SPEC, README and docs rewritten from scratch (closes #154, closes #155, closes #156)

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)
2026-10-26 03:06:28 +01:00
parent eafcc3fd73
commit f408f42b28
21 changed files with 2530 additions and 3978 deletions
@@ -0,0 +1,48 @@
+# Admin endpoints
+
+The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
+"Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
+and how their tokens work.
+
+- `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
+- `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
+  [`metrics.md`](metrics.md)).
+- `GET /_smallwebwaf/bans`: every ban held, under `bans`, each as `bans.json`
+  lists it. Needs `SWWAF_ADMIN_TOKEN`, as do the three below.
+- `POST /_smallwebwaf/bans`: bans a netblock. The body is a JSON object of
+  `netblock`, `duration` and, if you like, `reason`. `netblock` is a netblock
+  such as `203.0.113.0/24`, or a client's address, which bans its IPv4 netblock
+  (`SWWAF_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration such
+  as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying what is
+  wrong:
+    - one that is not such an object, or has another field;
+    - one longer than 4 KiB;
+    - one that names an IPv4-mapped netblock, or an address with a zone.
+- `DELETE /_smallwebwaf/bans/<client>`: lifts every active ban covering the
+  address `<client>`. It answers `404` when none is active.
+- `GET /_smallwebwaf/clients/<ip>`: what `smallwebwaf` knows of the client.
+  Under `client`, its counters and history as `clients.json` holds them, or
+  `null` when `clients.json` does not hold it. Under `bans`, every ban covering
+  the address, with its notes.
+
+## Examples
+
+With `SWWAF_ADMIN_TOKEN` set, and the token in `$TOKEN`:
+
+```sh
+# Every ban.
+curl -H "Authorization: Bearer $TOKEN" https://app.example/_smallwebwaf/bans
+
+# Ban 203.0.113.0/24 for seven days.
+curl -H "Authorization: Bearer $TOKEN" \
+    --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
+    https://app.example/_smallwebwaf/bans
+
+# Lift the bans on 203.0.113.9.
+curl -H "Authorization: Bearer $TOKEN" -X DELETE \
+    https://app.example/_smallwebwaf/bans/203.0.113.9
+
+# What smallwebwaf knows of 203.0.113.9.
+curl -H "Authorization: Bearer $TOKEN" \
+    https://app.example/_smallwebwaf/clients/203.0.113.9
+```