smallwebwaf

30 Commits 4 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	234c5eac60	Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23 ) check / check (push) Waiting to run Details GET /_smallwebwaf/metrics answers in the Prometheus text format for a request carrying SWWAF_METRICS_TOKEN, 401 without it and 404 while it is unset. Every request under /_smallwebwaf/ but the health check now goes through the checks and is answered where it would be forwarded, 404 for any path but the metrics, so none reaches the app. In the client's history a 401 counts as refused, the metrics and the 404s as neither. SWWAF_METRICS_TOP_N bounds the series by country, the rest counted as other. Deviation: go.mod and go.sum written by hand, as go runs only through make. Deviation: no metrics yet for state files read again after an edit or edits set aside; that work is not merged. Model: opus-5-5	2026-10-06 11:40:27 +02:00
clawbot	68f687cb0c	Run the GeoJS lookup tests on a clock the test controls (closes #73 ) check / check (push) Successful in 3m32s Details The tests that have GeoJS asked now run in a synctest bubble, so a wait lasts exactly as long as it should however slowly the test process runs: a new client's wait is checked to be exactly one second, and its next request exactly no wait. A request waiting on the network would stop the bubble's clock, so the stand-in for GeoJS now answers in place of the network, through a transport that a test-only file lets the tests set. The test of the failure log uses an abandoned request instead of a closed port. Model: opus-5-5	2026-10-06 09:12:50 +02:00
clawbot	0750879e58	Country allow and deny lists, looked up through GeoJS (closes #44 ) check / check (push) Failing after 3s Details SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a request with 403 before its body is read or rate-limited, logged as country_denied. internal/lookup asks GeoJS only while a list is set, 200 clients per request, one at a time, keeping answers 7 days. Failures, a redirect or an answer leaving an address out included, are logged without addresses; GeoJS is then left alone a second, doubling to five minutes. Private, loopback and link-local clients are never sent. Deviation, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE. Deviation: GeoJS's country endpoint, not geo.json. Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait. Judgement call: config.go lists the ISO 3166-1 codes; no widely used library holds them. Model: opus-5-5	2026-10-04 08:29:41 +02:00

Author

SHA1

Message

Date

clawbot

234c5eac60

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23 )

check / check (push) Waiting to run

Details

GET /_smallwebwaf/metrics answers in the Prometheus text format for a
request carrying SWWAF_METRICS_TOKEN, 401 without it and 404 while it is
unset. Every request under /_smallwebwaf/ but the health check now goes
through the checks and is answered where it would be forwarded, 404 for
any path but the metrics, so none reaches the app. In the client's
history a 401 counts as refused, the metrics and the 404s as neither.
SWWAF_METRICS_TOP_N bounds the series by country, the rest counted as
other.

Deviation: go.mod and go.sum written by hand, as go runs only through
make.
Deviation: no metrics yet for state files read again after an edit or
edits set aside; that work is not merged.

Model: opus-5-5

2026-10-06 11:40:27 +02:00

clawbot

68f687cb0c

Run the GeoJS lookup tests on a clock the test controls (closes #73 )

check / check (push) Successful in 3m32s

Details

The tests that have GeoJS asked now run in a synctest bubble, so a wait
lasts exactly as long as it should however slowly the test process runs:
a new client's wait is checked to be exactly one second, and its next
request exactly no wait. A request waiting on the network would stop the
bubble's clock, so the stand-in for GeoJS now answers in place of the
network, through a transport that a test-only file lets the tests set.
The test of the failure log uses an abandoned request instead of a
closed port.

Model: opus-5-5

2026-10-06 09:12:50 +02:00

clawbot

0750879e58

Country allow and deny lists, looked up through GeoJS (closes #44 )

check / check (push) Failing after 3s

Details

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read or rate-limited, logged as
country_denied. internal/lookup asks GeoJS only while a list is set, 200
clients per request, one at a time, keeping answers 7 days. Failures, a
redirect or an answer leaving an address out included, are logged without
addresses; GeoJS is then left alone a second, doubling to five minutes.
Private, loopback and link-local clients are never sent.

Deviation, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Judgement call: config.go lists the ISO 3166-1 codes; no widely used library holds them.

Model: opus-5-5

2026-10-04 08:29:41 +02:00