Docs: rproxy runs behind any TLS-terminating reverse proxy (closes #388)

README, SPEC and docs no longer present traefik as the required front
proxy, and call it the TLS-terminating proxy. The README section of that
name lists what the proxy must do: forward plain HTTP to port 8080, keep
Host, set X-Forwarded-For and X-Forwarded-Proto, close an unused
connection in under 120 seconds, and connect from an address in
SWW_RPROXY_TRUSTED_PROXIES. traefik, Caddy and nginx appear as examples,
with the Caddy and nginx settings their defaults lack.

Model: opus-5-5

Dockerfile

@@ -161,20 +161,6 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
 
-# The image's own labels, in place of the ones it would inherit from
-# Ubuntu's. script/docker and script/cibuild pass the build arguments;
-# a build that passes none labels the image unknown rather than leave
-# Ubuntu's values.
-ARG VERSION=unknown
-ARG CREATED=unknown
-ARG REVISION=unknown
-LABEL org.opencontainers.image.title="smallwebwaf" \
-    org.opencontainers.image.description="A web application firewall for self-hosted web apps: sww rproxy in front of an app, and sww waf, which decides." \
-    org.opencontainers.image.version="${VERSION}" \
-    org.opencontainers.image.created="${CREATED}" \
-    org.opencontainers.image.revision="${REVISION}" \
-    org.opencontainers.image.source="https://git.eeqj.de/sneak/smallwebwaf"
-
 # runit's install creates its _runit-log user with minsysusers, which
 # reads this file in place of runit's /usr/lib/sysusers.d/runit.conf.
 # runit's line leaves out the shell, and minsysusers prints a Perl

README.md

@@ -2,20 +2,7 @@
 
 `smallwebwaf` is an MIT-licensed web application firewall, written in Go by
 [@sneak](https://sneak.berlin), for self-hosted web apps. It refuses the
-requests of misbehaving scrapers, scanners and other abusers before they reach
-an app.
-
-With the default settings, a client is banned when it does any of these:
-
-- makes more than 120 requests in a minute, 1500 in an hour or 6000 in a day;
-- moves more than `50G` of request and response bodies in an hour, or `100G` in
-  a day;
-- asks for a secret or backup file, such as `/.env` or `/.git/config`;
-- sends a user agent that names a security scanner, such as `sqlmap` or `nikto`;
-- has more than 30 requests in a minute refused as probes or attacks.
-
-A scraper that does none of these is left alone. A scraper that waits 15 seconds
-between requests stays under the rate limits.
+requests of scrapers, scanners and other abusers before they reach an app.
 
 ## What it does
 

deploy/example-app/Dockerfile

@@ -9,10 +9,6 @@
 ARG SWW_IMAGE=smallwebwaf
 FROM ${SWW_IMAGE}
 
-# Its own title and description, in place of the smallwebwaf image's.
-LABEL org.opencontainers.image.title="smallwebwaf-example-app" \
-    org.opencontainers.image.description="An example app built on the smallwebwaf image."
-
 # Packages the app needs, from the nixpkgs in the image.
 RUN nix-env -iA nixpkgs.busybox
 

script/cibuild

@@ -20,13 +20,8 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
-    revision="$(git rev-parse HEAD 2>/dev/null || true)"
-    [ -n "$revision" ] || revision="unknown"
-    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
-        --build-arg REVISION="$revision" \
-        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }
 

script/docker

@@ -16,13 +16,8 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
-    revision="$(git rev-parse HEAD 2>/dev/null || true)"
-    [ -n "$revision" ] || revision="unknown"
-    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
-        --build-arg REVISION="$revision" \
-        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }