Lower the default request and byte limits (closes #193)

Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.

Model: opus-5-5

README.md

@@ -26,10 +26,10 @@ It protects against:
 
 - Scrapers that fetch every page of a site, all day. Each client gets a limit on
   requests and on bytes per minute, per hour and per day. The defaults leave
-  room for programmatic use of an API, such as an automation fleet, and catch a
-  client firing requests as fast as it can within seconds. A client over a limit
-  is refused and banned: for a while at first, for three times as long at each
-  repeat, and permanently when it keeps at it.
+  room for a person reading a site for hours. They catch a scraper that keeps up
+  one request every 2 seconds. A client over a limit is refused and banned: for
+  a while at first, for three times as long at each repeat, and permanently when
+  it keeps at it.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client at its first probe, and its next request
   during the ban makes the ban permanent. Your own rules, or a list of trap
@@ -237,13 +237,13 @@ Every setting the code reads, with its default:
 | `SWWAF_ALLOW_NETS`                         | empty                                                                          | Netblocks whose clients skip every check, such as your monitoring.                                                                                                  |
 | `SWWAF_RATE_LIMIT_EXEMPT_NETS`             | empty                                                                          | Netblocks whose clients the request and byte limits neither count nor refuse.                                                                                       |
 | `SWWAF_DENY_NETS`                          | empty                                                                          | Netblocks whose clients are refused.                                                                                                                                |
-| `SWWAF_RATE_LIMIT_PER_MINUTE`              | `500`                                                                          | The most requests a client may make in a minute, a count or `off`; one more bans it.                                                                                |
-| `SWWAF_RATE_LIMIT_PER_HOUR`                | `20000`                                                                        | The most requests a client may make in an hour, a count or `off`; one more bans it.                                                                                 |
-| `SWWAF_RATE_LIMIT_PER_DAY`                 | `300000`                                                                       | The most requests a client may make in a day, a count or `off`; one more bans it.                                                                                   |
+| `SWWAF_RATE_LIMIT_PER_MINUTE`              | `120`                                                                          | The most requests a client may make in a minute, a count or `off`; one more bans it.                                                                                |
+| `SWWAF_RATE_LIMIT_PER_HOUR`                | `1500`                                                                         | The most requests a client may make in an hour, a count or `off`; one more bans it.                                                                                 |
+| `SWWAF_RATE_LIMIT_PER_DAY`                 | `6000`                                                                         | The most requests a client may make in a day, a count or `off`; one more bans it.                                                                                   |
 | `SWWAF_RATE_LIMIT_EXEMPT_PATHS`            | empty                                                                          | Path prefixes whose requests the request and byte limits neither count nor refuse, such as `/assets/`.                                                              |
-| `SWWAF_BYTES_LIMIT_PER_MINUTE`             | `4G`                                                                           | The most bytes a client's requests may carry in a minute, a size or `off`; the request that takes a client past any byte limit bans it.                             |
-| `SWWAF_BYTES_LIMIT_PER_HOUR`               | `20G`                                                                          | The most bytes a client's requests may carry in an hour, a size or `off`.                                                                                           |
-| `SWWAF_BYTES_LIMIT_PER_DAY`                | `200G`                                                                         | The most bytes a client's requests may carry in a day, a size or `off`.                                                                                             |
+| `SWWAF_BYTES_LIMIT_PER_MINUTE`             | `off`                                                                          | The most bytes a client's requests may carry in a minute, a size or `off`; the request that takes a client past any byte limit bans it.                             |
+| `SWWAF_BYTES_LIMIT_PER_HOUR`               | `50G`                                                                          | The most bytes a client's requests may carry in an hour, a size or `off`.                                                                                           |
+| `SWWAF_BYTES_LIMIT_PER_DAY`                | `100G`                                                                         | The most bytes a client's requests may carry in a day, a size or `off`.                                                                                             |
 | `SWWAF_BYTES_COUNT`                        | `both`                                                                         | Which body bytes the byte limits count: `response`, `request` or `both`.                                                                                            |
 | `SWWAF_ERROR_BURST_THRESHOLD`              | `30`                                                                           | The most refusals by a rule file, a trap path or the Core Rule Set a client may get in a minute, a count or `off`; one more bans it.                                |
 | `SWWAF_BAN_RESPONSE`                       | `403`                                                                          | How a refused client is answered: `403`, `429` or `close`, which drops the connection.                                                                              |
@@ -408,10 +408,10 @@ services:
             SWWAF_RATE_LIMIT_EXEMPT_NETS: 203.0.113.0/24,198.51.100.7
             # A netblock that sends nothing wanted.
             SWWAF_DENY_NETS: 198.51.100.128/25
-            # Tighter limits for everyone else: a site with no API.
-            SWWAF_RATE_LIMIT_PER_MINUTE: "120"
-            SWWAF_RATE_LIMIT_PER_HOUR: "3000"
-            SWWAF_RATE_LIMIT_PER_DAY: "30000"
+            # Tighter limits for everyone else: a small static site.
+            SWWAF_RATE_LIMIT_PER_MINUTE: "60"
+            SWWAF_RATE_LIMIT_PER_HOUR: "600"
+            SWWAF_RATE_LIMIT_PER_DAY: "3000"
             # Hosting networks and one country get a share of those limits.
             SWWAF_ASN_LIMIT_PERCENT: AS14061:50,AS16276:25
             SWWAF_COUNTRY_LIMIT_PERCENT: cn:25
@@ -432,10 +432,9 @@ volumes:
 gitea behind traefik, set up for a code forge:
 
 - the upload limits raised, in size and in time;
-- the response size limit and the byte limits raised, for clones over 1 GiB;
+- the response size limit raised, for clones over 1 GiB;
 - the Actions runners exempt from counting;
-- the default request limits kept, since they already leave room for API
-  clients.
+- the default request and byte limits kept.
 
 `traefik` is the network traefik is on, made outside this file.
 
@@ -489,11 +488,6 @@ services:
             SWWAF_INSTANCE_NAME: fsn1/servewaf
             # The Actions runners ask for work all day; never count them.
             SWWAF_RATE_LIMIT_EXEMPT_NETS: 10.0.4.0/24
-            # Raised with rproxy's response limit, to four times the default
-            # each, so that one clone of that size breaks no byte limit.
-            SWWAF_BYTES_LIMIT_PER_MINUTE: 16G
-            SWWAF_BYTES_LIMIT_PER_HOUR: 80G
-            SWWAF_BYTES_LIMIT_PER_DAY: 800G
             # gitea never serves these; a request for one bans the client.
             SWWAF_TRAP_PATHS: /wp-login.php,/xmlrpc.php,/wp-admin/
         volumes:
@@ -688,8 +682,8 @@ aside as `<name>.bad`, and never stops the running process (see
   health check.
 - `internal/config`: reads the settings, the one place they are read.
 - `internal/rproxy`: the reverse proxy in front of one app.
-- `internal/servewaf`: `servewaf`'s server, which runs the checks and answers
-  its own endpoints.
+- `internal/proxy`: `servewaf`'s server, which runs the checks and answers its
+  own endpoints.
 - `internal/ratelimit`, `internal/bans`, `internal/rules`, `internal/waf`,
   `internal/lookup`, `internal/reputation`, `internal/anomaly` and
   `internal/alerts`: one check or source each.

SPEC.md

@@ -66,10 +66,10 @@ to them.
       one it does not know, the binary prints the commands and exits with
       status 2.
     - `internal/config`: reads the settings, the one place they are read.
-    - `internal/servewaf`: `servewaf`'s server. It runs the checks in `check`,
-      and holds `servewaf`'s question, answer and report. It answers
-      `servewaf`'s own endpoints in `answerOwnEndpoint`. It counts bytes,
-      refusals and anomalies, and writes the log lines.
+    - `internal/proxy`: `servewaf`'s server. It runs the checks in `check`, and
+      holds `servewaf`'s question, answer and report. It answers `servewaf`'s
+      own endpoints in `answerOwnEndpoint`. It counts bytes, refusals and
+      anomalies, and writes the log lines.
     - `internal/rproxy`: the reverse proxy in front of one app that asks
       `servewaf` about each request. It passes a request to the app with the
       standard library's `httputil.ReverseProxy`, within the time and size
@@ -397,32 +397,31 @@ Conventions:
 
 ### Request rate limits, per client
 
-Breaking one bans the client. The defaults suit programmatic use of an API, such
-as an automation fleet on another host, and still stop abusive bots. A fleet of
-20 agents, each making a request every 10 seconds at its busiest, makes 120
-requests a minute and 7,200 an hour. Working around the clock, it makes 172,800
-a day. It stays under all three limits.
+Breaking one bans the client. The defaults let people read a site and stop
+scrapers that send many requests slowly over hours or days. The hour limit is
+the main one.
 
-- Per minute: 500, about 8 requests a second. It leaves room for the fleet's 120
-  a minute and a few quick first visits with an empty cache. A gitea page opened
-  with an empty cache loads about 40 files. A client firing requests as fast as
-  it can passes the limit within seconds.
-- Per hour: 20,000, about 5.5 requests a second for a whole hour. A client that
-  keeps up 6 a second makes 21,600 in an hour, and passes it, at 360 a minute,
-  under the minute limit. The fleet's 7,200 an hour is about a third of it.
-- Per day: 300,000, about 3.5 requests a second around the clock. A scraper that
-  keeps up 4 a second makes 345,600 a day, and passes it. At 240 a minute and
-  14,400 an hour, it stays under the other two limits.
+- Per minute: 120, 2 requests a second. It leaves room for a person opening
+  several pages at once with an empty cache. A gitea page opened with an empty
+  cache loads 20 to 60 files, and a handful once cached.
+- Per hour: 1,500. A person reading code in gitea for a whole hour, a page every
+  20 seconds, makes about 900 requests. A scraper making one request every 2
+  seconds makes 1,800 an hour, more than the limit.
+- Per day: 6,000, four hours at the hour limit. A scraper making one request
+  every 10 seconds makes 8,640 a day, more than the limit.
 
-Counting cannot catch a client that stays under all three limits, such as one
-that keeps up 3 requests a second. Only the other checks can catch an abuser
+Counting cannot catch a client that stays under all three limits, about 4
+requests a minute around the clock. Only the other checks can catch an abuser
 that slow. They include the trap paths, the rule files, the Core Rule Set and
-the blocklists. An abuser that trips none of them is not caught. A machine that
-keeps up more than 500 requests a minute passes the minute limit. One that keeps
-up more than about 5.5 a second for an hour passes the hour limit. One that
-keeps up more than about 3.5 a second all day passes the day limit, as two busy
-Actions runners on one address do. Such a machine's address belongs in
-`SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+the blocklists. An abuser that trips none of them is not caught.
+
+Some legitimate clients pass the limits:
+
+- An Actions runner asks gitea for work all day and can pass the limits.
+- Everyone behind one shared address, such as an office, shares one client's
+  limits.
+
+Their addresses belong in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 `SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as
 static assets or health checks; their bytes are not counted either. A prefix is
@@ -435,12 +434,9 @@ matched the same way.
 
 ### Byte limits, per client
 
-The hour and day limits sit about twice above what 40 people busy with heavy web
-apps move together on one address. Each moves about 256 MiB an hour, for ten
-hours a day. A response's bytes are counted when it ends (see step 15). So the
-minute limit holds three of the largest responses, with their requests, ending
-in the same minute. No single download then breaks a limit. An operator who
-raises `SWRP_MAX_RESPONSE_SIZE` must raise the byte limits too.
+There is no minute limit, so a client can download in a burst at full speed. The
+hour limit is 50 GiB and the day limit 100 GiB. They allow several downloads of
+a few GiB each. A response's bytes are counted when it ends (see step 15).
 
 ### Lookup of AS number and country
 

docs/gitea.md

@@ -14,8 +14,7 @@ version.
   by it.
 - A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the
   repository is large or the link slow. A repository whose clone is larger than
-  1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised, and the byte limits with it
-  ("Byte limits, per client" in `SPEC.md`).
+  1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised.
 - A push is a request, and so is every other upload:
     - a git push;
     - an LFS object;
@@ -32,15 +31,13 @@ version.
   request limits do most of the work there.
 - An Actions runner that reaches gitea through `smallwebwaf` sends requests all
   day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
-  43,200 requests a day. While it runs a job, it reports the job's log and state
-  every second instead, two requests a second. So one runner busy all day sends
-  120 requests a minute and 172,800 a day, under the request limits. Two such
-  runners on one address, each busy all day, make 345,600 and pass the day limit
-  of 300,000. Three busy at once make 21,600 an hour and pass the hour limit of
-  20,000. Five busy at once make 600 a minute and pass the minute limit of 500.
-  Their address is then banned, their running jobs fail, and each repeat within
-  a day makes the ban longer. Newer runners ask for work less often. Put the
-  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+  1,800 requests an hour. While it runs a job, it reports the job's log and
+  state every second instead, two requests a second. So one idle runner makes
+  1,800 requests an hour, more than the hour limit of 1,500. A busy one, at two
+  requests a second, passes the minute limit of 120 within two minutes. Its
+  address is then banned, its running jobs fail, and each repeat within a day
+  makes the ban longer. Newer runners ask for work less often. Put the runners'
+  addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set lets through
 

docs/settings.md

@@ -99,19 +99,22 @@ chooses between the two (see "The image's command" below).
 
 ## Request rate limits, per client
 
-- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `500`, about 8 a second): the most
-  requests a client may make in a minute. A count or `off`. The default catches,
-  within seconds, a client firing requests as fast as it can. It leaves room for
-  a fleet of about 20 agents at its busiest, about 120 requests a minute. It
-  also leaves room for a few quick first visits to gitea with an empty cache,
-  about 40 files each.
-- `SWWAF_RATE_LIMIT_PER_HOUR` (default `20000`, about 5.5 a second): the most
-  requests a client may make in an hour. A count or `off`. The default leaves
-  room for an automation fleet at work. It catches a client that keeps up more
-  than about 5.5 a second for an hour.
-- `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most
-  requests a client may make in a day. A count or `off`. The default catches a
-  scraper that keeps up 4 a second around the clock.
+- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `120`, 2 a second): the most requests a
+  client may make in a minute. A count or `off`. The default leaves room for a
+  person opening several gitea pages at once with an empty cache, 20 to 60 files
+  each.
+- `SWWAF_RATE_LIMIT_PER_HOUR` (default `1500`): the most requests a client may
+  make in an hour. A count or `off`. It is the main limit against scrapers. A
+  person reading code in gitea for an hour, a page every 20 seconds, makes
+  about 900. A scraper making one request every 2 seconds makes 1,800 an hour,
+  more than the limit.
+- `SWWAF_RATE_LIMIT_PER_DAY` (default `6000`): the most requests a client may
+  make in a day. A count or `off`. The default is four hours at the hour limit.
+  A scraper making one request every 10 seconds makes 8,640 a day, more than the
+  limit.
+- An Actions runner asks gitea for work all day and can pass the limits. Put
+  their addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`. Do the same for a network
+  where many people share one address, such as an office.
 - Counting cannot catch a client that stays under all three limits (see "Request
   rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
@@ -119,8 +122,8 @@ chooses between the two (see "The image's command" below).
 
 ## Byte limits, per client
 
-- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `4G`), `SWWAF_BYTES_LIMIT_PER_HOUR`
-  (default `20G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `200G`): the most
+- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `off`), `SWWAF_BYTES_LIMIT_PER_HOUR`
+  (default `50G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `100G`): the most
   bytes counted for a client in each window. A size or `off`.
 - `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
   `response`, `request` or `both`.

internal/config/config.go

@@ -468,13 +468,13 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		AllowNets:            env.netblocks("SWWAF_ALLOW_NETS", ""),
 		RateLimitExemptNets:  env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
 		DenyNets:             env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:   env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
-		RateLimitPerHour:     env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
-		RateLimitPerDay:      env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
+		RateLimitPerMinute:   env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "120"),
+		RateLimitPerHour:     env.count("SWWAF_RATE_LIMIT_PER_HOUR", "1500"),
+		RateLimitPerDay:      env.count("SWWAF_RATE_LIMIT_PER_DAY", "6000"),
 		RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
-		BytesLimitPerMinute:  env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
-		BytesLimitPerHour:    env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
-		BytesLimitPerDay:     env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
+		BytesLimitPerMinute:  env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "off"),
+		BytesLimitPerHour:    env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "50G"),
+		BytesLimitPerDay:     env.size("SWWAF_BYTES_LIMIT_PER_DAY", "100G"),
 		BytesCount:           env.bytesCount("SWWAF_BYTES_COUNT", "both"),
 		LookupSource:         env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
 		LookupDBPath:         env.value("SWWAF_LOOKUP_DB_PATH", ""),

internal/config/config_test.go

@@ -244,9 +244,9 @@ func TestDefaults(t *testing.T) {
 	wantSettings(t, cfg, config.Config{
 		ListenAddr:           ":8080",
 		Observe:              false,
-		RateLimitPerMinute:   500,
-		RateLimitPerHour:     20000,
-		RateLimitPerDay:      300000,
+		RateLimitPerMinute:   120,
+		RateLimitPerHour:     1500,
+		RateLimitPerDay:      6000,
 		BanResponse:          403,
 		LimitBanDuration:     time.Hour,
 		LimitBanRepeatWindow: 24 * time.Hour,
@@ -266,8 +266,8 @@ func TestDefaults(t *testing.T) {
 		LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond,
 	})
 	wantByteLimitSettings(t, cfg, config.Config{
-		BytesLimitPerMinute: 4 << 30, BytesLimitPerHour: 20 << 30,
-		BytesLimitPerDay: 200 << 30, BytesCount: "both",
+		BytesLimitPerMinute: 0, BytesLimitPerHour: 50 << 30,
+		BytesLimitPerDay: 100 << 30, BytesCount: "both",
 	})
 
 	wantNetblocks(t, cfg.AllowNets)
@@ -308,7 +308,7 @@ func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
 	for _, limit := range []int64{
 		cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.BytesLimitPerDay,
 	} {
-		if largest > limit {
+		if limit != 0 && largest > limit { // 0 is off
 			t.Errorf("a request of %d bytes breaks the byte limit of %d", largest, limit)
 		}
 	}
@@ -2271,12 +2271,12 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		rateLimitExemptNets:  "",
 		denyNets:             "",
 		rateLimitPerMinute:   "45",
-		rateLimitPerHour:     "20000",
-		rateLimitPerDay:      "300000",
+		rateLimitPerHour:     "1500",
+		rateLimitPerDay:      "6000",
 		rateLimitExemptPaths: "",
-		bytesLimitPerMinute:  "4G",
-		bytesLimitPerHour:    "20G",
-		bytesLimitPerDay:     "200G",
+		bytesLimitPerMinute:  "off",
+		bytesLimitPerHour:    "50G",
+		bytesLimitPerDay:     "100G",
 		bytesCount:           "both",
 		lookupSource:         defaultLookupSource,
 		lookupDBPath:         "",

internal/proxy/admin.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"bytes"

internal/proxy/admin_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"encoding/json"
@@ -10,9 +10,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
@@ -88,11 +88,11 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 
 	// Any other request under /_smallwebwaf/ is not found.
 	for _, e := range []adminEndpoint{
-		{http.MethodPut, servewaf.BansPath, banOtherClient},
-		{http.MethodDelete, servewaf.BansPath, ""},
-		{http.MethodGet, servewaf.BansPath + "/" + otherClient, ""},
-		{http.MethodPost, servewaf.ClientsPath + otherClient, ""},
-		{http.MethodGet, strings.TrimSuffix(servewaf.ClientsPath, "/"), ""},
+		{http.MethodPut, proxy.BansPath, banOtherClient},
+		{http.MethodDelete, proxy.BansPath, ""},
+		{http.MethodGet, proxy.BansPath + "/" + otherClient, ""},
+		{http.MethodPost, proxy.ClientsPath + otherClient, ""},
+		{http.MethodGet, strings.TrimSuffix(proxy.ClientsPath, "/"), ""},
 	} {
 		s.admin(e.method, e.path, e.body, http.StatusNotFound)
 	}
@@ -118,7 +118,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 		Reason:   "probes for logins",
 	}
 
-	wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK),
+	wantBans(t, s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK),
 		want)
 
 	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
@@ -129,7 +129,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, proxy.BansPath, "", http.StatusOK), want)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -138,13 +138,13 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	lifted := clk.Now()
 	want.Lifted = &lifted
 
-	wantBans(t, s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "",
+	wantBans(t, s.admin(http.MethodDelete, proxy.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, proxy.BansPath, "", http.StatusOK), want)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(http.MethodDelete, proxy.BansPath+"/"+client, "", http.StatusNotFound)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -181,7 +181,7 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, body, http.StatusOK), want)
+		wantBans(t, s.admin(http.MethodPost, proxy.BansPath, body, http.StatusOK), want)
 	}
 }
 
@@ -250,7 +250,7 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 			"request body too large",
 		},
 	} {
-		got := s.admin(http.MethodPost, servewaf.BansPath, tc.body, http.StatusBadRequest)
+		got := s.admin(http.MethodPost, proxy.BansPath, tc.body, http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
 			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
 		}
@@ -283,7 +283,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 			Bans   []state.BanEntry  `json:"bans"`
 		}
 
-		decode(t, s.admin(http.MethodGet, servewaf.ClientsPath+addr, "", http.StatusOK), &got)
+		decode(t, s.admin(http.MethodGet, proxy.ClientsPath+addr, "", http.StatusOK), &got)
 
 		if got.Client == nil {
 			t.Fatalf("%s: no client", addr)
@@ -305,13 +305,13 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 
 	// Of an address no request came from and no ban covers, nothing is
 	// known.
-	got := s.admin(http.MethodGet, servewaf.ClientsPath+"198.51.100.99", "", http.StatusOK)
+	got := s.admin(http.MethodGet, proxy.ClientsPath+"198.51.100.99", "", http.StatusOK)
 	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
-	s.admin(http.MethodGet, servewaf.ClientsPath+"203.0.113", "", http.StatusBadRequest)
-	s.admin(http.MethodDelete, servewaf.BansPath+"/203.0.113.0/24", "",
+	s.admin(http.MethodGet, proxy.ClientsPath+"203.0.113", "", http.StatusBadRequest)
+	s.admin(http.MethodDelete, proxy.BansPath+"/203.0.113.0/24", "",
 		http.StatusBadRequest)
 }
 
@@ -342,10 +342,10 @@ type adminEndpoint struct {
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {
 	return []adminEndpoint{
-		{http.MethodGet, servewaf.BansPath, ""},
-		{http.MethodPost, servewaf.BansPath, banOtherClient},
-		{http.MethodDelete, servewaf.BansPath + "/" + otherClient, ""},
-		{http.MethodGet, servewaf.ClientsPath + otherClient, ""},
+		{http.MethodGet, proxy.BansPath, ""},
+		{http.MethodPost, proxy.BansPath, banOtherClient},
+		{http.MethodDelete, proxy.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, proxy.ClientsPath + otherClient, ""},
 	}
 }
 

internal/proxy/alerts_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"maps"
@@ -10,8 +10,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -201,7 +201,7 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 // never sent them, and returns the queue they wait in as well.
 func startWithAlerts(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
@@ -210,7 +210,7 @@ func startWithAlerts(
 // startAppWithAlerts is startWithAlerts in front of the app handler.
 func startAppWithAlerts(
 	t *testing.T, handler http.HandlerFunc, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	app := startApp(t, handler)

internal/proxy/anomaly_internal_test.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"net/netip"

internal/proxy/anomaly_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"maps"
@@ -13,9 +13,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The anomaly thresholds: the prefix of a scope followed by the end of a
@@ -319,7 +319,7 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// kept.
 	geojsURL, _, release := startHeldGeoJS(t)
 
-	var server atomic.Pointer[servewaf.Server]
+	var server atomic.Pointer[proxy.Server]
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()

internal/proxy/answertime_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"fmt"
@@ -16,10 +16,10 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -81,7 +81,7 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 
-	wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
@@ -144,13 +144,13 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			line := s.out.requestLine(t)
 
 			if tc.refused {
-				wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+				wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 
 				return
 			}
 
-			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 			if line.DurationWAF == nil {
@@ -175,7 +175,7 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 			req := s.question(siteA, client, "/")
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 		})
 	}
 }
@@ -187,7 +187,7 @@ func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
@@ -204,7 +204,7 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
@@ -224,8 +224,8 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 		return do(t, req)
 	}
 
-	wantDisposition(t, ask(), tooLarge, servewaf.DispositionDeny)
-	wantDisposition(t, ask(), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, ask(), tooLarge, proxy.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, proxy.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
 	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
@@ -249,7 +249,7 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
 		})
 	}
@@ -265,7 +265,7 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
@@ -275,7 +275,7 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	}
 
 	// The client is under no ban, and GeoJS places it in a country.
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
@@ -291,7 +291,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
 }
 
@@ -306,7 +306,7 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 	if asn != asnDE || country != "DE" {
@@ -318,9 +318,7 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 // newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
 // answers, a setting needs its answer, and everything is at its default but
 // for env. No request to it may use the network.
-func newServeWAFInBubble(
-	t *testing.T, env map[string]string,
-) (*servewaf.Server, *output) {
+func newServeWAFInBubble(t *testing.T, env map[string]string) (*proxy.Server, *output) {
 	t.Helper()
 
 	settings := map[string]string{deniedCountries: "KP"}
@@ -334,13 +332,13 @@ func newServeWAFInBubble(
 // askDirectly hands a question about a request from client straight to server,
 // as change leaves it, and returns the answer's status and how long it took.
 func askDirectly(
-	t *testing.T, server *servewaf.Server, change func(*http.Request),
+	t *testing.T, server *proxy.Server, change func(*http.Request),
 ) (int, time.Duration) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
-	req.Header.Set(servewaf.ClientHeader, client)
+	req.Header.Set(proxy.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
 	change(req)
 
@@ -353,17 +351,17 @@ func askDirectly(
 }
 
 // banClient bans client at now.
-func banClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+func banClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
 }
 
 // countClient counts one request from client at now for the rate limits.
-func countClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+func countClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
 }
 
 // listClient puts client on the blocklist at dropURL.
-func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
+func listClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 
 	err := server.Lists.Load([]reputation.List{{
@@ -375,13 +373,13 @@ func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
 }
 
 // decideOnClient puts client on the CrowdSec decision list.
-func decideOnClient(t *testing.T, server *servewaf.Server, now time.Time) {
+func decideOnClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 	loadDecisions(t, server, now, clientsDecision)
 }
 
 // leaveAsItIs prepares nothing.
-func leaveAsItIs(*testing.T, *servewaf.Server, time.Time) {}
+func leaveAsItIs(*testing.T, *proxy.Server, time.Time) {}
 
 func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	t.Parallel()
@@ -392,7 +390,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		// cookie is the request's Cookie header.
 		cookie string
 		status int
@@ -463,7 +461,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		status  int
 		action  string
 	}{
@@ -521,10 +519,10 @@ func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testin
 
 	t.Cleanup(func() { _ = resolver.Close() })
 
-	server, out, _ := newServeWAFWith(t, func(params servewaf.Params) *servewaf.Server {
+	server, out, _ := newServeWAFWith(t, func(params proxy.Params) *proxy.Server {
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 
-		return servewaf.NewServeWAF(params)
+		return proxy.NewServeWAF(params)
 	}, held, time.Now, map[string]string{
 		deniedCountries: "KP", wafMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),

internal/proxy/bans.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"net/http"

internal/proxy/bans_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"bufio"
@@ -15,8 +15,8 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -382,7 +382,7 @@ func (c *clock) advance(d time.Duration) {
 // window.
 func startWithClock(
 	t *testing.T, geojsURL string, env map[string]string,
-) (*sender, *clock, *servewaf.Server) {
+) (*sender, *clock, *proxy.Server) {
 	t.Helper()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})

internal/proxy/biased.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"sneak.berlin/go/smallwebwaf/internal/config"

internal/proxy/biased_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"fmt"
@@ -16,8 +16,8 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The biased thresholds.
@@ -419,7 +419,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 // clock.
 func startWithLookups(
 	t *testing.T, env map[string]string,
-) (*sender, *servewaf.Server, *alerts.Queue) {
+) (*sender, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	s, _, server, queue := startWithLookupsAndClock(t, env)
@@ -434,7 +434,7 @@ func startWithLookups(
 // country, and no other address.
 func startWithLookupsAndClock(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
@@ -463,11 +463,11 @@ func (s *sender) uploadFrom(from string) logLine {
 // serveFromDE hands a question about a request from fromDE with method and body
 // straight to server's handler, without the network, and returns once it is
 // answered.
-func serveFromDE(t *testing.T, server *servewaf.Server, method string, body io.Reader) {
+func serveFromDE(t *testing.T, server *proxy.Server, method string, body io.Reader) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.Header.Set(servewaf.ClientHeader, fromDE)
+	req.Header.Set(proxy.ClientHeader, fromDE)
 	req.Header.Set(requestIDHeader, "the-id")
 
 	server.Handler.ServeHTTP(httptest.NewRecorder(), req)

internal/proxy/bytelimits_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"bufio"

internal/proxy/client.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"crypto/rand"

internal/proxy/coreruleset.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"time"

internal/proxy/coreruleset_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"

internal/proxy/countries.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"slices"

internal/proxy/countries_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"encoding/json"

internal/proxy/crowdsec_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"
@@ -9,9 +9,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The CrowdSec settings, and the tests' engine, which is never asked: each
@@ -168,7 +168,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 // decisionsURL, answer, the engine's answer, fetched at fetched, as
 // reputation.json would at start.
 func loadDecisions(
-	t *testing.T, server *servewaf.Server, fetched time.Time, answer string,
+	t *testing.T, server *proxy.Server, fetched time.Time, answer string,
 ) {
 	t.Helper()
 

internal/proxy/errorburst_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"maps"
@@ -10,9 +10,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
@@ -51,7 +51,7 @@ func (r refused) send(s *sender, from string) logLine {
 // SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
-) (*sender, *clock, *servewaf.Server) {
+) (*sender, *clock, *proxy.Server) {
 	t.Helper()
 
 	settings := map[string]string{

internal/proxy/health_test.go

@@ -1,11 +1,11 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"
 	"testing"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
@@ -21,7 +21,7 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+		got := s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+

internal/proxy/history_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
@@ -100,8 +100,8 @@ func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 
 	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
-	s.adminRequest("", http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized)
+	s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
+	s.adminRequest("", http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized)
 	s.scrape()
 
 	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
@@ -126,7 +126,7 @@ func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 }
 
 // historyOf returns the history of the client at addr.
-func historyOf(t *testing.T, server *servewaf.Server, addr string) ratelimit.History {
+func historyOf(t *testing.T, server *proxy.Server, addr string) ratelimit.History {
 	t.Helper()
 
 	client := netip.MustParsePrefix(addr + "/32")

internal/proxy/lookup.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"context"

internal/proxy/lookup_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/metrics_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"
@@ -12,8 +12,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -32,7 +32,7 @@ func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{bearer, "Bearer ", ""} {
-		s.adminRequest(authorization, http.MethodGet, servewaf.MetricsPath, "",
+		s.adminRequest(authorization, http.MethodGet, proxy.MetricsPath, "",
 			http.StatusNotFound)
 	}
 }
@@ -46,18 +46,18 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		method, path, authorization string
 		status                      int
 	}{
-		{http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized},
+		{http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized},
 		{
-			http.MethodGet, servewaf.MetricsPath, "Bearer " + strings.ToUpper(token),
+			http.MethodGet, proxy.MetricsPath, "Bearer " + strings.ToUpper(token),
 			http.StatusUnauthorized,
 		},
-		{http.MethodGet, servewaf.MetricsPath, "Basic " + token, http.StatusUnauthorized},
-		{http.MethodGet, servewaf.MetricsPath, bearer, http.StatusOK},
-		{http.MethodGet, servewaf.MetricsPath, "bearer " + token, http.StatusOK},
-		{http.MethodPost, servewaf.MetricsPath, bearer, http.StatusNotFound},
-		{http.MethodGet, servewaf.MetricsPath + "/", bearer, http.StatusNotFound},
+		{http.MethodGet, proxy.MetricsPath, "Basic " + token, http.StatusUnauthorized},
+		{http.MethodGet, proxy.MetricsPath, bearer, http.StatusOK},
+		{http.MethodGet, proxy.MetricsPath, "bearer " + token, http.StatusOK},
+		{http.MethodPost, proxy.MetricsPath, bearer, http.StatusNotFound},
+		{http.MethodGet, proxy.MetricsPath + "/", bearer, http.StatusNotFound},
 		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
-		{http.MethodPost, servewaf.HealthPath, "", http.StatusNotFound},
+		{http.MethodPost, proxy.HealthPath, "", http.StatusNotFound},
 	} {
 		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
 
@@ -180,7 +180,7 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 	wantMetric(t, s.scrape(), admins, 1)
 
 	// And a ban made through the endpoint.
-	s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK)
+	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
 	wantMetric(t, s.scrape(), admins, 2)
 }
 
@@ -365,7 +365,7 @@ func keptAnswer(addr, country string) lookup.Answer {
 func scrape(t *testing.T, addr string) string {
 	t.Helper()
 
-	req := newRequest(t, http.MethodGet, addr, servewaf.MetricsPath, http.NoBody)
+	req := newRequest(t, http.MethodGet, addr, proxy.MetricsPath, http.NoBody)
 	req.Header.Set("Authorization", bearer)
 
 	got := do(t, req)
@@ -380,7 +380,7 @@ func scrape(t *testing.T, addr string) string {
 func (s *sender) scrape() string {
 	s.t.Helper()
 
-	return string(s.adminRequest(bearer, http.MethodGet, servewaf.MetricsPath, "",
+	return string(s.adminRequest(bearer, http.MethodGet, proxy.MetricsPath, "",
 		http.StatusOK).body)
 }
 

internal/proxy/observe_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/proxy.go

@@ -1,9 +1,10 @@
-// Package servewaf is the server the servewaf command runs. It answers each of
-// rproxy's questions with what to do with the request, and takes rproxy's
-// report once the visitor's answer has ended, writing the request's log line.
-// It also answers servewaf's own endpoints: the health check, the metrics, the
-// bans and the clients.
-package servewaf
+// Package proxy is servewaf's server. It runs the checks on the request each of
+// rproxy's questions carries, and answers rproxy what to do with that request. It
+// takes rproxy's report once the visitor's answer has ended, which counts the
+// request's bytes and writes its last log line. It answers servewaf's own
+// endpoints: the health check, the metrics, the bans and the clients. It passes
+// nothing to an app: internal/rproxy does that.
+package proxy
 
 import (
 	"io"

internal/proxy/proxy_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"bufio"
@@ -18,10 +18,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -300,7 +300,7 @@ func startProxyWithGeoJS(
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *servewaf.Server) {
+) (string, *output, *proxy.Server) {
 	t.Helper()
 
 	addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env)
@@ -313,7 +313,7 @@ func startProxyWithClock(
 func startProxyWithAlerts(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *servewaf.Server, *alerts.Queue) {
+) (string, *output, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	server, out, alertQueue := newServeWAF(t, geojsURL, now, env)
@@ -324,7 +324,7 @@ func startProxyWithAlerts(
 
 // serve serves server on a port of its own until the test ends, and sets its
 // Addr to where it listens.
-func serve(t *testing.T, server *servewaf.Server) {
+func serve(t *testing.T, server *proxy.Server) {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -401,17 +401,17 @@ func startRProxy(
 // inspected by it.
 func newServeWAF(
 	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
-) (*servewaf.Server, *output, *alerts.Queue) {
+) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 
-	return newServeWAFWith(t, servewaf.NewServeWAF, geojsURL, now, env)
+	return newServeWAFWith(t, proxy.NewServeWAF, geojsURL, now, env)
 }
 
 // newServeWAFWith is newServeWAF for the server build makes.
 func newServeWAFWith(
-	t *testing.T, build func(servewaf.Params) *servewaf.Server,
+	t *testing.T, build func(proxy.Params) *proxy.Server,
 	geojsURL string, now func() time.Time, env map[string]string,
-) (*servewaf.Server, *output, *alerts.Queue) {
+) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 
 	settings := map[string]string{
@@ -463,7 +463,7 @@ func newServeWAFWith(
 		}
 	}
 
-	server := build(servewaf.Params{
+	server := build(proxy.Params{
 		Config:       cfg,
 		RequestLog:   out,
 		ProcessLog:   processLog,

internal/proxy/ratelimits_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/reputation.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"context"

internal/proxy/reputation_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"fmt"
@@ -15,10 +15,10 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The reputation settings.
@@ -975,7 +975,7 @@ func verdictsFetched() time.Time {
 // verdictsFetched, as reputation.json would at start: one that lists the
 // client from each zone listedBy gives for it, and one that does not from
 // each other zone.
-func loadVerdicts(server *servewaf.Server, listedBy map[string][]string) {
+func loadVerdicts(server *proxy.Server, listedBy map[string][]string) {
 	verdicts := make([]reputation.Verdict, 0, len(listedBy)*len(server.DNSBL.Zones()))
 
 	for client, zones := range listedBy {
@@ -993,7 +993,7 @@ func loadVerdicts(server *servewaf.Server, listedBy map[string][]string) {
 // loadScores puts into server's AbuseIPDB the score scores gives each
 // client, an IPv4 address, fetched at verdictsFetched, as reputation.json
 // would at start.
-func loadScores(server *servewaf.Server, scores map[string]int64) {
+func loadScores(server *proxy.Server, scores map[string]int64) {
 	kept := make([]reputation.Score, 0, len(scores))
 	for client, score := range scores {
 		kept = append(kept, reputation.Score{
@@ -1007,7 +1007,7 @@ func loadScores(server *servewaf.Server, scores map[string]int64) {
 
 // wantAbuseIPDBChecks checks how many clients server has checked with
 // AbuseIPDB.
-func wantAbuseIPDBChecks(t *testing.T, server *servewaf.Server, want int) {
+func wantAbuseIPDBChecks(t *testing.T, server *proxy.Server, want int) {
 	t.Helper()
 
 	if got := server.AbuseIPDB.Checked(); got != want {
@@ -1017,7 +1017,7 @@ func wantAbuseIPDBChecks(t *testing.T, server *servewaf.Server, want int) {
 
 // loadLists puts copies of lists into server's lists, by URL, each with
 // its lines, fetched at listsFetched, as reputation.json would at start.
-func loadLists(t *testing.T, server *servewaf.Server, copies map[string][]string) {
+func loadLists(t *testing.T, server *proxy.Server, copies map[string][]string) {
 	t.Helper()
 
 	lists := make([]reputation.List, 0, len(copies))

internal/proxy/request.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"context"

internal/proxy/requestlog_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -220,7 +220,7 @@ func TestTimingsAreInOrder(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 	refused := out.endedLines(t, 2)[1]
 
-	wantStatus(t, get(t, server.Addr, servewaf.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, server.Addr, proxy.HealthPath), http.StatusOK)
 	health := out.endedLines(t, 3)[2]
 
 	// A request passed to the app has every timing; one refused, none of

internal/proxy/rulefiles_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/rules.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"slices"

internal/proxy/servewaf.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"bytes"

internal/proxy/servewaf_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"context"
@@ -19,9 +19,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -57,7 +57,7 @@ type serveWAF struct {
 	t      *testing.T
 	addr   string
 	out    *output
-	server *servewaf.Server
+	server *proxy.Server
 	clock  *clock
 	queue  *alerts.Queue
 }
@@ -67,13 +67,13 @@ type serveWAF struct {
 func startServeWAF(t *testing.T, geojsURL string, env map[string]string) *serveWAF {
 	t.Helper()
 
-	return startServeWAFWith(t, geojsURL, env, func(*servewaf.Server) {})
+	return startServeWAFWith(t, geojsURL, env, func(*proxy.Server) {})
 }
 
 // startServeWAFWith is startServeWAF with change applied to the server before
 // it starts.
 func startServeWAFWith(
-	t *testing.T, geojsURL string, env map[string]string, change func(*servewaf.Server),
+	t *testing.T, geojsURL string, env map[string]string, change func(*proxy.Server),
 ) *serveWAF {
 	t.Helper()
 
@@ -103,8 +103,8 @@ func (s *serveWAF) questionWith(
 
 	req := newRequest(s.t, method, s.addr, path, body)
 	req.Host = host
-	req.Header.Set(servewaf.ClientHeader, from)
-	req.Header.Set(servewaf.PeerHeader, rproxyPeer)
+	req.Header.Set(proxy.ClientHeader, from)
+	req.Header.Set(proxy.PeerHeader, rproxyPeer)
 	req.Header.Set(requestIDHeader, rand.Text())
 
 	return req
@@ -131,13 +131,13 @@ func (s *serveWAF) allowed(from string) string {
 	s.t.Helper()
 
 	req := s.question(siteA, from, "/")
-	wantDisposition(s.t, do(s.t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(s.t, do(s.t, req), http.StatusOK, proxy.DispositionAllow)
 
 	return req.Header.Get(requestIDHeader)
 }
 
 // report sends rproxy's report and returns the answer.
-func (s *serveWAF) report(report servewaf.Report) answer {
+func (s *serveWAF) report(report proxy.Report) answer {
 	s.t.Helper()
 
 	body, err := json.Marshal(report)
@@ -152,7 +152,7 @@ func (s *serveWAF) report(report servewaf.Report) answer {
 func (s *serveWAF) reportBody(body string) answer {
 	s.t.Helper()
 
-	return do(s.t, newRequest(s.t, http.MethodPost, s.addr, servewaf.ReportPath,
+	return do(s.t, newRequest(s.t, http.MethodPost, s.addr, proxy.ReportPath,
 		strings.NewReader(body)))
 }
 
@@ -161,7 +161,7 @@ func (s *serveWAF) reportBody(body string) answer {
 func (s *serveWAF) passedOn(from string) {
 	s.t.Helper()
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID:     s.allowed(from),
 		Status:        http.StatusOK,
 		RequestBytes:  bodyBytes,
@@ -182,7 +182,7 @@ func (s *serveWAF) history() ratelimit.History {
 func (s *serveWAF) metrics() string {
 	s.t.Helper()
 
-	req := newRequest(s.t, http.MethodGet, s.addr, servewaf.MetricsPath, http.NoBody)
+	req := newRequest(s.t, http.MethodGet, s.addr, proxy.MetricsPath, http.NoBody)
 	req.Header.Set("Authorization", bearer)
 
 	got := do(s.t, req)
@@ -196,7 +196,7 @@ func wantDisposition(t *testing.T, got answer, status int, disposition string) {
 	t.Helper()
 	wantStatus(t, got, status)
 
-	if answered := got.header.Get(servewaf.DispositionHeader); answered != disposition {
+	if answered := got.header.Get(proxy.DispositionHeader); answered != disposition {
 		t.Errorf("answered with disposition %q, want %q", answered, disposition)
 	}
 }
@@ -248,10 +248,10 @@ func TestQuestionAllowedIsAnsweredAndLogged(t *testing.T) {
 	req := s.question(siteA, client, "/page?q=1&token=visible")
 	req.Header.Set(requestIDHeader, "the-id")
 	req.Header.Set("X-Forwarded-Proto", "https")
-	req.Header.Set(servewaf.ContentLengthHeader, "1234")
+	req.Header.Set(proxy.ContentLengthHeader, "1234")
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	wantBody(t, got, "")
 
 	if id := got.header.Get(requestIDHeader); id != "" {
@@ -278,7 +278,7 @@ func TestIPv6VisitorIsCountedInItsGroup(t *testing.T) {
 	s.allowed("2001:db8::1")
 
 	got := s.ask("2001:db8::2", "/")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestIPv4VisitorInIPv6FormIsTheIPv4Client(t *testing.T) {
@@ -287,9 +287,9 @@ func TestIPv4VisitorInIPv6FormIsTheIPv4Client(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{denyNets: client})
 
 	req := s.question(siteA, "::ffff:"+client, "/")
-	req.Header.Set(servewaf.PeerHeader, "::ffff:"+rproxyPeer)
+	req.Header.Set(proxy.PeerHeader, "::ffff:"+rproxyPeer)
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	if line.ClientIP != client || line.PeerIP != rproxyPeer {
@@ -305,13 +305,13 @@ func TestMalformedQuestionGets400AndAWarningAndNoLine(t *testing.T) {
 		change func(*http.Request)
 	}{
 		{"client not an address", func(req *http.Request) {
-			req.Header.Set(servewaf.ClientHeader, "not an address")
+			req.Header.Set(proxy.ClientHeader, "not an address")
 		}},
 		{"client empty", func(req *http.Request) {
-			req.Header.Set(servewaf.ClientHeader, "")
+			req.Header.Set(proxy.ClientHeader, "")
 		}},
 		{"client address with a zone", func(req *http.Request) {
-			req.Header.Set(servewaf.ClientHeader, "2001:db8::1%eth0")
+			req.Header.Set(proxy.ClientHeader, "2001:db8::1%eth0")
 		}},
 		{"id absent", func(req *http.Request) {
 			req.Header.Del(requestIDHeader)
@@ -353,7 +353,7 @@ func TestLongestValidIDIsTaken(t *testing.T) {
 
 	req := s.question(siteA, client, "/")
 	req.Header.Set(requestIDHeader, strings.Repeat("x", 128))
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestQuestionWithABodyOver64KiBGets400(t *testing.T) {
@@ -361,15 +361,15 @@ func TestQuestionWithABodyOver64KiBGets400(t *testing.T) {
 
 	s := startServeWAF(t, "", nil)
 
-	over := strings.NewReader(strings.Repeat("x", servewaf.QuestionBodyMaxBytes+1))
+	over := strings.NewReader(strings.Repeat("x", proxy.QuestionBodyMaxBytes+1))
 	got := do(t, s.questionWith(http.MethodPost, siteA, client, "/", over))
 	wantDisposition(t, got, http.StatusBadRequest, "")
 	wantProcessMessages(t, s, "a question is refused", 1)
 	wantNoRequestLines(t, s)
 
-	whole := strings.NewReader(strings.Repeat("x", servewaf.QuestionBodyMaxBytes))
+	whole := strings.NewReader(strings.Repeat("x", proxy.QuestionBodyMaxBytes))
 	got = do(t, s.questionWith(http.MethodPost, siteA, client, "/", whole))
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestQuestionWithAHeldIDIsRefused(t *testing.T) {
@@ -385,15 +385,15 @@ func TestQuestionWithAHeldIDIsRefused(t *testing.T) {
 	wantProcessMessages(t, s, "a question is refused", 1)
 
 	// A denied request's id is held as well.
-	denied := s.question(siteA, otherClient, servewaf.HealthPath)
-	wantDisposition(t, do(t, denied), http.StatusNotFound, servewaf.DispositionDeny)
+	denied := s.question(siteA, otherClient, proxy.HealthPath)
+	wantDisposition(t, do(t, denied), http.StatusNotFound, proxy.DispositionDeny)
 
 	again = s.question(siteA, client, "/")
 	again.Header.Set(requestIDHeader, denied.Header.Get(requestIDHeader))
 	wantDisposition(t, do(t, again), http.StatusBadRequest, "")
 
 	// The report ends the holding, and the refused questions changed nothing.
-	got := s.report(servewaf.Report{RequestID: id, ResponseBytes: answerBytes})
+	got := s.report(proxy.Report{RequestID: id, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if history := s.history(); history.ResponseBytes != answerBytes {
@@ -402,7 +402,7 @@ func TestQuestionWithAHeldIDIsRefused(t *testing.T) {
 
 	again = s.question(siteA, client, "/")
 	again.Header.Set(requestIDHeader, id)
-	wantDisposition(t, do(t, again), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, again), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
@@ -436,7 +436,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
 
 	// A report for a question not yet answered is ignored, and that question's
 	// id is taken.
-	got := s.report(servewaf.Report{RequestID: id, ResponseBytes: 1000})
+	got := s.report(proxy.Report{RequestID: id, ResponseBytes: 1000})
 	wantStatus(t, got, http.StatusNoContent)
 
 	// This would wait on the same lookup were the id not taken.
@@ -451,7 +451,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
 
 	select {
 	case got := <-answered:
-		wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+		wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	case <-time.After(waitLimit):
 		t.Fatal("the question got no answer")
 	}
@@ -466,7 +466,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
 	}
 
 	// The true report comes after, and is the one that counts.
-	got = s.report(servewaf.Report{RequestID: id, ResponseBytes: answerBytes})
+	got = s.report(proxy.Report{RequestID: id, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if history := s.history(); history.ResponseBytes != answerBytes {
@@ -484,13 +484,13 @@ func TestPeerAbsentOrUnreadableIsAnsweredAndLoggedInvalid(t *testing.T) {
 			s := startServeWAF(t, "", nil)
 
 			req := s.question(siteA, client, "/")
-			req.Header.Del(servewaf.PeerHeader)
+			req.Header.Del(proxy.PeerHeader)
 
 			if peer != "" {
-				req.Header.Set(servewaf.PeerHeader, peer)
+				req.Header.Set(proxy.PeerHeader, peer)
 			}
 
-			wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
 			if line := s.out.requestLine(t); line.PeerIP != "invalid IP" {
 				t.Errorf("log line has peer_ip %q, want invalid IP", line.PeerIP)
@@ -511,8 +511,8 @@ func TestContentLengthUnreadableOrNegativeCountsAsAbsent(t *testing.T) {
 			})
 
 			req := s.question(siteA, client, "/")
-			req.Header.Set(servewaf.ContentLengthHeader, announced)
-			wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+			req.Header.Set(proxy.ContentLengthHeader, announced)
+			wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
 			if line := s.out.requestLine(t); line.ContentLength != 0 {
 				t.Errorf("log line has content_length %d, want none", line.ContentLength)
@@ -527,13 +527,13 @@ func TestHeaderSentTwiceUsesItsFirstValue(t *testing.T) {
 	s := startServeWAF(t, "", nil)
 
 	req := s.question(siteA, client, "/")
-	req.Header.Add(servewaf.ClientHeader, otherClient)
-	req.Header.Add(servewaf.PeerHeader, "172.18.0.3")
+	req.Header.Add(proxy.ClientHeader, otherClient)
+	req.Header.Add(proxy.PeerHeader, "172.18.0.3")
 	req.Header.Set(requestIDHeader, "first")
 	req.Header.Add(requestIDHeader, "second")
-	req.Header.Set(servewaf.ContentLengthHeader, "1234")
-	req.Header.Add(servewaf.ContentLengthHeader, "5678")
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	req.Header.Set(proxy.ContentLengthHeader, "1234")
+	req.Header.Add(proxy.ContentLengthHeader, "5678")
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.ClientIP != client || line.PeerIP != rproxyPeer ||
@@ -562,7 +562,7 @@ func sendQuestionWithPartOfItsBody(t *testing.T, conn net.Conn) {
 	_, err := fmt.Fprintf(conn,
 		"POST / HTTP/1.1\r\nHost: %s\r\n%s: %s\r\n%s: an-id\r\n"+
 			"Content-Length: 100\r\n\r\npart",
-		siteA, servewaf.ClientHeader, client, requestIDHeader)
+		siteA, proxy.ClientHeader, client, requestIDHeader)
 	if err != nil {
 		t.Fatalf("send the question: %v", err)
 	}
@@ -592,7 +592,7 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) {
 			t.Parallel()
 
 			s := startServeWAFWith(t, "", map[string]string{metricsToken: token},
-				func(server *servewaf.Server) { server.ReadTimeout = readTimeout })
+				func(server *proxy.Server) { server.ReadTimeout = readTimeout })
 
 			conn := dial(t, s.addr)
 			sendQuestionWithPartOfItsBody(t, conn)
@@ -615,7 +615,7 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) {
 			// The id was not taken.
 			again := s.question(siteA, client, "/")
 			again.Header.Set(requestIDHeader, "an-id")
-			wantDisposition(t, do(t, again), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, again), http.StatusOK, proxy.DispositionAllow)
 		})
 	}
 }
@@ -632,7 +632,7 @@ func TestQuestionDeniedGetsTheBanResponse(t *testing.T) {
 			})
 
 			got := s.ask(client, "/")
-			wantDisposition(t, got, status, servewaf.DispositionDeny)
+			wantDisposition(t, got, status, proxy.DispositionDeny)
 			wantBody(t, got, http.StatusText(status)+"\n")
 			wantLine(t, s.out.requestLine(t), status, requestlog.ActionDenied)
 		})
@@ -647,7 +647,7 @@ func TestBanResponseCloseIsAnAnswerOfItsOwn(t *testing.T) {
 	})
 
 	got := s.ask(client, "/")
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionClose)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionClose)
 	wantBody(t, got, "")
 	// The visitor is sent nothing.
 	wantLine(t, s.out.requestLine(t), 0, requestlog.ActionDenied)
@@ -664,12 +664,12 @@ func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(t *testing.T) {
 	})
 
 	got := s.ask(client, "/blocked")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
 		requestlog.ActionRuleBlocked)
 
 	got = s.ask(client, "/.env")
-	wantDisposition(t, got, http.StatusTooManyRequests, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusTooManyRequests, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLines(t, 2)[1], http.StatusTooManyRequests,
 		requestlog.ActionBanned)
 }
@@ -681,17 +681,15 @@ func TestQuestionUnderTheOwnPrefixIsDeniedWith404AfterTheChecks(t *testing.T) {
 		metricsToken: token, denyNets: otherClient,
 	})
 
-	for _, path := range []string{
-		servewaf.HealthPath, servewaf.MetricsPath, servewaf.ReportPath,
-	} {
+	for _, path := range []string{proxy.HealthPath, proxy.MetricsPath, proxy.ReportPath} {
 		got := s.ask(client, path)
-		wantDisposition(t, got, http.StatusNotFound, servewaf.DispositionDeny)
+		wantDisposition(t, got, http.StatusNotFound, proxy.DispositionDeny)
 	}
 
 	wantLine(t, s.out.requestLine(t), http.StatusNotFound, requestlog.ActionAdmin)
 
-	got := s.ask(otherClient, servewaf.MetricsPath)
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	got := s.ask(otherClient, proxy.MetricsPath)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
@@ -700,7 +698,7 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{mode: observe, denyNets: client})
 
 	got := s.ask(client, "/")
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, http.StatusOK, requestlog.ActionForward)
@@ -716,7 +714,7 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) {
 
 	for range 2 {
 		got := s.ask(client, "/blocked")
-		wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+		wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	}
 
 	lines := s.out.requestLines(t, 2)
@@ -735,7 +733,7 @@ func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) {
 
 	for range 2 {
 		got := s.ask(client, "/blocked")
-		wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+		wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 	}
 
 	lines := s.out.requestLines(t, 2)
@@ -764,7 +762,7 @@ func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) {
 			})
 
 			got := s.ask(fromDE, "/")
-			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 			asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 			if asn != tc.wantASN || country != tc.wantCountry {
@@ -789,7 +787,7 @@ func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) {
 	}
 
 	// 100 bytes are over the limit of 99.
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 	})
@@ -813,7 +811,7 @@ func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) {
 	}
 
 	got = s.ask(client, "/")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) {
@@ -827,10 +825,10 @@ func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) {
 	})
 
 	s.passedOn(fromKP)
-	wantDisposition(t, s.ask(fromKP, "/"), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, s.ask(fromKP, "/"), http.StatusOK, proxy.DispositionAllow)
 
 	s.passedOn(fromDE)
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing.T) {
@@ -848,7 +846,7 @@ func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing
 		t.Errorf("anomaly counters %v before the report, want none", counters)
 	}
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 	})
@@ -876,7 +874,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) {
 	s.allowed(client)
 
 	denied := s.question(siteA, client, "/")
-	wantDisposition(t, do(t, denied), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, denied), http.StatusForbidden, proxy.DispositionDeny)
 
 	counters := s.server.Anomalies.Snapshot()
 	if len(counters) != 1 || counters[0].Minute.Current != 1 {
@@ -893,7 +891,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) {
 
 	wantMetric(t, s.metrics(), series, 1)
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: denied.Header.Get(requestIDHeader), Status: http.StatusForbidden,
 		ResponseBytes: 1000, DurationTotal: 2,
 	})
@@ -926,7 +924,7 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) {
 	wantMetric(t, metrics, `smallwebwaf_requests_in_flight{instance="`+alertInstance+`"}`,
 		1) // the scrape itself
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 		DurationTotal: 5, DurationUpstreamTotal: 4,
@@ -944,7 +942,7 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) {
 	// check needs a server that has not been scraped yet.
 	unscraped := startServeWAF(t, "", map[string]string{metricsToken: token})
 
-	got = unscraped.report(servewaf.Report{
+	got = unscraped.report(proxy.Report{
 		RequestID: unscraped.allowed(client), Status: http.StatusBadGateway, DurationTotal: 5,
 	})
 	wantStatus(t, got, http.StatusNoContent)
@@ -957,7 +955,7 @@ func TestReportForARequestNotHeldIsIgnored(t *testing.T) {
 
 	s := startServeWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit})
 
-	got := s.report(servewaf.Report{RequestID: "no-such-request", ResponseBytes: 1000})
+	got := s.report(proxy.Report{RequestID: "no-such-request", ResponseBytes: 1000})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if clients := s.server.Limiter.Snapshot(); len(clients) != 0 {
@@ -974,7 +972,7 @@ func TestReportForARequestNotHeldIsIgnored(t *testing.T) {
 	// A second report of the same request does not count it twice.
 	id := s.allowed(client)
 	for range 2 {
-		got = s.report(servewaf.Report{RequestID: id, ResponseBytes: answerBytes})
+		got = s.report(proxy.Report{RequestID: id, ResponseBytes: answerBytes})
 		wantStatus(t, got, http.StatusNoContent)
 	}
 
@@ -1162,7 +1160,7 @@ func TestBytesAtTheirMostEachWayBanRatherThanOverflow(t *testing.T) {
 
 	s := startServeWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit})
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: s.allowed(client), Status: http.StatusOK,
 		RequestBytes: reportedBytesLimit, ResponseBytes: reportedBytesLimit,
 	})
@@ -1247,9 +1245,9 @@ func TestReportWritesTheLastLineWithTheDecisionsAndTheReportsFields(t *testing.T
 	req.Header.Set("X-Forwarded-Proto", "https")
 	id := req.Header.Get(requestIDHeader)
 
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusCreated,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 		DurationTotal: 12.5, DurationUpstreamTotal: 10.25,
@@ -1296,7 +1294,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 			"close", map[string]string{denyNets: client, banResponse: banResponseClose}, "/",
 			0, requestlog.ActionDenied,
 		},
-		{"own prefix", nil, servewaf.HealthPath, http.StatusNotFound, requestlog.ActionAdmin},
+		{"own prefix", nil, proxy.HealthPath, http.StatusNotFound, requestlog.ActionAdmin},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -1307,7 +1305,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 			id := req.Header.Get(requestIDHeader)
 			do(t, req)
 
-			got := s.report(servewaf.Report{
+			got := s.report(proxy.Report{
 				RequestID: id, Status: tc.status, ResponseBytes: 8, DurationTotal: 3,
 			})
 			wantStatus(t, got, http.StatusNoContent)
@@ -1343,18 +1341,18 @@ func TestOldestAnsweredRequestIsDroppedPastTheBound(t *testing.T) {
 			t.Fatalf("question: %v", err)
 		}
 
-		wantDisposition(t, readAnswer(res), http.StatusOK, servewaf.DispositionAllow)
+		wantDisposition(t, readAnswer(res), http.StatusOK, proxy.DispositionAllow)
 	}
 
 	// The table is full again with next and those, without oldest.
-	got := s.report(servewaf.Report{RequestID: oldest, ResponseBytes: answerBytes})
+	got := s.report(proxy.Report{RequestID: oldest, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if counted := s.history().Requests; counted != 0 {
 		t.Errorf("history holds %d requests, want the dropped one not counted", counted)
 	}
 
-	got = s.report(servewaf.Report{RequestID: next, ResponseBytes: answerBytes})
+	got = s.report(proxy.Report{RequestID: next, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if counted := s.history().Requests; counted != 1 {
@@ -1368,10 +1366,10 @@ func TestBanMadeThroughOneHostRefusesTheClientOnAnother(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{rulesDir: writeRules(t, testRules)})
 
 	got := do(t, s.question(siteA, client, "/.env"))
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	got = do(t, s.question(siteB, client, "/"))
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
 	if lines[0].Host != siteA || lines[1].Host != siteB {
@@ -1397,7 +1395,7 @@ func TestRequestsOnEverySiteCountTowardOneSetOfLimits(t *testing.T) {
 	s.allowed(client)
 
 	got := do(t, s.question(siteB, client, "/"))
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) {
@@ -1412,13 +1410,13 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) {
 		path, authorization string
 		want                int
 	}{
-		{servewaf.HealthPath, "", http.StatusOK},
-		{servewaf.MetricsPath, bearer, http.StatusOK},
-		{servewaf.MetricsPath, "", http.StatusUnauthorized},
-		{servewaf.BansPath, adminBearer, http.StatusOK},
-		{servewaf.BansPath, "", http.StatusUnauthorized},
-		{servewaf.ClientsPath + client, adminBearer, http.StatusOK},
-		{servewaf.ReportPath, "", http.StatusNotFound},
+		{proxy.HealthPath, "", http.StatusOK},
+		{proxy.MetricsPath, bearer, http.StatusOK},
+		{proxy.MetricsPath, "", http.StatusUnauthorized},
+		{proxy.BansPath, adminBearer, http.StatusOK},
+		{proxy.BansPath, "", http.StatusUnauthorized},
+		{proxy.ClientsPath + client, adminBearer, http.StatusOK},
+		{proxy.ReportPath, "", http.StatusNotFound},
 		{"/_smallwebwaf/other", "", http.StatusNotFound},
 		{"/", "", http.StatusNotFound},
 	} {
@@ -1431,9 +1429,9 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) {
 		req.Header.Set("Authorization", tc.authorization)
 
 		if strings.HasPrefix(tc.path, "/_smallwebwaf/") {
-			wantDisposition(t, do(t, req), http.StatusNotFound, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), http.StatusNotFound, proxy.DispositionDeny)
 		} else {
-			wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 		}
 	}
 }
@@ -1443,11 +1441,10 @@ func TestOwnEndpointsLinesDoNotSayWhichOfTheTwoTheyAre(t *testing.T) {
 
 	s := startServeWAF(t, "", nil)
 
-	wantStatus(t, get(t, s.addr, servewaf.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, s.addr, proxy.HealthPath), http.StatusOK)
 
 	line := s.out.requestLine(t)
-	if _, there := line.fields["servewaf_line"]; there ||
-		line.Path != servewaf.HealthPath {
+	if _, there := line.fields["servewaf_line"]; there || line.Path != proxy.HealthPath {
 		t.Errorf("the health check's log line is %+v", line.fields)
 	}
 }
@@ -1459,12 +1456,12 @@ func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) {
 
 	req := s.questionWith(http.MethodPost, siteA, client, "/",
 		strings.NewReader("a body"))
-	req.Header.Set(servewaf.ContentLengthHeader, "1073741824")
+	req.Header.Set(proxy.ContentLengthHeader, "1073741824")
 	req.Header.Set(forwardedFor, otherClient)
 	req.Header.Set("X-Long", strings.Repeat("x", 40<<10))
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.ClientIP != client || line.ContentLength != 1<<30 {
@@ -1532,7 +1529,7 @@ carried     header:Content-Length                block  ^6$
 			strings.NewReader("a body"))
 
 		if tc.announced != "" {
-			req.Header.Set(servewaf.ContentLengthHeader, tc.announced)
+			req.Header.Set(proxy.ContentLengthHeader, tc.announced)
 		}
 
 		wantStatus(t, do(t, req), tc.want)
@@ -1550,19 +1547,19 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) {
 		req := s.questionWith(http.MethodPost, siteA, client, "/",
 			strings.NewReader(body))
 		req.Header.Set("Content-Type", contentType)
-		req.Header.Set(servewaf.ContentLengthHeader, "100000")
+		req.Header.Set(proxy.ContentLengthHeader, "100000")
 
 		return do(t, req)
 	}
 
 	got := ask(formData, "id=1'%20OR%20'1'='1")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	// The first 64 KiB of a longer JSON body cannot be parsed, which is no
 	// attack, so the Core Rule Set does not read it.
-	cut := `{"text":"` + strings.Repeat("x", servewaf.QuestionBodyMaxBytes)
-	got = ask("application/json", cut[:servewaf.QuestionBodyMaxBytes])
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	cut := `{"text":"` + strings.Repeat("x", proxy.QuestionBodyMaxBytes)
+	got = ask("application/json", cut[:proxy.QuestionBodyMaxBytes])
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
@@ -1571,7 +1568,7 @@ func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{wafMode: block})
 
 	got := s.ask(client, sqlInjection)
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 1 || waiting[0].Event != alerts.EventWAFBlock ||
@@ -1586,7 +1583,7 @@ func TestReputationHitAlertNamesTheSite(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{blocklistURLs: dropURL})
 	loadLists(t, s.server, map[string][]string{dropURL: {client}})
 
-	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, proxy.DispositionDeny)
 
 	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit ||

internal/proxy/staticlists_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/trappaths_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/rproxy/limits_test.go

@@ -16,9 +16,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // post is the start of a POST whose headers end with what follows it.
@@ -71,11 +71,11 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestSize: tc.limit,
 			})
 
@@ -85,11 +85,11 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 				t.Errorf("answered %+v, want 413", got)
 			}
 
-			if asked := standIn.question(t); len(asked.body) != tc.asked {
+			if asked := servewaf.question(t); len(asked.body) != tc.asked {
 				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
 			}
 
-			report := standIn.report(t)
+			report := servewaf.report(t)
 			if report.Status != http.StatusRequestEntityTooLarge {
 				t.Errorf("report %+v, want status 413", report)
 			}
@@ -100,9 +100,9 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestSize: "1K",
 	})
 
@@ -132,12 +132,12 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 
 			var asked atomic.Bool
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				asked.Store(true)
 				greet(w, r)
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestSize: tc.limit,
 			})
 
@@ -165,12 +165,12 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("announced, is refused", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startServeWAF(t, allow)
+		servewaf := startServeWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
 			_, _ = io.WriteString(w, large)
 		})
-		addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 			maxResponseSize: "1K",
 		})
 
@@ -179,7 +179,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 			t.Errorf("answered %d, want 502", got.status)
 		}
 
-		if report := standIn.report(t); report.Status != http.StatusBadGateway {
+		if report := servewaf.report(t); report.Status != http.StatusBadGateway {
 			t.Errorf("report %+v, want status 502", report)
 		}
 	})
@@ -187,13 +187,13 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("not announced, is cut off", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startServeWAF(t, allow)
+		servewaf := startServeWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = io.WriteString(w, large[:1])
 			_ = http.NewResponseController(w).Flush()
 			_, _ = io.WriteString(w, large[1:])
 		})
-		addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 			maxResponseSize: "1K",
 		})
 
@@ -205,7 +205,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
 		}
 
-		report := standIn.report(t)
+		report := servewaf.report(t)
 		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
 			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
 		}
@@ -217,11 +217,11 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.
 
 	const announced = "2048"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseSize: "1K",
 	})
 
@@ -240,9 +240,9 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				setting: "off",
 			})
 
@@ -251,7 +251,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 				strings.NewReader("a body"))))
 
-			if got := get(t, addr, servewaf.HealthPath); got.status != http.StatusOK {
+			if got := get(t, addr, proxy.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
@@ -270,9 +270,9 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestTime: "500",
 			})
 
@@ -288,11 +288,11 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 				t.Errorf("line %v, want no disposition and 10 bytes", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -300,9 +300,9 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(100)+"some of it")
@@ -313,7 +313,7 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 		t.Errorf("line %v, want no answer and no disposition", line)
 	}
 
-	if len(standIn.questions) != 0 {
+	if len(servewaf.questions) != 0 {
 		t.Error("servewaf was asked")
 	}
 }
@@ -334,9 +334,9 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			conn := dial(t, addr)
 			send(t, conn, tc.request)
@@ -364,7 +364,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 				t.Errorf("line %v, want no answer and no disposition", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 		})
@@ -404,11 +404,11 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 		announced = 100 * questionBodyMaxBytes
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
-	_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+	_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
 	})
 
@@ -454,9 +454,9 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
-			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+			_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
 			})
 
@@ -484,9 +484,9 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
 	})
 
@@ -498,11 +498,11 @@ func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 		t.Errorf("status %d, want 408", status)
 	}
 
-	if asked := standIn.question(t); len(asked.body) != questionBodyMaxBytes {
+	if asked := servewaf.question(t); len(asked.body) != questionBodyMaxBytes {
 		t.Errorf("the question carries %d bytes", len(asked.body))
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusRequestTimeout {
+	if report := servewaf.report(t); report.Status != http.StatusRequestTimeout {
 		t.Errorf("report %+v, want status 408", report)
 	}
 }
@@ -553,8 +553,8 @@ func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startServeWAF(t, allow)
-	addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t),
+	servewaf := startServeWAF(t, allow)
+	addr, _ := startRProxy(t, servewaf.URL, startAppThatTakesNothing(t),
 		map[string]string{maxRequestTime: "3000"})
 
 	conn := dial(t, addr)
@@ -580,14 +580,14 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		<-release
 	})
 
 	t.Cleanup(func() { close(release) })
 
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "300",
 	})
 
@@ -596,7 +596,7 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 		t.Errorf("answered %d, want 504", got.status)
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusGatewayTimeout {
+	if report := servewaf.report(t); report.Status != http.StatusGatewayTimeout {
 		t.Errorf("report %+v, want status 504", report)
 	}
 }
@@ -607,7 +607,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 	const start = "the start"
 
 	release := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, start)
 		_ = http.NewResponseController(w).Flush()
@@ -619,7 +619,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 
 	// The time limit is long enough for a loaded host to pass on the start of the
 	// answer before it runs out.
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "3000",
 	})
 
@@ -642,7 +642,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 			res.StatusCode, body, err, start)
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusOK {
+	if report := servewaf.report(t); report.Status != http.StatusOK {
 		t.Errorf("report %+v, want the status the visitor got", report)
 	}
 }
@@ -656,7 +656,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		part := make([]byte, writeSize)
 
@@ -669,7 +669,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 	})
 	// The time limit is long enough for a loaded host to start passing on the
 	// answer before it runs out.
-	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "3000",
 	})
 
@@ -684,7 +684,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		t.Errorf("line %v, want status 200 and the answer cut off", line)
 	}
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
 		t.Errorf("report %+v, want status 200 and the answer cut off", report)
 	}
@@ -693,15 +693,15 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	servewaf := startServeWAF(t, allow)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusBadGateway {
 		t.Errorf("answered %d, want 502", got.status)
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusBadGateway {
+	if report := servewaf.report(t); report.Status != http.StatusBadGateway {
 		t.Errorf("report %+v, want status 502", report)
 	}
 }
@@ -709,11 +709,11 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
 	})
 
@@ -732,12 +732,12 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 
 	working := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
 	})
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -773,7 +773,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 
 	const answer = "the end of a long answer"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		_ = http.NewResponseController(w).Flush()
@@ -782,7 +782,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 
 		_, _ = io.WriteString(w, answer)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "2000",
 	})
 
@@ -802,18 +802,18 @@ func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing
 		{"a deny", post, http.StatusForbidden},
 		{
 			"the health check",
-			"GET " + servewaf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			"GET " + proxy.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
 			// The time limit is long enough for a loaded host to read the first part of
 			// the body before it runs out.
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestTime: "3000",
 			})
 

internal/rproxy/question_test.go

@@ -12,11 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // questionBodyMaxBytes is the most of a body a question carries.
-const questionBodyMaxBytes = servewaf.QuestionBodyMaxBytes
+const questionBodyMaxBytes = proxy.QuestionBodyMaxBytes
 
 // chunked is the encoding of a body whose length the visitor did not announce.
 const chunked = "chunked"
@@ -29,9 +29,9 @@ const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
 func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
 
@@ -42,16 +42,16 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	req.Header.Set(forwardedForHeader, "198.51.100.1")
 	req.Header.Set(forwardedProtoHeader, "gopher")
 	req.Header.Set(requestIDHeader, "the-visitor's")
-	req.Header.Set(servewaf.ClientHeader, "198.51.100.2")
-	req.Header.Set(servewaf.PeerHeader, "198.51.100.3")
-	req.Header.Set(servewaf.ContentLengthHeader, "12345")
+	req.Header.Set(proxy.ClientHeader, "198.51.100.2")
+	req.Header.Set(proxy.PeerHeader, "198.51.100.3")
+	req.Header.Set(proxy.ContentLengthHeader, "12345")
 	// Go's client then sends no User-Agent, so that one in the question would be
 	// Go's own.
 	req.Header["User-Agent"] = nil
 
 	wantGreeting(t, visit(t, req))
 
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 	if asked.method != http.MethodDelete || asked.target != target ||
 		asked.host != site {
 		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
@@ -68,8 +68,8 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	want.Set(forwardedForHeader, "198.51.100.1")
 	want.Set(forwardedProtoHeader, "http")
 	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
-	want.Set(servewaf.ClientHeader, localhost)
-	want.Set(servewaf.PeerHeader, localhost)
+	want.Set(proxy.ClientHeader, localhost)
+	want.Set(proxy.PeerHeader, localhost)
 
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
 		t.Errorf("the question's headers are %v, want %v", asked.header, want)
@@ -93,14 +93,14 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			forwarded := make(chan http.Header, 1)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				forwarded <- r.Header.Clone()
 
 				greet(w, r)
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: tc.trusted,
 			})
 
@@ -109,9 +109,9 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			req.Header.Set(forwardedProtoHeader, "https")
 			wantGreeting(t, visit(t, req))
 
-			asked := standIn.question(t)
-			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
-				asked.header.Get(servewaf.PeerHeader) != localhost ||
+			asked := servewaf.question(t)
+			if asked.header.Get(proxy.ClientHeader) != tc.client ||
+				asked.header.Get(proxy.PeerHeader) != localhost ||
 				asked.header.Get(forwardedForHeader) != visitor ||
 				asked.header.Get(forwardedProtoHeader) != tc.proto {
 				t.Errorf("the question's headers are %v", asked.header)
@@ -157,9 +157,9 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32,10.0.0.0/8",
 			})
 
@@ -167,7 +167,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 			req.Header[forwardedForHeader] = tc.header
 			wantGreeting(t, visit(t, req))
 
-			if got := standIn.question(t).header.Get(servewaf.ClientHeader); got != tc.client {
+			if got := servewaf.question(t).header.Get(proxy.ClientHeader); got != tc.client {
 				t.Errorf("the question names %s, want %s", got, tc.client)
 			}
 		})
@@ -197,7 +197,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 				t.Parallel()
 
 				body := randomBytes(size)
-				standIn := startServeWAF(t, allow)
+				servewaf := startServeWAF(t, allow)
 				received := make(chan []byte, 1)
 				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 					whole, _ := io.ReadAll(r.Body)
@@ -205,7 +205,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 
 					greet(w, r)
 				})
-				addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+				addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
 				if !announced {
@@ -215,7 +215,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 
 				wantGreeting(t, visit(t, req))
 
-				asked := standIn.question(t)
+				asked := servewaf.question(t)
 				want := body[:min(size, questionBodyMaxBytes)]
 				wantQuestionBody(t, asked, want, size, announced)
 
@@ -223,7 +223,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 					t.Error("the app did not get the whole body")
 				}
 
-				if report := standIn.report(t); report.RequestBytes != int64(size) {
+				if report := servewaf.report(t); report.RequestBytes != int64(size) {
 					t.Errorf("report %+v, of %d bytes", report, size)
 				}
 			})
@@ -243,7 +243,7 @@ func wantQuestionBody(
 			len(want))
 	}
 
-	values := asked.header.Values(servewaf.ContentLengthHeader)
+	values := asked.header.Values(proxy.ContentLengthHeader)
 
 	if announced {
 		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
@@ -264,9 +264,9 @@ func wantQuestionBody(
 func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	// Far more announced than sent. Go's server does not wait for that much, so
 	// the answer comes at once.
@@ -278,7 +278,7 @@ func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 		t.Errorf("status %d, want servewaf's 403", status)
 	}
 
-	if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes {
+	if report := servewaf.report(t); report.RequestBytes != questionBodyMaxBytes {
 		t.Errorf("report %+v, want the first part's bytes", report)
 	}
 }
@@ -306,8 +306,8 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startServeWAF(t, deny)
-				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+				servewaf := startServeWAF(t, deny)
+				addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 				conn := dial(t, addr)
 				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
@@ -316,7 +316,7 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 					t.Errorf("status %d, want servewaf's 403", status)
 				}
 
-				asked := standIn.question(t)
+				asked := servewaf.question(t)
 				if string(asked.body) != tc.body ||
 					!slices.Equal(asked.transferEncoding, tc.encoding) {
 					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
@@ -334,11 +334,11 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
@@ -352,11 +352,11 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 				t.Errorf("line %v, want status 405 and no disposition", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -372,18 +372,18 @@ func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 			t.Parallel()
 
 			reached := make(chan string, 1)
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusOK {
 				t.Errorf("answered %+v, want the app's 200", got)
 			}
 
-			if asked := standIn.question(t); asked.method != method {
+			if asked := servewaf.question(t); asked.method != method {
 				t.Errorf("servewaf was asked about %s", asked.method)
 			}
 
@@ -416,9 +416,9 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			conn := dial(t, addr)
 			send(t, conn, request)
@@ -433,11 +433,11 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 				t.Errorf("line %v, want status 400 and no disposition", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -447,9 +447,9 @@ func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
 
 	const host = "a%b"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: "+host+"\r\n\r\n")
@@ -458,7 +458,7 @@ func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
 		t.Errorf("status %d, want the app's 200", status)
 	}
 
-	if asked := standIn.question(t); asked.host != host {
+	if asked := servewaf.question(t); asked.host != host {
 		t.Errorf("asked about the host %q, want %q", asked.host, host)
 	}
 }
@@ -468,15 +468,15 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	const want = "http"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 
 	wantGreeting(t, get(t, addr, "/"))
 
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 	if got := asked.header.Get(forwardedProtoHeader); got != want {
 		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
 	}
@@ -497,9 +497,9 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
-			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
+			_, out, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32",
 			})
 
@@ -509,9 +509,9 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 
 			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 
-			asked := standIn.question(t)
-			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
-				asked.header.Get(servewaf.PeerHeader) != tc.peer {
+			asked := servewaf.question(t)
+			if asked.header.Get(proxy.ClientHeader) != tc.client ||
+				asked.header.Get(proxy.PeerHeader) != tc.peer {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 

internal/rproxy/request.go

@@ -16,9 +16,9 @@ import (
 	"sync/atomic"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
@@ -129,7 +129,7 @@ func (rq *request) readFirstPartOfBody() bool {
 	}
 
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
-	held, err := io.ReadAll(io.LimitReader(rq.body, servewaf.QuestionBodyMaxBytes))
+	held, err := io.ReadAll(io.LimitReader(rq.body, proxy.QuestionBodyMaxBytes))
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
@@ -384,7 +384,7 @@ func (rq *request) finish(ctx context.Context) {
 		return
 	}
 
-	report := &servewaf.Report{
+	report := &proxy.Report{
 		RequestID:     rq.id,
 		Status:        min(rq.out.status, reportStatusMax),
 		RequestBytes:  requestBytes,

internal/rproxy/rproxy.go

@@ -22,7 +22,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // How rproxy keeps connections to the app and to servewaf open between
@@ -85,7 +85,7 @@ func New(params Params) *Server {
 		transport:         newTransport(),
 		serveWAFTransport: newServeWAFTransport(),
 		reportURL: (&url.URL{
-			Scheme: backend.Scheme, Host: backend.Host, Path: servewaf.ReportPath,
+			Scheme: backend.Scheme, Host: backend.Host, Path: proxy.ReportPath,
 		}).String(),
 	}
 
@@ -166,7 +166,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
 
-	if r.Method == http.MethodGet && r.URL.Path == servewaf.HealthPath {
+	if r.Method == http.MethodGet && r.URL.Path == proxy.HealthPath {
 		rq.answerHealth()
 
 		return
@@ -199,9 +199,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq.noteAnswer(answer)
 
 	switch rq.disposition {
-	case servewaf.DispositionAllow:
+	case proxy.DispositionAllow:
 		rq.passToApp(r.Context())
-	case servewaf.DispositionClose:
+	case proxy.DispositionClose:
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)

internal/rproxy/rproxy_test.go

@@ -19,9 +19,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -54,7 +54,7 @@ const (
 
 // The headers the tests set and look at.
 const (
-	dispositionHeader    = servewaf.DispositionHeader
+	dispositionHeader    = proxy.DispositionHeader
 	forwardedForHeader   = "X-Forwarded-For"
 	forwardedProtoHeader = "X-Forwarded-Proto"
 	requestIDHeader      = "X-Request-ID"
@@ -70,9 +70,9 @@ const (
 
 // What the stand-in for servewaf answers.
 const (
-	dispositionAllow = servewaf.DispositionAllow
-	dispositionDeny  = servewaf.DispositionDeny
-	dispositionClose = servewaf.DispositionClose
+	dispositionAllow = proxy.DispositionAllow
+	dispositionDeny  = proxy.DispositionDeny
+	dispositionClose = proxy.DispositionClose
 	// deniedBody is the body of a deny.
 	deniedBody = "refused by servewaf"
 )
@@ -173,7 +173,7 @@ type serveWAF struct {
 	*httptest.Server
 
 	questions chan question
-	reports   chan servewaf.Report
+	reports   chan proxy.Report
 }
 
 // startServeWAF starts a stand-in for servewaf.
@@ -182,11 +182,11 @@ func startServeWAF(t *testing.T, answer http.HandlerFunc) *serveWAF {
 
 	s := &serveWAF{
 		questions: make(chan question, 10),
-		reports:   make(chan servewaf.Report, 10),
+		reports:   make(chan proxy.Report, 10),
 	}
 	s.Server = httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) == "" {
+			if r.Header.Get(proxy.ClientHeader) == "" {
 				s.takeReport(t, w, r)
 
 				return
@@ -213,10 +213,10 @@ func startServeWAF(t *testing.T, answer http.HandlerFunc) *serveWAF {
 func (s *serveWAF) takeReport(t *testing.T, w http.ResponseWriter, r *http.Request) {
 	t.Helper()
 
-	var report servewaf.Report
+	var report proxy.Report
 
 	err := json.NewDecoder(r.Body).Decode(&report)
-	if err != nil || r.Method != http.MethodPost || r.URL.Path != servewaf.ReportPath {
+	if err != nil || r.Method != http.MethodPost || r.URL.Path != proxy.ReportPath {
 		t.Errorf("%s %s is no report: %v", r.Method, r.URL.Path, err)
 	}
 
@@ -237,7 +237,7 @@ func (s *serveWAF) wantNoReport(t *testing.T) {
 }
 
 // report waits for a report.
-func (s *serveWAF) report(t *testing.T) servewaf.Report {
+func (s *serveWAF) report(t *testing.T) proxy.Report {
 	t.Helper()
 
 	select {
@@ -246,7 +246,7 @@ func (s *serveWAF) report(t *testing.T) servewaf.Report {
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 
-		return servewaf.Report{}
+		return proxy.Report{}
 	}
 }
 
@@ -273,7 +273,7 @@ func startServeWAFAnsweringReports(
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
 				answer(w, r)
 
 				return
@@ -498,7 +498,7 @@ func readStatus(t *testing.T, conn net.Conn) int {
 func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, r *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set(asnHeader, "AS64496")
 		w.Header().Set(countryHeader, "DE")
 		allow(w, r)
@@ -512,7 +512,7 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 		w.WriteHeader(http.StatusTeapot)
 		_, _ = io.WriteString(w, greeting)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
 
@@ -530,7 +530,7 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	}
 
 	received := <-seen
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 
 	if received.RequestURI != target || received.Host != site {
 		t.Errorf("the app saw %s for %s", received.RequestURI, received.Host)
@@ -557,14 +557,14 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	}
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
 
 		greet(w, r)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: "10.0.0.0/8",
 	})
 
@@ -602,14 +602,14 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
 
 		greet(w, r)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 
@@ -641,12 +641,12 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		_, _ = io.WriteString(w, "<html>")
 	})
-	_, _, server := startServer(t, standIn.URL, app.URL, nil)
+	_, _, server := startServer(t, servewaf.URL, app.URL, nil)
 
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	w := httptest.NewRecorder()
@@ -704,11 +704,11 @@ func TestRemovesTheVisitorsLookupHeadersWhenServeWAFGivesNone(t *testing.T) {
 func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusForbidden || got.body != deniedBody ||
@@ -720,7 +720,7 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 		t.Errorf("the visitor got %s", dispositionHeader)
 	}
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != http.StatusForbidden ||
 		report.ResponseBytes != int64(len(deniedBody)) ||
 		report.DurationUpstreamTotal != 0 {
@@ -736,9 +736,9 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 func TestADeniedHeadKeepsServeWAFsContentLength(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
@@ -758,15 +758,15 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 	}{
 		{"a deny", "GET /" + host, deniedBody, http.StatusForbidden},
 		{"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest},
-		{"the health check", "GET " + servewaf.HealthPath + host, "ok\n", http.StatusOK},
+		{"the health check", "GET " + proxy.HealthPath + host, "ok\n", http.StatusOK},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			log := heldLog{release: make(chan struct{})}
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
-			addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard)
+			addr, _ := startServerLogging(t, servewaf.URL, app.URL, nil, log, io.Discard)
 
 			t.Cleanup(func() { close(log.release) })
 
@@ -794,9 +794,9 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -817,14 +817,14 @@ func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(dispositionHeader, dispositionClose)
 		w.WriteHeader(http.StatusOK)
 	})
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -835,7 +835,7 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 			text, err)
 	}
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != 0 || report.ResponseBytes != 0 {
 		t.Errorf("report %+v, of a visitor sent nothing", report)
 	}
@@ -935,7 +935,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+				servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 					if tc.disposition != "" {
 						w.Header().Set(dispositionHeader, tc.disposition)
 					}
@@ -947,7 +947,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
 					t.Error("the app was asked")
 				})
-				addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 					defaultDisposition: setting,
 				})
 
@@ -977,11 +977,11 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadRequest {
 		t.Errorf("answered %+v, want servewaf's 400", got)
@@ -991,18 +991,18 @@ func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 		t.Errorf("line %v, want no disposition", line)
 	}
 
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = io.WriteString(w, "<html>broken")
 	})
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
 	if contentType, sent := got.header["Content-Type"]; sent {
@@ -1015,11 +1015,11 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	const size = 1 << 20
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusInternalServerError || len(got.body) != size {
@@ -1135,15 +1135,15 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, overOneMiB(dispositionDeny))
-	addr, out := startRProxy(t, standIn.URL, nowhere, nil)
+	servewaf := startServeWAF(t, overOneMiB(dispositionDeny))
+	addr, out := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
 		t.Errorf("answered %+v, want 502", got)
 	}
 
 	out.requestLine(t)
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
@@ -1199,20 +1199,20 @@ func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
 		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+			servewaf := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 				<-r.Context().Done()
 			})
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				timeoutSetting:     "60000",
 				defaultDisposition: disposition,
 			})
 
 			conn := dial(t, addr)
 			send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
-			standIn.question(t)
+			servewaf.question(t)
 
 			_ = conn.Close()
 
@@ -1226,7 +1226,7 @@ func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
 				t.Error("rproxy warned that servewaf gave no answer")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -1244,17 +1244,17 @@ func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
 func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+	servewaf := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
 	})
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		timeoutSetting: "200",
 	})
 
 	wantGreeting(t, get(t, addr, "/"))
 	out.requestLine(t)
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
@@ -1274,25 +1274,25 @@ func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
 func TestHealthCheckIsAnsweredWhileServeWAFIsDown(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
-	got := get(t, addr, servewaf.HealthPath)
+	got := get(t, addr, proxy.HealthPath)
 	if got.status != http.StatusOK || got.body != "ok\n" {
 		t.Errorf("answered %+v, want ok", got)
 	}
 
 	line := out.requestLine(t)
-	if line["path"] != servewaf.HealthPath || line["disposition"] != nil {
+	if line["path"] != proxy.HealthPath || line["disposition"] != nil {
 		t.Errorf("line %v, want one with no disposition", line)
 	}
 
 	// With servewaf up too, it is not asked.
-	addr, _ = startRProxy(t, standIn.URL, app.URL, nil)
-	get(t, addr, servewaf.HealthPath)
+	addr, _ = startRProxy(t, servewaf.URL, app.URL, nil)
+	get(t, addr, proxy.HealthPath)
 
-	if len(standIn.questions) != 0 {
+	if len(servewaf.questions) != 0 {
 		t.Error("servewaf was asked about the health check")
 	}
 }
@@ -1396,15 +1396,15 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out, server := startServer(t, standIn.URL, app.URL, nil)
+	addr, out, server := startServer(t, servewaf.URL, app.URL, nil)
 
 	server.WaitForReports()
 
 	wantGreeting(t, get(t, addr, "/"))
 	out.requestLine(t)
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestReportGivesWhatHappened(t *testing.T) {
@@ -1412,14 +1412,14 @@ func TestReportGivesWhatHappened(t *testing.T) {
 
 	const body = "the visitor's body"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 		strings.NewReader(body))))
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 
 	if report.RequestID == "" || report.Status != http.StatusOK ||
 		report.RequestBytes != int64(len(body)) ||
@@ -1442,7 +1442,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
 				allow(w, r)
 
 				return
@@ -1497,9 +1497,9 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, echoAfterUpgrade)
-	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime:  "2000",
 		maxResponseTime: "2000",
 	})
@@ -1535,7 +1535,7 @@ func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 
 	_ = conn.Close()
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != http.StatusSwitchingProtocols ||
 		report.RequestBytes != int64(len(message)) ||
 		report.ResponseBytes != int64(len(message)) {
@@ -1552,7 +1552,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 
 	const goodbye = "sent after the visitor stopped sending\n"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1572,7 +1572,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 		_, _ = buffered.WriteString(goodbye)
 		_ = buffered.Flush()
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
@@ -1610,7 +1610,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 //nolint:paralleltest // see above
 func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 	closed := make(chan error, 1)
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1633,7 +1633,7 @@ func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 		_, err = buffered.ReadByte()
 		closed <- err
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
@@ -1681,9 +1681,9 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 
 	const fromTraefik = "an-id-from-traefik"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 
@@ -1694,7 +1694,7 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 		req.Header.Set(requestIDHeader, fromTraefik)
 		wantGreeting(t, visit(t, req))
 
-		ids = append(ids, standIn.question(t).header.Get(requestIDHeader))
+		ids = append(ids, servewaf.question(t).header.Get(requestIDHeader))
 	}
 
 	if slices.Contains(ids, fromTraefik) || ids[0] == "" || ids[0] == ids[1] {
@@ -1711,16 +1711,16 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 		body  = "the visitor's body"
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	req := newRequest(t, http.MethodPost, addr, path+"?"+query, strings.NewReader(body))
 	req.Host = site
 	wantGreeting(t, visit(t, req))
 
 	line := out.requestLine(t)
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 
 	for name, want := range map[string]any{
 		"type":           "request",

internal/rproxy/servewaf.go

@@ -11,7 +11,7 @@ import (
 	"net/http"
 	"strings"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // answerBodyMaxBytes is the most of the body of servewaf's answer that is read.
@@ -38,10 +38,10 @@ type servewafAnswer struct {
 // notes nothing, and no report is due for it: servewaf holds no decision to report
 // on.
 func (rq *request) noteAnswer(answer *servewafAnswer) {
-	disposition := answer.header.Get(servewaf.DispositionHeader)
+	disposition := answer.header.Get(proxy.DispositionHeader)
 
 	switch disposition {
-	case servewaf.DispositionAllow, servewaf.DispositionDeny, servewaf.DispositionClose:
+	case proxy.DispositionAllow, proxy.DispositionDeny, proxy.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
@@ -74,7 +74,7 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
 
-		if rq.disposition == servewaf.DispositionAllow {
+		if rq.disposition == proxy.DispositionAllow {
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
@@ -169,13 +169,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	question.TransferEncoding = in.TransferEncoding
 
 	question.Header = in.Header.Clone()
-	question.Header.Set(servewaf.ClientHeader, rq.client.String())
-	question.Header.Set(servewaf.PeerHeader, rq.peer.String())
-	question.Header.Del(servewaf.ContentLengthHeader)
+	question.Header.Set(proxy.ClientHeader, rq.client.String())
+	question.Header.Set(proxy.PeerHeader, rq.peer.String())
+	question.Header.Del(proxy.ContentLengthHeader)
 
 	announced := in.Header.Get("Content-Length")
 	if announced != "" {
-		question.Header.Set(servewaf.ContentLengthHeader, announced)
+		question.Header.Set(proxy.ContentLengthHeader, announced)
 	}
 
 	question.Header.Set(requestIDHeader, rq.id)
@@ -196,7 +196,7 @@ func (rq *request) answerWith(answer *servewafAnswer) {
 
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
-	header.Del(servewaf.DispositionHeader)
+	header.Del(proxy.DispositionHeader)
 
 	// Go's server adds a Content-Type it guesses from the body to a response whose
 	// headers have no Content-Type key. The key with no value sends none.
@@ -210,7 +210,7 @@ func (rq *request) answerWith(answer *servewafAnswer) {
 // sendReport sends servewaf report on a goroutine of its own, so that the
 // visitor does not wait for it. The report goes on after ctx, the request's own
 // context, has ended.
-func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
+func (h *handler) sendReport(ctx context.Context, report *proxy.Report) {
 	h.reportsMu.Lock()
 	defer h.reportsMu.Unlock()
 
@@ -228,7 +228,7 @@ func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
 
 // postReport posts report to servewaf, and waits for its answer for up to
 // SWRP_TIMEOUT_MS.
-func (h *handler) postReport(ctx context.Context, report *servewaf.Report) error {
+func (h *handler) postReport(ctx context.Context, report *proxy.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {
 		return fmt.Errorf("encode the report: %w", err)

internal/smallwebwaf/healthcheck.go

@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // healthCheckTimeout bounds the whole health check.
@@ -107,7 +107,7 @@ func checkRProxyAndApp(
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
-	health := "http://" + net.JoinHostPort("127.0.0.1", port) + servewaf.HealthPath
+	health := "http://" + net.JoinHostPort("127.0.0.1", port) + proxy.HealthPath
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody)
 	if err != nil {

internal/smallwebwaf/rproxy_test.go

@@ -19,7 +19,7 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -153,7 +153,7 @@ func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 
 	// One request's three lines carry one id, rproxy's with servewaf's answer.
 	line := firstOut.line(t, "path", bannedProbe)
-	if line["disposition"] != servewaf.DispositionDeny || line["client_ip"] != placed {
+	if line["disposition"] != proxy.DispositionDeny || line["client_ip"] != placed {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
@@ -225,7 +225,7 @@ func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 
 	line := out.line(t, "path", "/after-stop")
-	if line["disposition"] != servewaf.DispositionAllow ||
+	if line["disposition"] != proxy.DispositionAllow ||
 		line["default_disposition"] != true {
 		t.Errorf("rproxy's line is %v", line)
 	}
@@ -318,7 +318,7 @@ func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
 	const smuggledID = "smuggled-request"
 
 	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
-		servewaf.ClientHeader + ": " + otherClient + "\r\n" +
+		proxy.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 
 	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
@@ -459,10 +459,10 @@ func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	protocols := make(chan string, 10)
 	backend := httptest.NewUnstartedServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
 				protocols <- r.Proto
 
-				w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionDeny)
+				w.Header().Set(proxy.DispositionHeader, proxy.DispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
 			}
 		}))
@@ -532,8 +532,8 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
-				w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionAllow)
+			if r.Header.Get(proxy.ClientHeader) != "" {
+				w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 
 				return
 			}
@@ -640,7 +640,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionAllow)
+			w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 
@@ -757,7 +757,7 @@ func TestMainRunsRProxy(t *testing.T) {
 	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
-		"http://"+addr+servewaf.HealthPath, http.NoBody)
+		"http://"+addr+proxy.HealthPath, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}

internal/smallwebwaf/servewaf_test.go

@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -67,7 +67,7 @@ func TestMainRunsServeWAF(t *testing.T) {
 	})
 
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	ask(t, addr, "/", http.StatusOK, servewaf.DispositionAllow)
+	ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
 
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
@@ -132,7 +132,7 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 		t.Fatalf("new request: %v", err)
 	}
 
-	req.Header.Set(servewaf.ClientHeader, placed)
+	req.Header.Set(proxy.ClientHeader, placed)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}
@@ -147,9 +147,9 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 	_ = res.Body.Close()
 
 	if res.StatusCode != status ||
-		res.Header.Get(servewaf.DispositionHeader) != disposition {
+		res.Header.Get(proxy.DispositionHeader) != disposition {
 		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
-			res.Header.Get(servewaf.DispositionHeader), status, disposition)
+			res.Header.Get(proxy.DispositionHeader), status, disposition)
 	}
 }
 
@@ -193,12 +193,12 @@ func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 	}
 
 	runServeWAF(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusOK, servewaf.DispositionAllow)
+		ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
 		// The default rule file bans a probe for this.
-		ask(t, addr, "/.env", http.StatusForbidden, servewaf.DispositionDeny)
+		ask(t, addr, "/.env", http.StatusForbidden, proxy.DispositionDeny)
 	})
 
 	runServeWAF(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusForbidden, servewaf.DispositionDeny)
+		ask(t, addr, "/", http.StatusForbidden, proxy.DispositionDeny)
 	})
 }

internal/smallwebwaf/smallwebwaf.go

@@ -23,11 +23,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
@@ -190,7 +190,7 @@ func RunServeWAF(ctx context.Context, params Params) int {
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
-) (*servewaf.Server, error) {
+) (*proxy.Server, error) {
 	var lookupFile *lookup.File
 
 	if cfg.LookupSource == "file" {
@@ -207,7 +207,7 @@ func newServer(
 		}
 	}
 
-	server := servewaf.NewServeWAF(servewaf.Params{
+	server := proxy.NewServeWAF(proxy.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -230,7 +230,7 @@ func newServer(
 // loadStateFiles reads the state files into the parts of server and into
 // alertQueue, as state.Load does.
 func loadStateFiles(
-	cfg *config.Config, server *servewaf.Server, alertQueue *alerts.Queue,
+	cfg *config.Config, server *proxy.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
@@ -316,7 +316,7 @@ func startSending(
 // shutdownTimeout to finish, and writes every state file, alerts.json with
 // the alerts still waiting.
 func serve(
-	ctx context.Context, server *servewaf.Server, listener net.Listener,
+	ctx context.Context, server *proxy.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {

internal/smallwebwaf/smallwebwaf_test.go

@@ -20,7 +20,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -1225,9 +1225,9 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 		"SWWAF_ALLOW_NETS":                    "",
 		rateLimitExemptNets:                   "",
 		"SWWAF_DENY_NETS":                     "",
-		"SWWAF_RATE_LIMIT_PER_MINUTE":         "500",
-		"SWWAF_RATE_LIMIT_PER_HOUR":           "20000",
-		rateLimitPerDay:                       "300000",
+		"SWWAF_RATE_LIMIT_PER_MINUTE":         "120",
+		"SWWAF_RATE_LIMIT_PER_HOUR":           "1500",
+		rateLimitPerDay:                       "6000",
 		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":       "",
 		"SWWAF_DENIED_COUNTRIES":              "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES": "",
@@ -1627,7 +1627,7 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
-	req.Header.Set(servewaf.ClientHeader, from)
+	req.Header.Set(proxy.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}