SPEC: the one place for behaviour and reasons; docs/ as lookup lists only

docs/core-rule-set.md, docs/lookup.md, docs/reputation.md and docs/bans.md
restated the spec and are folded back into it and removed. The remaining
docs files hold only lists: settings with their defaults and value forms,
the request log's fields, the metrics, the endpoints, the state files and
their contents, the rule file format and default file, the alert events
and messages, the image's contents and pins, and the gitea notes. Every
behaviour each of them held moves to the spec, said once. The settings
groups have the same names in both files. Stale comments in
internal/state and script/example-app point at the right places.

Model: fable-5-1

README.md

@@ -113,16 +113,16 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
   `X-Forwarded-Proto`, and `X-Forwarded-For` with the peer added at the end. It
   also gets the request's id in `X-Request-ID`, the same id as in the request's
   log line (see `request_id` in "Request log" below).
-- Enforces the timeouts and the size limits below. A limit passed before the
-  response has started gets `smallwebwaf`'s own answer: `408` for a client too
-  slow to send its request, `413` for a request body that is too large, `504`
-  for an app too slow to answer, and `502` for a response that is too large or
-  an app that cannot be reached. A request that announces a body over the limit
-  is refused before anything reaches the app. While a request body is still on
-  its way, a request timeout that runs out answers `408` if `smallwebwaf` was
-  waiting for the client to send more, and `504` if it was waiting for the app
-  to take what it had. Once the response has started, a limit can only cut the
-  connection.
+- Enforces the timeouts and the size limits below. Once a request's line and
+  headers have been read, a limit passed before the response has started gets
+  `smallwebwaf`'s own answer: `408` for a client too slow to send its body,
+  `413` for a request body that is too large, `504` for an app too slow to
+  answer, and `502` for a response that is too large or an app that cannot be
+  reached. A request that announces a body over the limit is refused before
+  anything reaches the app. While a request body is still on its way, a request
+  timeout that runs out answers `408` if `smallwebwaf` was waiting for the
+  client to send more, and `504` if it was waiting for the app to take what it
+  had. Once the response has started, a limit can only cut the connection.
 - Counts each client's requests over a minute, an hour and a day. A request that
   takes the client over one of the rate limits below is refused with
   `SWWAF_BAN_RESPONSE`, `403` by default, before anything reaches the app, and
@@ -1045,9 +1045,11 @@ less severe than `SWWAF_LOG_LEVEL` are not written.
 Go's HTTP server, on which `smallwebwaf` is built, reads a request's line and
 headers before `smallwebwaf` sees the request, and some requests end there,
 without a line in the log: headers over `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`,
-which it answers `431`, headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`,
-whose connection it closes without an answer, and requests it cannot read at
-all, which it answers itself, mostly with `400`.
+which it answers `431`, and requests it cannot read at all, which it answers
+itself, mostly with `400`. A client too slow to send its request line and
+headers within `SWWAF_CLIENT_REQUEST_TIMEOUT` gets either no answer or an error
+answer from the server, mostly `400 Bad Request`; either way the server closes
+its connection, nothing reaches the app, and no line is written in the log.
 
 ### Sending the log to a syslog server
 
@@ -1447,11 +1449,12 @@ whole service, its `asn`, for an AS number, its `name`, for a named netblock, or
 the `start` of a window in which it has requests or bytes; a list's `url`,
 `fetched` or `lines`, which is `[]` for an empty list; a verdict's `zone`,
 `client`, `listed`, which is `false` for a client the zone does not list, or
-`fetched`. So does a ban whose `cause` is not `limit`, `attack`, `admin` or
-`crowdsec`, alerts waiting for a destination that is not `webhook`, `slack` or
-`ntfy`, an anomaly counter whose `scope` is not `client`, `net`, `asn`, `total`
-or `watch`, and a copy of a list with a line that would make its fetch fail. An
-answer's `asn` or `as_name` left out reads as empty.
+`fetched`. So does a ban whose `expires` is not after its `start` or whose
+`cause` is not `limit`, `attack`, `admin` or `crowdsec`, alerts waiting for a
+destination that is not `webhook`, `slack` or `ntfy`, an anomaly counter whose
+`scope` is not `client`, `net`, `asn`, `total` or `watch`, and a copy of a list
+with a line that would make its fetch fail. An answer's `asn` or `as_name` left
+out reads as empty.
 
 While it runs, `smallwebwaf` watches `SWWAF_STATE_DIR` and takes in your edit of
 a state file as soon as you save it: what the file then holds replaces what
@@ -1461,14 +1464,15 @@ writes a file it takes in any edit made since, so your edit is not overwritten;
 a change `smallwebwaf` made after you opened the file, such as a new ban, is
 lost when you save over it. An edit that would stop the start, because it does
 not parse, has another `version`, leaves out a field an entry needs, gives a ban
-another `cause`, names another destination, gives an anomaly counter another
-`scope` or gives a list's copy a line that would make its fetch fail, does not
-stop the running `smallwebwaf`: it keeps what it holds, and at the file's next
-write renames your file to `<name>.bad`, such as `bans.json.bad`, writes the
-file again from memory, logs the file and where the error is, and raises a
-`file_error` alert for it. It waits for that write because an editor's file can
-be read before the editor has finished writing it. Mend the `.bad` file and move
-it back. A file you remove is written again at its next write.
+an `expires` not after its `start` or another `cause`, names another
+destination, gives an anomaly counter another `scope` or gives a list's copy a
+line that would make its fetch fail, does not stop the running `smallwebwaf`: it
+keeps what it holds, and at the file's next write renames your file to
+`<name>.bad`, such as `bans.json.bad`, writes the file again from memory, logs
+the file and where the error is, and raises a `file_error` alert for it. It
+waits for that write because an editor's file can be read before the editor has
+finished writing it. Mend the `.bad` file and move it back. A file you remove is
+written again at its next write.
 
 To ban a netblock, add an entry to `bans.json` with its `netblock`, its `start`
 and its `expires`, `null` for a ban that never ends; its `reason` and its
@@ -2156,13 +2160,14 @@ addresses sends, so that one client costs at most one check every
 `SWWAF_REPUTATION_CACHE_TTL`.
 
 Only a client whose history counts an offence is checked, so that the checks are
-spent on suspects: so far, one that has broken a rate limit or a byte limit,
-matched a ban rule, or had a request refused by a block rule or the Core Rule
-Set. A client dropped from the table of clients loses its history, and with it
-its offences. A client is checked in the background, at its first request after
-its offence that reaches the check: no request waits, a request refused under
-its ban is not checked, and the request that has it checked, and any other from
-it before the answer comes, goes on as from a client without a score.
+spent on suspects: so far, one that has broken a rate limit, a byte limit or the
+error burst, matched a ban rule, asked for a trap path, or had a request refused
+by a block rule, by the Core Rule Set or for a missing or wrong token. A client
+dropped from the table of clients loses its history, and with it its offences. A
+client is checked in the background, at its first request after its offence that
+reaches the check: no request waits, a request refused under its ban is not
+checked, and the request that has it checked, and any other from it before the
+answer comes, goes on as from a client without a score.
 
 A score at or over `SWWAF_ABUSEIPDB_MIN_SCORE`, 75 by default, is a hit, and
 `SWWAF_REPUTATION_ACTION` says what is done with its client, as for a DNSBL
@@ -2379,10 +2384,13 @@ so that they run in minimal containers.
   that the health check passes, that a request reaches the app through
   `smallwebwaf`, that a second request in a minute bans the client, that a probe
   for `/.env` bans another client, whose next request makes the ban permanent,
-  that `sv stop` and `docker stop` stop it in order, and that a new container on
-  the same volume still refuses the banned client; then removes the containers,
-  the volume and both images. It needs network access, for nixpkgs' binary
-  cache, and `script/check` does not run it; `make example-app` does.
+  that `sv stop` and `docker stop` stop it in order, that a new container on the
+  same volume still refuses the banned client, that a container with its state
+  files on a new volume mounted at the directory `SWWAF_STATE_DIR_FILE` names
+  becomes healthy, and that one whose `SWWAF_STATE_DIR` does not exist logs
+  `smallwebwaf`'s message about it; then removes the containers, the volumes and
+  both images. It needs network access, for nixpkgs' binary cache, and
+  `script/check` does not run it; `make example-app` does.
 - `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind it,
   with every setting of `smallwebwaf` at its default but `SWWAF_UPSTREAM_URL`,
   which names gitea's container. Of the requests that three of the notes

docs/admin-endpoints.md

@@ -0,0 +1,48 @@
+# Admin endpoints
+
+The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
+"Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
+and how their tokens work.
+
+- `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
+- `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
+  [`metrics.md`](metrics.md)).
+- `GET /_smallwebwaf/bans`: every ban held, under `bans`, each as `bans.json`
+  lists it. Needs `SWWAF_ADMIN_TOKEN`, as do the three below.
+- `POST /_smallwebwaf/bans`: bans a netblock. The body is a JSON object of
+  `netblock`, `duration` and, if you like, `reason`. `netblock` is a netblock
+  such as `203.0.113.0/24`, or a client's address, which bans its IPv4 netblock
+  (`SWWAF_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration such
+  as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying what is
+  wrong:
+    - one that is not such an object, or has another field;
+    - one longer than 4 KiB;
+    - one that names an IPv4-mapped netblock, or an address with a zone.
+- `DELETE /_smallwebwaf/bans/<client>`: lifts every active ban covering the
+  address `<client>`. It answers `404` when none is active.
+- `GET /_smallwebwaf/clients/<ip>`: what `smallwebwaf` knows of the client.
+  Under `client`, its counters and history as `clients.json` holds them, or
+  `null` when `clients.json` does not hold it. Under `bans`, every ban covering
+  the address, with its notes.
+
+## Examples
+
+With `SWWAF_ADMIN_TOKEN` set, and the token in `$TOKEN`:
+
+```sh
+# Every ban.
+curl -H "Authorization: Bearer $TOKEN" https://app.example/_smallwebwaf/bans
+
+# Ban 203.0.113.0/24 for seven days.
+curl -H "Authorization: Bearer $TOKEN" \
+    --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
+    https://app.example/_smallwebwaf/bans
+
+# Lift the bans on 203.0.113.9.
+curl -H "Authorization: Bearer $TOKEN" -X DELETE \
+    https://app.example/_smallwebwaf/bans/203.0.113.9
+
+# What smallwebwaf knows of 203.0.113.9.
+curl -H "Authorization: Bearer $TOKEN" \
+    https://app.example/_smallwebwaf/clients/203.0.113.9
+```

docs/alerts.md

@@ -0,0 +1,127 @@
+# Alerts
+
+The alert events, the JSON object the webhook gets, and the messages Slack and
+ntfy get. "Alerting" in [`SPEC.md`](../SPEC.md) says when an alert is sent, held
+back or dropped.
+
+## Events
+
+- `ban`: a ban `smallwebwaf` made.
+- `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
+  a request.
+- `waf_block`: the Core Rule Set scored a request at or over the threshold. The
+  request was refused unless the alert's `detail` gives `mode`: `detect` or
+  `observe`.
+- `anomaly`: a count over an anomaly threshold.
+- `reputation_hit`: a request from a client on a blocklist, the CrowdSec
+  decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
+  One alert per source.
+- `source_failure`: one of:
+    - GeoJS failing;
+    - a list that cannot be fetched;
+    - a DNS blocklist or AbuseIPDB failing or refusing a query;
+    - the day's AbuseIPDB checks used up.
+- `file_error`: one of:
+    - a rule file or state file edit with an error;
+    - a state file that cannot be written;
+    - a replacement lookup database that cannot be read.
+- `summary`: the hourly summary of alerts held back.
+
+## The JSON object
+
+This is the alert for a ban for a broken rate limit, shown indented; it is sent
+on one line:
+
+```json
+{
+    "instance": "fsn1app1/gitea",
+    "time": "2026-10-06T12:00:00.123461Z",
+    "event": "ban",
+    "client": "203.0.113.9",
+    "netblock": "203.0.113.9/32",
+    "asn": "",
+    "as_name": "",
+    "country": "",
+    "reason": "requests per minute over the limit of 1000",
+    "detail": {
+        "ban_expires": "2026-10-06T13:00:00.123Z",
+        "cause": "limit",
+        "notes": {
+            "asn": "",
+            "as_name": "",
+            "country": "",
+            "kind": "requests",
+            "limit": 1000,
+            "window": "minute",
+            "count": 1001,
+            "request": {
+                "time": "2026-10-06T12:00:00.123456789Z",
+                "method": "GET",
+                "host": "app.example",
+                "path": "/owner/repo/commits/branch/main?page=812",
+                "status": 403,
+                "user_agent": "scraper/1.0"
+            },
+            "requests": 5210,
+            "refused": 0,
+            "earlier_bans": {
+                "limit": 0,
+                "attack": 0,
+                "admin": 0,
+                "crowdsec": 0
+            }
+        }
+    },
+    "suppressed_repeats": 0
+}
+```
+
+- `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
+  one of the events above.
+- `client`: the address whose request raised the alert. `netblock`: the ban's
+  netblock, the netblock an anomaly counted, or, for the other events, the
+  client as rate limiting counts it: an IPv4 address as a /32, or an IPv6 group.
+  Both are empty for `source_failure` and `file_error`.
+- `asn`, `as_name` and `country`: the client's as known when the alert was
+  raised. They are empty when GeoJS had not answered yet.
+- `reason`: a short sentence, such as
+  `requests per minute over the limit of 1000` or `listed by a blocklist`.
+- `detail`: what is particular to the event:
+    - for a ban, its `cause`, `ban_expires` and `notes` (the notes are listed
+      under `bans.json` in [`state-files.md`](state-files.md));
+    - for an anomaly, the `scope`, `window`, `kind`, `count` and `threshold`;
+    - for a reputation hit, the `source` and, for AbuseIPDB, the `score`;
+    - for a Core Rule Set match, the `rule_ids`, `score`, `method` and `path`;
+    - for a source failure, the `source` and `error`;
+    - for a file error, the `file` and `error`;
+    - `mode`, when the request was not refused: `detect` or `observe`.
+- `suppressed_repeats`: how many repeats the cooldown held back before this
+  alert.
+
+## Slack and ntfy
+
+Slack and ntfy get a message with a title and a text. The title is the instance
+and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
+line for each of these that the alert has:
+
+- the client, the netblock and the country;
+- the file, the source, the error and the mode from `detail`;
+- the suppressed repeats, if any.
+
+Slack gets the title in bold and the text below it, with `&`, `<` and `>`
+escaped. ntfy gets the text as the message, with these headers:
+
+- `Title`: the title;
+- `Authorization`: the token, as `Bearer <token>`, while
+  `SWWAF_ALERT_NTFY_TOKEN` is set;
+- `Priority` and `Tags`: by event, as listed below.
+
+The priority and tag by event:
+
+- `ban`: priority `default`, tag `no_entry`.
+- `permanent_ban`: priority `high`, tag `no_entry`.
+- `waf_block`: priority `default`, tag `shield`.
+- `anomaly`: priority `high`, tag `chart_with_upwards_trend`.
+- `reputation_hit`: priority `low`, tag `label`.
+- `source_failure` and `file_error`: priority `high`, tag `warning`.
+- `summary`: priority `default`, tag `bar_chart`.

docs/gitea.md

@@ -0,0 +1,211 @@
+# smallwebwaf in front of gitea
+
+These notes record what `smallwebwaf` does in front of gitea at the default
+settings. They are observations, not requirements; the requirements are in
+[`SPEC.md`](../SPEC.md). `script/gitea-requests` runs gitea behind the image and
+sends through it a sample of gitea's ordinary use and the requests named below.
+It reports each request the Core Rule Set refuses, so that these notes can be
+checked again when gitea or the Core Rule Set changes version.
+
+## What the defaults cover
+
+- SSH access to gitea does not pass through `smallwebwaf` and is not protected
+  by it.
+- A clone is a response. It fits the defaults of 30 minutes and 5 GiB for all
+  but the largest repositories and slowest links.
+- A push is a request, and so is every other upload:
+    - a git push;
+    - an LFS object;
+    - a container image layer;
+    - a package file;
+    - a release attachment.
+
+    At the defaults, an upload larger than 100 MiB or taking more than 60
+    seconds is cut off, and no one is banned for it. "Size and time limits" in
+    `SPEC.md` gives the answers the client gets. A gitea that takes large
+    uploads needs `SWWAF_REQUEST_MAX_BYTES`, `SWWAF_CLIENT_REQUEST_TIMEOUT` and
+    `SWWAF_UPSTREAM_REQUEST_TIMEOUT` raised to fit.
+
+- Archive download and blame or history pages are what scrapers hammer. The
+  request limits do most of the work there.
+- An Actions runner that reaches gitea through `smallwebwaf` sends requests all
+  day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
+  43,200 requests a day, and reports a running job's log and state every second.
+  So it passes the day limit of 50,000 after about an hour and a quarter of
+  jobs. It is then banned, the job it is running fails, and each repeat within a
+  day makes the ban longer. Newer runners ask less often, but a busy one, or
+  several on one address, can still pass it. Put the runners' addresses in
+  `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+
+## What the Core Rule Set lets through
+
+At the defaults, the Core Rule Set lets gitea's ordinary use through, apart from
+the refusals in the next section:
+
+- browsing and views of files in a repository, with their history, blame and the
+  file tree;
+- diffs, including their hidden lines and large files, and pull request review;
+- git's clone, fetch and push over HTTP;
+- signing in, including the return to the page a visitor came from, and sign-in
+  with Git Credential Manager, git-credential-oauth or tea;
+- the API's calls for a file and its commits;
+- pushing and pulling container images and packages;
+- Actions runners, and artifacts uploaded with `actions/upload-artifact@v4`;
+- posting issues, pull requests, comments, wiki pages and files saved in the web
+  editor, code included, since no body is read;
+- the page gitea shows after a change, with its message naming what was done.
+
+## What the Core Rule Set still refuses
+
+Each refusal answers only that request ("Bans" in `SPEC.md` says what it counts
+toward). The request log names the rule in `waf_rule_ids`, which
+`SWWAF_WAF_DISABLED_RULES` can switch off.
+
+### A query string that reads as an attack
+
+Most often this is a search. Every query parameter is checked against the Core
+Rule Set's lists of system files and commands, except the ten named under
+"Attack detection" in `SPEC.md`. A release attachment uploaded through the API
+as `docker-compose.yml` is refused the same way. Examples:
+
+- a name on those lists, such as `package.json`, `.gitignore` or
+  `docker-compose.yml`;
+- text that starts with a command name, or whose first word has one right after
+  a `/`, such as `python3`, `ssh key` or `feat/docker-support`;
+- a shell command with its options or a system path (`ls -la`, `sed -i`,
+  `/bin/sh`), or a command in backticks;
+- script code (`fetch(`, `${VAR}`, `process.env`), HTML (`<img src=`) or an SQL
+  statement (`SELECT * FROM users WHERE`);
+- a URL naming an IP address or `localhost`.
+
+### A branch, tag or file name that starts with a command name
+
+The Core Rule Set's list of commands (932260) holds names such as `docker-`,
+`python3`, `ansible`, `base64` and `whoami`. A branch, tag or file name that
+starts with one is refused. So is one that has such a name right after a `/`,
+such as `feat/docker-support`, `fix/docker-build` or
+`renovate/docker-build-push-action-6.x`. gitea's own pages send the name in a
+query parameter that 930120, 932160 and 932260 still check:
+
+- `refSubUrl`, the branch or tag of a directory listing. It is sent when the
+  listing asks for its entries' last commits in a second request, which it does
+  whenever gitea takes more than a second to work them out;
+- `name`, when a branch is deleted or restored on the branches page;
+- `tag`, when a release is started from a tag;
+- `template`, the file of an issue template, when an issue is opened from it;
+- `rule_name`, when a branch protection rule is opened for editing in the
+  repository's settings or has just been saved.
+
+What a visitor sees, for a branch named `docker-build`:
+
+- A directory listing that makes that second request leaves those last commits
+  out and shows an error.
+- The branches page shows an error instead of deleting or restoring the branch.
+- A release started from such a tag gets the `403` answer of `smallwebwaf` in
+  place of its form. So does an issue opened from such a template, and such a
+  rule opened for editing.
+- Saving such a rule stores it. gitea then returns to the branch settings page,
+  which gets the `403` answer, so the save looks as if it failed.
+
+### A file name in a query parameter that trips the code rules
+
+The Core Rule Set's rules for Java, script, PowerShell and SQL find what they
+look for in some file names. This holds in the parameters `smallwebwaf` leaves
+out of 930120, 932160 and 932260 too (see the changes to the Core Rule Set under
+"Attack detection" in `SPEC.md`). Examples:
+
+- `runtime` in OpenJDK's `src/java.base/share/classes/java/lang/Runtime.java`
+  (944110);
+- a Java class, as in `java.lang.String.md` (944130);
+- `document.write.js` (941180);
+- `process.env.d.ts` (934100);
+- `__proto__` (934130);
+- the PowerShell command `Install-Script`, as in `install-script.sh` (932120);
+- a database's name, as in PostgreSQL's `information_schema.sql` (942140).
+
+For such a file, these requests are refused:
+
+- the API's list of its commits (`path`);
+- the API's call for the contents of files that names it in its query (`body`);
+- the commit graph of that file alone (`file`);
+- the hidden lines of its diff (`path`), which stay hidden;
+- the sign-in page gitea sends a visitor to on the way to a page of the file
+  that needs signing in, such as its edit page (`redirect_to`). The visitor can
+  still sign in by opening the sign-in page itself.
+
+### A path
+
+- A file name ending in `~`, or an `.xhtml` file whose path holds a space.
+- A path that holds what the Core Rule Set takes for a Java class (944130), as
+  `java.lang.String.md` and
+  `META-INF/services/org.apache.commons.logging.LogFactory` do.
+- A path that holds what it takes for Node.js code (934100), as
+  `process.env.d.ts` does.
+- A path with a directory named `...` (930100, 930110), such as `.../notes.txt`.
+
+For such a file, the page of the file, its raw file, its history, its blame and
+its edit page are refused. The directory that holds it lists it, and a clone
+carries it.
+
+### A container image push that reuses a layer
+
+A push can reuse a layer of an image docker has pushed to that gitea before.
+docker then asks gitea to take the layer from that image, naming it in the query
+parameter `from`, which 932260 checks. The request is refused when the image's
+owner starts with an entry on the list of commands. So is one whose name after
+the owner does. Examples are `owner/python3-app`, `owner/docker-base`, and any
+image of an owner named `ansible` or `docker-team`.
+
+What happens next depends on docker's image store. A docker that keeps its
+images in containerd's image store fails the push, and fails each new try the
+same way. A new install of Docker Engine 29 does this. A docker that keeps them
+in its own older image store uploads the layer instead. The push then succeeds
+after one refusal for each layer it reuses, and each of those refusals counts
+toward the error burst.
+
+### Artifact uploads from `actions/upload-artifact@v3`
+
+This action sends the header `Content-Range`, which the Core Rule Set refuses
+(920450). The action sends two files at a time, does not retry a `403`, and
+sends no further file once one is refused. So an upload is refused once or
+twice, however many files it holds, and the step fails. One upload does not ban
+the runner. More than 30 such refusals from its address within a minute, as when
+many jobs upload at once, ban it through the error burst.
+`actions/upload-artifact@v4` does not send the header.
+
+## What body inspection refuses
+
+With `SWWAF_WAF_BODY_LIMIT` set, the Core Rule Set reads request bodies too. In
+front of gitea it then refuses these, until their rule ids, named in the request
+log, are added to `SWWAF_WAF_DISABLED_RULES`:
+
+- issue and comment text, wiki pages and files saved in the web editor that hold
+  shell commands or code (932125, 932235, 932250 and others);
+- package descriptions that show code;
+- PyPI uploads (922130);
+- attachments named like `debug.log` or `config.yml` (932180).
+
+## What `script/gitea-requests` sends
+
+Of the requests above, the script sends:
+
+- for each file named under "A file name in a query parameter that trips the
+  code rules", the API's list of its commits;
+- for `Runtime.java` alone, the commit graph of that file, the hidden lines of
+  its diff, and the API's call for the contents of files that names it;
+- the sign-in page gitea sends a visitor to on the way to the edit page of
+  `document.write.js`;
+- the pages of `java.lang.String.md`,
+  `META-INF/services/org.apache.commons.logging.LogFactory`, `process.env.d.ts`
+  and `.../notes.txt`;
+- one container image push that reuses a layer, which it does not try again.
+
+It does not send the raw file, history, blame or edit page of those four files,
+or the pages of the directories `META-INF/services` and `...`. It also sends a
+short sample of gitea's ordinary use:
+
+- signing in;
+- pages of files and commits, and a diff;
+- the API;
+- a push, and clone and fetch over HTTP;
+- two container image pushes.

docs/image.md

@@ -0,0 +1,36 @@
+# What the image holds
+
+The contents of the `smallwebwaf` image, and how each part is pinned.
+"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
+is pinned that way.
+
+## Contents
+
+- Ubuntu 26.04 LTS, pinned by digest.
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
+  archive at `20261001T000000Z`.
+- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
+  `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
+  Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
+  Unpacked, nixpkgs takes about 500 MiB.
+- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
+  at a fixed commit hash.
+- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
+- The service directory `/etc/service/smallwebwaf`, with the `run` script
+  `share/smallwebwaf.run`.
+- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
+  with the default rule file `share/rules.d/00-default.rules`.
+- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
+
+## Pins
+
+- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
+  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
+  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
+  `apt-get update`. The hashes are the amd64 archive's.
+- nixpkgs: the release file `nixexprs.tar.xz` of
+  `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
+  SHA-256 hash.
+- `runsvinit`: the archived repository, unchanged since 2015, at tag `v2.0.0`,
+  by commit hash, with a `go.mod` the build writes.
+- The Go image that builds `smallwebwaf`: by digest.

docs/metrics.md

@@ -0,0 +1,83 @@
+# The metrics
+
+`GET /_smallwebwaf/metrics` answers in the Prometheus text format. The
+requirements are under "Metrics endpoint" in [`SPEC.md`](../SPEC.md); this file
+lists the metrics. Every metric carries the label `instance`, set to
+`SWWAF_INSTANCE_NAME`; Prometheus keeps it as `exported_instance` unless the
+scrape sets `honor_labels: true`. No metric carries a client's address.
+
+## Traffic
+
+- `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
+  `smallwebwaf_response_bytes_total`, by `status_class` such as `2xx` and by
+  `action`;
+- `smallwebwaf_request_duration_seconds` and
+  `smallwebwaf_upstream_duration_seconds`, as histograms;
+- `smallwebwaf_requests_in_flight`.
+
+## Limits and bans
+
+- `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
+  `bytes` or `refusals`);
+- `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed;
+- `smallwebwaf_offences_total`, by `kind`;
+- `smallwebwaf_bans_made_total`, by `cause`;
+- `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
+
+## Attack detection
+
+- `smallwebwaf_rule_matches_total`, by `rule_id` and `action`, and
+  `smallwebwaf_rules_loaded`;
+- `smallwebwaf_waf_matches_total`, by `mode` and `rule_id`, for the rules that
+  fired.
+
+## Countries and AS numbers
+
+For the `SWWAF_METRICS_TOP_N` busiest of each, the rest as `other`:
+
+- `smallwebwaf_country_requests_total`,
+  `smallwebwaf_country_request_bytes_total`,
+  `smallwebwaf_country_response_bytes_total` and
+  `smallwebwaf_country_list_refusals_total`, by `country`;
+- `smallwebwaf_asn_requests_total`, `smallwebwaf_asn_request_bytes_total` and
+  `smallwebwaf_asn_response_bytes_total`, by `asn`.
+
+## Lookups
+
+- `smallwebwaf_geojs_requests_total` and `smallwebwaf_geojs_failures_total`;
+- `smallwebwaf_geojs_unanswered_total`: the requests that needed an answer and
+  went on without it;
+- with the file source,
+  `smallwebwaf_lookup_database_last_read_timestamp_seconds` and
+  `smallwebwaf_lookup_database_read_failures_total`.
+
+## Reputation sources
+
+By `source`: each list's URL, each zone, and `abuseipdb`:
+
+- `smallwebwaf_reputation_hits_total`, `smallwebwaf_reputation_queries_total`
+  and `smallwebwaf_reputation_failures_total`;
+- `smallwebwaf_reputation_last_fetch_timestamp_seconds`, for a list;
+- `smallwebwaf_reputation_daily_budget_remaining`, for AbuseIPDB.
+
+## State files
+
+By `file`:
+
+- `smallwebwaf_state_file_writes_total`,
+  `smallwebwaf_state_file_write_failures_total`,
+  `smallwebwaf_state_file_last_write_timestamp_seconds` and
+  `smallwebwaf_state_file_size_bytes`;
+- `smallwebwaf_state_file_edits_taken_in_total` and
+  `smallwebwaf_state_file_edits_set_aside_total`;
+- `smallwebwaf_tracked_clients`: the clients in the table.
+
+## Remote log, alerts and the process
+
+- while a syslog server is set, `smallwebwaf_remote_log_lines_sent_total`,
+  `smallwebwaf_remote_log_lines_dropped_total` and
+  `smallwebwaf_remote_log_buffer_depth`;
+- by `destination`, `smallwebwaf_alerts_sent_total`,
+  `smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
+  `smallwebwaf_alerts_dropped_total`;
+- Go's own `go_` metrics and the process's `process_` metrics.

docs/request-log.md

@@ -0,0 +1,108 @@
+# The request log's fields
+
+The fields of the JSON object `smallwebwaf` writes for each request. "Request
+log" in [`SPEC.md`](../SPEC.md) says when a line is written and how the log is
+sent to a syslog server. A field that does not apply to a request is left out.
+
+## Example
+
+```
+{"type":"request","time":"2026-10-03T12:00:00.123Z","instance":"fsn1app1/gitea","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"response_content_type":"text/html; charset=utf-8","upstream_status":200,"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"duration_total":3.217,"duration_checks":0.041,"duration_upstream_connect":0.052,"duration_upstream_first_byte":2.874,"duration_upstream_total":3.104}
+```
+
+## Every line
+
+Every line has `type` (`request`; the process's own messages have `process`),
+the standard web log fields, `request_id`, `peer_ip`, `client_group`, `asn`,
+`as_name`, `country`, `action` and `duration_total`.
+
+## Standard web log fields
+
+- `time`: when the request arrived, RFC 3339 with milliseconds, in UTC;
+- `instance`: `SWWAF_INSTANCE_NAME`;
+- `client_ip`, `method`, `scheme`, `host`, `path`, `query`, `protocol`;
+- `status`: what the client was sent, `0` if nothing;
+- `request_bytes` and `response_bytes`: body bytes each way;
+- `referer` and `user_agent`.
+
+## Request detail
+
+- `request_id`: the `X-Request-ID` a trusted proxy sent, or a new random one of
+  26 letters and digits. It goes to the app in `X-Request-ID`.
+- `peer_ip`: the TCP peer, normally traefik.
+- `forwarded_for`: the `X-Forwarded-For` header as received.
+- `client_group`: the client as rate limiting counts it, an IPv4 address as a
+  /32 or an IPv6 group.
+- `asn`, `as_name` and `country`: the client's, as looked up. Each is empty
+  when:
+    - lookups are off;
+    - the client is not looked up;
+    - the source cannot place the client;
+    - GeoJS had not answered by the time the request went on.
+- `content_type` and `content_length`: the request's own.
+- `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
+  in lower case.
+- `has_authorization` and `has_cookie`: true when the request had those headers.
+  Their values are never logged.
+- `websocket`: true when the app switched the connection to another protocol.
+
+## Response detail
+
+- `upstream_status`: what the app answered. It differs from `status` when
+  `smallwebwaf` answered itself.
+- `response_content_type`, `cache_control` and `location`: the answer's headers.
+- `aborted`: true when the client went away early.
+
+## Decision
+
+- `action`: what was done:
+    - `forward`: passed to the app;
+    - `denied`: refused for `SWWAF_DENY_NETS`, or for a reputation source with
+      the action `deny`;
+    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
+      CrowdSec decision, each of which bans the client;
+    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
+      refused by that check;
+    - `too_large` and `timed_out`: a size or time limit was passed;
+    - `upstream_error`: the app could not be reached, or its answer broke off;
+    - `admin`: answered at one of `smallwebwaf`'s own endpoints.
+- `would_action`: in `observe` mode, what `enforce` mode would have done with a
+  request it would have refused. `action` then names what was done, normally
+  `forward`.
+- `limit_percent` and `limit_percent_setting`: the client's percentage of the
+  rate limits and the setting that lowered it, when one did. `bytes_percent` and
+  `bytes_percent_setting` do the same for the byte limits.
+- `counts`: the client's totals as rate limiting counts them, this request
+  included. It is left out when rate limiting did not count the request. A count
+  can have a fraction, since each window is counted in two buckets with the
+  earlier one weighted:
+    - `minute`, `hour` and `day`: requests;
+    - `minute_bytes`, `hour_bytes` and `day_bytes`: bytes.
+- `limit_hit`: the limit broken: `minute`, `hour` or `day` for a rate limit;
+  `minute_bytes`, `hour_bytes` or `day_bytes` for a byte limit; or
+  `error_burst`. A request whose bytes broke a limit was passed on whole, so its
+  `action` stays `forward`.
+- `rule_ids`: the rule file rules that matched, in order, up to the one that
+  refused.
+- `waf_score` and `waf_rule_ids`: the Core Rule Set's score and the rules that
+  matched, for a request it inspected.
+- `reputation`: the sources the client is on, in this order:
+    - blocklist URLs;
+    - the CrowdSec decision list's URL;
+    - DNS blocklist zones;
+    - `abuseipdb`.
+- `offence`: the kind of offence recorded, when one was.
+- `ban_expires`: when the client's ban ends, for a request that made one or was
+  refused under one: a time, or `permanent`.
+
+## Timings
+
+All in milliseconds:
+
+- `duration_total`: from the request's headers being read to its log line;
+- `duration_checks`: to the end of the checks, before forwarding;
+- `duration_waf`: the part of that the Core Rule Set took;
+- `duration_upstream_connect`: from the hand-over to the app until there was a
+  connection;
+- `duration_upstream_first_byte`: until the first byte of the answer;
+- `duration_upstream_total`: until the end of the answer.

docs/rules.md

@@ -0,0 +1,67 @@
+# Rule files
+
+The format of a rule file, and the default file the image ships. "Rule files" in
+[`SPEC.md`](../SPEC.md) says how the files are read, watched and mounted, and
+what each action leads to.
+
+## The format
+
+A rule is a line of four fields separated by spaces or tabs: an id, a target, an
+action and a regex. The regex runs to the end of the line. Blank lines and lines
+starting with `#` are ignored.
+
+```
+# id           target      action  regex
+env-file       path        ban     (?i)^/\.env(\.[a-z]+)?$
+scanner-agent  user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|wpscan)\b
+```
+
+- The id is letters, digits, `-` and `_`, unique across all files. The log line,
+  the metrics, the alerts and a ban's notes name the rule by it.
+- The target is what the regex is matched against:
+    - `path`: the path without the query;
+    - `uri`: the path and the query together;
+    - `query`: the query as sent;
+    - `method`, `host`, `user_agent` and `referer`;
+    - `header:<Name>`: any one request header but `Host` and
+      `Transfer-Encoding`.
+- The action is `log`, `block` or `ban`.
+- The regex is in Go's syntax, RE2. It matches anywhere in the target unless
+  anchored with `^` and `$`. `(?i)` at its front makes it ignore case.
+
+## The default file
+
+The image ships one file, `share/rules.d/00-default.rules`, installed as
+`/etc/smallwebwaf/rules.d/00-default.rules`:
+
+```
+# 00-default.rules: probes no real visitor sends, anchored at the site root
+
+# id             target      action  regex
+env-file         path        ban     (?i)^/\.env(\.[a-z]+)?$
+vcs-dir          path        ban     (?i)^/\.(git|svn|hg|bzr)(/|$)
+secrets-dir      path        ban     (?i)^/\.(aws|ssh|docker|kube)/
+secret-file      path        ban     (?i)^/\.(htpasswd|htaccess|npmrc|netrc|pgpass|git-credentials|bash_history|DS_Store)$
+editor-dir       path        ban     (?i)^/\.(vscode|idea)/
+backup-file      path        ban     (?i)^/[^/]+\.(php(\.[a-z0-9]+|~)|sql(\.[a-z0-9]+)?)$
+log-file         path        ban     (?i)^/(debug|error|access)\.log$
+compose-file     path        ban     (?i)^/(docker-)?compose\.ya?ml$
+php-shell        path        ban     (?i)^/(shell|c99|r57|wso|alfa)\.php$
+scanner-agent    user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|masscan|zgrab|wpscan)\b
+path-traversal   uri         block   (\.\./){2,}
+empty-agent      user_agent  log     ^$
+```
+
+## A file of your own
+
+An app's `Dockerfile` adds rules of its own in a file named to sort after the
+default, such as `50-gitea.rules`:
+
+```
+# 50-gitea.rules: WordPress probes, which gitea never serves
+wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
+```
+
+```dockerfile
+COPY 50-gitea.rules /etc/smallwebwaf/rules.d/50-gitea.rules
+```

docs/settings.md

@@ -0,0 +1,326 @@
+# Settings
+
+Every setting, its default and the values it takes, in the groups of "Settings"
+in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
+that take `off`, the `_FILE` form, and what each group does and why. A setting
+set to a value its entry does not allow stops the start.
+
+## Forms of values
+
+- A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
+  and negative durations are refused.
+- A size is a number of bytes with an optional `K`, `M` or `G`, which are powers
+  of 1024, so `1K` is 1024 bytes. Examples: `512K`, `100M`, `5G`.
+- A count is a whole number of requests, such as `1000`.
+- A list is comma separated, with spaces around items ignored. An empty item is
+  refused.
+- A netblock is an address and a prefix length, such as `10.0.0.0/8`. A bare
+  address stands for itself alone.
+- A country is a two-letter code of ISO 3166-1, in either case: `de` and `DE`
+  are the same. `xk` stands for Kosovo. A code that is not a country is refused,
+  such as `nk` (North Korea is `kp`) or the withdrawn `su`.
+- An AS number is `AS` and the number, in either case, such as `AS64496`.
+- A percentage is a whole number from 0 to 100.
+- A path prefix starts with `/`, such as `/assets/`.
+
+## Core
+
+- `SWWAF_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
+  `https` URL with a host and an optional port, and nothing more.
+- `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens, an
+  optional host and a port. The host stays empty.
+- `SWWAF_INSTANCE_NAME` (default: the container's host name): the `instance`
+  name in every log line, alert and metric, such as `fsn1app1/gitea`. Valid
+  UTF-8. No control character while `SWWAF_ALERT_NTFY_URL` is set. 1 to 48
+  printable ASCII characters without a space while `SWWAF_LOG_REMOTE_URL` is set
+  and `SWWAF_LOG_REMOTE_APP_NAME` is not.
+- `SWWAF_MODE` (default `enforce`): `enforce` or `observe`.
+- `SWWAF_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
+  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
+  nothing.
+- `SWWAF_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6
+  client's group, from 32 to 128.
+- `SWWAF_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
+  number above zero.
+- `SWWAF_MAX_BANS` (default `5000`): the most bans `smallwebwaf` made that are
+  kept, a whole number above zero.
+
+## Tokens
+
+- `SWWAF_ADMIN_TOKEN` (default unset): the token for the ban endpoints and
+  `/_smallwebwaf/clients/<ip>`. At least 32 characters.
+- `SWWAF_METRICS_TOKEN` (default unset): the token for `/_smallwebwaf/metrics`.
+  At least 32 characters.
+
+## State files
+
+- `SWWAF_STATE_DIR` (default `/var/lib/smallwebwaf`): the directory of the state
+  files, an absolute path that exists and can be written.
+- `SWWAF_STATE_WRITE_DELAY` (default `10s`): how long `bans.json` waits to be
+  written after a ban is made, lifted or made permanent. A duration.
+- `SWWAF_STATE_COUNTER_INTERVAL` (default `15m`): how often every state file is
+  written. A duration.
+
+## Logging
+
+- `SWWAF_LOG_LEVEL` (default `info`): the least severe of `smallwebwaf`'s own
+  messages that are written: `debug`, `info`, `warn` or `error`.
+- `SWWAF_LOG_REQUEST_HEADERS` (default
+  `accept,accept-language,accept-encoding,content-type,origin,range`): the
+  request headers recorded in the log line, in either case. `Host` and
+  `Transfer-Encoding` are refused; the host is the field `host`.
+- `SWWAF_LOG_REMOTE_URL` (default unset): a syslog server that also gets every
+  line written to stdout: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://`,
+  each with a host and a port and nothing more.
+- `SWWAF_LOG_REMOTE_TLS_CA_FILE` (default unset): a file of PEM certificates
+  that a `syslog+tls` server's certificate must chain to, instead of the host's
+  own. A file that cannot be read, or holds no certificate, is refused.
+- `SWWAF_LOG_REMOTE_BUFFER` (default `10000`): the most lines held while they
+  wait to be sent, a whole number above zero.
+- `SWWAF_LOG_REMOTE_FACILITY` (default `local0`): the syslog facility: `kern`,
+  `user`, `mail`, `daemon`, `auth`, `syslog`, `lpr`, `news`, `uucp`, `cron`,
+  `authpriv`, `ftp`, or `local0` to `local7`.
+- `SWWAF_LOG_REMOTE_APP_NAME` (default: `SWWAF_INSTANCE_NAME`): the app name in
+  each syslog record, 1 to 48 printable ASCII characters without a space.
+
+## Metrics
+
+- `SWWAF_METRICS_TOP_N` (default `50`): how many AS numbers and how many
+  countries get series of their own. A whole number above zero.
+
+## Static lists
+
+- `SWWAF_ALLOW_NETS` (default empty): netblocks whose clients are refused only
+  for a size or time limit or a missing or wrong token, such as your monitoring.
+- `SWWAF_RATE_LIMIT_EXEMPT_NETS` (default empty): netblocks whose clients are
+  exempt from rate limiting and the byte limits.
+- `SWWAF_DENY_NETS` (default empty): netblocks whose clients are always refused.
+
+## Request rate limits, per client
+
+- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `1000`), `SWWAF_RATE_LIMIT_PER_HOUR`
+  (default `10000`) and `SWWAF_RATE_LIMIT_PER_DAY` (default `50000`): the most
+  requests a client may make in each window. A count or `off`.
+- `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
+  rate limiting and the byte limits, such as `/assets/`.
+
+## Byte limits, per client
+
+- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `10G`), `SWWAF_BYTES_LIMIT_PER_HOUR`
+  (default `20G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `50G`): the most
+  bytes counted for a client in each window. A size or `off`.
+- `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
+  `response`, `request` or `both`.
+
+## Size and time limits
+
+- `SWWAF_CLIENT_REQUEST_TIMEOUT` (default `60s`): how long a client may take to
+  send its request line and headers, and then, from the end of the headers, its
+  body. A duration or `off`.
+- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest request
+  line and headers. A size over `4K`; never `off`.
+- `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open connection
+  may wait for its next request before it is closed. A duration or `off`.
+- `SWWAF_CLIENT_RESPONSE_TIMEOUT` (default `30m`): how long the answer may take
+  to reach the client, from the end of the request to the last byte. A duration
+  or `off`.
+- `SWWAF_UPSTREAM_REQUEST_TIMEOUT` (default `60s`): how long connecting to the
+  app and sending it the whole request may take. A duration or `off`.
+- `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` (default `30m`): how long the app may take
+  to send its whole answer. A duration or `off`.
+- `SWWAF_REQUEST_MAX_BYTES` (default `100M`): the largest request body. A size
+  or `off`.
+- `SWWAF_RESPONSE_MAX_BYTES` (default `5G`): the largest response body. A size
+  or `off`.
+
+## Lookup of AS number and country
+
+- `SWWAF_LOOKUP_SOURCE` (default `geojs`): `geojs`, `file` or `off`.
+- `SWWAF_LOOKUP_DB_PATH` (default empty): the IPinfo Lite database file, in its
+  `.mmdb` form, for `SWWAF_LOOKUP_SOURCE=file`.
+- `SWWAF_LOOKUP_TIMEOUT` (default `1s`): how long a request waits for its
+  client's first answer from GeoJS, and how long a request to GeoJS may take. A
+  duration; never `off`.
+- `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` passes the app the
+  client's AS number in `X-Client-ASN` and its country in `X-Client-Country`.
+
+## Country lists
+
+- `SWWAF_DENIED_COUNTRIES` (default empty): countries whose clients are refused,
+  such as `cn,ru,kp`.
+- `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` (default empty): when set, the only
+  countries whose clients get through, such as `us,de`. A country on both lists
+  is refused.
+
+## Biased thresholds
+
+- `SWWAF_ASN_LIMIT_PERCENT` (default empty): a list of AS numbers, each with `:`
+  and a percentage, such as `AS14061:50,AS16276:50,AS45102:25`. An AS number
+  listed twice is refused.
+- `SWWAF_COUNTRY_LIMIT_PERCENT` (default empty): the same by country, such as
+  `cn:25,ru:50`.
+- `SWWAF_ASN_BYTES_PERCENT` and `SWWAF_COUNTRY_BYTES_PERCENT` (default empty):
+  the same, for the byte limits alone.
+- `SWWAF_UNKNOWN_LIMIT_PERCENT` (default `100`): the percentage for a client the
+  lookup cannot place.
+- `SWWAF_ASN_LIMIT_PERCENT_URL` (default unset): the `http` or `https` URL of a
+  text file of `AS<number>:<percent>` lines, one to a line. A URL that is also
+  in `SWWAF_BLOCKLIST_URLS` is refused.
+
+## Attack detection
+
+- `SWWAF_RULES_DIR` (default `/etc/smallwebwaf/rules.d`): the directory of the
+  rule files.
+- `SWWAF_RULES_ENABLED` (default `true`): `false` reads no rule file.
+- `SWWAF_TRAP_PATHS` (default empty): paths only scanners ask for, such as
+  `/wp-login.php,/xmlrpc.php`. Each starts with `/` and holds no `?`.
+- `SWWAF_WAF_MODE` (default `block`): `off`, `detect` or `block`.
+- `SWWAF_WAF_PARANOIA_LEVEL` (default `1`): the Core Rule Set's paranoia level,
+  from 1 to 4.
+- `SWWAF_WAF_ANOMALY_THRESHOLD` (default `5`): the score at which a request is a
+  match. A whole number above zero, or `off`.
+- `SWWAF_WAF_DISABLED_RULES` (default
+  `920340,920420,920440,920640,930130,930140`): the ids of Core Rule Set rules
+  to switch off. Each a whole number above zero. An id from 900000 to 900999 is
+  refused: those are the rules that set the Core Rule Set up, and
+  `smallwebwaf`'s own.
+- `SWWAF_WAF_EXEMPT_PATHS` (default empty): path prefixes the Core Rule Set does
+  not inspect.
+- `SWWAF_WAF_BODY_LIMIT` (default `off`): `off`, or how much of a request body
+  the Core Rule Set reads, a size of at most `1G`.
+- `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
+  in a minute for a rule match, a trap path, a Core Rule Set match or a failed
+  token check. A count or `off`.
+
+## Ban lengths, response and scope
+
+- `SWWAF_BAN_RESPONSE` (default `403`): `403`, `429` or `close`.
+- `SWWAF_LIMIT_BAN_DURATION` (default `1h`): the ban for a first broken limit. A
+  duration.
+- `SWWAF_LIMIT_BAN_REPEAT_WINDOW` (default `24h`): the time after a ban ends
+  within which breaking a limit again lengthens the next ban. A duration.
+- `SWWAF_MAX_BAN_DURATION` (default `7d`): the longest ban for a broken limit;
+  one that would be longer is permanent. A duration.
+- `SWWAF_ATTACK_BAN_DURATION` (default `7d`): the ban for a first clear sign of
+  attack. A duration.
+- `SWWAF_BAN_SCOPE_V4_PREFIX` (default `32`): how much a ban on an IPv4 client
+  covers: the prefix length of its netblock, from 0 to 32.
+
+## Reputation
+
+- `SWWAF_BLOCKLIST_URLS` (default empty): blocklists to fetch, such as
+  `https://www.spamhaus.org/drop/drop.txt`. Each an `http` or `https` URL
+  without a user or a fragment. A URL listed twice is refused.
+- `SWWAF_BLOCKLIST_REFRESH` (default `24h`): how long a list waits after its
+  last try before it is fetched again. A duration of `1h` or more.
+- `SWWAF_BLOCKLIST_ACTION` (default `deny`): `deny`, `limit:<percent>` or `log`.
+- `SWWAF_DNSBL_ZONES` (default empty): the DNS blocklists to ask, such as
+  `dnsbl.dronebl.org`. Each a DNS name of at most 189 characters. A Spamhaus
+  zone carries its key, as in `<key>.xbl.dq.spamhaus.net`. A zone listed twice
+  is refused, whatever its case or key.
+- `SWWAF_DNSBL_RESOLVER` (default unset): the resolver to ask the zones through,
+  such as `192.0.2.53` or `[2001:db8::53]:5353`. An IP address with an optional
+  port, 53 when none is given. Unset, the host's resolver is used.
+- `SWWAF_ABUSEIPDB_KEY` (default unset): the key of your AbuseIPDB account. A
+  control character in it is refused.
+- `SWWAF_ABUSEIPDB_MIN_SCORE` (default `75`): the least abuse confidence score,
+  from 0 to 100, that is a hit.
+- `SWWAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a day,
+  a whole number above zero. AbuseIPDB's free accounts may make 1,000.
+- `SWWAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec engine
+  you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL without a
+  user or a fragment; its decision list is at `v1/decisions` under it. Set
+  without the key, it is refused. So is a decision list URL that is also in
+  `SWWAF_BLOCKLIST_URLS`, or that is `SWWAF_ASN_LIMIT_PERCENT_URL`.
+- `SWWAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
+  `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
+  URL, it is refused.
+- `SWWAF_REPUTATION_ACTION` (default `limit:25`): `deny`, `limit:<percent>` or
+  `log`, for DNS blocklist and AbuseIPDB hits.
+- `SWWAF_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict or
+  AbuseIPDB's score is used. A duration.
+- `SWWAF_REPUTATION_TIMEOUT` (default `2s`): how long a query to a zone or a
+  check with AbuseIPDB may take. A duration.
+
+## Alerting
+
+- `SWWAF_ALERT_WEBHOOK_URL` (default unset): the webhook that receives each
+  alert as a JSON object. An `http` or `https` URL without a user or a fragment.
+- `SWWAF_ALERT_WEBHOOK_HEADERS` (default empty): headers sent with each post,
+  such as `Authorization:Bearer 0123456789abcdef`. A list of name, `:` and
+  value. A value cannot hold a comma.
+- `SWWAF_ALERT_SLACK_WEBHOOK_URL` (default unset): the Slack incoming webhook
+  that receives each alert as a message, checked as the webhook URL is.
+- `SWWAF_ALERT_NTFY_URL` (default unset): the ntfy topic that receives each
+  alert, as the topic's full URL, such as `https://ntfy.sh/my-alerts`, checked
+  as the webhook URL is.
+- `SWWAF_ALERT_NTFY_TOKEN` (default unset): an ntfy access token. A control
+  character in it is refused.
+- `SWWAF_ALERT_EVENTS` (default
+  `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
+  the event types alerts are sent for, from those in [`alerts.md`](alerts.md)
+  but `summary`. Any other name is refused.
+- `SWWAF_ALERT_COOLDOWN` (default `15m`): how long a repeat of an alert is held
+  back. A duration or `off`.
+- `SWWAF_ALERT_MAX_PER_HOUR` (default `60`): the most alerts sent in an hour. A
+  whole number above zero, or `off`.
+
+## Anomaly thresholds
+
+Each scope has four thresholds: the most requests and the most bytes counted in
+a minute and in an hour. Requests are counts, bytes are sizes. Each is `off` by
+default. The four thresholds per client are:
+
+- `SWWAF_ANOMALY_CLIENT_REQUESTS_PER_MINUTE`;
+- `SWWAF_ANOMALY_CLIENT_REQUESTS_PER_HOUR`;
+- `SWWAF_ANOMALY_CLIENT_BYTES_PER_MINUTE`;
+- `SWWAF_ANOMALY_CLIENT_BYTES_PER_HOUR`.
+
+The other scopes' names have another prefix before the same four endings, such
+as `REQUESTS_PER_MINUTE`:
+
+- `SWWAF_ANOMALY_NET_...`: per netblock around a client. Two settings give the
+  netblock's length:
+    - `SWWAF_ANOMALY_NET_V4_PREFIX` (default `24`, from 0 to 32) for an IPv4
+      client;
+    - `SWWAF_ANOMALY_NET_V6_PREFIX` (default `48`, from 0 to 128) for an IPv6
+      client.
+- `SWWAF_ANOMALY_ASN_...`: per AS number. Needs a lookup source.
+- `SWWAF_ANOMALY_TOTAL_...`: the whole service.
+- `SWWAF_WATCH_...`: each netblock in `SWWAF_WATCH_NETS`, as a whole.
+  `SWWAF_WATCH_NETS` (default empty) is a list of name, `=` and netblock, such
+  as `office=203.0.113.0/24,scraper-x=198.51.100.0/22`. An item without `=` or a
+  name, or with a bad netblock, is refused. So is a name used twice.
+
+## Settings given as files
+
+Add `_FILE` to a setting's name to read its value from a file:
+`SWWAF_METRICS_TOKEN_FILE` names the file that holds `SWWAF_METRICS_TOKEN`. To
+keep a token from the app, make the file on the host, owned by uid 65532 with
+mode `0400`:
+
+```sh
+mkdir -p /srv/app/tokens
+openssl rand -hex 32 > /srv/app/tokens/metrics
+chown 65532:65532 /srv/app/tokens/metrics
+chmod 0400 /srv/app/tokens/metrics
+```
+
+Mount its directory into the container read-only, and name the file:
+
+```sh
+docker run \
+    -v /srv/app/tokens:/etc/smallwebwaf/tokens:ro \
+    -e SWWAF_METRICS_TOKEN_FILE=/etc/smallwebwaf/tokens/metrics \
+    ...
+```
+
+## Fixed limits
+
+A few limits are fixed rather than settings:
+
+- at most 100,000 GeoJS answers are kept;
+- at most 100,000 DNS blocklist verdicts and 100,000 AbuseIPDB scores are kept;
+- at most 1,000 DNS blocklist queries are under way at once;
+- at most 20,000 anomaly counters are kept;
+- each alert destination's queue holds at most 1,000 alerts.

docs/state-files.md

@@ -0,0 +1,100 @@
+# State files
+
+The five JSON files in `SWWAF_STATE_DIR`, and what each holds. "Persistent
+state" in [`SPEC.md`](../SPEC.md) says how they are written, read and edited.
+Each has a top-level `version` of 1.
+
+## `bans.json`
+
+Active and past bans: every ban an admin made, and up to `SWWAF_MAX_BANS` of
+those `smallwebwaf` made. Per entry:
+
+- `netblock`, `start` and `expires` (`null` for a permanent ban);
+- `cause`: `attack`, `limit`, `admin` or `crowdsec`;
+- `reason`: a short reason;
+- `lifted`: when an admin lifted it, if one did;
+- `notes`: the notes below.
+
+To ban a netblock, add an entry with its `netblock`, `start` and `expires`.
+`reason`, `notes` and `cause` may be left out; the cause is then `admin`:
+
+```json
+{
+    "version": 1,
+    "bans": [
+        {
+            "netblock": "203.0.113.0/24",
+            "start": "2026-10-06T12:00:00Z",
+            "expires": null,
+            "reason": "probes for logins"
+        }
+    ]
+}
+```
+
+To lift a ban, add `"lifted"` with the time you lift it, such as
+`"lifted": "2026-10-06T13:00:00Z"`. To keep a ban `smallwebwaf` made, set its
+`cause` to `admin`. To forget a ban, delete its entry.
+
+The notes:
+
+- `asn`, `as_name` and `country`: the client's, added when the lookup answers
+  (empty when lookups are off);
+- what was broken: the rule id and target that matched, or the trap path, or the
+  limit, its window and the count reached;
+- the client's percentage of the limit, with the setting that gave it;
+- the reputation sources the client is on;
+- `request`: the request that caused the ban: time, method, host, path with its
+  query string, status and user agent, each text cut to 256 bytes;
+- `requests` and `refused`: the netblock's requests since it was first seen, and
+  how many this ban has refused so far, kept up to date while the ban lasts;
+- `earlier_bans`: how many earlier bans the netblock had, by cause.
+
+## `clients.json`
+
+Per client, one per line: its minute, hour and day counters, and its history
+since it was first seen:
+
+- the first and last time seen;
+- the AS number, AS name and country last looked up, and when;
+- total requests, and how many were forwarded and how many refused;
+- bytes in each direction;
+- responses by status class;
+- offences by kind: `limit`, `attack`, `rule_blocked`, `waf_blocked` and
+  `token_refused`.
+
+## `lookups.json`
+
+GeoJS answers, one per line:
+
+- `client`;
+- `asn`, `as_name` and `country`;
+- `answered`: when GeoJS answered;
+- `used`: when the answer was last used.
+
+## `reputation.json`
+
+- the last good copy of each list fetched from a URL, with when it was last
+  tried;
+- each DNS blocklist verdict still in use;
+- AbuseIPDB's scores, and the checks spent today.
+
+## `alerts.json`
+
+- the anomaly counters;
+- the alert cooldowns: for each event and netblock, source, file or anomaly
+  scope, when it was last sent and the count of repeats held back since;
+- the alerts sent and held back in the current hour;
+- the alerts waiting for each destination.
+
+## Sizes
+
+- `clients.json`: about 1 KiB per client, about 20 MiB at the default
+  `SWWAF_MAX_TRACKED_CLIENTS`. Written every 15 minutes, that is under 2 GiB of
+  disk writes a day.
+- `bans.json`: about 1.2 KiB per ban, at most about 2.5 KiB, so about 6 MiB at
+  the default `SWWAF_MAX_BANS`. With a full file, a hundred new bans a day come
+  to about 600 MiB of writes.
+- `lookups.json`: about 150 bytes per answer, under 1.5 GiB of writes a day when
+  full.
+- `reputation.json` and `alerts.json`: usually a few MiB or less.

internal/alerts/alerts.go

@@ -1,8 +1,8 @@
 // Package alerts sends alerts on bans, on traffic over an anomaly
 // threshold, on a source that fails and on a file with an error to each
 // destination set: to the webhook
-// SWWAF_ALERT_WEBHOOK_URL names, each as one JSON object, as the "Alert
-// webhook schema" section of SPEC.md describes, to the Slack incoming
+// SWWAF_ALERT_WEBHOOK_URL names, each as one JSON object, as "The JSON
+// object" in docs/alerts.md describes, to the Slack incoming
 // webhook SWWAF_ALERT_SLACK_WEBHOOK_URL names, as a message, and to the
 // ntfy topic SWWAF_ALERT_NTFY_URL names. A repeat within
 // SWWAF_ALERT_COOLDOWN is held back, and so is an alert past
@@ -149,11 +149,10 @@ type Params struct {
 }
 
 // Alert is one alert, as the webhook is sent it and alerts.json holds it,
-// with the fields of the "Alert webhook schema" section of SPEC.md. ASN,
-// ASName and Country are, for a ban, the client's as the ban's notes give
-// them.
+// with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
+// Country are, for a ban, the client's as the ban's notes give them.
 //
-//nolint:tagliatelle // SPEC.md's alert webhook schema names its fields in snake_case
+//nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case
 type Alert struct {
 	Instance string       `json:"instance"`
 	Time     time.Time    `json:"time"`

internal/anomaly/anomaly.go

@@ -1,8 +1,8 @@
 // Package anomaly counts requests and bytes over a minute and an hour, per
 // client, per surrounding netblock, per AS number, for the whole service
 // and per named netblock, and raises an anomaly alert for a count over its
-// threshold, as "Anomaly thresholds" under "Configuration surface" in
-// SPEC.md describes. It refuses and bans nothing. At most 20,000 counters
+// threshold, as "Anomaly thresholds" under "Settings" in SPEC.md
+// describes. It refuses and bans nothing. At most 20,000 counters
 // are kept, in memory, and written to alerts.json and read from it by the
 // state package.
 package anomaly

internal/metrics/metrics.go

@@ -1,6 +1,7 @@
-// Package metrics keeps smallwebwaf's Prometheus metrics, as the "Metrics
-// endpoint" section of SPEC.md lists them, and serves them in the
-// Prometheus text format. No metric carries a client's address.
+// Package metrics keeps smallwebwaf's Prometheus metrics, as
+// docs/metrics.md lists them, and serves them in the Prometheus text
+// format, as the "Metrics endpoint" section of SPEC.md requires. No
+// metric carries a client's address.
 package metrics
 
 import (

internal/ratelimit/ratelimit.go

@@ -206,7 +206,7 @@ type Hit struct {
 // Counts are a client's requests and bytes in the minute, the hour and
 // the day that end at a request, that request's included.
 //
-//nolint:tagliatelle // SPEC.md's request log names its fields in snake_case
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Counts struct {
 	Minute      float64 `json:"minute"`
 	Hour        float64 `json:"hour"`

internal/requestlog/requestlog.go

@@ -64,11 +64,10 @@ const LimitHitErrorBurst = "error_burst"
 const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 
 // Line is one request's line in the request log. The field names, and
-// their order, are those of the "Request log" section of SPEC.md. A field
-// that may not apply to a request is left out of its line when it does
-// not.
+// their order, are those of docs/request-log.md. A field that may not
+// apply to a request is left out of its line when it does not.
 //
-//nolint:tagliatelle // SPEC.md's request log names its fields in snake_case
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Line struct {
 	Type string `json:"type"`
 

internal/state/state.go

@@ -1,5 +1,6 @@
 // Package state keeps smallwebwaf's state in JSON files in
-// SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md describes:
+// SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md requires
+// and docs/state-files.md lists them:
 // bans.json holds the bans, clients.json each client's counters and
 // history, lookups.json GeoJS's answers, reputation.json the last try and
 // last good copy of each list fetched from a URL, the DNSBL zones'
@@ -61,6 +62,7 @@ var (
 	// errMissing is for an entry without a field it needs.
 	errMissing     = errors.New("has no")
 	errCause       = errors.New("is not limit, attack, admin or crowdsec")
+	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
 	errScope       = errors.New("is not client, net, asn, total or watch")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
@@ -646,8 +648,10 @@ func (e BanEntry) ban() bans.Ban {
 // client, a start, from which the length of the netblock's next ban is
 // worked out, or an expires, which would make it permanent. A permanent
 // ban's expires is null, which Bans cannot tell from a missing one, so
-// each expires is read again as written. A cause other than limit,
-// attack, admin or crowdsec, most likely misspelt, is refused too.
+// each expires is read again as written. An expires not after the start
+// is refused too, since the netblock's next ban for a broken limit, three
+// times as long as this one, would then refuse nothing; and so is a cause
+// other than limit, attack, admin or crowdsec, most likely misspelt.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -668,6 +672,8 @@ func (f *bansFile) check(data []byte) error {
 			return missing(i, "start")
 		case written.Bans[i].Expires == nil:
 			return missing(i, "expires")
+		case entry.Expires != nil && !entry.Expires.After(entry.Start):
+			return fmt.Errorf("entry %d's expires %w", i+1, errExpires)
 		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
 			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin &&
 			entry.Cause != bans.CauseCrowdSec:

internal/state/state_test.go

@@ -865,6 +865,21 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
 		`: entry 4's cause "atack" is not limit, attack, admin or crowdsec`)
 }
 
+func TestBanThatDoesNotEndAfterItsStartStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	// The first ban ends a second after its start; the second ends as it
+	// starts, or an hour before.
+	for _, expires := range []string{`"2026-10-06T00:00:00Z"`, `"2026-10-05T23:00:00Z"`} {
+		wantRefused(t, bansJSON, `{"version": 1, "bans": [`+
+			`{"netblock": "203.0.113.9/32", "start": "2026-10-06T00:00:00Z", `+
+			`"expires": "2026-10-06T00:00:01Z"}, `+
+			`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
+			`"expires": `+expires+`}]}`,
+			`: entry 2's expires is not after its start`)
+	}
+}
+
 func TestUnknownVersionStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -1004,8 +1019,8 @@ func TestEditJustBeforeAScheduledWriteSurvivesIt(t *testing.T) {
 		edit(t, dir, bansJSON, permanentBansJSON)
 
 		// The write takes the edit in first, and writes it back. The second
-		// ban, made after the admin opened the file, is lost, as "Edits
-		// while running" in SPEC.md says.
+		// ban, made after the admin opened the file, is lost, as the
+		// "Persistent state" section of SPEC.md says.
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
 

internal/waf/waf.go

@@ -1,8 +1,8 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
 // body while SWWAF_WAF_BODY_LIMIT is set, with the six changes smallwebwaf
-// makes to it, as "Attack detection" under "Configuration surface" in
-// SPEC.md describes them. It reads no response.
+// makes to it, as "Attack detection" under "Settings" in SPEC.md describes
+// them. It reads no response.
 //
 // smallwebwaf writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a

script/example-app

@@ -5,12 +5,15 @@
 # served through smallwebwaf, that a second one in a minute bans the
 # client, that a probe for /.env bans another client, which its next
 # request bans for good, that `sv stop` stops smallwebwaf in order, that
-# `docker stop` stops the container without having to kill it, and that
-# a new container on the same volume still refuses the banned client. The
+# `docker stop` stops the container without having to kill it, that a
+# new container on the same volume still refuses the banned client, that
+# a container with its state files on a new volume mounted at the
+# directory SWWAF_STATE_DIR_FILE names becomes healthy, and that one whose
+# SWWAF_STATE_DIR does not exist logs smallwebwaf's message about it. The
 # containers run with SWWAF_LOOKUP_SOURCE=off, so that no address is sent
-# to GeoJS. The containers, the volume and both images are removed however
-# the script ends. Building the app needs network access, for nixpkgs'
-# binary cache. script/check does not run this.
+# to GeoJS. The containers, the volumes and both images are removed
+# however the script ends. Building the app needs network access, for
+# nixpkgs' binary cache. script/check does not run this.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -23,10 +26,15 @@ IMAGE="$NAME-base"
 APP_IMAGE="$NAME-app"
 CONTAINER="$NAME"
 VOLUME="$NAME-state"
+# The volumes of the container whose state directory SWWAF_STATE_DIR_FILE
+# names: its state files, and the file that names their directory.
+MOVED_VOLUME="$NAME-moved-state"
+SETTINGS_VOLUME="$NAME-settings"
 
 cleanup() {
     docker rm --force "$CONTAINER" >/dev/null 2>&1 || true
-    docker volume rm --force "$VOLUME" >/dev/null 2>&1 || true
+    docker volume rm --force "$VOLUME" "$MOVED_VOLUME" "$SETTINGS_VOLUME" \
+        >/dev/null 2>&1 || true
     docker rmi --force "$APP_IMAGE" "$IMAGE" >/dev/null 2>&1 || true
 }
 
@@ -76,6 +84,27 @@ start_container() {
     address="$(docker port "$CONTAINER" 8080/tcp)"
 }
 
+# start_moved_container: run the app's container with the state files on
+# a new volume at /srv/state, which SWWAF_STATE_DIR_FILE names in a file
+# only the smallwebwaf user can read, as under "Settings given as files"
+# in docs/settings.md, and wait until it is healthy. smallwebwaf can write the
+# new volume only once the run script has given it to that user.
+start_moved_container() {
+    docker volume create "$MOVED_VOLUME" >/dev/null
+    docker volume create "$SETTINGS_VOLUME" >/dev/null
+    docker run --rm --volume "$SETTINGS_VOLUME:/settings" \
+        --entrypoint bash "$IMAGE" -c 'echo /srv/state > /settings/state-dir &&
+            chown smallwebwaf:smallwebwaf /settings/state-dir &&
+            chmod 0400 /settings/state-dir'
+    docker run --detach --name "$CONTAINER" \
+        --volume "$MOVED_VOLUME:/srv/state" \
+        --volume "$SETTINGS_VOLUME:/etc/smallwebwaf/settings:ro" \
+        --env SWWAF_STATE_DIR_FILE=/etc/smallwebwaf/settings/state-dir \
+        --env SWWAF_LOOKUP_SOURCE=off \
+        "$APP_IMAGE" >/dev/null
+    wait_for "the health check did not pass" healthy
+}
+
 # refused: a request to the container gets 403, SWWAF_BAN_RESPONSE's
 # default.
 refused() {
@@ -140,6 +169,20 @@ main() {
     wait_for "smallwebwaf logged no request refused under the ban" \
         logged '"action":"banned"'
     echo "example-app: a new container on the same volume keeps the ban"
+
+    docker rm --force "$CONTAINER" >/dev/null
+    start_moved_container
+    echo "example-app: the run script gives the state files' directory named" \
+        "by SWWAF_STATE_DIR_FILE to the smallwebwaf user"
+
+    docker rm --force "$CONTAINER" >/dev/null
+    docker run --detach --name "$CONTAINER" \
+        --env SWWAF_STATE_DIR=/srv/missing \
+        --env SWWAF_LOOKUP_SOURCE=off \
+        "$APP_IMAGE" >/dev/null
+    wait_for "smallwebwaf did not report the missing state directory" \
+        logged "SWWAF_STATE_DIR cannot be written"
+    echo "example-app: smallwebwaf reports a state directory that does not exist"
 }
 
 main "$@"

script/gitea-requests

@@ -2,11 +2,12 @@
 # script/gitea-requests: build the image and run gitea 1.27.3 behind it,
 # with every setting of smallwebwaf at its default but SWWAF_UPSTREAM_URL,
 # which names gitea's container. Then send through it the gitea requests
-# that reading gitea's source found the Core Rule Set refuses, and a short
-# sample of gitea's ordinary use: signing in, pages of files and commits,
-# a diff, the API, a push, clone and fetch over HTTP, and two container
-# image pushes. Last, print each request smallwebwaf logged, with what it
-# did with it and the ids of the Core Rule Set's rules that matched it.
+# that reading gitea's source found the Core Rule Set refuses, which
+# docs/gitea.md records, and a short sample of gitea's ordinary use:
+# signing in, pages of files and commits, a diff, the API, a push, clone
+# and fetch over HTTP, and two container image pushes. Last, print each
+# request smallwebwaf logged, with what it did with it and the ids of the
+# Core Rule Set's rules that matched it.
 # Every request comes from one client, docker's gateway, so more than
 # SWWAF_ERROR_BURST_THRESHOLD, 30, refusals in a minute would ban it, and
 # the requests after would show as banned. The containers, the network,

share/smallwebwaf.run

@@ -5,12 +5,32 @@ set -euo pipefail
 # exits; the wait spaces out the restarts. The state directory and every
 # file in it are given to the smallwebwaf user, so that a volume mounted
 # there needs no change of owner; chown -R changes a symbolic link itself,
-# never what it points to. exec, so that the signal `sv stop` sends
-# reaches smallwebwaf itself.
+# never what it points to. When SWWAF_STATE_DIR, in either form, cannot be
+# read or is not the absolute path of a directory, no owner is changed,
+# and smallwebwaf starts and stops with a message naming the setting. A
+# change of owner that fails, as on a volume mounted read-only, does not
+# end the script either: smallwebwaf reports a directory it cannot write.
+# exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
 main() {
     sleep 1
-    chown -R smallwebwaf:smallwebwaf "${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}"
+    local dir
+    if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
+        chown -R smallwebwaf:smallwebwaf "$dir" || true
+    fi
     exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
 }
 
+# state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,
+# or what is in the file SWWAF_STATE_DIR_FILE names, less every newline at
+# its end. It fails when both are set or the file cannot be read.
+state_dir() {
+    if [[ ! -v SWWAF_STATE_DIR_FILE ]]; then
+        printf '%s\n' "${SWWAF_STATE_DIR-/var/lib/smallwebwaf}"
+    elif [[ ! -v SWWAF_STATE_DIR ]]; then
+        cat -- "$SWWAF_STATE_DIR_FILE" 2>/dev/null
+    else
+        return 1
+    fi
+}
+
 main "$@"