3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	4cc492004a	smallwebwaf starts with SWWAF_STATE_DIR given as a file on a new volume (closes #137) ... The run script gave ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the smallwebwaf user and never read SWWAF_STATE_DIR_FILE, so a new volume at the directory that file names stayed root's. The run script now takes the setting from the variable or the file, and changes the owner only when it is the absolute path of a directory that exists; otherwise it starts smallwebwaf, which stops with its message naming the setting. A chown that fails, as on a read-only volume, no longer ends the run script. script/example-app, and its entry in README.md, gain two steps: a container on such a volume becomes healthy, and a missing state directory reaches smallwebwaf's message. Model: opus-5-5	2026-10-20 16:54:34 +02:00
clawbot	df2c5042d2	Keep the bans, the clients and GeoJS's answers in state files (closes #17) ... smallwebwaf now copies its state to bans.json, clients.json and lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md describes, and reads them back at start, so a restart lifts no ban and gives no client a fresh allowance. Each client gains a history, and a ban's notes count the netblock's requests. bans.json is written SWWAF_STATE_WRITE_DELAY after a ban, and every file every SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked to its netblock and refuses every client in it. A file that does not parse, an unknown version, an entry without a field it needs, or an unwritable directory stops the start. Deviation: no AS number or name, and no ban cause, reason or lifting yet. Model: opus-5-5	2026-10-06 08:31:52 +02:00
clawbot	d4f90dba37	The image apps build FROM, with its health check (closes #45) ... The Dockerfile's last stage is now the image of "Deployment" in SPEC.md: Ubuntu 26.04 with ca-certificates, nix-bin and runit from a dated snapshot whose InRelease files are checked by hash, nixpkgs from its release file checked by SHA-256, runsvinit built at a fixed commit, and smallwebwaf as a runit service. smallwebwaf answers /_smallwebwaf/healthz, and `smallwebwaf healthcheck`, which takes no further argument, is the image's HEALTHCHECK. script/example-app builds an app on the image and checks it end to end. The Nix profile comes last on the PATH: first, busybox from nixpkgs replaced runit's own runsvdir and sv. SPEC.md is corrected to match what was built. Model: opus-5-5	2026-10-04 10:05:30 +02:00