4 Commits

Include renames

Author	SHA1	Message	Date
sneak	ec879925b2	Remove what is about deploying behind Gitea (closes #209) ... Delete the Gitea compose setup, its document, its two scripts and their make targets. Documents and tests no longer use Gitea as the example deployment. The Core Rule Set exclusions for Gitea's false positives in internal/waf stay, with their comments and tests. Model: opus-5-5	2026-11-07 02:21:27 +00:00
clawbot	21cac70b50	Lower the default request and byte limits (closes #193) ... New defaults, as sneak approved: 120 requests a minute, 1,500 an hour and 6,000 a day; bytes off a minute, 50G an hour and 100G a day. The README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md` give the new figures and reasoning, and point Actions runners and shared addresses at `SWWAF_RATE_LIMIT_EXEMPT_NETS`. The README examples now hold against the new defaults. An Actions runner that is not exempted makes more requests an hour than the new limit and will be banned. Model: opus-5-5	2026-11-06 20:14:23 +01:00
clawbot	3cb41f27a8	deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178) ... A compose setup that runs gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network with IPv4 and IPv6, and `script/gitea-setup` (`make gitea-setup`), which brings it up and checks that a page load, a push and a clone pass through rproxy and are checked by servewaf. Containers on the shared network skip servewaf's checks; the gateways do not. gitea gets a secret key made per install and has sign-up off. `docs/gitea.md` explains each setting. Judgement call: the Core Rule Set runs in `detect` mode here until #198 lands. Model: deepseek-v4-pro (implementation), opus-5-5 (rework)	2026-11-06 19:46:38 +01:00
clawbot	d4f90dba37	The image apps build FROM, with its health check (closes #45) ... The Dockerfile's last stage is now the image of "Deployment" in SPEC.md: Ubuntu 26.04 with ca-certificates, nix-bin and runit from a dated snapshot whose InRelease files are checked by hash, nixpkgs from its release file checked by SHA-256, runsvinit built at a fixed commit, and smallwebwaf as a runit service. smallwebwaf answers /_smallwebwaf/healthz, and `smallwebwaf healthcheck`, which takes no further argument, is the image's HEALTHCHECK. script/example-app builds an app on the image and checks it end to end. The Nix profile comes last on the PATH: first, busybox from nixpkgs replaced runit's own runsvdir and sv. SPEC.md is corrected to match what was built. Model: opus-5-5	2026-10-04 10:05:30 +02:00