smallwebwaf

83 Commits 7 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	ec01945a76	Install the image's Ubuntu packages from the normal mirrors (closes #190 ) check / check (push) Waiting to run Details The final image stage now apt-gets ca-certificates, nix-bin and runit from Ubuntu's archive, with no snapshot and no hash check of the package lists. The borrowed CA bundle is dropped: apt fetches the packages over plain HTTP and checks each one against the archive's signed package lists, so the install needs none. The Ubuntu base image stays pinned by digest, and every other pin is kept. README.md, SPEC.md and docs/image.md no longer describe a snapshot. Model: deepseek-v4-pro (implementation), opus-5-5 (rework)	2026-11-06 17:51:48 +00:00
clawbot	344ce13c96	rproxy and servewaf replace the one-process smallwebwaf (closes #172 , closes #165 ) check / check (push) Failing after 14m44s Details `smallwebwaf` with no command now prints the commands and exits with status 2. The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The passing-on code, its settings and its log fields and metric go. internal/proxy keeps the checks, answers, reports and own endpoints; its tests run through the real rproxy. The documents describe the pair. Judgement call: clients.json keeps token_refused, since state files refuse unknown fields. Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests. Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx. Model: opus-5-5	2026-11-05 13:15:05 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 ) check / check (push) Canceled after 0s Details SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00

Author

SHA1

Message

Date

sneak

ec01945a76

Install the image's Ubuntu packages from the normal mirrors (closes #190 )

check / check (push) Waiting to run

Details

The final image stage now apt-gets ca-certificates, nix-bin and runit
from Ubuntu's archive, with no snapshot and no hash check of the package
lists. The borrowed CA bundle is dropped: apt fetches the packages over
plain HTTP and checks each one against the archive's signed package
lists, so the install needs none. The Ubuntu base image stays pinned by
digest, and every other pin is kept. README.md, SPEC.md and
docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

2026-11-06 17:51:48 +00:00

clawbot

344ce13c96

rproxy and servewaf replace the one-process smallwebwaf (closes #172 , closes #165 )

check / check (push) Failing after 14m44s

Details

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5

2026-11-05 13:15:05 +01:00

clawbot

f408f42b28

SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 )

check / check (push) Canceled after 0s

Details

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8.

Model: fable-5-1 (writing); opus-5-5 (review, merge)

2026-10-26 03:06:28 +01:00