleTimeout ||
-		got.ClientResponseTimeout != want.ClientResponseTimeout ||
-		got.UpstreamRequestTimeout != want.UpstreamRequestTimeout ||
-		got.UpstreamResponseTimeout != want.UpstreamResponseTimeout ||
-		got.RequestMaxBytes != want.RequestMaxBytes ||
-		got.ResponseMaxBytes != want.ResponseMaxBytes ||
 		got.RateLimitPerMinute != want.RateLimitPerMinute ||
 		got.RateLimitPerHour != want.RateLimitPerHour ||
 		got.RateLimitPerDay != want.RateLimitPerDay {

internal/config/rproxy.go

@@ -64,15 +64,9 @@ var (
 // invalid is an error that names it. Since rproxy never touches disk, its
 // settings have no _FILE form.
 func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
-	env := &environment{lookupEnv: func(name string) (string, bool) {
-		if strings.HasSuffix(name, "_FILE") {
-			return "", false
-		}
-
-		return lookupEnv(name)
-	}}
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
 	cfg := &RProxy{
-		ListenAddr:         env.address("SWRP_LISTEN_ADDR", defaultListenAddr),
+		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
 		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
 		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
 		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
@@ -93,6 +87,37 @@ func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, erro
 	return cfg, nil
 }
 
+// RProxyListenAddrAndUpstreamURL reads only SWRP_LISTEN_ADDR and
+// SWRP_UPSTREAM_URL. The health check in rproxy's container needs no other
+// setting, so it reads no other.
+func RProxyListenAddrAndUpstreamURL(
+	lookupEnv func(string) (string, bool),
+) (string, *url.URL, error) {
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	listenAddr := env.address("SWRP_LISTEN_ADDR")
+	upstreamURL := env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL)
+
+	if env.err != nil {
+		return "", nil, env.err
+	}
+
+	return listenAddr, upstreamURL, nil
+}
+
+// withoutFileForms returns lookupEnv finding no setting named with _FILE, since
+// rproxy never touches disk.
+func withoutFileForms(
+	lookupEnv func(string) (string, bool),
+) func(string) (string, bool) {
+	return func(name string) (string, bool) {
+		if strings.HasSuffix(name, "_FILE") {
+			return "", false
+		}
+
+		return lookupEnv(name)
+	}
+}
+
 // LogValue makes an RProxy log as each setting's name with the value it was
 // given, or its default.
 func (c *RProxy) LogValue() slog.Value {

internal/config/rproxy_test.go

@@ -125,7 +125,19 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		{rproxyDefault, "maybe"},
 		{rproxyListen, "8080"},
 		{rproxyUpstream, "app"},
+		{rproxyUpstream, "127.0.0.1:8081"},
+		{rproxyUpstream, "ftp://127.0.0.1:8081"},
+		{rproxyUpstream, "http://"},
+		{rproxyUpstream, "http://:8081"},
+		{rproxyUpstream, "http://127.0.0.1:0"},
+		{rproxyUpstream, "http://127.0.0.1:99999"},
+		{rproxyUpstream, "http://127.0.0.1:8081/app"},
+		{rproxyUpstream, "http://127.0.0.1:8081/?a=1"},
+		{rproxyUpstream, "http://user:secret@127.0.0.1:8081"},
 		{rproxyTrusted, "not a netblock"},
+		{rproxyTrusted, "10.0.0.0/33"},
+		{rproxyTrusted, "10.0.0.0/8,,192.168.0.0/16"},
+		{rproxyTrusted, "fe80::1%eth0"},
 		{rproxyMaxRequest, notASize},
 		{rproxyMaxResponse, notASize},
 		{rproxyRequestTime, "0"},
@@ -143,6 +155,19 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 	}
 }
 
+func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
+	}
+}
+
 func TestRProxyNeedsItsBackend(t *testing.T) {
 	t.Parallel()