smallwebwaf

87 Commits 8 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	7e26fe37bc	Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198 ) check / check (push) Successful in 3m20s Details The Gitea setup runs the Core Rule Set in block mode. Rules that refused ordinary Gitea requests are switched off only where they misfired: - deploy/gitea/crs-exclusions.conf, loaded through the new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name and branch-name fields, Referer, and file paths; - smallwebwaf's defaults gain a seventh change: the registry upload path's from parameter skips 932260. A file that cannot be read, does not parse or names an id from 900000 to 900999 stops servewaf at start. internal/waf's tests and script/gitea-setup send the recorded requests in internal/waf/testdata/gitea-requests.txt and three attacks. Model: opus-5-5	2026-11-06 19:15:51 +00:00
clawbot	21cac70b50	Lower the default request and byte limits (closes #193 ) check / check (push) Successful in 3m12s Details New defaults, as sneak approved: 120 requests a minute, 1,500 an hour and 6,000 a day; bytes off a minute, 50G an hour and 100G a day. The README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md` give the new figures and reasoning, and point Actions runners and shared addresses at `SWWAF_RATE_LIMIT_EXEMPT_NETS`. The README examples now hold against the new defaults. An Actions runner that is not exempted makes more requests an hour than the new limit and will be banned. Model: opus-5-5	2026-11-06 20:14:23 +01:00
clawbot	3cb41f27a8	deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178 ) check / check (push) Successful in 3m50s Details A compose setup that runs gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network with IPv4 and IPv6, and `script/gitea-setup` (`make gitea-setup`), which brings it up and checks that a page load, a push and a clone pass through rproxy and are checked by servewaf. Containers on the shared network skip servewaf's checks; the gateways do not. gitea gets a secret key made per install and has sign-up off. `docs/gitea.md` explains each setting. Judgement call: the Core Rule Set runs in `detect` mode here until #198 lands. Model: deepseek-v4-pro (implementation), opus-5-5 (rework)	2026-11-06 19:46:38 +01:00

Author

SHA1

Message

Date

clawbot

7e26fe37bc

Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198 )

check / check (push) Successful in 3m20s

Details

The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:

- deploy/gitea/crs-exclusions.conf, loaded through the new setting
  SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name
  and branch-name fields, Referer, and file paths;
- smallwebwaf's defaults gain a seventh change: the registry upload
  path's from parameter skips 932260.

A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start. internal/waf's tests and
script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.

Model: opus-5-5

2026-11-06 19:15:51 +00:00

clawbot

21cac70b50

Lower the default request and byte limits (closes #193 )

check / check (push) Successful in 3m12s

Details

New defaults, as sneak approved: 120 requests a minute, 1,500 an hour and 6,000 a day; bytes off a minute, 50G an hour and 100G a day. The README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md` give the new figures and reasoning, and point Actions runners and shared addresses at `SWWAF_RATE_LIMIT_EXEMPT_NETS`. The README examples now hold against the new defaults.

An Actions runner that is not exempted makes more requests an hour than the new limit and will be banned.

Model: opus-5-5

2026-11-06 20:14:23 +01:00

clawbot

3cb41f27a8

deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178 )

check / check (push) Successful in 3m50s

Details

A compose setup that runs gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network with IPv4 and IPv6, and `script/gitea-setup` (`make gitea-setup`), which brings it up and checks that a page load, a push and a clone pass through rproxy and are checked by servewaf. Containers on the shared network skip servewaf's checks; the gateways do not. gitea gets a secret key made per install and has sign-up off. `docs/gitea.md` explains each setting.

Judgement call: the Core Rule Set runs in `detect` mode here until #198 lands.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

2026-11-06 19:46:38 +01:00