The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:
- deploy/gitea/crs-exclusions.conf, loaded through the new setting
SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE before the Core Rule Set's rules,
covers Gitea's search, file-name and branch-name fields, Referer, file
paths, API attachment names and Actions artifact uploads;
- smallwebwaf's defaults gain a seventh change: the registry upload
path's from parameter skips 932260.
A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start, in every mode. internal/waf's tests
and script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.
Model: opus-5-5
A compose setup that runs gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network with IPv4 and IPv6, and `script/gitea-setup` (`make gitea-setup`), which brings it up and checks that a page load, a push and a clone pass through rproxy and are checked by servewaf. Containers on the shared network skip servewaf's checks; the gateways do not. gitea gets a secret key made per install and has sign-up off. `docs/gitea.md` explains each setting.
Judgement call: the Core Rule Set runs in `detect` mode here until #198 lands.
Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
clawbot