3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	9bcbe5a3c8	Every time in UTC, and every day as YYYY-MM-DD (closes #313) ... Every time the program stores, logs or compares is in UTC, whatever TZ says, and AbuseIPDB's day in `reputation.json` is a `YYYY-MM-DD` date. Times read from a state file are converted to UTC as they are read, so a file is written back with `Z` times only. A test runs `sww waf` with `TZ=Pacific/Kiritimati` and checks the process line, the request line and `clients.json`. `SPEC.md` states the rule and `AGENTS.md` makes it an iron rule. - The rate limit's `day` and `day_bytes` buckets keep a start time: each is a 24-hour bucket begun at an instant, not a calendar day. - New dependency `cloud.google.com/go`, of which only `civil` is built. - No migration: a `reputation.json` holding the old day form fails to load, naming the file. Model: opus-5-5	2026-11-11 06:00:53 +01:00
clawbot	beb503b233	Rename the program to sww and its deciding daemon to discriminator (closes #218) (#221)	2026-11-07 06:51:06 +01:00
clawbot	ca787985f8	AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105) ... With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence (a broken limit, a ban rule's match or a block rule's refusal, counted by kind) is checked in the background, at most SWWAF_ABUSEIPDB_DAILY_BUDGET checks a day, the count kept in reputation.json. A client, an IPv4 address or an IPv6 /64, is checked by the address it sent from, and its score serves all its addresses. A score at or over SWWAF_ABUSEIPDB_MIN_SCORE is a hit for SWWAF_REPUTATION_ACTION, logged as abuseipdb and alerted with its score. A failure or the used-up budget gives no score and raises source_failure. The key goes only in the Key header. Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time. Judgement call: each check sent spends budget; a minute's pause after a failure. Model: opus-5-5	2026-10-07 22:47:06 +02:00