servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request a
question carries and answers allow, deny or close, instead of passing it
to an app. rproxy's report then counts the bytes toward the byte limits
and adds the request to the client's history. SPEC.md gives the exact
question, answer and report, which rproxy follows. `smallwebwaf` with no
command is unchanged.

Judgement call: a third disposition, close, since closing the question's
connection would read as servewaf down and let the request through.
Judgement call: allow can answer a new request id, since a visitor behind
a trusted proxy can choose its own.

Model: opus-5-5

docs/admin-endpoints.md

@@ -2,7 +2,8 @@
 
 The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
 "Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
-and how their tokens work.
+and how their tokens work. `smallwebwaf servewaf` answers them at its own
+address, without those checks (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).
 
 - `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
 - `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see

docs/alerts.md

@@ -78,6 +78,9 @@ on one line:
 
 - `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
+- `host`: the site of the request that raised the alert. Only `servewaf` sends
+  this field, since it serves many sites, and not for `source_failure`,
+  `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -110,7 +113,7 @@ Slack and ntfy get a message with a title and a text. The title is the instance
 and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
 line for each of these that the alert has:
 
-- the client, the netblock and the country;
+- the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;
 - the suppressed repeats, if any.
 

docs/metrics.md

@@ -4,6 +4,11 @@ What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
 [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
 label as `exported_instance` unless the scrape sets `honor_labels: true`.
 
+`smallwebwaf servewaf` counts a denied request at its decision. It counts an
+allowed request when its report comes, with the status, bytes and times the
+report gives. A report itself is not counted, and neither is a request whose
+report never comes.
+
 ## Traffic
 
 - `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and

docs/request-log.md

@@ -117,3 +117,36 @@ All in milliseconds:
   connection;
 - `duration_upstream_first_byte`: until the first byte of the answer;
 - `duration_upstream_total`: until the end of the answer.
+
+## `servewaf`'s line
+
+`smallwebwaf servewaf` writes one line for each question, once it has answered
+it, and one for each request to its own endpoints but a report. A report writes
+no line. A question's line has the fields above, with these meanings where they
+differ:
+
+- `client_ip`: `X-Smallwebwaf-Client`.
+- `peer_ip`: `X-Smallwebwaf-Peer`.
+- `host`: the site the visitor asked for.
+- `protocol`: the question's own, `HTTP/1.1`.
+- `content_length`: `X-Smallwebwaf-Content-Length`.
+- `request_id`: the id `servewaf` answers with on `allow`.
+- `status`: what `servewaf` answered: `200` for `allow`, the status of `deny`,
+  or `0` for `close`, as the visitor is then sent nothing.
+- `request_bytes`: how much of the question's body the Core Rule Set read.
+- `response_bytes`: the body of `servewaf`'s answer.
+- `action`: `forward` for `allow`, and `admin` for the `404` for a path under
+  `/_smallwebwaf/`.
+- `aborted`: true when `rproxy` went away before the answer.
+- `duration_total`: from the question's headers being read to the line.
+
+The line leaves out `upstream_status`, `websocket` and the
+`duration_upstream_...` fields, since `servewaf` passes nothing to the app.
+`rproxy` holds the visitor's status, the body bytes and the times of the app's
+answer. The request id joins the two.
+
+The bytes of an allowed request are counted when its report comes, after its
+line. So `counts` holds the client's bytes without this request's. A report that
+breaks a byte limit writes a process message instead of `limit_hit` on the line:
+`a report's bytes broke a byte limit`, with `request_id`, `client_ip`, `host`,
+`limit_hit` and `ban_expires`.

docs/settings.md

@@ -4,6 +4,23 @@ Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
 that take `off`, the `_FILE` form, and what each group does and why.
 
+## `servewaf`
+
+`smallwebwaf servewaf` uses every setting here but these, which it ignores:
+
+- `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
+- the five timeouts under "Size and time limits";
+- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`, `SWWAF_REQUEST_MAX_BYTES` and
+  `SWWAF_RESPONSE_MAX_BYTES`.
+
+An invalid value of one of these still stops the start, and the line of settings
+at start still shows them.
+
+`SWWAF_ADD_LOOKUP_HEADERS` puts the headers on the answer to `rproxy`, not on a
+request to an app. `SWWAF_WAF_BODY_LIMIT` has an effect up to 64 KiB less one
+byte, whatever its value. A question carries no more of a body than 64 KiB (see
+"`servewaf`" in [`SPEC.md`](../SPEC.md)).
+
 ## Forms of values
 
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
@@ -327,4 +344,5 @@ A few limits are fixed rather than settings:
 - at most 100,000 DNS blocklist verdicts and 100,000 AbuseIPDB scores are kept;
 - at most 1,000 DNS blocklist queries are under way at once;
 - at most 20,000 anomaly counters are kept;
-- each alert destination's queue holds at most 1,000 alerts.
+- each alert destination's queue holds at most 1,000 alerts;
+- `servewaf` holds at most 10,000 allowed requests awaiting their reports.