Install the image's Ubuntu packages from the normal mirrors (closes #190)

The final image stage now apt-gets ca-certificates, nix-bin and runit
from Ubuntu's archive, with no snapshot and no hash check of the package
lists. The borrowed CA bundle is dropped: apt fetches the packages over
plain HTTP and checks each one against the archive's signed package
lists, so the install needs none. The Ubuntu base image stays pinned by
digest, and every other pin is kept. README.md, SPEC.md and
docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

Dockerfile

@@ -133,32 +133,11 @@ RUN mkdir /etc/sysusers.d \
     && echo 'u  _runit-log  -  "runit svlogd user"  /nonexistent  /sbin/nologin' \
         > /etc/sysusers.d/runit.conf
 
-# ca-certificates, nix-bin and runit, from Ubuntu's archive as it was at
+# ca-certificates, nix-bin and runit, from Ubuntu's archive. apt fetches
-# the snapshot moment, which is never earlier than the Ubuntu image above.
+# them over plain HTTP and checks each one against the archive's signed
-# apt checks every package against the snapshot's InRelease files, and
+# package lists, so no CA certificates are needed.
-# this step checks those against the hashes named here, which are those
+RUN apt-get update \
-# of the amd64 archive: other architectures use Ubuntu's ports archive.
-# apt also fetches the live archive's InRelease files, which change daily
-# and which the install does not use. The snapshot service is HTTPS only
-# and this image has no CA certificates yet, so this step uses the Go
-# image's. The snapshot service answers 503 at times; apt retries a
-# failed download, waiting twice as long before each retry, and this
-# step gives it five retries, about half a minute in all, where its
-# default of three gives up after seven seconds.
-RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,target=/tmp/go-image-ca.crt \
-    apt-get update --snapshot 20261001T000000Z \
-        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
-        -o Acquire::Retries=5 \
-    && printf '%s\n' \
-        '45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute_InRelease' \
-        '802e675dd9de4c7f3916434a95e7c1d8eec0e82886622d7805ab19a2c6fe0365  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-updates_InRelease' \
-        '64b3353f0bd4970b4f7271962245bcea9ff24d4cc7bea16b433f8a60e42ca3dd  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-backports_InRelease' \
-        '1d5041572116a8b23aabf79ac7439ad8af83d57ad3fb0f9aa0d4523ec10c5908  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-security_InRelease' \
-        | (cd /var/lib/apt/lists && sha256sum --check --strict) \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
-        --snapshot 20261001T000000Z \
-        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
-        -o Acquire::Retries=5 \
         ca-certificates nix-bin runit \
     && rm -rf /var/lib/apt/lists/*
 

README.md

@@ -69,8 +69,7 @@ Not built, and not planned:
 ### The image
 
 No image is published. Build it from a clone. `make docker` runs the tests and
-the linter, then builds the image, tagged `smallwebwaf`. It builds for amd64, on
+the linter, then builds the image, tagged `smallwebwaf`.
-an amd64 host only.
 
 ```sh
 git clone https://git.eeqj.de/sneak/smallwebwaf.git
@@ -662,8 +661,8 @@ aside as `<name>.bad`, and never stops the running process (see
 
 ### The image and its processes
 
-- The image is built on Ubuntu 26.04 LTS, pinned by digest, with its packages
+- The image is built on Ubuntu 26.04 LTS, pinned by digest. Its Ubuntu packages
-  from a snapshot of Ubuntu's archive and nixpkgs fixed at one release. An app's
+  come from Ubuntu's archive, and nixpkgs is fixed at one release. An app's
   `Dockerfile` installs a package with `nix-env -iA nixpkgs.<name>` and gets the
   same package each time it is built (see [`docs/image.md`](docs/image.md)).
 - runit, a service supervisor, runs `smallwebwaf` as the `smallwebwaf` user (uid
@@ -688,8 +687,8 @@ aside as `<name>.bad`, and never stops the running process (see
   health check.
 - `internal/config`: reads the settings, the one place they are read.
 - `internal/rproxy`: the reverse proxy in front of one app.
-- `internal/servewaf`: `servewaf`'s server, which runs the checks and answers
+- `internal/proxy`: `servewaf`'s server, which runs the checks and answers its
-  its own endpoints.
+  own endpoints.
 - `internal/ratelimit`, `internal/bans`, `internal/rules`, `internal/waf`,
   `internal/lookup`, `internal/reputation`, `internal/anomaly` and
   `internal/alerts`: one check or source each.

SPEC.md

@@ -66,10 +66,10 @@ to them.
       one it does not know, the binary prints the commands and exits with
       status 2.
     - `internal/config`: reads the settings, the one place they are read.
-    - `internal/servewaf`: `servewaf`'s server. It runs the checks in `check`,
+    - `internal/proxy`: `servewaf`'s server. It runs the checks in `check`, and
-      and holds `servewaf`'s question, answer and report. It answers
+      holds `servewaf`'s question, answer and report. It answers `servewaf`'s
-      `servewaf`'s own endpoints in `answerOwnEndpoint`. It counts bytes,
+      own endpoints in `answerOwnEndpoint`. It counts bytes, refusals and
-      refusals and anomalies, and writes the log lines.
+      anomalies, and writes the log lines.
     - `internal/rproxy`: the reverse proxy in front of one app that asks
       `servewaf` about each request. It passes a request to the app with the
       standard library's `httputil.ReverseProxy`, within the time and size
@@ -1544,20 +1544,11 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 
 - The image is Ubuntu's newest long-term support release, pinned by digest, and
   moves to the next LTS release when that ships. Its packages come from Ubuntu's
-  snapshot service, the archive as it was at the moment the Dockerfile names,
+  archive, whose packages change with every update.
-  rather than the live archive, whose packages change with every update. The
-  snapshot is never older than the pinned Ubuntu image, since older packages can
-  need older versions of packages the image holds, and it moves forward with the
-  image's digest. The Dockerfile names the hash of each of the snapshot's
-  `InRelease` files, which cover every package list and so every package, and
-  the build checks them before installing. The live archive's `InRelease` files,
-  which `apt-get update` also fetches and the install does not use, are left out
-  of the check. The hashes are the amd64 archive's, so the image is built for
-  amd64 only.
 - The Ubuntu image has no CA certificates. Without them Nix cannot download
   packages and `servewaf` cannot reach GeoJS, so `ca-certificates` is installed
-  by name. The snapshot itself is fetched over HTTPS with the CA certificates of
+  by name. apt fetches the packages over plain HTTP and checks each one against
-  the Go image that builds `smallwebwaf`, itself pinned by digest.
+  the archive's signed package lists, so the install needs no CA certificates.
 - nixpkgs comes from a release file on `releases.nixos.org`, named with its
   hash, not from a GitHub archive, whose bytes can change. Root uses Nix
   directly; no Nix daemon runs. `nix-bin` creates no build users, so

docs/image.md

@@ -8,8 +8,7 @@ is pinned that way.
 ## Contents
 
 - Ubuntu 26.04 LTS, pinned by digest.
-- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's archive.
-  archive at `20261001T000000Z`.
 - Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
   `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
   Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
@@ -26,10 +25,8 @@ is pinned that way.
 
 ## Pins
 
-- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
+- Ubuntu's packages are not pinned: they come from the live archive, whose
-  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
+  packages change with every update.
-  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
-  `apt-get update`. The hashes are the amd64 archive's.
 - nixpkgs: the release file `nixexprs.tar.xz` of
   `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
   SHA-256 hash.

internal/proxy/admin.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"bytes"

internal/proxy/admin_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"encoding/json"
@@ -10,9 +10,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
@@ -88,11 +88,11 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 
 	// Any other request under /_smallwebwaf/ is not found.
 	for _, e := range []adminEndpoint{
-		{http.MethodPut, servewaf.BansPath, banOtherClient},
+		{http.MethodPut, proxy.BansPath, banOtherClient},
-		{http.MethodDelete, servewaf.BansPath, ""},
+		{http.MethodDelete, proxy.BansPath, ""},
-		{http.MethodGet, servewaf.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, proxy.BansPath + "/" + otherClient, ""},
-		{http.MethodPost, servewaf.ClientsPath + otherClient, ""},
+		{http.MethodPost, proxy.ClientsPath + otherClient, ""},
-		{http.MethodGet, strings.TrimSuffix(servewaf.ClientsPath, "/"), ""},
+		{http.MethodGet, strings.TrimSuffix(proxy.ClientsPath, "/"), ""},
 	} {
 		s.admin(e.method, e.path, e.body, http.StatusNotFound)
 	}
@@ -118,7 +118,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 		Reason:   "probes for logins",
 	}
 
-	wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK),
+	wantBans(t, s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK),
 		want)
 
 	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
@@ -129,7 +129,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, proxy.BansPath, "", http.StatusOK), want)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -138,13 +138,13 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	lifted := clk.Now()
 	want.Lifted = &lifted
 
-	wantBans(t, s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "",
+	wantBans(t, s.admin(http.MethodDelete, proxy.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, proxy.BansPath, "", http.StatusOK), want)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(http.MethodDelete, proxy.BansPath+"/"+client, "", http.StatusNotFound)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -181,7 +181,7 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, body, http.StatusOK), want)
+		wantBans(t, s.admin(http.MethodPost, proxy.BansPath, body, http.StatusOK), want)
 	}
 }
 
@@ -250,7 +250,7 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 			"request body too large",
 		},
 	} {
-		got := s.admin(http.MethodPost, servewaf.BansPath, tc.body, http.StatusBadRequest)
+		got := s.admin(http.MethodPost, proxy.BansPath, tc.body, http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
 			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
 		}
@@ -283,7 +283,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 			Bans   []state.BanEntry  `json:"bans"`
 		}
 
-		decode(t, s.admin(http.MethodGet, servewaf.ClientsPath+addr, "", http.StatusOK), &got)
+		decode(t, s.admin(http.MethodGet, proxy.ClientsPath+addr, "", http.StatusOK), &got)
 
 		if got.Client == nil {
 			t.Fatalf("%s: no client", addr)
@@ -305,13 +305,13 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 
 	// Of an address no request came from and no ban covers, nothing is
 	// known.
-	got := s.admin(http.MethodGet, servewaf.ClientsPath+"198.51.100.99", "", http.StatusOK)
+	got := s.admin(http.MethodGet, proxy.ClientsPath+"198.51.100.99", "", http.StatusOK)
 	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
-	s.admin(http.MethodGet, servewaf.ClientsPath+"203.0.113", "", http.StatusBadRequest)
+	s.admin(http.MethodGet, proxy.ClientsPath+"203.0.113", "", http.StatusBadRequest)
-	s.admin(http.MethodDelete, servewaf.BansPath+"/203.0.113.0/24", "",
+	s.admin(http.MethodDelete, proxy.BansPath+"/203.0.113.0/24", "",
 		http.StatusBadRequest)
 }
 
@@ -342,10 +342,10 @@ type adminEndpoint struct {
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {
 	return []adminEndpoint{
-		{http.MethodGet, servewaf.BansPath, ""},
+		{http.MethodGet, proxy.BansPath, ""},
-		{http.MethodPost, servewaf.BansPath, banOtherClient},
+		{http.MethodPost, proxy.BansPath, banOtherClient},
-		{http.MethodDelete, servewaf.BansPath + "/" + otherClient, ""},
+		{http.MethodDelete, proxy.BansPath + "/" + otherClient, ""},
-		{http.MethodGet, servewaf.ClientsPath + otherClient, ""},
+		{http.MethodGet, proxy.ClientsPath + otherClient, ""},
 	}
 }
 

internal/proxy/alerts_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"maps"
@@ -10,8 +10,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -201,7 +201,7 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 // never sent them, and returns the queue they wait in as well.
 func startWithAlerts(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
@@ -210,7 +210,7 @@ func startWithAlerts(
 // startAppWithAlerts is startWithAlerts in front of the app handler.
 func startAppWithAlerts(
 	t *testing.T, handler http.HandlerFunc, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	app := startApp(t, handler)

internal/proxy/anomaly_internal_test.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"net/netip"

internal/proxy/anomaly_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"maps"
@@ -13,9 +13,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The anomaly thresholds: the prefix of a scope followed by the end of a
@@ -319,7 +319,7 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// kept.
 	geojsURL, _, release := startHeldGeoJS(t)
 
-	var server atomic.Pointer[servewaf.Server]
+	var server atomic.Pointer[proxy.Server]
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()

internal/proxy/answertime_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"fmt"
@@ -16,10 +16,10 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -81,7 +81,7 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 
-	wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
@@ -144,13 +144,13 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			line := s.out.requestLine(t)
 
 			if tc.refused {
-				wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+				wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 
 				return
 			}
 
-			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 			if line.DurationWAF == nil {
@@ -175,7 +175,7 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 			req := s.question(siteA, client, "/")
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 		})
 	}
 }
@@ -187,7 +187,7 @@ func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
@@ -204,7 +204,7 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
@@ -224,8 +224,8 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 		return do(t, req)
 	}
 
-	wantDisposition(t, ask(), tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, ask(), tooLarge, proxy.DispositionDeny)
-	wantDisposition(t, ask(), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, proxy.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
 	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
@@ -249,7 +249,7 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
 		})
 	}
@@ -265,7 +265,7 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
@@ -275,7 +275,7 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	}
 
 	// The client is under no ban, and GeoJS places it in a country.
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
@@ -291,7 +291,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
 }
 
@@ -306,7 +306,7 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 	if asn != asnDE || country != "DE" {
@@ -318,9 +318,7 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 // newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
 // answers, a setting needs its answer, and everything is at its default but
 // for env. No request to it may use the network.
-func newServeWAFInBubble(
+func newServeWAFInBubble(t *testing.T, env map[string]string) (*proxy.Server, *output) {
-	t *testing.T, env map[string]string,
-) (*servewaf.Server, *output) {
 	t.Helper()
 
 	settings := map[string]string{deniedCountries: "KP"}
@@ -334,13 +332,13 @@ func newServeWAFInBubble(
 // askDirectly hands a question about a request from client straight to server,
 // as change leaves it, and returns the answer's status and how long it took.
 func askDirectly(
-	t *testing.T, server *servewaf.Server, change func(*http.Request),
+	t *testing.T, server *proxy.Server, change func(*http.Request),
 ) (int, time.Duration) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
-	req.Header.Set(servewaf.ClientHeader, client)
+	req.Header.Set(proxy.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
 	change(req)
 
@@ -353,17 +351,17 @@ func askDirectly(
 }
 
 // banClient bans client at now.
-func banClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+func banClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
 }
 
 // countClient counts one request from client at now for the rate limits.
-func countClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+func countClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
 }
 
 // listClient puts client on the blocklist at dropURL.
-func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
+func listClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 
 	err := server.Lists.Load([]reputation.List{{
@@ -375,13 +373,13 @@ func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
 }
 
 // decideOnClient puts client on the CrowdSec decision list.
-func decideOnClient(t *testing.T, server *servewaf.Server, now time.Time) {
+func decideOnClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 	loadDecisions(t, server, now, clientsDecision)
 }
 
 // leaveAsItIs prepares nothing.
-func leaveAsItIs(*testing.T, *servewaf.Server, time.Time) {}
+func leaveAsItIs(*testing.T, *proxy.Server, time.Time) {}
 
 func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	t.Parallel()
@@ -392,7 +390,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		// cookie is the request's Cookie header.
 		cookie string
 		status int
@@ -463,7 +461,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		status  int
 		action  string
 	}{
@@ -521,10 +519,10 @@ func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testin
 
 	t.Cleanup(func() { _ = resolver.Close() })
 
-	server, out, _ := newServeWAFWith(t, func(params servewaf.Params) *servewaf.Server {
+	server, out, _ := newServeWAFWith(t, func(params proxy.Params) *proxy.Server {
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 
-		return servewaf.New(params)
+		return proxy.NewServeWAF(params)
 	}, held, time.Now, map[string]string{
 		deniedCountries: "KP", wafMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),

internal/proxy/bans.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"net/http"

internal/proxy/bans_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"bufio"
@@ -15,8 +15,8 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -382,7 +382,7 @@ func (c *clock) advance(d time.Duration) {
 // window.
 func startWithClock(
 	t *testing.T, geojsURL string, env map[string]string,
-) (*sender, *clock, *servewaf.Server) {
+) (*sender, *clock, *proxy.Server) {
 	t.Helper()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})

internal/proxy/biased.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"sneak.berlin/go/smallwebwaf/internal/config"

internal/proxy/biased_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"fmt"
@@ -16,8 +16,8 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The biased thresholds.
@@ -419,7 +419,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 // clock.
 func startWithLookups(
 	t *testing.T, env map[string]string,
-) (*sender, *servewaf.Server, *alerts.Queue) {
+) (*sender, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	s, _, server, queue := startWithLookupsAndClock(t, env)
@@ -434,7 +434,7 @@ func startWithLookups(
 // country, and no other address.
 func startWithLookupsAndClock(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
@@ -463,11 +463,11 @@ func (s *sender) uploadFrom(from string) logLine {
 // serveFromDE hands a question about a request from fromDE with method and body
 // straight to server's handler, without the network, and returns once it is
 // answered.
-func serveFromDE(t *testing.T, server *servewaf.Server, method string, body io.Reader) {
+func serveFromDE(t *testing.T, server *proxy.Server, method string, body io.Reader) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.Header.Set(servewaf.ClientHeader, fromDE)
+	req.Header.Set(proxy.ClientHeader, fromDE)
 	req.Header.Set(requestIDHeader, "the-id")
 
 	server.Handler.ServeHTTP(httptest.NewRecorder(), req)

internal/proxy/bytelimits_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"bufio"

internal/proxy/client.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"crypto/rand"

internal/proxy/coreruleset.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"time"

internal/proxy/coreruleset_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"

internal/proxy/countries.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"slices"

internal/proxy/countries_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"encoding/json"

internal/proxy/crowdsec_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"
@@ -9,9 +9,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The CrowdSec settings, and the tests' engine, which is never asked: each
@@ -168,7 +168,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 // decisionsURL, answer, the engine's answer, fetched at fetched, as
 // reputation.json would at start.
 func loadDecisions(
-	t *testing.T, server *servewaf.Server, fetched time.Time, answer string,
+	t *testing.T, server *proxy.Server, fetched time.Time, answer string,
 ) {
 	t.Helper()
 

internal/proxy/errorburst_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"maps"
@@ -10,9 +10,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
@@ -51,7 +51,7 @@ func (r refused) send(s *sender, from string) logLine {
 // SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
-) (*sender, *clock, *servewaf.Server) {
+) (*sender, *clock, *proxy.Server) {
 	t.Helper()
 
 	settings := map[string]string{

internal/proxy/health_test.go

@@ -1,11 +1,11 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"
 	"testing"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
@@ -21,7 +21,7 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+		got := s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+

internal/proxy/history_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
@@ -100,8 +100,8 @@ func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 
 	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+	s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
-	s.adminRequest("", http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized)
+	s.adminRequest("", http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized)
 	s.scrape()
 
 	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
@@ -126,7 +126,7 @@ func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 }
 
 // historyOf returns the history of the client at addr.
-func historyOf(t *testing.T, server *servewaf.Server, addr string) ratelimit.History {
+func historyOf(t *testing.T, server *proxy.Server, addr string) ratelimit.History {
 	t.Helper()
 
 	client := netip.MustParsePrefix(addr + "/32")

internal/proxy/lookup.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"context"

internal/proxy/lookup_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"
@@ -379,7 +379,7 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	// clock of the test's own: the wait lasts exactly as long as it should,
 	// however slowly the test process runs. Nothing in it may wait on the
 	// network, which would keep that clock from moving on: the request is
-	// handed to servewaf's handler, and GeoJS is one that never answers.
+	// handed to the proxy's handler, and GeoJS is one that never answers.
 	synctest.Test(t, func(t *testing.T) {
 		// Not the default. The exclusive list needs the answer, and the app
 		// is never reached.

internal/proxy/metrics_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"
@@ -12,8 +12,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -32,7 +32,7 @@ func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{bearer, "Bearer ", ""} {
-		s.adminRequest(authorization, http.MethodGet, servewaf.MetricsPath, "",
+		s.adminRequest(authorization, http.MethodGet, proxy.MetricsPath, "",
 			http.StatusNotFound)
 	}
 }
@@ -46,18 +46,18 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		method, path, authorization string
 		status                      int
 	}{
-		{http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized},
+		{http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized},
 		{
-			http.MethodGet, servewaf.MetricsPath, "Bearer " + strings.ToUpper(token),
+			http.MethodGet, proxy.MetricsPath, "Bearer " + strings.ToUpper(token),
 			http.StatusUnauthorized,
 		},
-		{http.MethodGet, servewaf.MetricsPath, "Basic " + token, http.StatusUnauthorized},
+		{http.MethodGet, proxy.MetricsPath, "Basic " + token, http.StatusUnauthorized},
-		{http.MethodGet, servewaf.MetricsPath, bearer, http.StatusOK},
+		{http.MethodGet, proxy.MetricsPath, bearer, http.StatusOK},
-		{http.MethodGet, servewaf.MetricsPath, "bearer " + token, http.StatusOK},
+		{http.MethodGet, proxy.MetricsPath, "bearer " + token, http.StatusOK},
-		{http.MethodPost, servewaf.MetricsPath, bearer, http.StatusNotFound},
+		{http.MethodPost, proxy.MetricsPath, bearer, http.StatusNotFound},
-		{http.MethodGet, servewaf.MetricsPath + "/", bearer, http.StatusNotFound},
+		{http.MethodGet, proxy.MetricsPath + "/", bearer, http.StatusNotFound},
 		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
-		{http.MethodPost, servewaf.HealthPath, "", http.StatusNotFound},
+		{http.MethodPost, proxy.HealthPath, "", http.StatusNotFound},
 	} {
 		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
 
@@ -180,7 +180,7 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 	wantMetric(t, s.scrape(), admins, 1)
 
 	// And a ban made through the endpoint.
-	s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK)
+	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
 	wantMetric(t, s.scrape(), admins, 2)
 }
 
@@ -365,7 +365,7 @@ func keptAnswer(addr, country string) lookup.Answer {
 func scrape(t *testing.T, addr string) string {
 	t.Helper()
 
-	req := newRequest(t, http.MethodGet, addr, servewaf.MetricsPath, http.NoBody)
+	req := newRequest(t, http.MethodGet, addr, proxy.MetricsPath, http.NoBody)
 	req.Header.Set("Authorization", bearer)
 
 	got := do(t, req)
@@ -380,7 +380,7 @@ func scrape(t *testing.T, addr string) string {
 func (s *sender) scrape() string {
 	s.t.Helper()
 
-	return string(s.adminRequest(bearer, http.MethodGet, servewaf.MetricsPath, "",
+	return string(s.adminRequest(bearer, http.MethodGet, proxy.MetricsPath, "",
 		http.StatusOK).body)
 }
 

internal/proxy/observe_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/proxy.go

@@ -1,7 +1,10 @@
-// Package servewaf is the server the servewaf command runs. It answers rproxy's
+// Package proxy is servewaf's server. It runs the checks on the request each of
-// questions, takes rproxy's reports and answers its own endpoints, and writes a
+// rproxy's questions carries, and answers rproxy what to do with that request. It
-// log line for each.
+// takes rproxy's report once the visitor's answer has ended, which counts the
-package servewaf
+// request's bytes and writes its last log line. It answers servewaf's own
+// endpoints: the health check, the metrics, the bans and the clients. It passes
+// nothing to an app: internal/rproxy does that.
+package proxy
 
 import (
 	"io"
@@ -43,7 +46,7 @@ const BansPath = "/_smallwebwaf/bans"
 // client's address after it, with SWWAF_ADMIN_TOKEN.
 const ClientsPath = "/_smallwebwaf/clients/"
 
-// Params are what New needs.
+// Params are what NewServeWAF needs.
 type Params struct {
 	Config *config.Config
 	// RequestLog receives two JSON lines per question, one at its decision and

internal/proxy/proxy_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"bufio"
@@ -18,10 +18,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -300,7 +300,7 @@ func startProxyWithGeoJS(
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *servewaf.Server) {
+) (string, *output, *proxy.Server) {
 	t.Helper()
 
 	addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env)
@@ -313,7 +313,7 @@ func startProxyWithClock(
 func startProxyWithAlerts(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *servewaf.Server, *alerts.Queue) {
+) (string, *output, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
 	server, out, alertQueue := newServeWAF(t, geojsURL, now, env)
@@ -324,7 +324,7 @@ func startProxyWithAlerts(
 
 // serve serves server on a port of its own until the test ends, and sets its
 // Addr to where it listens.
-func serve(t *testing.T, server *servewaf.Server) {
+func serve(t *testing.T, server *proxy.Server) {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -401,17 +401,17 @@ func startRProxy(
 // inspected by it.
 func newServeWAF(
 	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
-) (*servewaf.Server, *output, *alerts.Queue) {
+) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 
-	return newServeWAFWith(t, servewaf.New, geojsURL, now, env)
+	return newServeWAFWith(t, proxy.NewServeWAF, geojsURL, now, env)
 }
 
 // newServeWAFWith is newServeWAF for the server build makes.
 func newServeWAFWith(
-	t *testing.T, build func(servewaf.Params) *servewaf.Server,
+	t *testing.T, build func(proxy.Params) *proxy.Server,
 	geojsURL string, now func() time.Time, env map[string]string,
-) (*servewaf.Server, *output, *alerts.Queue) {
+) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 
 	settings := map[string]string{
@@ -463,7 +463,7 @@ func newServeWAFWith(
 		}
 	}
 
-	server := build(servewaf.Params{
+	server := build(proxy.Params{
 		Config:       cfg,
 		RequestLog:   out,
 		ProcessLog:   processLog,

internal/proxy/ratelimits_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/reputation.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"context"

internal/proxy/reputation_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"fmt"
@@ -15,10 +15,10 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // The reputation settings.
@@ -617,7 +617,7 @@ const (
 // AbuseIPDB.
 const abuseipdb = reputation.AbuseIPDBSource
 
-// abuseIPDBURL is where newServeWAF has clients checked with AbuseIPDB: at
+// abuseIPDBURL is where newProxy has clients checked with AbuseIPDB: at
 // abuseIPDBStandIn, which TestMain registers with Go's default transport,
 // through which AbuseIPDB is asked.
 const abuseIPDBURL = "abuseipdb://stand-in/api/v2/check"
@@ -975,7 +975,7 @@ func verdictsFetched() time.Time {
 // verdictsFetched, as reputation.json would at start: one that lists the
 // client from each zone listedBy gives for it, and one that does not from
 // each other zone.
-func loadVerdicts(server *servewaf.Server, listedBy map[string][]string) {
+func loadVerdicts(server *proxy.Server, listedBy map[string][]string) {
 	verdicts := make([]reputation.Verdict, 0, len(listedBy)*len(server.DNSBL.Zones()))
 
 	for client, zones := range listedBy {
@@ -993,7 +993,7 @@ func loadVerdicts(server *servewaf.Server, listedBy map[string][]string) {
 // loadScores puts into server's AbuseIPDB the score scores gives each
 // client, an IPv4 address, fetched at verdictsFetched, as reputation.json
 // would at start.
-func loadScores(server *servewaf.Server, scores map[string]int64) {
+func loadScores(server *proxy.Server, scores map[string]int64) {
 	kept := make([]reputation.Score, 0, len(scores))
 	for client, score := range scores {
 		kept = append(kept, reputation.Score{
@@ -1007,7 +1007,7 @@ func loadScores(server *servewaf.Server, scores map[string]int64) {
 
 // wantAbuseIPDBChecks checks how many clients server has checked with
 // AbuseIPDB.
-func wantAbuseIPDBChecks(t *testing.T, server *servewaf.Server, want int) {
+func wantAbuseIPDBChecks(t *testing.T, server *proxy.Server, want int) {
 	t.Helper()
 
 	if got := server.AbuseIPDB.Checked(); got != want {
@@ -1017,7 +1017,7 @@ func wantAbuseIPDBChecks(t *testing.T, server *servewaf.Server, want int) {
 
 // loadLists puts copies of lists into server's lists, by URL, each with
 // its lines, fetched at listsFetched, as reputation.json would at start.
-func loadLists(t *testing.T, server *servewaf.Server, copies map[string][]string) {
+func loadLists(t *testing.T, server *proxy.Server, copies map[string][]string) {
 	t.Helper()
 
 	lists := make([]reputation.List, 0, len(copies))

internal/proxy/request.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"context"

internal/proxy/requestlog_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"io"
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -220,7 +220,7 @@ func TestTimingsAreInOrder(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 	refused := out.endedLines(t, 2)[1]
 
-	wantStatus(t, get(t, server.Addr, servewaf.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, server.Addr, proxy.HealthPath), http.StatusOK)
 	health := out.endedLines(t, 3)[2]
 
 	// A request passed to the app has every timing; one refused, none of

internal/proxy/rulefiles_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/rules.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"slices"

internal/proxy/servewaf.go

@@ -1,4 +1,4 @@
-package servewaf
+package proxy
 
 import (
 	"bytes"
@@ -103,13 +103,13 @@ type Report struct {
 	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
 }
 
-// New returns the server `smallwebwaf servewaf` runs. It answers
+// NewServeWAF returns the server `smallwebwaf servewaf` runs. It answers
 // rproxy's questions, takes rproxy's reports and answers its own endpoints. It
 // passes nothing to an app. rproxy applies the size and time limits to the
 // visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
 // is far above rproxy's, and a question refused for its size would have rproxy
 // let the request through.
-func New(params Params) *Server {
+func NewServeWAF(params Params) *Server {
 	h := newHandler(params)
 
 	return &Server{

internal/proxy/servewaf_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"context"
@@ -19,9 +19,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -57,7 +57,7 @@ type serveWAF struct {
 	t      *testing.T
 	addr   string
 	out    *output
-	server *servewaf.Server
+	server *proxy.Server
 	clock  *clock
 	queue  *alerts.Queue
 }
@@ -67,13 +67,13 @@ type serveWAF struct {
 func startServeWAF(t *testing.T, geojsURL string, env map[string]string) *serveWAF {
 	t.Helper()
 
-	return startServeWAFWith(t, geojsURL, env, func(*servewaf.Server) {})
+	return startServeWAFWith(t, geojsURL, env, func(*proxy.Server) {})
 }
 
 // startServeWAFWith is startServeWAF with change applied to the server before
 // it starts.
 func startServeWAFWith(
-	t *testing.T, geojsURL string, env map[string]string, change func(*servewaf.Server),
+	t *testing.T, geojsURL string, env map[string]string, change func(*proxy.Server),
 ) *serveWAF {
 	t.Helper()
 
@@ -103,8 +103,8 @@ func (s *serveWAF) questionWith(
 
 	req := newRequest(s.t, method, s.addr, path, body)
 	req.Host = host
-	req.Header.Set(servewaf.ClientHeader, from)
+	req.Header.Set(proxy.ClientHeader, from)
-	req.Header.Set(servewaf.PeerHeader, rproxyPeer)
+	req.Header.Set(proxy.PeerHeader, rproxyPeer)
 	req.Header.Set(requestIDHeader, rand.Text())
 
 	return req
@@ -131,13 +131,13 @@ func (s *serveWAF) allowed(from string) string {
 	s.t.Helper()
 
 	req := s.question(siteA, from, "/")
-	wantDisposition(s.t, do(s.t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(s.t, do(s.t, req), http.StatusOK, proxy.DispositionAllow)
 
 	return req.Header.Get(requestIDHeader)
 }
 
 // report sends rproxy's report and returns the answer.
-func (s *serveWAF) report(report servewaf.Report) answer {
+func (s *serveWAF) report(report proxy.Report) answer {
 	s.t.Helper()
 
 	body, err := json.Marshal(report)
@@ -152,7 +152,7 @@ func (s *serveWAF) report(report servewaf.Report) answer {
 func (s *serveWAF) reportBody(body string) answer {
 	s.t.Helper()
 
-	return do(s.t, newRequest(s.t, http.MethodPost, s.addr, servewaf.ReportPath,
+	return do(s.t, newRequest(s.t, http.MethodPost, s.addr, proxy.ReportPath,
 		strings.NewReader(body)))
 }
 
@@ -161,7 +161,7 @@ func (s *serveWAF) reportBody(body string) answer {
 func (s *serveWAF) passedOn(from string) {
 	s.t.Helper()
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID:     s.allowed(from),
 		Status:        http.StatusOK,
 		RequestBytes:  bodyBytes,
@@ -182,7 +182,7 @@ func (s *serveWAF) history() ratelimit.History {
 func (s *serveWAF) metrics() string {
 	s.t.Helper()
 
-	req := newRequest(s.t, http.MethodGet, s.addr, servewaf.MetricsPath, http.NoBody)
+	req := newRequest(s.t, http.MethodGet, s.addr, proxy.MetricsPath, http.NoBody)
 	req.Header.Set("Authorization", bearer)
 
 	got := do(s.t, req)
@@ -196,7 +196,7 @@ func wantDisposition(t *testing.T, got answer, status int, disposition string) {
 	t.Helper()
 	wantStatus(t, got, status)
 
-	if answered := got.header.Get(servewaf.DispositionHeader); answered != disposition {
+	if answered := got.header.Get(proxy.DispositionHeader); answered != disposition {
 		t.Errorf("answered with disposition %q, want %q", answered, disposition)
 	}
 }
@@ -248,10 +248,10 @@ func TestQuestionAllowedIsAnsweredAndLogged(t *testing.T) {
 	req := s.question(siteA, client, "/page?q=1&token=visible")
 	req.Header.Set(requestIDHeader, "the-id")
 	req.Header.Set("X-Forwarded-Proto", "https")
-	req.Header.Set(servewaf.ContentLengthHeader, "1234")
+	req.Header.Set(proxy.ContentLengthHeader, "1234")
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	wantBody(t, got, "")
 
 	if id := got.header.Get(requestIDHeader); id != "" {
@@ -278,7 +278,7 @@ func TestIPv6VisitorIsCountedInItsGroup(t *testing.T) {
 	s.allowed("2001:db8::1")
 
 	got := s.ask("2001:db8::2", "/")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestIPv4VisitorInIPv6FormIsTheIPv4Client(t *testing.T) {
@@ -287,9 +287,9 @@ func TestIPv4VisitorInIPv6FormIsTheIPv4Client(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{denyNets: client})
 
 	req := s.question(siteA, "::ffff:"+client, "/")
-	req.Header.Set(servewaf.PeerHeader, "::ffff:"+rproxyPeer)
+	req.Header.Set(proxy.PeerHeader, "::ffff:"+rproxyPeer)
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	if line.ClientIP != client || line.PeerIP != rproxyPeer {
@@ -305,13 +305,13 @@ func TestMalformedQuestionGets400AndAWarningAndNoLine(t *testing.T) {
 		change func(*http.Request)
 	}{
 		{"client not an address", func(req *http.Request) {
-			req.Header.Set(servewaf.ClientHeader, "not an address")
+			req.Header.Set(proxy.ClientHeader, "not an address")
 		}},
 		{"client empty", func(req *http.Request) {
-			req.Header.Set(servewaf.ClientHeader, "")
+			req.Header.Set(proxy.ClientHeader, "")
 		}},
 		{"client address with a zone", func(req *http.Request) {
-			req.Header.Set(servewaf.ClientHeader, "2001:db8::1%eth0")
+			req.Header.Set(proxy.ClientHeader, "2001:db8::1%eth0")
 		}},
 		{"id absent", func(req *http.Request) {
 			req.Header.Del(requestIDHeader)
@@ -353,7 +353,7 @@ func TestLongestValidIDIsTaken(t *testing.T) {
 
 	req := s.question(siteA, client, "/")
 	req.Header.Set(requestIDHeader, strings.Repeat("x", 128))
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestQuestionWithABodyOver64KiBGets400(t *testing.T) {
@@ -361,15 +361,15 @@ func TestQuestionWithABodyOver64KiBGets400(t *testing.T) {
 
 	s := startServeWAF(t, "", nil)
 
-	over := strings.NewReader(strings.Repeat("x", servewaf.QuestionBodyMaxBytes+1))
+	over := strings.NewReader(strings.Repeat("x", proxy.QuestionBodyMaxBytes+1))
 	got := do(t, s.questionWith(http.MethodPost, siteA, client, "/", over))
 	wantDisposition(t, got, http.StatusBadRequest, "")
 	wantProcessMessages(t, s, "a question is refused", 1)
 	wantNoRequestLines(t, s)
 
-	whole := strings.NewReader(strings.Repeat("x", servewaf.QuestionBodyMaxBytes))
+	whole := strings.NewReader(strings.Repeat("x", proxy.QuestionBodyMaxBytes))
 	got = do(t, s.questionWith(http.MethodPost, siteA, client, "/", whole))
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestQuestionWithAHeldIDIsRefused(t *testing.T) {
@@ -385,15 +385,15 @@ func TestQuestionWithAHeldIDIsRefused(t *testing.T) {
 	wantProcessMessages(t, s, "a question is refused", 1)
 
 	// A denied request's id is held as well.
-	denied := s.question(siteA, otherClient, servewaf.HealthPath)
+	denied := s.question(siteA, otherClient, proxy.HealthPath)
-	wantDisposition(t, do(t, denied), http.StatusNotFound, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, denied), http.StatusNotFound, proxy.DispositionDeny)
 
 	again = s.question(siteA, client, "/")
 	again.Header.Set(requestIDHeader, denied.Header.Get(requestIDHeader))
 	wantDisposition(t, do(t, again), http.StatusBadRequest, "")
 
 	// The report ends the holding, and the refused questions changed nothing.
-	got := s.report(servewaf.Report{RequestID: id, ResponseBytes: answerBytes})
+	got := s.report(proxy.Report{RequestID: id, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if history := s.history(); history.ResponseBytes != answerBytes {
@@ -402,7 +402,7 @@ func TestQuestionWithAHeldIDIsRefused(t *testing.T) {
 
 	again = s.question(siteA, client, "/")
 	again.Header.Set(requestIDHeader, id)
-	wantDisposition(t, do(t, again), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, again), http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
@@ -436,7 +436,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
 
 	// A report for a question not yet answered is ignored, and that question's
 	// id is taken.
-	got := s.report(servewaf.Report{RequestID: id, ResponseBytes: 1000})
+	got := s.report(proxy.Report{RequestID: id, ResponseBytes: 1000})
 	wantStatus(t, got, http.StatusNoContent)
 
 	// This would wait on the same lookup were the id not taken.
@@ -451,7 +451,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
 
 	select {
 	case got := <-answered:
-		wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+		wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	case <-time.After(waitLimit):
 		t.Fatal("the question got no answer")
 	}
@@ -466,7 +466,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
 	}
 
 	// The true report comes after, and is the one that counts.
-	got = s.report(servewaf.Report{RequestID: id, ResponseBytes: answerBytes})
+	got = s.report(proxy.Report{RequestID: id, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if history := s.history(); history.ResponseBytes != answerBytes {
@@ -484,13 +484,13 @@ func TestPeerAbsentOrUnreadableIsAnsweredAndLoggedInvalid(t *testing.T) {
 			s := startServeWAF(t, "", nil)
 
 			req := s.question(siteA, client, "/")
-			req.Header.Del(servewaf.PeerHeader)
+			req.Header.Del(proxy.PeerHeader)
 
 			if peer != "" {
-				req.Header.Set(servewaf.PeerHeader, peer)
+				req.Header.Set(proxy.PeerHeader, peer)
 			}
 
-			wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
 			if line := s.out.requestLine(t); line.PeerIP != "invalid IP" {
 				t.Errorf("log line has peer_ip %q, want invalid IP", line.PeerIP)
@@ -511,8 +511,8 @@ func TestContentLengthUnreadableOrNegativeCountsAsAbsent(t *testing.T) {
 			})
 
 			req := s.question(siteA, client, "/")
-			req.Header.Set(servewaf.ContentLengthHeader, announced)
+			req.Header.Set(proxy.ContentLengthHeader, announced)
-			wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
 			if line := s.out.requestLine(t); line.ContentLength != 0 {
 				t.Errorf("log line has content_length %d, want none", line.ContentLength)
@@ -527,13 +527,13 @@ func TestHeaderSentTwiceUsesItsFirstValue(t *testing.T) {
 	s := startServeWAF(t, "", nil)
 
 	req := s.question(siteA, client, "/")
-	req.Header.Add(servewaf.ClientHeader, otherClient)
+	req.Header.Add(proxy.ClientHeader, otherClient)
-	req.Header.Add(servewaf.PeerHeader, "172.18.0.3")
+	req.Header.Add(proxy.PeerHeader, "172.18.0.3")
 	req.Header.Set(requestIDHeader, "first")
 	req.Header.Add(requestIDHeader, "second")
-	req.Header.Set(servewaf.ContentLengthHeader, "1234")
+	req.Header.Set(proxy.ContentLengthHeader, "1234")
-	req.Header.Add(servewaf.ContentLengthHeader, "5678")
+	req.Header.Add(proxy.ContentLengthHeader, "5678")
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.ClientIP != client || line.PeerIP != rproxyPeer ||
@@ -562,7 +562,7 @@ func sendQuestionWithPartOfItsBody(t *testing.T, conn net.Conn) {
 	_, err := fmt.Fprintf(conn,
 		"POST / HTTP/1.1\r\nHost: %s\r\n%s: %s\r\n%s: an-id\r\n"+
 			"Content-Length: 100\r\n\r\npart",
-		siteA, servewaf.ClientHeader, client, requestIDHeader)
+		siteA, proxy.ClientHeader, client, requestIDHeader)
 	if err != nil {
 		t.Fatalf("send the question: %v", err)
 	}
@@ -592,7 +592,7 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) {
 			t.Parallel()
 
 			s := startServeWAFWith(t, "", map[string]string{metricsToken: token},
-				func(server *servewaf.Server) { server.ReadTimeout = readTimeout })
+				func(server *proxy.Server) { server.ReadTimeout = readTimeout })
 
 			conn := dial(t, s.addr)
 			sendQuestionWithPartOfItsBody(t, conn)
@@ -615,7 +615,7 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) {
 			// The id was not taken.
 			again := s.question(siteA, client, "/")
 			again.Header.Set(requestIDHeader, "an-id")
-			wantDisposition(t, do(t, again), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, again), http.StatusOK, proxy.DispositionAllow)
 		})
 	}
 }
@@ -632,7 +632,7 @@ func TestQuestionDeniedGetsTheBanResponse(t *testing.T) {
 			})
 
 			got := s.ask(client, "/")
-			wantDisposition(t, got, status, servewaf.DispositionDeny)
+			wantDisposition(t, got, status, proxy.DispositionDeny)
 			wantBody(t, got, http.StatusText(status)+"\n")
 			wantLine(t, s.out.requestLine(t), status, requestlog.ActionDenied)
 		})
@@ -647,7 +647,7 @@ func TestBanResponseCloseIsAnAnswerOfItsOwn(t *testing.T) {
 	})
 
 	got := s.ask(client, "/")
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionClose)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionClose)
 	wantBody(t, got, "")
 	// The visitor is sent nothing.
 	wantLine(t, s.out.requestLine(t), 0, requestlog.ActionDenied)
@@ -664,12 +664,12 @@ func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(t *testing.T) {
 	})
 
 	got := s.ask(client, "/blocked")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
 		requestlog.ActionRuleBlocked)
 
 	got = s.ask(client, "/.env")
-	wantDisposition(t, got, http.StatusTooManyRequests, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusTooManyRequests, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLines(t, 2)[1], http.StatusTooManyRequests,
 		requestlog.ActionBanned)
 }
@@ -681,17 +681,15 @@ func TestQuestionUnderTheOwnPrefixIsDeniedWith404AfterTheChecks(t *testing.T) {
 		metricsToken: token, denyNets: otherClient,
 	})
 
-	for _, path := range []string{
+	for _, path := range []string{proxy.HealthPath, proxy.MetricsPath, proxy.ReportPath} {
-		servewaf.HealthPath, servewaf.MetricsPath, servewaf.ReportPath,
-	} {
 		got := s.ask(client, path)
-		wantDisposition(t, got, http.StatusNotFound, servewaf.DispositionDeny)
+		wantDisposition(t, got, http.StatusNotFound, proxy.DispositionDeny)
 	}
 
 	wantLine(t, s.out.requestLine(t), http.StatusNotFound, requestlog.ActionAdmin)
 
-	got := s.ask(otherClient, servewaf.MetricsPath)
+	got := s.ask(otherClient, proxy.MetricsPath)
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
@@ -700,7 +698,7 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{mode: observe, denyNets: client})
 
 	got := s.ask(client, "/")
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, http.StatusOK, requestlog.ActionForward)
@@ -716,7 +714,7 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) {
 
 	for range 2 {
 		got := s.ask(client, "/blocked")
-		wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+		wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	}
 
 	lines := s.out.requestLines(t, 2)
@@ -735,7 +733,7 @@ func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) {
 
 	for range 2 {
 		got := s.ask(client, "/blocked")
-		wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+		wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 	}
 
 	lines := s.out.requestLines(t, 2)
@@ -764,7 +762,7 @@ func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) {
 			})
 
 			got := s.ask(fromDE, "/")
-			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 			asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 			if asn != tc.wantASN || country != tc.wantCountry {
@@ -789,7 +787,7 @@ func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) {
 	}
 
 	// 100 bytes are over the limit of 99.
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 	})
@@ -813,7 +811,7 @@ func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) {
 	}
 
 	got = s.ask(client, "/")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) {
@@ -827,10 +825,10 @@ func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) {
 	})
 
 	s.passedOn(fromKP)
-	wantDisposition(t, s.ask(fromKP, "/"), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, s.ask(fromKP, "/"), http.StatusOK, proxy.DispositionAllow)
 
 	s.passedOn(fromDE)
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing.T) {
@@ -848,7 +846,7 @@ func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing
 		t.Errorf("anomaly counters %v before the report, want none", counters)
 	}
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 	})
@@ -876,7 +874,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) {
 	s.allowed(client)
 
 	denied := s.question(siteA, client, "/")
-	wantDisposition(t, do(t, denied), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, do(t, denied), http.StatusForbidden, proxy.DispositionDeny)
 
 	counters := s.server.Anomalies.Snapshot()
 	if len(counters) != 1 || counters[0].Minute.Current != 1 {
@@ -893,7 +891,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) {
 
 	wantMetric(t, s.metrics(), series, 1)
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: denied.Header.Get(requestIDHeader), Status: http.StatusForbidden,
 		ResponseBytes: 1000, DurationTotal: 2,
 	})
@@ -926,7 +924,7 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) {
 	wantMetric(t, metrics, `smallwebwaf_requests_in_flight{instance="`+alertInstance+`"}`,
 		1) // the scrape itself
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 		DurationTotal: 5, DurationUpstreamTotal: 4,
@@ -944,7 +942,7 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) {
 	// check needs a server that has not been scraped yet.
 	unscraped := startServeWAF(t, "", map[string]string{metricsToken: token})
 
-	got = unscraped.report(servewaf.Report{
+	got = unscraped.report(proxy.Report{
 		RequestID: unscraped.allowed(client), Status: http.StatusBadGateway, DurationTotal: 5,
 	})
 	wantStatus(t, got, http.StatusNoContent)
@@ -957,7 +955,7 @@ func TestReportForARequestNotHeldIsIgnored(t *testing.T) {
 
 	s := startServeWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit})
 
-	got := s.report(servewaf.Report{RequestID: "no-such-request", ResponseBytes: 1000})
+	got := s.report(proxy.Report{RequestID: "no-such-request", ResponseBytes: 1000})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if clients := s.server.Limiter.Snapshot(); len(clients) != 0 {
@@ -974,7 +972,7 @@ func TestReportForARequestNotHeldIsIgnored(t *testing.T) {
 	// A second report of the same request does not count it twice.
 	id := s.allowed(client)
 	for range 2 {
-		got = s.report(servewaf.Report{RequestID: id, ResponseBytes: answerBytes})
+		got = s.report(proxy.Report{RequestID: id, ResponseBytes: answerBytes})
 		wantStatus(t, got, http.StatusNoContent)
 	}
 
@@ -1162,7 +1160,7 @@ func TestBytesAtTheirMostEachWayBanRatherThanOverflow(t *testing.T) {
 
 	s := startServeWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit})
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: s.allowed(client), Status: http.StatusOK,
 		RequestBytes: reportedBytesLimit, ResponseBytes: reportedBytesLimit,
 	})
@@ -1247,9 +1245,9 @@ func TestReportWritesTheLastLineWithTheDecisionsAndTheReportsFields(t *testing.T
 	req.Header.Set("X-Forwarded-Proto", "https")
 	id := req.Header.Get(requestIDHeader)
 
-	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 
-	got := s.report(servewaf.Report{
+	got := s.report(proxy.Report{
 		RequestID: id, Status: http.StatusCreated,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
 		DurationTotal: 12.5, DurationUpstreamTotal: 10.25,
@@ -1296,7 +1294,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 			"close", map[string]string{denyNets: client, banResponse: banResponseClose}, "/",
 			0, requestlog.ActionDenied,
 		},
-		{"own prefix", nil, servewaf.HealthPath, http.StatusNotFound, requestlog.ActionAdmin},
+		{"own prefix", nil, proxy.HealthPath, http.StatusNotFound, requestlog.ActionAdmin},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -1307,7 +1305,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 			id := req.Header.Get(requestIDHeader)
 			do(t, req)
 
-			got := s.report(servewaf.Report{
+			got := s.report(proxy.Report{
 				RequestID: id, Status: tc.status, ResponseBytes: 8, DurationTotal: 3,
 			})
 			wantStatus(t, got, http.StatusNoContent)
@@ -1343,18 +1341,18 @@ func TestOldestAnsweredRequestIsDroppedPastTheBound(t *testing.T) {
 			t.Fatalf("question: %v", err)
 		}
 
-		wantDisposition(t, readAnswer(res), http.StatusOK, servewaf.DispositionAllow)
+		wantDisposition(t, readAnswer(res), http.StatusOK, proxy.DispositionAllow)
 	}
 
 	// The table is full again with next and those, without oldest.
-	got := s.report(servewaf.Report{RequestID: oldest, ResponseBytes: answerBytes})
+	got := s.report(proxy.Report{RequestID: oldest, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if counted := s.history().Requests; counted != 0 {
 		t.Errorf("history holds %d requests, want the dropped one not counted", counted)
 	}
 
-	got = s.report(servewaf.Report{RequestID: next, ResponseBytes: answerBytes})
+	got = s.report(proxy.Report{RequestID: next, ResponseBytes: answerBytes})
 	wantStatus(t, got, http.StatusNoContent)
 
 	if counted := s.history().Requests; counted != 1 {
@@ -1368,10 +1366,10 @@ func TestBanMadeThroughOneHostRefusesTheClientOnAnother(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{rulesDir: writeRules(t, testRules)})
 
 	got := do(t, s.question(siteA, client, "/.env"))
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	got = do(t, s.question(siteB, client, "/"))
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
 	if lines[0].Host != siteA || lines[1].Host != siteB {
@@ -1397,7 +1395,7 @@ func TestRequestsOnEverySiteCountTowardOneSetOfLimits(t *testing.T) {
 	s.allowed(client)
 
 	got := do(t, s.question(siteB, client, "/"))
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 }
 
 func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) {
@@ -1412,13 +1410,13 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) {
 		path, authorization string
 		want                int
 	}{
-		{servewaf.HealthPath, "", http.StatusOK},
+		{proxy.HealthPath, "", http.StatusOK},
-		{servewaf.MetricsPath, bearer, http.StatusOK},
+		{proxy.MetricsPath, bearer, http.StatusOK},
-		{servewaf.MetricsPath, "", http.StatusUnauthorized},
+		{proxy.MetricsPath, "", http.StatusUnauthorized},
-		{servewaf.BansPath, adminBearer, http.StatusOK},
+		{proxy.BansPath, adminBearer, http.StatusOK},
-		{servewaf.BansPath, "", http.StatusUnauthorized},
+		{proxy.BansPath, "", http.StatusUnauthorized},
-		{servewaf.ClientsPath + client, adminBearer, http.StatusOK},
+		{proxy.ClientsPath + client, adminBearer, http.StatusOK},
-		{servewaf.ReportPath, "", http.StatusNotFound},
+		{proxy.ReportPath, "", http.StatusNotFound},
 		{"/_smallwebwaf/other", "", http.StatusNotFound},
 		{"/", "", http.StatusNotFound},
 	} {
@@ -1431,9 +1429,9 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) {
 		req.Header.Set("Authorization", tc.authorization)
 
 		if strings.HasPrefix(tc.path, "/_smallwebwaf/") {
-			wantDisposition(t, do(t, req), http.StatusNotFound, servewaf.DispositionDeny)
+			wantDisposition(t, do(t, req), http.StatusNotFound, proxy.DispositionDeny)
 		} else {
-			wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+			wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 		}
 	}
 }
@@ -1443,11 +1441,10 @@ func TestOwnEndpointsLinesDoNotSayWhichOfTheTwoTheyAre(t *testing.T) {
 
 	s := startServeWAF(t, "", nil)
 
-	wantStatus(t, get(t, s.addr, servewaf.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, s.addr, proxy.HealthPath), http.StatusOK)
 
 	line := s.out.requestLine(t)
-	if _, there := line.fields["servewaf_line"]; there ||
+	if _, there := line.fields["servewaf_line"]; there || line.Path != proxy.HealthPath {
-		line.Path != servewaf.HealthPath {
 		t.Errorf("the health check's log line is %+v", line.fields)
 	}
 }
@@ -1459,12 +1456,12 @@ func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) {
 
 	req := s.questionWith(http.MethodPost, siteA, client, "/",
 		strings.NewReader("a body"))
-	req.Header.Set(servewaf.ContentLengthHeader, "1073741824")
+	req.Header.Set(proxy.ContentLengthHeader, "1073741824")
 	req.Header.Set(forwardedFor, otherClient)
 	req.Header.Set("X-Long", strings.Repeat("x", 40<<10))
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.ClientIP != client || line.ContentLength != 1<<30 {
@@ -1532,7 +1529,7 @@ carried     header:Content-Length                block  ^6$
 			strings.NewReader("a body"))
 
 		if tc.announced != "" {
-			req.Header.Set(servewaf.ContentLengthHeader, tc.announced)
+			req.Header.Set(proxy.ContentLengthHeader, tc.announced)
 		}
 
 		wantStatus(t, do(t, req), tc.want)
@@ -1550,19 +1547,19 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) {
 		req := s.questionWith(http.MethodPost, siteA, client, "/",
 			strings.NewReader(body))
 		req.Header.Set("Content-Type", contentType)
-		req.Header.Set(servewaf.ContentLengthHeader, "100000")
+		req.Header.Set(proxy.ContentLengthHeader, "100000")
 
 		return do(t, req)
 	}
 
 	got := ask(formData, "id=1'%20OR%20'1'='1")
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	// The first 64 KiB of a longer JSON body cannot be parsed, which is no
 	// attack, so the Core Rule Set does not read it.
-	cut := `{"text":"` + strings.Repeat("x", servewaf.QuestionBodyMaxBytes)
+	cut := `{"text":"` + strings.Repeat("x", proxy.QuestionBodyMaxBytes)
-	got = ask("application/json", cut[:servewaf.QuestionBodyMaxBytes])
+	got = ask("application/json", cut[:proxy.QuestionBodyMaxBytes])
-	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 }
 
 func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
@@ -1571,7 +1568,7 @@ func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{wafMode: block})
 
 	got := s.ask(client, sqlInjection)
-	wantDisposition(t, got, http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
 
 	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 1 || waiting[0].Event != alerts.EventWAFBlock ||
@@ -1586,7 +1583,7 @@ func TestReputationHitAlertNamesTheSite(t *testing.T) {
 	s := startServeWAF(t, "", map[string]string{blocklistURLs: dropURL})
 	loadLists(t, s.server, map[string][]string{dropURL: {client}})
 
-	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, servewaf.DispositionDeny)
+	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, proxy.DispositionDeny)
 
 	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit ||

internal/proxy/staticlists_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/proxy/trappaths_test.go

@@ -1,4 +1,4 @@
-package servewaf_test
+package proxy_test
 
 import (
 	"net/http"

internal/rproxy/limits_test.go

@@ -16,9 +16,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // post is the start of a POST whose headers end with what follows it.
@@ -71,11 +71,11 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestSize: tc.limit,
 			})
 
@@ -85,11 +85,11 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 				t.Errorf("answered %+v, want 413", got)
 			}
 
-			if asked := standIn.question(t); len(asked.body) != tc.asked {
+			if asked := servewaf.question(t); len(asked.body) != tc.asked {
 				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
 			}
 
-			report := standIn.report(t)
+			report := servewaf.report(t)
 			if report.Status != http.StatusRequestEntityTooLarge {
 				t.Errorf("report %+v, want status 413", report)
 			}
@@ -100,9 +100,9 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestSize: "1K",
 	})
 
@@ -132,12 +132,12 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 
 			var asked atomic.Bool
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				asked.Store(true)
 				greet(w, r)
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestSize: tc.limit,
 			})
 
@@ -165,12 +165,12 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("announced, is refused", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startServeWAF(t, allow)
+		servewaf := startServeWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
 			_, _ = io.WriteString(w, large)
 		})
-		addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 			maxResponseSize: "1K",
 		})
 
@@ -179,7 +179,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 			t.Errorf("answered %d, want 502", got.status)
 		}
 
-		if report := standIn.report(t); report.Status != http.StatusBadGateway {
+		if report := servewaf.report(t); report.Status != http.StatusBadGateway {
 			t.Errorf("report %+v, want status 502", report)
 		}
 	})
@@ -187,13 +187,13 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("not announced, is cut off", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startServeWAF(t, allow)
+		servewaf := startServeWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = io.WriteString(w, large[:1])
 			_ = http.NewResponseController(w).Flush()
 			_, _ = io.WriteString(w, large[1:])
 		})
-		addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 			maxResponseSize: "1K",
 		})
 
@@ -205,7 +205,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
 		}
 
-		report := standIn.report(t)
+		report := servewaf.report(t)
 		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
 			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
 		}
@@ -217,11 +217,11 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.
 
 	const announced = "2048"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseSize: "1K",
 	})
 
@@ -240,9 +240,9 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				setting: "off",
 			})
 
@@ -251,7 +251,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 				strings.NewReader("a body"))))
 
-			if got := get(t, addr, servewaf.HealthPath); got.status != http.StatusOK {
+			if got := get(t, addr, proxy.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
@@ -270,9 +270,9 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestTime: "500",
 			})
 
@@ -288,11 +288,11 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 				t.Errorf("line %v, want no disposition and 10 bytes", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -300,9 +300,9 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(100)+"some of it")
@@ -313,7 +313,7 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 		t.Errorf("line %v, want no answer and no disposition", line)
 	}
 
-	if len(standIn.questions) != 0 {
+	if len(servewaf.questions) != 0 {
 		t.Error("servewaf was asked")
 	}
 }
@@ -334,9 +334,9 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			conn := dial(t, addr)
 			send(t, conn, tc.request)
@@ -364,7 +364,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 				t.Errorf("line %v, want no answer and no disposition", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 		})
@@ -404,11 +404,11 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 		announced = 100 * questionBodyMaxBytes
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
-	_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+	_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
 	})
 
@@ -454,9 +454,9 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
-			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+			_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
 			})
 
@@ -484,9 +484,9 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
 	})
 
@@ -498,11 +498,11 @@ func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 		t.Errorf("status %d, want 408", status)
 	}
 
-	if asked := standIn.question(t); len(asked.body) != questionBodyMaxBytes {
+	if asked := servewaf.question(t); len(asked.body) != questionBodyMaxBytes {
 		t.Errorf("the question carries %d bytes", len(asked.body))
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusRequestTimeout {
+	if report := servewaf.report(t); report.Status != http.StatusRequestTimeout {
 		t.Errorf("report %+v, want status 408", report)
 	}
 }
@@ -553,8 +553,8 @@ func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
-	addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t),
+	addr, _ := startRProxy(t, servewaf.URL, startAppThatTakesNothing(t),
 		map[string]string{maxRequestTime: "3000"})
 
 	conn := dial(t, addr)
@@ -580,14 +580,14 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		<-release
 	})
 
 	t.Cleanup(func() { close(release) })
 
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "300",
 	})
 
@@ -596,7 +596,7 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 		t.Errorf("answered %d, want 504", got.status)
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusGatewayTimeout {
+	if report := servewaf.report(t); report.Status != http.StatusGatewayTimeout {
 		t.Errorf("report %+v, want status 504", report)
 	}
 }
@@ -607,7 +607,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 	const start = "the start"
 
 	release := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, start)
 		_ = http.NewResponseController(w).Flush()
@@ -619,7 +619,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 
 	// The time limit is long enough for a loaded host to pass on the start of the
 	// answer before it runs out.
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "3000",
 	})
 
@@ -642,7 +642,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 			res.StatusCode, body, err, start)
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusOK {
+	if report := servewaf.report(t); report.Status != http.StatusOK {
 		t.Errorf("report %+v, want the status the visitor got", report)
 	}
 }
@@ -656,7 +656,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		part := make([]byte, writeSize)
 
@@ -669,7 +669,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 	})
 	// The time limit is long enough for a loaded host to start passing on the
 	// answer before it runs out.
-	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "3000",
 	})
 
@@ -684,7 +684,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		t.Errorf("line %v, want status 200 and the answer cut off", line)
 	}
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
 		t.Errorf("report %+v, want status 200 and the answer cut off", report)
 	}
@@ -693,15 +693,15 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusBadGateway {
 		t.Errorf("answered %d, want 502", got.status)
 	}
 
-	if report := standIn.report(t); report.Status != http.StatusBadGateway {
+	if report := servewaf.report(t); report.Status != http.StatusBadGateway {
 		t.Errorf("report %+v, want status 502", report)
 	}
 }
@@ -709,11 +709,11 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
 	})
 
@@ -732,12 +732,12 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 
 	working := make(chan struct{})
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
 	})
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -773,7 +773,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 
 	const answer = "the end of a long answer"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		_ = http.NewResponseController(w).Flush()
@@ -782,7 +782,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 
 		_, _ = io.WriteString(w, answer)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "2000",
 	})
 
@@ -802,18 +802,18 @@ func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing
 		{"a deny", post, http.StatusForbidden},
 		{
 			"the health check",
-			"GET " + servewaf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			"GET " + proxy.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
 			// The time limit is long enough for a loaded host to read the first part of
 			// the body before it runs out.
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestTime: "3000",
 			})
 

internal/rproxy/question_test.go

@@ -12,11 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // questionBodyMaxBytes is the most of a body a question carries.
-const questionBodyMaxBytes = servewaf.QuestionBodyMaxBytes
+const questionBodyMaxBytes = proxy.QuestionBodyMaxBytes
 
 // chunked is the encoding of a body whose length the visitor did not announce.
 const chunked = "chunked"
@@ -29,9 +29,9 @@ const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
 func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
 
@@ -42,16 +42,16 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	req.Header.Set(forwardedForHeader, "198.51.100.1")
 	req.Header.Set(forwardedProtoHeader, "gopher")
 	req.Header.Set(requestIDHeader, "the-visitor's")
-	req.Header.Set(servewaf.ClientHeader, "198.51.100.2")
+	req.Header.Set(proxy.ClientHeader, "198.51.100.2")
-	req.Header.Set(servewaf.PeerHeader, "198.51.100.3")
+	req.Header.Set(proxy.PeerHeader, "198.51.100.3")
-	req.Header.Set(servewaf.ContentLengthHeader, "12345")
+	req.Header.Set(proxy.ContentLengthHeader, "12345")
 	// Go's client then sends no User-Agent, so that one in the question would be
 	// Go's own.
 	req.Header["User-Agent"] = nil
 
 	wantGreeting(t, visit(t, req))
 
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 	if asked.method != http.MethodDelete || asked.target != target ||
 		asked.host != site {
 		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
@@ -68,8 +68,8 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	want.Set(forwardedForHeader, "198.51.100.1")
 	want.Set(forwardedProtoHeader, "http")
 	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
-	want.Set(servewaf.ClientHeader, localhost)
+	want.Set(proxy.ClientHeader, localhost)
-	want.Set(servewaf.PeerHeader, localhost)
+	want.Set(proxy.PeerHeader, localhost)
 
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
 		t.Errorf("the question's headers are %v, want %v", asked.header, want)
@@ -93,14 +93,14 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			forwarded := make(chan http.Header, 1)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				forwarded <- r.Header.Clone()
 
 				greet(w, r)
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: tc.trusted,
 			})
 
@@ -109,9 +109,9 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			req.Header.Set(forwardedProtoHeader, "https")
 			wantGreeting(t, visit(t, req))
 
-			asked := standIn.question(t)
+			asked := servewaf.question(t)
-			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
+			if asked.header.Get(proxy.ClientHeader) != tc.client ||
-				asked.header.Get(servewaf.PeerHeader) != localhost ||
+				asked.header.Get(proxy.PeerHeader) != localhost ||
 				asked.header.Get(forwardedForHeader) != visitor ||
 				asked.header.Get(forwardedProtoHeader) != tc.proto {
 				t.Errorf("the question's headers are %v", asked.header)
@@ -157,9 +157,9 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32,10.0.0.0/8",
 			})
 
@@ -167,7 +167,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 			req.Header[forwardedForHeader] = tc.header
 			wantGreeting(t, visit(t, req))
 
-			if got := standIn.question(t).header.Get(servewaf.ClientHeader); got != tc.client {
+			if got := servewaf.question(t).header.Get(proxy.ClientHeader); got != tc.client {
 				t.Errorf("the question names %s, want %s", got, tc.client)
 			}
 		})
@@ -197,7 +197,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 				t.Parallel()
 
 				body := randomBytes(size)
-				standIn := startServeWAF(t, allow)
+				servewaf := startServeWAF(t, allow)
 				received := make(chan []byte, 1)
 				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 					whole, _ := io.ReadAll(r.Body)
@@ -205,7 +205,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 
 					greet(w, r)
 				})
-				addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+				addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
 				if !announced {
@@ -215,7 +215,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 
 				wantGreeting(t, visit(t, req))
 
-				asked := standIn.question(t)
+				asked := servewaf.question(t)
 				want := body[:min(size, questionBodyMaxBytes)]
 				wantQuestionBody(t, asked, want, size, announced)
 
@@ -223,7 +223,7 @@ func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 					t.Error("the app did not get the whole body")
 				}
 
-				if report := standIn.report(t); report.RequestBytes != int64(size) {
+				if report := servewaf.report(t); report.RequestBytes != int64(size) {
 					t.Errorf("report %+v, of %d bytes", report, size)
 				}
 			})
@@ -243,7 +243,7 @@ func wantQuestionBody(
 			len(want))
 	}
 
-	values := asked.header.Values(servewaf.ContentLengthHeader)
+	values := asked.header.Values(proxy.ContentLengthHeader)
 
 	if announced {
 		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
@@ -264,9 +264,9 @@ func wantQuestionBody(
 func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	// Far more announced than sent. Go's server does not wait for that much, so
 	// the answer comes at once.
@@ -278,7 +278,7 @@ func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 		t.Errorf("status %d, want servewaf's 403", status)
 	}
 
-	if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes {
+	if report := servewaf.report(t); report.RequestBytes != questionBodyMaxBytes {
 		t.Errorf("report %+v, want the first part's bytes", report)
 	}
 }
@@ -306,8 +306,8 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startServeWAF(t, deny)
+				servewaf := startServeWAF(t, deny)
-				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+				addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 				conn := dial(t, addr)
 				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
@@ -316,7 +316,7 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 					t.Errorf("status %d, want servewaf's 403", status)
 				}
 
-				asked := standIn.question(t)
+				asked := servewaf.question(t)
 				if string(asked.body) != tc.body ||
 					!slices.Equal(asked.transferEncoding, tc.encoding) {
 					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
@@ -334,11 +334,11 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
@@ -352,11 +352,11 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 				t.Errorf("line %v, want status 405 and no disposition", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -372,18 +372,18 @@ func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 			t.Parallel()
 
 			reached := make(chan string, 1)
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
-			addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusOK {
 				t.Errorf("answered %+v, want the app's 200", got)
 			}
 
-			if asked := standIn.question(t); asked.method != method {
+			if asked := servewaf.question(t); asked.method != method {
 				t.Errorf("servewaf was asked about %s", asked.method)
 			}
 
@@ -416,9 +416,9 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, allow)
+			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
-			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 			conn := dial(t, addr)
 			send(t, conn, request)
@@ -433,11 +433,11 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 				t.Errorf("line %v, want status 400 and no disposition", line)
 			}
 
-			if len(standIn.questions) != 0 {
+			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -447,9 +447,9 @@ func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
 
 	const host = "a%b"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: "+host+"\r\n\r\n")
@@ -458,7 +458,7 @@ func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
 		t.Errorf("status %d, want the app's 200", status)
 	}
 
-	if asked := standIn.question(t); asked.host != host {
+	if asked := servewaf.question(t); asked.host != host {
 		t.Errorf("asked about the host %q, want %q", asked.host, host)
 	}
 }
@@ -468,15 +468,15 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	const want = "http"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 
 	wantGreeting(t, get(t, addr, "/"))
 
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 	if got := asked.header.Get(forwardedProtoHeader); got != want {
 		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
 	}
@@ -497,9 +497,9 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
-			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
+			_, out, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32",
 			})
 
@@ -509,9 +509,9 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 
 			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 
-			asked := standIn.question(t)
+			asked := servewaf.question(t)
-			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
+			if asked.header.Get(proxy.ClientHeader) != tc.client ||
-				asked.header.Get(servewaf.PeerHeader) != tc.peer {
+				asked.header.Get(proxy.PeerHeader) != tc.peer {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 

internal/rproxy/request.go

@@ -16,9 +16,9 @@ import (
 	"sync/atomic"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
@@ -129,7 +129,7 @@ func (rq *request) readFirstPartOfBody() bool {
 	}
 
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
-	held, err := io.ReadAll(io.LimitReader(rq.body, servewaf.QuestionBodyMaxBytes))
+	held, err := io.ReadAll(io.LimitReader(rq.body, proxy.QuestionBodyMaxBytes))
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
@@ -384,7 +384,7 @@ func (rq *request) finish(ctx context.Context) {
 		return
 	}
 
-	report := &servewaf.Report{
+	report := &proxy.Report{
 		RequestID:     rq.id,
 		Status:        min(rq.out.status, reportStatusMax),
 		RequestBytes:  requestBytes,

internal/rproxy/rproxy.go

@@ -22,7 +22,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // How rproxy keeps connections to the app and to servewaf open between
@@ -85,7 +85,7 @@ func New(params Params) *Server {
 		transport:         newTransport(),
 		serveWAFTransport: newServeWAFTransport(),
 		reportURL: (&url.URL{
-			Scheme: backend.Scheme, Host: backend.Host, Path: servewaf.ReportPath,
+			Scheme: backend.Scheme, Host: backend.Host, Path: proxy.ReportPath,
 		}).String(),
 	}
 
@@ -166,7 +166,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
 
-	if r.Method == http.MethodGet && r.URL.Path == servewaf.HealthPath {
+	if r.Method == http.MethodGet && r.URL.Path == proxy.HealthPath {
 		rq.answerHealth()
 
 		return
@@ -199,9 +199,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq.noteAnswer(answer)
 
 	switch rq.disposition {
-	case servewaf.DispositionAllow:
+	case proxy.DispositionAllow:
 		rq.passToApp(r.Context())
-	case servewaf.DispositionClose:
+	case proxy.DispositionClose:
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)

internal/rproxy/rproxy_test.go

@@ -19,9 +19,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -54,7 +54,7 @@ const (
 
 // The headers the tests set and look at.
 const (
-	dispositionHeader    = servewaf.DispositionHeader
+	dispositionHeader    = proxy.DispositionHeader
 	forwardedForHeader   = "X-Forwarded-For"
 	forwardedProtoHeader = "X-Forwarded-Proto"
 	requestIDHeader      = "X-Request-ID"
@@ -70,9 +70,9 @@ const (
 
 // What the stand-in for servewaf answers.
 const (
-	dispositionAllow = servewaf.DispositionAllow
+	dispositionAllow = proxy.DispositionAllow
-	dispositionDeny  = servewaf.DispositionDeny
+	dispositionDeny  = proxy.DispositionDeny
-	dispositionClose = servewaf.DispositionClose
+	dispositionClose = proxy.DispositionClose
 	// deniedBody is the body of a deny.
 	deniedBody = "refused by servewaf"
 )
@@ -173,7 +173,7 @@ type serveWAF struct {
 	*httptest.Server
 
 	questions chan question
-	reports   chan servewaf.Report
+	reports   chan proxy.Report
 }
 
 // startServeWAF starts a stand-in for servewaf.
@@ -182,11 +182,11 @@ func startServeWAF(t *testing.T, answer http.HandlerFunc) *serveWAF {
 
 	s := &serveWAF{
 		questions: make(chan question, 10),
-		reports:   make(chan servewaf.Report, 10),
+		reports:   make(chan proxy.Report, 10),
 	}
 	s.Server = httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) == "" {
+			if r.Header.Get(proxy.ClientHeader) == "" {
 				s.takeReport(t, w, r)
 
 				return
@@ -213,10 +213,10 @@ func startServeWAF(t *testing.T, answer http.HandlerFunc) *serveWAF {
 func (s *serveWAF) takeReport(t *testing.T, w http.ResponseWriter, r *http.Request) {
 	t.Helper()
 
-	var report servewaf.Report
+	var report proxy.Report
 
 	err := json.NewDecoder(r.Body).Decode(&report)
-	if err != nil || r.Method != http.MethodPost || r.URL.Path != servewaf.ReportPath {
+	if err != nil || r.Method != http.MethodPost || r.URL.Path != proxy.ReportPath {
 		t.Errorf("%s %s is no report: %v", r.Method, r.URL.Path, err)
 	}
 
@@ -237,7 +237,7 @@ func (s *serveWAF) wantNoReport(t *testing.T) {
 }
 
 // report waits for a report.
-func (s *serveWAF) report(t *testing.T) servewaf.Report {
+func (s *serveWAF) report(t *testing.T) proxy.Report {
 	t.Helper()
 
 	select {
@@ -246,7 +246,7 @@ func (s *serveWAF) report(t *testing.T) servewaf.Report {
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 
-		return servewaf.Report{}
+		return proxy.Report{}
 	}
 }
 
@@ -273,7 +273,7 @@ func startServeWAFAnsweringReports(
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
 				answer(w, r)
 
 				return
@@ -498,7 +498,7 @@ func readStatus(t *testing.T, conn net.Conn) int {
 func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, r *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set(asnHeader, "AS64496")
 		w.Header().Set(countryHeader, "DE")
 		allow(w, r)
@@ -512,7 +512,7 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 		w.WriteHeader(http.StatusTeapot)
 		_, _ = io.WriteString(w, greeting)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
 
@@ -530,7 +530,7 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	}
 
 	received := <-seen
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 
 	if received.RequestURI != target || received.Host != site {
 		t.Errorf("the app saw %s for %s", received.RequestURI, received.Host)
@@ -557,14 +557,14 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	}
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
 
 		greet(w, r)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: "10.0.0.0/8",
 	})
 
@@ -602,14 +602,14 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
 
 		greet(w, r)
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 
@@ -641,12 +641,12 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		_, _ = io.WriteString(w, "<html>")
 	})
-	_, _, server := startServer(t, standIn.URL, app.URL, nil)
+	_, _, server := startServer(t, servewaf.URL, app.URL, nil)
 
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	w := httptest.NewRecorder()
@@ -704,11 +704,11 @@ func TestRemovesTheVisitorsLookupHeadersWhenServeWAFGivesNone(t *testing.T) {
 func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusForbidden || got.body != deniedBody ||
@@ -720,7 +720,7 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 		t.Errorf("the visitor got %s", dispositionHeader)
 	}
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != http.StatusForbidden ||
 		report.ResponseBytes != int64(len(deniedBody)) ||
 		report.DurationUpstreamTotal != 0 {
@@ -736,9 +736,9 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 func TestADeniedHeadKeepsServeWAFsContentLength(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, deny)
+	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
@@ -758,15 +758,15 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 	}{
 		{"a deny", "GET /" + host, deniedBody, http.StatusForbidden},
 		{"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest},
-		{"the health check", "GET " + servewaf.HealthPath + host, "ok\n", http.StatusOK},
+		{"the health check", "GET " + proxy.HealthPath + host, "ok\n", http.StatusOK},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			log := heldLog{release: make(chan struct{})}
-			standIn := startServeWAF(t, deny)
+			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
-			addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard)
+			addr, _ := startServerLogging(t, servewaf.URL, app.URL, nil, log, io.Discard)
 
 			t.Cleanup(func() { close(log.release) })
 
@@ -794,9 +794,9 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -817,14 +817,14 @@ func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(dispositionHeader, dispositionClose)
 		w.WriteHeader(http.StatusOK)
 	})
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
@@ -835,7 +835,7 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 			text, err)
 	}
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != 0 || report.ResponseBytes != 0 {
 		t.Errorf("report %+v, of a visitor sent nothing", report)
 	}
@@ -935,7 +935,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+				servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 					if tc.disposition != "" {
 						w.Header().Set(dispositionHeader, tc.disposition)
 					}
@@ -947,7 +947,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
 					t.Error("the app was asked")
 				})
-				addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 					defaultDisposition: setting,
 				})
 
@@ -977,11 +977,11 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadRequest {
 		t.Errorf("answered %+v, want servewaf's 400", got)
@@ -991,18 +991,18 @@ func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 		t.Errorf("line %v, want no disposition", line)
 	}
 
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = io.WriteString(w, "<html>broken")
 	})
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
 	if contentType, sent := got.header["Content-Type"]; sent {
@@ -1015,11 +1015,11 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	const size = 1 << 20
 
-	standIn := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
-	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusInternalServerError || len(got.body) != size {
@@ -1135,15 +1135,15 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, overOneMiB(dispositionDeny))
+	servewaf := startServeWAF(t, overOneMiB(dispositionDeny))
-	addr, out := startRProxy(t, standIn.URL, nowhere, nil)
+	addr, out := startRProxy(t, servewaf.URL, nowhere, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
 		t.Errorf("answered %+v, want 502", got)
 	}
 
 	out.requestLine(t)
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
@@ -1199,20 +1199,20 @@ func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
 		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+			servewaf := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 				<-r.Context().Done()
 			})
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
-			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				timeoutSetting:     "60000",
 				defaultDisposition: disposition,
 			})
 
 			conn := dial(t, addr)
 			send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
-			standIn.question(t)
+			servewaf.question(t)
 
 			_ = conn.Close()
 
@@ -1226,7 +1226,7 @@ func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
 				t.Error("rproxy warned that servewaf gave no answer")
 			}
 
-			standIn.wantNoReport(t)
+			servewaf.wantNoReport(t)
 		})
 	}
 }
@@ -1244,17 +1244,17 @@ func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
 func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+	servewaf := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
 	})
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		timeoutSetting: "200",
 	})
 
 	wantGreeting(t, get(t, addr, "/"))
 	out.requestLine(t)
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
@@ -1274,25 +1274,25 @@ func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
 func TestHealthCheckIsAnsweredWhileServeWAFIsDown(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
-	got := get(t, addr, servewaf.HealthPath)
+	got := get(t, addr, proxy.HealthPath)
 	if got.status != http.StatusOK || got.body != "ok\n" {
 		t.Errorf("answered %+v, want ok", got)
 	}
 
 	line := out.requestLine(t)
-	if line["path"] != servewaf.HealthPath || line["disposition"] != nil {
+	if line["path"] != proxy.HealthPath || line["disposition"] != nil {
 		t.Errorf("line %v, want one with no disposition", line)
 	}
 
 	// With servewaf up too, it is not asked.
-	addr, _ = startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ = startRProxy(t, servewaf.URL, app.URL, nil)
-	get(t, addr, servewaf.HealthPath)
+	get(t, addr, proxy.HealthPath)
 
-	if len(standIn.questions) != 0 {
+	if len(servewaf.questions) != 0 {
 		t.Error("servewaf was asked about the health check")
 	}
 }
@@ -1396,15 +1396,15 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out, server := startServer(t, standIn.URL, app.URL, nil)
+	addr, out, server := startServer(t, servewaf.URL, app.URL, nil)
 
 	server.WaitForReports()
 
 	wantGreeting(t, get(t, addr, "/"))
 	out.requestLine(t)
-	standIn.wantNoReport(t)
+	servewaf.wantNoReport(t)
 }
 
 func TestReportGivesWhatHappened(t *testing.T) {
@@ -1412,14 +1412,14 @@ func TestReportGivesWhatHappened(t *testing.T) {
 
 	const body = "the visitor's body"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 		strings.NewReader(body))))
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 
 	if report.RequestID == "" || report.Status != http.StatusOK ||
 		report.RequestBytes != int64(len(body)) ||
@@ -1442,7 +1442,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
 				allow(w, r)
 
 				return
@@ -1497,9 +1497,9 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 	t.Parallel()
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, echoAfterUpgrade)
-	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime:  "2000",
 		maxResponseTime: "2000",
 	})
@@ -1535,7 +1535,7 @@ func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 
 	_ = conn.Close()
 
-	report := standIn.report(t)
+	report := servewaf.report(t)
 	if report.Status != http.StatusSwitchingProtocols ||
 		report.RequestBytes != int64(len(message)) ||
 		report.ResponseBytes != int64(len(message)) {
@@ -1552,7 +1552,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 
 	const goodbye = "sent after the visitor stopped sending\n"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1572,7 +1572,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 		_, _ = buffered.WriteString(goodbye)
 		_ = buffered.Flush()
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
@@ -1610,7 +1610,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 //nolint:paralleltest // see above
 func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 	closed := make(chan error, 1)
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1633,7 +1633,7 @@ func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 		_, err = buffered.ReadByte()
 		closed <- err
 	})
-	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
@@ -1681,9 +1681,9 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 
 	const fromTraefik = "an-id-from-traefik"
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 
@@ -1694,7 +1694,7 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 		req.Header.Set(requestIDHeader, fromTraefik)
 		wantGreeting(t, visit(t, req))
 
-		ids = append(ids, standIn.question(t).header.Get(requestIDHeader))
+		ids = append(ids, servewaf.question(t).header.Get(requestIDHeader))
 	}
 
 	if slices.Contains(ids, fromTraefik) || ids[0] == "" || ids[0] == ids[1] {
@@ -1711,16 +1711,16 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 		body  = "the visitor's body"
 	)
 
-	standIn := startServeWAF(t, allow)
+	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 
 	req := newRequest(t, http.MethodPost, addr, path+"?"+query, strings.NewReader(body))
 	req.Host = site
 	wantGreeting(t, visit(t, req))
 
 	line := out.requestLine(t)
-	asked := standIn.question(t)
+	asked := servewaf.question(t)
 
 	for name, want := range map[string]any{
 		"type":           "request",

internal/rproxy/servewaf.go

@@ -11,7 +11,7 @@ import (
 	"net/http"
 	"strings"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // answerBodyMaxBytes is the most of the body of servewaf's answer that is read.
@@ -38,10 +38,10 @@ type servewafAnswer struct {
 // notes nothing, and no report is due for it: servewaf holds no decision to report
 // on.
 func (rq *request) noteAnswer(answer *servewafAnswer) {
-	disposition := answer.header.Get(servewaf.DispositionHeader)
+	disposition := answer.header.Get(proxy.DispositionHeader)
 
 	switch disposition {
-	case servewaf.DispositionAllow, servewaf.DispositionDeny, servewaf.DispositionClose:
+	case proxy.DispositionAllow, proxy.DispositionDeny, proxy.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
@@ -74,7 +74,7 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
 
-		if rq.disposition == servewaf.DispositionAllow {
+		if rq.disposition == proxy.DispositionAllow {
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
@@ -169,13 +169,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	question.TransferEncoding = in.TransferEncoding
 
 	question.Header = in.Header.Clone()
-	question.Header.Set(servewaf.ClientHeader, rq.client.String())
+	question.Header.Set(proxy.ClientHeader, rq.client.String())
-	question.Header.Set(servewaf.PeerHeader, rq.peer.String())
+	question.Header.Set(proxy.PeerHeader, rq.peer.String())
-	question.Header.Del(servewaf.ContentLengthHeader)
+	question.Header.Del(proxy.ContentLengthHeader)
 
 	announced := in.Header.Get("Content-Length")
 	if announced != "" {
-		question.Header.Set(servewaf.ContentLengthHeader, announced)
+		question.Header.Set(proxy.ContentLengthHeader, announced)
 	}
 
 	question.Header.Set(requestIDHeader, rq.id)
@@ -196,7 +196,7 @@ func (rq *request) answerWith(answer *servewafAnswer) {
 
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
-	header.Del(servewaf.DispositionHeader)
+	header.Del(proxy.DispositionHeader)
 
 	// Go's server adds a Content-Type it guesses from the body to a response whose
 	// headers have no Content-Type key. The key with no value sends none.
@@ -210,7 +210,7 @@ func (rq *request) answerWith(answer *servewafAnswer) {
 // sendReport sends servewaf report on a goroutine of its own, so that the
 // visitor does not wait for it. The report goes on after ctx, the request's own
 // context, has ended.
-func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
+func (h *handler) sendReport(ctx context.Context, report *proxy.Report) {
 	h.reportsMu.Lock()
 	defer h.reportsMu.Unlock()
 
@@ -228,7 +228,7 @@ func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
 
 // postReport posts report to servewaf, and waits for its answer for up to
 // SWRP_TIMEOUT_MS.
-func (h *handler) postReport(ctx context.Context, report *servewaf.Report) error {
+func (h *handler) postReport(ctx context.Context, report *proxy.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {
 		return fmt.Errorf("encode the report: %w", err)

internal/smallwebwaf/healthcheck.go

@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 
 // healthCheckTimeout bounds the whole health check.
@@ -107,7 +107,7 @@ func checkRProxyAndApp(
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
-	health := "http://" + net.JoinHostPort("127.0.0.1", port) + servewaf.HealthPath
+	health := "http://" + net.JoinHostPort("127.0.0.1", port) + proxy.HealthPath
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody)
 	if err != nil {

internal/smallwebwaf/rproxy_test.go

@@ -19,7 +19,7 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -153,7 +153,7 @@ func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 
 	// One request's three lines carry one id, rproxy's with servewaf's answer.
 	line := firstOut.line(t, "path", bannedProbe)
-	if line["disposition"] != servewaf.DispositionDeny || line["client_ip"] != placed {
+	if line["disposition"] != proxy.DispositionDeny || line["client_ip"] != placed {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
@@ -225,7 +225,7 @@ func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 
 	line := out.line(t, "path", "/after-stop")
-	if line["disposition"] != servewaf.DispositionAllow ||
+	if line["disposition"] != proxy.DispositionAllow ||
 		line["default_disposition"] != true {
 		t.Errorf("rproxy's line is %v", line)
 	}
@@ -318,7 +318,7 @@ func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
 	const smuggledID = "smuggled-request"
 
 	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
-		servewaf.ClientHeader + ": " + otherClient + "\r\n" +
+		proxy.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 
 	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
@@ -459,10 +459,10 @@ func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	protocols := make(chan string, 10)
 	backend := httptest.NewUnstartedServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
 				protocols <- r.Proto
 
-				w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionDeny)
+				w.Header().Set(proxy.DispositionHeader, proxy.DispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
 			}
 		}))
@@ -532,8 +532,8 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(servewaf.ClientHeader) != "" {
+			if r.Header.Get(proxy.ClientHeader) != "" {
-				w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionAllow)
+				w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 
 				return
 			}
@@ -640,7 +640,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set(servewaf.DispositionHeader, servewaf.DispositionAllow)
+			w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 
@@ -757,7 +757,7 @@ func TestMainRunsRProxy(t *testing.T) {
 	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
-		"http://"+addr+servewaf.HealthPath, http.NoBody)
+		"http://"+addr+proxy.HealthPath, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}

internal/smallwebwaf/servewaf_test.go

@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -67,7 +67,7 @@ func TestMainRunsServeWAF(t *testing.T) {
 	})
 
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	ask(t, addr, "/", http.StatusOK, servewaf.DispositionAllow)
+	ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
 
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
@@ -132,7 +132,7 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 		t.Fatalf("new request: %v", err)
 	}
 
-	req.Header.Set(servewaf.ClientHeader, placed)
+	req.Header.Set(proxy.ClientHeader, placed)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}
@@ -147,9 +147,9 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 	_ = res.Body.Close()
 
 	if res.StatusCode != status ||
-		res.Header.Get(servewaf.DispositionHeader) != disposition {
+		res.Header.Get(proxy.DispositionHeader) != disposition {
 		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
-			res.Header.Get(servewaf.DispositionHeader), status, disposition)
+			res.Header.Get(proxy.DispositionHeader), status, disposition)
 	}
 }
 
@@ -193,12 +193,12 @@ func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 	}
 
 	runServeWAF(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusOK, servewaf.DispositionAllow)
+		ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
 		// The default rule file bans a probe for this.
-		ask(t, addr, "/.env", http.StatusForbidden, servewaf.DispositionDeny)
+		ask(t, addr, "/.env", http.StatusForbidden, proxy.DispositionDeny)
 	})
 
 	runServeWAF(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusForbidden, servewaf.DispositionDeny)
+		ask(t, addr, "/", http.StatusForbidden, proxy.DispositionDeny)
 	})
 }

internal/smallwebwaf/smallwebwaf.go

@@ -23,11 +23,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
@@ -190,7 +190,7 @@ func RunServeWAF(ctx context.Context, params Params) int {
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
-) (*servewaf.Server, error) {
+) (*proxy.Server, error) {
 	var lookupFile *lookup.File
 
 	if cfg.LookupSource == "file" {
@@ -207,7 +207,7 @@ func newServer(
 		}
 	}
 
-	server := servewaf.New(servewaf.Params{
+	server := proxy.NewServeWAF(proxy.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -230,7 +230,7 @@ func newServer(
 // loadStateFiles reads the state files into the parts of server and into
 // alertQueue, as state.Load does.
 func loadStateFiles(
-	cfg *config.Config, server *servewaf.Server, alertQueue *alerts.Queue,
+	cfg *config.Config, server *proxy.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
@@ -316,7 +316,7 @@ func startSending(
 // shutdownTimeout to finish, and writes every state file, alerts.json with
 // the alerts still waiting.
 func serve(
-	ctx context.Context, server *servewaf.Server, listener net.Listener,
+	ctx context.Context, server *proxy.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {

internal/smallwebwaf/smallwebwaf_test.go

@@ -20,7 +20,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
-	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -1627,7 +1627,7 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
-	req.Header.Set(servewaf.ClientHeader, from)
+	req.Header.Set(proxy.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}