A client that stops sending after the app answers is timed out (closes #130 )

When the app answered before the client had sent its whole body, and its answer ended with its last bytes, every timeout was stopped, SWWAF_CLIENT_REQUEST_TIMEOUT included. The transport went on waiting to read the body, and Go's server cannot send the answer until that read returns, so a client that stopped sending held the request until it closed the connection. The timeouts now run on until the client has sent its body, as they do before the app answers: once SWWAF_CLIENT_REQUEST_TIMEOUT runs out the client is sent the app's answer, the connection is closed, and the log line says timed_out. Model: opus-5-5
2026-10-14 17:11:53 +00:00
73 changed files with 4147 additions and 13534 deletions
@@ -140,14 +140,10 @@ RUN mkdir /etc/sysusers.d \
 # apt also fetches the live archive's InRelease files, which change daily
 # and which the install does not use. The snapshot service is HTTPS only
 # and this image has no CA certificates yet, so this step uses the Go
-# image's. The snapshot service answers 503 at times; apt retries a
+# image's.
 # failed download, waiting twice as long before each retry, and this
 # step gives it five retries, about half a minute in all, where its
 # default of three gives up after seven seconds.
 RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,target=/tmp/go-image-ca.crt \
    apt-get update --snapshot 20261001T000000Z \
        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
        -o Acquire::Retries=5 \
    && printf '%s\n' \
        '45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute_InRelease' \
        '802e675dd9de4c7f3916434a95e7c1d8eec0e82886622d7805ab19a2c6fe0365  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-updates_InRelease' \
@@ -157,7 +153,6 @@ RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,tar
    && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
        --snapshot 20261001T000000Z \
        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
        -o Acquire::Retries=5 \
        ca-certificates nix-bin runit \
    && rm -rf /var/lib/apt/lists/*
@@ -1,12 +1,11 @@
 .PHONY: bootstrap setup test lint fmt fmt-check tidy check docker hooks build \
-	run example-app gitea-requests
+	run example-app
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
 # of README.md). tidy writes go.mod and go.sum as `go mod tidy` does,
 # which test checks. build and run are for working on the code by hand;
-# example-app checks the image with an app built on it; gitea-requests
+# example-app checks the image with an app built on it.
 # reports the gitea requests the Core Rule Set refuses at the defaults.
 bootstrap:
 	@script/bootstrap
@@ -46,6 +45,3 @@ run:
 example-app:
 	@script/example-app
 gitea-requests:
 	@script/gitea-requests
@@ -1,8 +1,6 @@
 // Command smallwebwaf is a web application firewall for one app: it runs
-// between traefik and the app and passes requests through within its limits,
+// between traefik and the app, and passes requests through within its
-// or, as `smallwebwaf servewaf`, answers rproxy's questions about them, or, as
+// limits. Everything it does is in internal/smallwebwaf.
 // `smallwebwaf rproxy`, is the reverse proxy that asks those questions.
 // Everything it does is in internal/smallwebwaf.
 package main
 import (
@@ -1,59 +0,0 @@
 # Admin endpoints
 The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
 "Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
 and how their tokens work.
 - `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
 - `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
  [`metrics.md`](metrics.md)).
 - `GET /_smallwebwaf/bans`: every ban held, under `bans`, each as `bans.json`
  lists it. Needs `SWWAF_ADMIN_TOKEN`, as do the three below.
 - `POST /_smallwebwaf/bans`: bans a netblock. The body is a JSON object of
  `netblock`, `duration` and, if you like, `reason`. `netblock` is a netblock
  such as `203.0.113.0/24`, or a client's address, which bans its IPv4 netblock
  (`SWWAF_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration such
  as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying what is
  wrong:
    - one that is not such an object, or has another field;
    - one longer than 4 KiB;
    - one that names an IPv4-mapped netblock, or an address with a zone.
 - `DELETE /_smallwebwaf/bans/<client>`: lifts every active ban covering the
  address `<client>`. It answers `404` when none is active.
 - `GET /_smallwebwaf/clients/<ip>`: what `smallwebwaf` knows of the client.
  Under `client`, its counters and history as `clients.json` holds them, or
  `null` when `clients.json` does not hold it. Under `bans`, every ban covering
  the address, with its notes.
 ## Examples
 With `SWWAF_ADMIN_TOKEN` set, and the token in `$TOKEN`:
 ```sh
 # Every ban.
 curl -H "Authorization: Bearer $TOKEN" https://app.example/_smallwebwaf/bans
 # Ban 203.0.113.0/24 for seven days.
 curl -H "Authorization: Bearer $TOKEN" \
    --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
    https://app.example/_smallwebwaf/bans
 # Lift the bans on 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" -X DELETE \
    https://app.example/_smallwebwaf/bans/203.0.113.9
 # What smallwebwaf knows of 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" \
    https://app.example/_smallwebwaf/clients/203.0.113.9
 ```
 ## `servewaf`
 `smallwebwaf servewaf` answers these endpoints at its own address. No check runs
 on those requests (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).
 ## `rproxy`
 `smallwebwaf rproxy` answers only the health check, at its own address. It asks
 `servewaf` about any other request under `/_smallwebwaf/` (see "`rproxy`" in
 [`SPEC.md`](../SPEC.md)).
@@ -1,136 +0,0 @@
 # Alerts
 The alert events, the JSON object the webhook gets, and the messages Slack and
 ntfy get. "Alerting" in [`SPEC.md`](../SPEC.md) says when an alert is sent, held
 back or dropped.
 ## Events
 - `ban`: a ban `smallwebwaf` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
  a request.
 - `waf_block`: the Core Rule Set scored a request at or over the threshold. The
  request was refused unless the alert's `detail` gives `mode`: `detect` or
  `observe`.
 - `anomaly`: a count over an anomaly threshold.
 - `reputation_hit`: a request from a client on a blocklist, the CrowdSec
  decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
  One alert per source.
 - `source_failure`: one of:
    - GeoJS failing;
    - a list that cannot be fetched;
    - a DNS blocklist or AbuseIPDB failing or refusing a query;
    - the day's AbuseIPDB checks used up.
 - `file_error`: one of:
    - a rule file or state file edit with an error;
    - a state file that cannot be written;
    - a replacement lookup database that cannot be read.
 - `summary`: the hourly summary of alerts held back.
 ## The JSON object
 This is the alert for a ban for a broken rate limit, shown indented; it is sent
 on one line:
 ```json
 {
    "instance": "fsn1app1/gitea",
    "time": "2026-10-06T12:00:50.123461Z",
    "event": "ban",
    "client": "203.0.113.9",
    "netblock": "203.0.113.9/32",
    "asn": "",
    "as_name": "",
    "country": "",
    "reason": "requests per minute over the limit of 500",
    "detail": {
        "ban_expires": "2026-10-06T13:00:50.123Z",
        "cause": "limit",
        "notes": {
            "asn": "",
            "as_name": "",
            "country": "",
            "kind": "requests",
            "limit": 500,
            "window": "minute",
            "count": 501,
            "request": {
                "time": "2026-10-06T12:00:50.123456789Z",
                "method": "GET",
                "host": "app.example",
                "path": "/owner/repo/commits/branch/main?page=501",
                "status": 403,
                "user_agent": "scraper/1.0"
            },
            "requests": 501,
            "refused": 0,
            "earlier_bans": {
                "limit": 0,
                "attack": 0,
                "admin": 0,
                "crowdsec": 0
            }
        }
    },
    "suppressed_repeats": 0
 }
 ```
 - `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
  one of the events above.
 - `host`: the site of the request that raised the alert. Only `servewaf` sends
  this field, since it serves many sites, and not for `source_failure`,
  `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
  `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
  one of:
    - the ban's netblock;
    - the netblock an anomaly counted, empty in the `asn` and `total` scopes;
    - for the other events, the client as rate limiting counts it: an IPv4
      address as a /32, or an IPv6 group.
 - `asn`, `as_name` and `country`: the client's, as known when the alert was
  raised. They are empty when GeoJS had not answered yet.
 - `reason`: a short sentence, such as
  `requests per minute over the limit of 500` or `listed by a blocklist`.
 - `detail`: what is particular to the event:
    - for a ban, its `cause`, `ban_expires` and `notes` (the notes are listed
      under `bans.json` in [`state-files.md`](state-files.md));
    - for an anomaly, the `scope`, `window`, `kind`, `count` and `threshold`;
    - for a reputation hit, the `source` and, for AbuseIPDB, the `score`;
    - for a Core Rule Set match, the `rule_ids`, `score`, `method` and `path`;
    - for a source failure, the `source` and `error`;
    - for a file error, the `file` and `error`;
    - for a summary, the `hour` it covers, the `count` of alerts held back, and
      that count by event in `events`;
    - `mode`, when the request was not refused: `detect` or `observe`.
 - `suppressed_repeats`: how many repeats the cooldown held back before this
  alert.
 ## Slack and ntfy
 Slack and ntfy get a message with a title and a text. The title is the instance
 and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
 line for each of these that the alert has:
 - the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;
 - the suppressed repeats, if any.
 Slack gets the title in bold and the text below it, with `&`, `<` and `>`
 escaped. ntfy gets the text as the message, with these headers:
 - `Title`: the title;
 - `Authorization`: the token, as `Bearer <token>`, while
  `SWWAF_ALERT_NTFY_TOKEN` is set;
 - `Priority` and `Tags`: by event, as listed below.
 The priority and tag by event:
 - `ban`: priority `default`, tag `no_entry`.
 - `permanent_ban`: priority `high`, tag `no_entry`.
 - `waf_block`: priority `default`, tag `shield`.
 - `anomaly`: priority `high`, tag `chart_with_upwards_trend`.
 - `reputation_hit`: priority `low`, tag `label`.
 - `source_failure` and `file_error`: priority `high`, tag `warning`.
 - `summary`: priority `default`, tag `bar_chart`.
@@ -1,220 +0,0 @@
 # smallwebwaf in front of gitea
 These notes record what `smallwebwaf` does in front of gitea at the default
 settings. They are observations, not requirements; the requirements are in
 [`SPEC.md`](../SPEC.md). `script/gitea-requests` runs gitea behind the image and
 sends through it a sample of gitea's ordinary use and the requests named below.
 It reports each request the Core Rule Set refuses, so that these notes can be
 checked again when gitea or the Core Rule Set changes version.
 ## What the defaults cover
 - SSH access to gitea does not pass through `smallwebwaf` and is not protected
  by it.
 - A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the
  repository is large or the link slow. A repository whose clone is larger than
  1 GiB needs `SWWAF_RESPONSE_MAX_BYTES` raised, and the byte limits with it
  ("Byte limits, per client" in `SPEC.md`).
 - A push is a request, and so is every other upload:
    - a git push;
    - an LFS object;
    - a container image layer;
    - a package file;
    - a release attachment.
    At the defaults, an upload larger than 100 MiB or taking more than 60
    seconds is cut off ("Size and time limits" in `SPEC.md`). A gitea that takes
    large uploads needs `SWWAF_REQUEST_MAX_BYTES`,
    `SWWAF_CLIENT_REQUEST_TIMEOUT` and `SWWAF_UPSTREAM_REQUEST_TIMEOUT` raised
    to fit.
 - Archive download and blame or history pages are what scrapers hammer. The
  request limits do most of the work there.
 - An Actions runner that reaches gitea through `smallwebwaf` sends requests all
  day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
  43,200 requests a day. While it runs a job, it reports the job's log and state
  every second instead, two requests a second. So one runner busy all day sends
  120 requests a minute and 172,800 a day, under the request limits. Two such
  runners on one address, each busy all day, make 345,600 and pass the day limit
  of 300,000. Three busy at once make 21,600 an hour and pass the hour limit of
  20,000. Five busy at once make 600 a minute and pass the minute limit of 500.
  Their address is then banned, their running jobs fail, and each repeat within
  a day makes the ban longer. Newer runners ask for work less often. Put the
  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 ## What the Core Rule Set lets through
 At the defaults, the Core Rule Set lets gitea's ordinary use through, apart from
 the refusals in the next section:
 - browsing and views of files in a repository, with their history, blame and the
  file tree;
 - diffs, including their hidden lines and large files, and pull request review;
 - git's clone, fetch and push over HTTP;
 - signing in, including the return to the page a visitor came from, and sign-in
  with Git Credential Manager, git-credential-oauth or tea;
 - the API's calls for a file and its commits;
 - pushing and pulling container images and packages;
 - Actions runners, and artifacts uploaded with `actions/upload-artifact@v4`;
 - posting issues, pull requests, comments, wiki pages and files saved in the web
  editor, code included, since no body is read;
 - the page gitea shows after a change, with its message naming what was done.
 ## What the Core Rule Set still refuses
 Each refusal answers only that request ("Bans" in `SPEC.md` says what it counts
 toward). The request log names the rule in `waf_rule_ids`, which
 `SWWAF_WAF_DISABLED_RULES` can switch off.
 ### A query string that reads as an attack
 Most often this is a search. A search term is a query parameter, which the Core
 Rule Set checks against its lists of system files and commands (see the fourth
 change under "Attack detection" in `SPEC.md`). A release attachment uploaded
 through the API as `docker-compose.yml` is refused the same way. Examples:
 - a name on those lists, such as `package.json`, `.gitignore` or
  `docker-compose.yml`;
 - text that starts with a command name, such as `python3` or `ssh key`, or has
  one right after a `/` in its first word, such as `feat/docker-support`;
 - a shell command with its options or a system path (`ls -la`, `sed -i`,
  `/bin/sh`), or a command in backticks;
 - script code (`fetch(`, `${VAR}`, `process.env`), HTML (`<img src=`) or an SQL
  statement (`SELECT * FROM users WHERE`);
 - a URL naming an IP address or `localhost`.
 ### A branch, tag or file name that starts with a command name
 The Core Rule Set's list of commands (932260) holds names such as `docker-`,
 `python3`, `ansible`, `base64` and `whoami`. A query parameter holding a branch,
 tag or file name that starts with one is refused. So is one that has such a name
 right after a `/`, such as `feat/docker-support`, `fix/docker-build` or
 `renovate/docker-build-push-action-6.x`. gitea's own pages send the name in a
 query parameter that 930120, 932160 and 932260 still check:
 - `refSubUrl`, the branch or tag of a directory listing. A listing sends it when
  it asks for its entries' last commits in a second request. It does so whenever
  gitea takes more than a second to work them out;
 - `name`, when a branch is deleted or restored on the branches page;
 - `tag`, when a release is started from a tag;
 - `template`, the file of an issue template, when an issue is opened from it;
 - `rule_name`, when a branch protection rule is opened for editing in the
  repository's settings or has just been saved.
 What a visitor sees, for a branch named `docker-build`:
 - A directory listing that makes that second request leaves those last commits
  out and shows an error.
 - The branches page shows an error instead of deleting or restoring the branch.
 - A release started from such a tag gets the `403` answer of `smallwebwaf` in
  place of its form. So does an issue opened from such a template, and such a
  rule opened for editing.
 - Saving such a rule stores it. gitea then returns to the branch settings page,
  which gets the `403` answer, so the save looks as if it failed.
 ### A file name in a query parameter that trips the code rules
 The Core Rule Set's rules for Java, script, PowerShell and SQL find what they
 look for in some file names. This holds too in the ten query parameters that
 930120, 932160 and 932260 do not check (see the fourth change under "Attack
 detection" in `SPEC.md`). Examples:
 - `runtime` in OpenJDK's `src/java.base/share/classes/java/lang/Runtime.java`
  (944110);
 - a Java class, as in `java.lang.String.md` (944130);
 - `document.write.js` (941180);
 - `process.env.d.ts` (934100);
 - `__proto__` (934130);
 - the PowerShell command `Install-Script`, as in `install-script.sh` (932120);
 - a database's name, as in PostgreSQL's `information_schema.sql` (942140).
 For such a file, these requests are refused:
 - the API's list of its commits (`path`);
 - the API's call for the contents of files that names it in its query (`body`);
 - the commit graph of that file alone (`file`);
 - the hidden lines of its diff (`path`), which stay hidden;
 - the sign-in page, for a visitor who opens a page of the file that needs
  signing in, such as its edit page (`redirect_to`). The visitor can still sign
  in by opening the sign-in page itself.
 ### A path
 - A file name ending in `~`, or an `.xhtml` file whose path holds a space.
 - A path that holds what the Core Rule Set takes for a Java class (944130), as
  `java.lang.String.md` and
  `META-INF/services/org.apache.commons.logging.LogFactory` do.
 - A path that holds what it takes for Node.js code (934100), as
  `process.env.d.ts` does.
 - A path with a directory named `...` (930100, 930110), such as `.../notes.txt`.
 For such a file, these are refused:
 - the page of the file;
 - its raw file;
 - its history and its blame;
 - its edit page.
 The directory that holds it lists it, and a clone carries it.
 ### A container image push that reuses a layer
 A push can reuse a layer of an image docker has pushed to that gitea before.
 docker then asks gitea to take the layer from that image, naming it in the query
 parameter `from`, which 932260 checks. The request is refused when the image's
 owner starts with an entry on the list of commands. It is refused too when the
 image's name after the owner starts with one. Examples are `owner/python3-app`,
 `owner/docker-base`, and any image of an owner named `ansible` or `docker-team`.
 What happens next depends on docker's image store. A docker that keeps its
 images in containerd's image store fails the push, and fails each new try the
 same way. A new install of Docker Engine 29 does this. A docker that keeps them
 in its own older image store uploads the layer instead. The push then succeeds
 after one refusal for each layer it reuses, and each of those refusals counts
 toward the error burst ("Attack detection" in `SPEC.md`).
 ### Artifact uploads from `actions/upload-artifact@v3`
 This action sends the header `Content-Range`, which the Core Rule Set refuses
 (920450). The action sends two files at a time, does not retry a `403`, and
 sends no further file once one is refused. So an upload is refused once or
 twice, however many files it holds, and the step fails. One upload does not ban
 the runner. The error burst ("Attack detection" in `SPEC.md`) bans it after more
 than 30 such refusals from its address in a minute, as when many jobs upload at
 once. `actions/upload-artifact@v4` does not send the header.
 ## What body inspection refuses
 With `SWWAF_WAF_BODY_LIMIT` set, the Core Rule Set reads request bodies too. In
 front of gitea it then refuses these, until their rule ids, named in the request
 log, are added to `SWWAF_WAF_DISABLED_RULES`:
 - issue and comment text, wiki pages and files saved in the web editor that hold
  shell commands or code (932125, 932235, 932250 and others);
 - package descriptions that show code;
 - PyPI uploads (922130);
 - attachments named like `debug.log` or `config.yml` (932180).
 ## What `script/gitea-requests` sends
 Of the requests above, the script sends:
 - for each file named under "A file name in a query parameter that trips the
  code rules", the API's list of its commits;
 - for `Runtime.java` alone, the commit graph of that file, the hidden lines of
  its diff, and the API's call for the contents of files that names it;
 - the sign-in page for a visitor who opens the edit page of `document.write.js`;
 - the pages of `java.lang.String.md`,
  `META-INF/services/org.apache.commons.logging.LogFactory`, `process.env.d.ts`
  and `.../notes.txt`;
 - one container image push that reuses a layer, which it does not try again.
 It does not send the raw file, history, blame or edit page of those four files,
 or the pages of the directories `META-INF/services` and `...`. It also sends a
 short sample of gitea's ordinary use:
 - signing in;
 - pages of files and commits, and a diff;
 - the API;
 - a push, and clone and fetch over HTTP;
 - two container image pushes.
@@ -1,37 +0,0 @@
 # What the image holds
 The contents of the `smallwebwaf` image, and how each part is pinned.
 "Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
 is pinned that way.
 ## Contents
 - Ubuntu 26.04 LTS, pinned by digest.
 - `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
  archive at `20261001T000000Z`.
 - Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
  `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
  Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
  Unpacked, nixpkgs takes about 500 MiB.
 - `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
  at a fixed commit hash.
 - The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
 - The service directory `/etc/service/smallwebwaf`, with the `run` script
  `share/smallwebwaf.run`.
 - `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
  with the default rule file `share/rules.d/00-default.rules`.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
 ## Pins
 - Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
  `apt-get update`. The hashes are the amd64 archive's.
 - nixpkgs: the release file `nixexprs.tar.xz` of
  `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
  SHA-256 hash.
 - `runsvinit`: the archived repository, unchanged since 2015, at its last commit
  (`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
  build writes.
 - The Go image that builds `smallwebwaf`: by digest.
@@ -1,93 +0,0 @@
 # The metrics
 What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
 [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
 label as `exported_instance` unless the scrape sets `honor_labels: true`.
 ## Traffic
 - `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
  `smallwebwaf_response_bytes_total`, by `status_class` such as `2xx` and by
  `action`;
 - `smallwebwaf_request_duration_seconds` and
  `smallwebwaf_upstream_duration_seconds`, as histograms;
 - `smallwebwaf_requests_in_flight`.
 ## Limits and bans
 - `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
  `bytes` or `refusals`);
 - `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed.
  `servewaf`'s header limits have no setting, so it leaves them out;
 - `smallwebwaf_offences_total`, by `kind`;
 - `smallwebwaf_bans_made_total`, by `cause`;
 - `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
 ## Attack detection
 - `smallwebwaf_rule_matches_total`, by `rule_id` and `action`, and
  `smallwebwaf_rules_loaded`;
 - `smallwebwaf_waf_matches_total`, by `mode` and `rule_id`, for the rules that
  fired.
 ## Countries and AS numbers
 For the `SWWAF_METRICS_TOP_N` busiest of each, the rest as `other`:
 - `smallwebwaf_country_requests_total`,
  `smallwebwaf_country_request_bytes_total`,
  `smallwebwaf_country_response_bytes_total` and
  `smallwebwaf_country_list_refusals_total`, by `country`;
 - `smallwebwaf_asn_requests_total`, `smallwebwaf_asn_request_bytes_total` and
  `smallwebwaf_asn_response_bytes_total`, by `asn`.
 ## Lookups
 - `smallwebwaf_geojs_requests_total` and `smallwebwaf_geojs_failures_total`;
 - `smallwebwaf_geojs_unanswered_total`: the requests that needed an answer and
  went on without it;
 - with the file source,
  `smallwebwaf_lookup_database_last_read_timestamp_seconds` and
  `smallwebwaf_lookup_database_read_failures_total`.
 ## Reputation sources
 By `source`: each list's URL, each zone, and `abuseipdb`:
 - `smallwebwaf_reputation_hits_total`, `smallwebwaf_reputation_queries_total`
  and `smallwebwaf_reputation_failures_total`;
 - `smallwebwaf_reputation_last_fetch_timestamp_seconds`, for a list;
 - `smallwebwaf_reputation_daily_budget_remaining`, for AbuseIPDB.
 ## State files
 By `file`:
 - `smallwebwaf_state_file_writes_total`,
  `smallwebwaf_state_file_write_failures_total`,
  `smallwebwaf_state_file_last_write_timestamp_seconds` and
  `smallwebwaf_state_file_size_bytes`;
 - `smallwebwaf_state_file_edits_taken_in_total` and
  `smallwebwaf_state_file_edits_set_aside_total`;
 - `smallwebwaf_tracked_clients`: the clients in the table.
 ## Remote log, alerts and the process
 - while a syslog server is set, `smallwebwaf_remote_log_lines_sent_total`,
  `smallwebwaf_remote_log_lines_dropped_total` and
  `smallwebwaf_remote_log_buffer_depth`;
 - by `destination`, `smallwebwaf_alerts_sent_total`,
  `smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
  `smallwebwaf_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
 ## `servewaf`
 `smallwebwaf servewaf` counts a denied request at its decision. It counts an
 allowed request when its report comes, with the status, bytes and times the
 report gives. These are not counted:
 - a report itself;
 - an allowed request whose report never comes;
 - a question refused with `400`;
 - a question whose body stopped arriving.
@@ -1,220 +0,0 @@
 # The request log's fields
 The fields of the JSON object `smallwebwaf` writes for each request. "Request
 log" in [`SPEC.md`](../SPEC.md) says when a line is written and how the log is
 sent to a syslog server. A field that does not apply to a request is left out.
 `smallwebwaf rproxy` writes a shorter line, which "`rproxy`'s line" below gives.
 ## Example
 ```
 {"type":"request","time":"2026-10-03T12:00:00.123Z","instance":"fsn1app1/gitea","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"response_content_type":"text/html; charset=utf-8","upstream_status":200,"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"duration_total":3.217,"duration_checks":0.041,"duration_upstream_connect":0.052,"duration_upstream_first_byte":2.874,"duration_upstream_total":3.104}
 ```
 ## Every line
 Every line but `rproxy`'s has:
 - `type`: `request` (the process's own messages have `process`);
 - the standard web log fields;
 - `request_id`, `peer_ip` and `client_group`;
 - `asn`, `as_name` and `country`;
 - `action` and `duration_total`.
 ## Standard web log fields
 - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC;
 - `instance`: `SWWAF_INSTANCE_NAME`;
 - `client_ip`, `method`, `scheme`, `host`, `path`, `query`, `protocol`;
 - `status`: what the client was sent, `0` if nothing;
 - `request_bytes` and `response_bytes`: body bytes each way;
 - `referer` and `user_agent`.
 ## Request detail
 - `request_id`: the `X-Request-ID` a trusted proxy sent, or a new random one of
  26 letters and digits.
 - `peer_ip`: the TCP peer, normally traefik.
 - `forwarded_for`: the `X-Forwarded-For` header as received.
 - `client_group`: the client as rate limiting counts it, an IPv4 address as a
  /32 or an IPv6 group.
 - `asn`, `as_name` and `country`: the client's, as looked up. Each is empty
  when:
    - lookups are off;
    - the client is not looked up;
    - the source cannot place the client;
    - GeoJS had not answered by the time the request went on.
 - `content_type` and `content_length`: the request's own.
 - `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
  in lower case.
 - `has_authorization` and `has_cookie`: true when the request had those headers.
  Their values are never logged.
 - `websocket`: true when the app switched the connection to another protocol.
 ## Response detail
 - `upstream_status`: what the app answered. It differs from `status` when
  `smallwebwaf` answered itself.
 - `response_content_type`, `cache_control` and `location`: the answer's headers.
 - `aborted`: true when the client went away early.
 ## Decision
 - `action`: what was done:
    - `forward`: passed to the app;
    - `denied`: refused for `SWWAF_DENY_NETS`, or for a reputation source with
      the action `deny`;
    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
      CrowdSec decision, each of which bans the client;
    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
      refused by that check;
    - `too_large`: a size limit was passed, or a header limit in `servewaf`;
    - `timed_out`: a time limit was passed;
    - `upstream_error`: the app could not be reached, or its answer broke off;
    - `admin`: answered at one of `smallwebwaf`'s own endpoints.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
  request it would have refused. `action` then names what was done, normally
  `forward`.
 - `limit_percent` and `limit_percent_setting`: the client's percentage of the
  rate limits and the setting that lowered it, when one did. `bytes_percent` and
  `bytes_percent_setting` do the same for the byte limits.
 - `counts`: the client's totals as rate limiting counts them, this request
  included. It is left out when rate limiting did not count the request. It
  holds:
    - `minute`, `hour` and `day`: requests;
    - `minute_bytes`, `hour_bytes` and `day_bytes`: bytes.
    A count can have a fraction (see "Counting method" in
    [`SPEC.md`](../SPEC.md)).
 - `limit_hit`: the limit broken:
    - `minute`, `hour` or `day` for a rate limit;
    - `minute_bytes`, `hour_bytes` or `day_bytes` for a byte limit;
    - `error_burst`.
    A request whose bytes broke a limit was passed on whole, so its `action`
    stays `forward`.
 - `rule_ids`: the rule file rules that matched, in order, up to the one that
  refused.
 - `waf_score` and `waf_rule_ids`: the Core Rule Set's score and the rules that
  matched, for a request it inspected.
 - `reputation`: the sources the client is on, in this order:
    - blocklist URLs;
    - the CrowdSec decision list's URL;
    - DNS blocklist zones;
    - `abuseipdb`.
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
  refused under one: a time, or `permanent`.
 ## Timings
 All in milliseconds:
 - `duration_total`: from the request's headers being read to its log line;
 - `duration_checks`: to the end of the checks, before forwarding;
 - `duration_waf`: the part of that the Core Rule Set took;
 - `duration_upstream_connect`: from the hand-over to the app until there was a
  connection;
 - `duration_upstream_first_byte`: until the first byte of the answer;
 - `duration_upstream_total`: until the end of the answer.
 ## `servewaf`'s lines
 `smallwebwaf servewaf` writes two lines for each question it answers, joined by
 `request_id`. The field `servewaf_line` says which of the two a line is:
 - `decision`: the line it writes once it has answered the question;
 - `report`: the line it writes when `rproxy`'s report comes, with everything
  known. The repetition is intended.
 A request to its own endpoints writes one line, without `servewaf_line`. A
 report writes no line but the `report` line of the request it names.
 These questions write no line:
 - a question refused with `400` (see "The question" under "`servewaf`" in
  [`SPEC.md`](../SPEC.md));
 - a question whose body stopped arriving, which gets no answer.
 ### The `decision` line
 It has the fields above, with these meanings where they differ:
 - `client_ip`: `X-Smallwebwaf-Client`.
 - `peer_ip`: `X-Smallwebwaf-Peer`.
 - `host`: the site the visitor asked for.
 - `protocol`: the question's own, `HTTP/1.1`.
 - `content_length`: `X-Smallwebwaf-Content-Length`.
 - `request_id`: the question's `X-Request-ID`.
 - `status`: what `servewaf` answered: `200` for `allow`, the status of `deny`,
  or `0` for `close`, as the visitor is then sent nothing.
 - `request_bytes`: how much of the question's body the Core Rule Set read.
 - `response_bytes`: the body of `servewaf`'s answer.
 - `action`: `forward` for `allow`, and `admin` for the `404` for a path under
  `/_smallwebwaf/`.
 - `aborted`: true when `rproxy` went away before the answer.
 - `duration_total`: from `servewaf` having read the question's body to the line.
 - `time`: when `servewaf` had read the question's body.
 The line leaves out `upstream_status`, `websocket` and the
 `duration_upstream_...` fields, since `servewaf` passes nothing to the app.
 The bytes of an allowed request are counted when its report comes. So `counts`
 holds the client's bytes without this request's.
 ### The `report` line
 It has every field of the `decision` line, and `time` stays as the `decision`
 line gives it. These fields say what the report says:
 - `status`: what the visitor got, `0` if nothing;
 - `request_bytes` and `response_bytes`: the body bytes each way, with what a
  WebSocket carried each way;
 - `duration_total`: from the request's headers being read by `rproxy` to the end
  of the answer;
 - `duration_upstream_total`: from the hand-over to the app to the end of the
  answer, for an allowed request.
 For an allowed request, the report's counting also changes these fields:
 - `counts`: the byte totals now include this request's;
 - `limit_hit`, `offence` and `ban_expires`: set when the report's bytes broke a
  byte limit.
 ## `rproxy`'s line
 `smallwebwaf rproxy` writes one short line for each request. `request_id` joins
 it to `servewaf`'s two. It has these fields and no others:
 - `type`: `request`.
 - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC.
 - `request_id`: the id `rproxy` made for the request when it arrived.
 - `client_ip`: the visitor's address.
 - `host` and `method`.
 - `path` and `query`: as the visitor sent them.
 - `status`: what the visitor got, `0` if nothing.
 - `request_bytes`: the bytes of the visitor's body that `rproxy` read, with what
  a WebSocket carried from the visitor.
 - `response_bytes`: the bytes of the answer's body, with what a WebSocket
  carried from the app.
 - `duration_request`: milliseconds from the request's headers being read until
  the app had been sent the whole request, or the answer started if that was
  sooner. It includes the wait for `servewaf`.
 - `duration_response`: milliseconds from then until the end of the answer.
 - `disposition`: what was done with the request: `allow`, `deny` or `close`. It
  is `servewaf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left
  out when:
    - `servewaf` was not asked, as for the health check;
    - the visitor went away while `servewaf` was being asked;
    - `servewaf`'s answer had no valid `X-Smallwebwaf-Disposition`;
    - `rproxy` could not pass on `servewaf`'s answer, and answered `502`.
 - `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
  `disposition`, and otherwise left out.
 For example:
 ```
 {"type":"request","time":"2026-10-03T12:00:00.123Z","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","client_ip":"203.0.113.9","host":"app.example","method":"GET","path":"/","query":"","status":200,"request_bytes":0,"response_bytes":5120,"duration_request":1.204,"duration_response":3.104,"disposition":"allow"}
 ```
@@ -1,67 +0,0 @@
 # Rule files
 The format of a rule file, and the default file the image ships. "Rule files" in
 [`SPEC.md`](../SPEC.md) says how the files are read, watched and mounted, and
 what each action leads to.
 ## The format
 A rule is a line of four fields separated by spaces or tabs: an id, a target, an
 action and a regex. The regex runs to the end of the line. Blank lines and lines
 starting with `#` are ignored.
 ```
 # id           target      action  regex
 env-file       path        ban     (?i)^/\.env(\.[a-z]+)?$
 scanner-agent  user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|wpscan)\b
 ```
 - The id is letters, digits, `-` and `_`, unique across all files. The log line,
  the metrics, the alerts and a ban's notes name the rule by it.
 - The target is what the regex is matched against:
    - `path`: the path without the query;
    - `uri`: the path and the query together;
    - `query`: the query as sent;
    - `method`, `host`, `user_agent` and `referer`;
    - `header:<Name>`: any one request header but `Host` and
      `Transfer-Encoding`.
 - The action is `log`, `block` or `ban`.
 - The regex is in Go's syntax, RE2. It matches anywhere in the target unless
  anchored with `^` and `$`. `(?i)` at its front makes it ignore case.
 ## The default file
 The image ships one file, `share/rules.d/00-default.rules`, installed as
 `/etc/smallwebwaf/rules.d/00-default.rules`:
 ```
 # 00-default.rules: probes no real visitor sends, anchored at the site root
 # id             target      action  regex
 env-file         path        ban     (?i)^/\.env(\.[a-z]+)?$
 vcs-dir          path        ban     (?i)^/\.(git|svn|hg|bzr)(/|$)
 secrets-dir      path        ban     (?i)^/\.(aws|ssh|docker|kube)/
 secret-file      path        ban     (?i)^/\.(htpasswd|htaccess|npmrc|netrc|pgpass|git-credentials|bash_history|DS_Store)$
 editor-dir       path        ban     (?i)^/\.(vscode|idea)/
 backup-file      path        ban     (?i)^/[^/]+\.(php(\.[a-z0-9]+|~)|sql(\.[a-z0-9]+)?)$
 log-file         path        ban     (?i)^/(debug|error|access)\.log$
 compose-file     path        ban     (?i)^/(docker-)?compose\.ya?ml$
 php-shell        path        ban     (?i)^/(shell|c99|r57|wso|alfa)\.php$
 scanner-agent    user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|masscan|zgrab|wpscan)\b
 path-traversal   uri         block   (\.\./){2,}
 empty-agent      user_agent  log     ^$
 ```
 ## A file of your own
 An app's `Dockerfile` adds rules of its own in a file named to sort after the
 default, such as `50-gitea.rules`:
 ```
 # 50-gitea.rules: WordPress probes, which gitea never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 ```dockerfile
 COPY 50-gitea.rules /etc/smallwebwaf/rules.d/50-gitea.rules
 ```
@@ -1,409 +0,0 @@
 # Settings
 Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
 that take `off`, the `_FILE` form, and what each group does and why.
 ## Forms of values
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
  and negative durations are refused.
 - A size is a number of bytes with an optional `K`, `M` or `G`, which are powers
  of 1024, so `1K` is 1024 bytes. Examples: `512K`, `100M`, `5G`.
 - A count is a whole number of requests, such as `1000`.
 - A list is comma separated, with spaces around items ignored. An empty item is
  refused.
 - A netblock is an address and a prefix length, such as `10.0.0.0/8`. A bare
  address stands for itself alone.
 - A country is a two-letter code of ISO 3166-1, in either case: `de` and `DE`
  are the same. `xk` stands for Kosovo. A code that is not a country is refused,
  such as `nk` (North Korea is `kp`) or the withdrawn `su`.
 - An AS number is `AS` and the number, in either case, such as `AS64496`.
 - A percentage is a whole number from 0 to 100.
 - A path prefix starts with `/`, such as `/assets/`.
 ## Core
 - `SWWAF_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
  `https` URL with a host and an optional port, and nothing more.
 - `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens: `:` and a
  port, such as `:9000`. Leave the host out (see "Ports" in
  [`SPEC.md`](../SPEC.md)).
 - `SWWAF_INSTANCE_NAME` (default: the container's host name): the `instance`
  name in every log line, alert and metric, such as `fsn1app1/gitea`. Valid
  UTF-8. No control character while `SWWAF_ALERT_NTFY_URL` is set. 1 to 48
  printable ASCII characters without a space while `SWWAF_LOG_REMOTE_URL` is set
  and `SWWAF_LOG_REMOTE_APP_NAME` is not.
 - `SWWAF_MODE` (default `enforce`): `enforce` or `observe`.
 - `SWWAF_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
  nothing.
 - `SWWAF_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6
  client's group, from 32 to 128.
 - `SWWAF_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
  number above zero.
 - `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `smallwebwaf`
  keeps, a whole number above zero.
 ## Tokens
 - `SWWAF_ADMIN_TOKEN` (default unset): the token for the ban endpoints and
  `/_smallwebwaf/clients/<ip>`. At least 32 characters.
 - `SWWAF_METRICS_TOKEN` (default unset): the token for `/_smallwebwaf/metrics`.
  At least 32 characters.
 ## State files
 - `SWWAF_STATE_DIR` (default `/var/lib/smallwebwaf`): the directory of the state
  files, an absolute path that exists and can be written.
 - `SWWAF_STATE_WRITE_DELAY` (default `10s`): how long `bans.json` waits to be
  written after a ban is made, lifted or made permanent. A duration.
 - `SWWAF_STATE_COUNTER_INTERVAL` (default `15m`): how often every state file is
  written. A duration.
 ## Logging
 - `SWWAF_LOG_LEVEL` (default `info`): the least severe of `smallwebwaf`'s own
  messages that are written: `debug`, `info`, `warn` or `error`.
 - `SWWAF_LOG_REQUEST_HEADERS` (default
  `accept,accept-language,accept-encoding,content-type,origin,range`): the
  request headers recorded in the log line, in either case. `Host` and
  `Transfer-Encoding` are refused; the host is the field `host`.
 - `SWWAF_LOG_REMOTE_URL` (default unset): a syslog server that also gets every
  line written to stdout: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://`,
  each with a host and a port and nothing more.
 - `SWWAF_LOG_REMOTE_TLS_CA_FILE` (default unset): a file of PEM certificates
  that a `syslog+tls` server's certificate must chain to, instead of the host's
  own. A file that cannot be read, or holds no certificate, is refused.
 - `SWWAF_LOG_REMOTE_BUFFER` (default `10000`): the most lines held while they
  wait to be sent, a whole number above zero.
 - `SWWAF_LOG_REMOTE_FACILITY` (default `local0`): the syslog facility: `kern`,
  `user`, `mail`, `daemon`, `auth`, `syslog`, `lpr`, `news`, `uucp`, `cron`,
  `authpriv`, `ftp`, or `local0` to `local7`.
 - `SWWAF_LOG_REMOTE_APP_NAME` (default: `SWWAF_INSTANCE_NAME`): the app name in
  each syslog record, 1 to 48 printable ASCII characters without a space.
 ## Metrics
 - `SWWAF_METRICS_TOP_N` (default `50`): how many AS numbers and how many
  countries get series of their own. A whole number above zero.
 ## Static lists
 - `SWWAF_ALLOW_NETS` (default empty): netblocks you trust, such as your
  monitoring (see step 3 in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_NETS` (default empty): netblocks whose clients are
  exempt from rate limiting and the byte limits.
 - `SWWAF_DENY_NETS` (default empty): netblocks whose clients are refused (see
  step 3 in [`SPEC.md`](../SPEC.md)).
 ## Request rate limits, per client
 - `SWWAF_RATE_LIMIT_PER_MINUTE` (default `500`, about 8 a second): the most
  requests a client may make in a minute. A count or `off`. The default catches,
  within seconds, a client firing requests as fast as it can. It leaves room for
  a fleet of about 20 agents at its busiest, about 120 requests a minute. It
  also leaves room for a few quick first visits to gitea with an empty cache,
  about 40 files each.
 - `SWWAF_RATE_LIMIT_PER_HOUR` (default `20000`, about 5.5 a second): the most
  requests a client may make in an hour. A count or `off`. The default leaves
  room for an automation fleet at work. It catches a client that keeps up more
  than about 5.5 a second for an hour.
 - `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most
  requests a client may make in a day. A count or `off`. The default catches a
  scraper that keeps up 4 a second around the clock.
 - Counting cannot catch a client that stays under all three limits (see "Request
  rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
  rate limiting and the byte limits, such as `/assets/`.
 ## Byte limits, per client
 - `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `4G`), `SWWAF_BYTES_LIMIT_PER_HOUR`
  (default `20G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `200G`): the most
  bytes counted for a client in each window. A size or `off`.
 - `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
  `response`, `request` or `both`.
 ## Size and time limits
 - `SWWAF_CLIENT_REQUEST_TIMEOUT` (default `60s`): how long a client may take to
  send its request line and headers, and then, from the end of the headers, its
  body. A duration or `off`.
 - `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest request
  line and headers. A size over `4K`; never `off`.
 - `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open connection
  may wait for its next request before it is closed. A duration or `off`.
 - `SWWAF_CLIENT_RESPONSE_TIMEOUT` (default `30m`): how long the answer may take
  to reach the client, from the end of the request to the last byte. A duration
  or `off`.
 - `SWWAF_UPSTREAM_REQUEST_TIMEOUT` (default `60s`): how long connecting to the
  app and sending it the whole request may take. A duration or `off`.
 - `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` (default `30m`): how long the app may take
  to send its whole answer. A duration or `off`.
 - `SWWAF_REQUEST_MAX_BYTES` (default `100M`): the largest request body. A size
  or `off`.
 - `SWWAF_RESPONSE_MAX_BYTES` (default `1G`): the largest response body. A size
  or `off`.
 ## Lookup of AS number and country
 - `SWWAF_LOOKUP_SOURCE` (default `geojs`): `geojs`, `file` or `off`. `off` stops
  the start while a setting that needs a lookup is set:
    - the two country lists;
    - `SWWAF_ADD_LOOKUP_HEADERS`;
    - the four biased threshold lists and `SWWAF_ASN_LIMIT_PERCENT_URL`;
    - `SWWAF_UNKNOWN_LIMIT_PERCENT` below `100`;
    - an anomaly threshold per AS number.
 - `SWWAF_LOOKUP_DB_PATH` (default empty): the IPinfo Lite database file, in its
  `.mmdb` form, for `SWWAF_LOOKUP_SOURCE=file`.
 - `SWWAF_LOOKUP_TIMEOUT` (default `800ms`): how long a request waits for its
  client's first answer from GeoJS, and how long a request to GeoJS may take. A
  duration; never `off`.
 - `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` passes the app the
  client's AS number in `X-Client-ASN` and its country in `X-Client-Country`.
 ## Country lists
 - `SWWAF_DENIED_COUNTRIES` (default empty): countries whose clients are refused,
  such as `cn,ru,kp`.
 - `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` (default empty): when set, the only
  countries whose clients get through, such as `us,de`. A country on both lists
  stops the start.
 ## Biased thresholds
 - `SWWAF_ASN_LIMIT_PERCENT` (default empty): a list of AS numbers, each with `:`
  and a percentage, such as `AS14061:50,AS16276:50,AS45102:25`. An AS number
  listed twice is refused.
 - `SWWAF_COUNTRY_LIMIT_PERCENT` (default empty): the same by country, such as
  `cn:25,ru:50`.
 - `SWWAF_ASN_BYTES_PERCENT` and `SWWAF_COUNTRY_BYTES_PERCENT` (default empty):
  the same, for the byte limits alone.
 - `SWWAF_UNKNOWN_LIMIT_PERCENT` (default `100`): the percentage for a client the
  lookup cannot place.
 - `SWWAF_ASN_LIMIT_PERCENT_URL` (default unset): the `http` or `https` URL of a
  text file with one AS number and percentage on each line, such as
  `AS64496:50`. A URL that is also in `SWWAF_BLOCKLIST_URLS` is refused.
 ## Attack detection
 - `SWWAF_RULES_DIR` (default `/etc/smallwebwaf/rules.d`): the directory of the
  rule files.
 - `SWWAF_RULES_ENABLED` (default `true`): `false` reads no rule file.
 - `SWWAF_TRAP_PATHS` (default empty): paths only scanners ask for, such as
  `/wp-login.php,/xmlrpc.php`. Each starts with `/` and holds no `?`.
 - `SWWAF_WAF_MODE` (default `block`): `off`, `detect` or `block`.
 - `SWWAF_WAF_PARANOIA_LEVEL` (default `1`): the Core Rule Set's paranoia level,
  from 1 to 4.
 - `SWWAF_WAF_ANOMALY_THRESHOLD` (default `5`): the score at which a request is a
  match. A whole number above zero, or `off`.
 - `SWWAF_WAF_DISABLED_RULES` (default
  `920340,920420,920440,920640,930130,930140`): the ids of Core Rule Set rules
  to switch off. Each a whole number above zero. An id from 900000 to 900999 is
  refused: those are the rules that set the Core Rule Set up, and
  `smallwebwaf`'s own.
 - `SWWAF_WAF_EXEMPT_PATHS` (default empty): path prefixes the Core Rule Set does
  not inspect.
 - `SWWAF_WAF_BODY_LIMIT` (default `off`): `off`, or how much of a request body
  the Core Rule Set reads, a size of at most `1G`.
 - `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
  in a minute (see "Attack detection" in `SPEC.md`). A count or `off`.
 ## Ban lengths, response and scope
 - `SWWAF_BAN_RESPONSE` (default `403`): `403`, `429` or `close`.
 - `SWWAF_LIMIT_BAN_DURATION` (default `1h`): the ban for a first broken limit. A
  duration.
 - `SWWAF_LIMIT_BAN_REPEAT_WINDOW` (default `24h`): the time after a ban ends
  within which breaking a limit again lengthens the next ban. A duration.
 - `SWWAF_MAX_BAN_DURATION` (default `7d`): the longest ban for a broken limit;
  one that would be longer is permanent. A duration.
 - `SWWAF_ATTACK_BAN_DURATION` (default `7d`): the ban for a first clear sign of
  attack. A duration.
 - `SWWAF_BAN_SCOPE_V4_PREFIX` (default `32`): how much a ban on an IPv4 client
  covers: the prefix length of its netblock, from 0 to 32.
 ## Reputation
 - `SWWAF_BLOCKLIST_URLS` (default empty): blocklists to fetch, such as
  `https://www.spamhaus.org/drop/drop.txt`. Each an `http` or `https` URL
  without a user or a fragment. A URL listed twice is refused.
 - `SWWAF_BLOCKLIST_REFRESH` (default `24h`): how long a list waits after its
  last try before it is fetched again. A duration of `1h` or more.
 - `SWWAF_BLOCKLIST_ACTION` (default `deny`): `deny`, `limit:<percent>` or `log`.
 - `SWWAF_DNSBL_ZONES` (default empty): the DNS blocklists to ask, such as
  `dnsbl.dronebl.org`. Each a DNS name of at most 189 characters. A Spamhaus
  zone carries its key, as in `<key>.xbl.dq.spamhaus.net`. A zone listed twice
  is refused, whatever its case or key.
 - `SWWAF_DNSBL_RESOLVER` (default unset): the resolver to ask the zones through,
  such as `192.0.2.53` or `[2001:db8::53]:5353`. An IP address with an optional
  port, 53 when none is given. Unset, the host's resolver is used.
 - `SWWAF_ABUSEIPDB_KEY` (default unset): the key of your AbuseIPDB account. A
  control character in it is refused.
 - `SWWAF_ABUSEIPDB_MIN_SCORE` (default `75`): the least abuse confidence score,
  from 0 to 100, that is a hit.
 - `SWWAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a day,
  a whole number above zero. AbuseIPDB's free accounts may make 1,000.
 - `SWWAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec engine
  you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL without a
  user or a fragment; its decision list is at `v1/decisions` under it. Set
  without the key, it is refused. So is a decision list URL that is also in
  `SWWAF_BLOCKLIST_URLS`, or that is `SWWAF_ASN_LIMIT_PERCENT_URL`.
 - `SWWAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
  `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
  URL, it is refused.
 - `SWWAF_REPUTATION_ACTION` (default `limit:25`): `deny`, `limit:<percent>` or
  `log`, for DNS blocklist and AbuseIPDB hits.
 - `SWWAF_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict or
  AbuseIPDB's score is used. A duration.
 - `SWWAF_REPUTATION_TIMEOUT` (default `2s`): how long a query to a zone or a
  check with AbuseIPDB may take. A duration.
 ## Alerting
 - `SWWAF_ALERT_WEBHOOK_URL` (default unset): the webhook that receives each
  alert as a JSON object. An `http` or `https` URL without a user or a fragment.
 - `SWWAF_ALERT_WEBHOOK_HEADERS` (default empty): headers sent with each post,
  such as `Authorization:Bearer 0123456789abcdef`. A list of name, `:` and
  value. A value cannot hold a comma.
 - `SWWAF_ALERT_SLACK_WEBHOOK_URL` (default unset): the Slack incoming webhook
  that receives each alert as a message, checked as the webhook URL is.
 - `SWWAF_ALERT_NTFY_URL` (default unset): the ntfy topic that receives each
  alert, as the topic's full URL, such as `https://ntfy.sh/my-alerts`, checked
  as the webhook URL is.
 - `SWWAF_ALERT_NTFY_TOKEN` (default unset): an ntfy access token. A control
  character in it is refused.
 - `SWWAF_ALERT_EVENTS` (default
  `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
  the event types alerts are sent for, from those in [`alerts.md`](alerts.md)
  but `summary`. Any other name is refused.
 - `SWWAF_ALERT_COOLDOWN` (default `15m`): how long after an alert is sent its
  repeats are held back. A duration or `off`.
 - `SWWAF_ALERT_MAX_PER_HOUR` (default `60`): the most alerts sent in an hour. A
  whole number above zero, or `off`.
 ## Anomaly thresholds
 Each scope has four thresholds: the most requests and the most bytes counted in
 a minute and in an hour. Requests are counts, bytes are sizes. Each is `off` by
 default. The four thresholds per client are:
 - `SWWAF_ANOMALY_CLIENT_REQUESTS_PER_MINUTE`;
 - `SWWAF_ANOMALY_CLIENT_REQUESTS_PER_HOUR`;
 - `SWWAF_ANOMALY_CLIENT_BYTES_PER_MINUTE`;
 - `SWWAF_ANOMALY_CLIENT_BYTES_PER_HOUR`.
 The other scopes' names have another prefix before the same four endings, such
 as `REQUESTS_PER_MINUTE`:
 - `SWWAF_ANOMALY_NET_...`: per netblock around a client. Two settings give the
  netblock's length:
    - `SWWAF_ANOMALY_NET_V4_PREFIX` (default `24`, from 0 to 32) for an IPv4
      client;
    - `SWWAF_ANOMALY_NET_V6_PREFIX` (default `48`, from 0 to 128) for an IPv6
      client.
 - `SWWAF_ANOMALY_ASN_...`: per AS number.
 - `SWWAF_ANOMALY_TOTAL_...`: the whole service.
 - `SWWAF_WATCH_...`: each netblock in `SWWAF_WATCH_NETS`, as a whole.
  `SWWAF_WATCH_NETS` (default empty) is a list of name, `=` and netblock, such
  as `office=203.0.113.0/24,scraper-x=198.51.100.0/22`. An item without `=` or a
  name, or with a bad netblock, is refused. So is a name used twice.
 ## Settings given as files
 To give a token as a file, as "Tokens" under "Deployment" in
 [`SPEC.md`](../SPEC.md) describes, make the file on the host:
 ```sh
 mkdir -p /srv/app/tokens
 openssl rand -hex 32 > /srv/app/tokens/metrics
 chown 65532:65532 /srv/app/tokens/metrics
 chmod 0400 /srv/app/tokens/metrics
 ```
 Then mount its directory into the container read-only, and name the file:
 ```sh
 docker run \
    -v /srv/app/tokens:/etc/smallwebwaf/tokens:ro \
    -e SWWAF_METRICS_TOKEN_FILE=/etc/smallwebwaf/tokens/metrics \
    ...
 ```
 ## Fixed limits
 A few limits are fixed rather than settings:
 - at most 100,000 GeoJS answers are kept;
 - at most 100,000 DNS blocklist verdicts and 100,000 AbuseIPDB scores are kept;
 - at most 1,000 DNS blocklist queries are under way at once;
 - at most 20,000 anomaly counters are kept;
 - each alert destination's queue holds at most 1,000 alerts;
 - `servewaf` holds at most 10,000 answered requests awaiting their reports;
 - `servewaf` refuses a request with more than 50 cookies or more than 100 header
  fields (see "Answering in time" under "`servewaf`" in
  [`SPEC.md`](../SPEC.md));
 - `rproxy` takes a request line and headers of at most 32 KiB, and closes a
  kept-open connection idle for 120 seconds;
 - `rproxy` reads at most 1 MiB of the body of `servewaf`'s answer, and answers
  `502` to a longer one.
 ## `servewaf`
 `smallwebwaf servewaf` uses every `SWWAF_` setting but these, which it ignores:
 - `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
 - the five timeouts under "Size and time limits";
 - `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`, `SWWAF_REQUEST_MAX_BYTES` and
  `SWWAF_RESPONSE_MAX_BYTES`.
 An invalid value of one of these still stops the start, and the line of settings
 at start still shows them.
 `SWWAF_ADD_LOOKUP_HEADERS` puts the headers on the answer to `rproxy`, not on a
 request to an app. `SWWAF_WAF_BODY_LIMIT` has an effect up to 64 KiB less one
 byte, whatever its value. A question carries no more of a body than 64 KiB (see
 "`servewaf`" in [`SPEC.md`](../SPEC.md)).
 `SWWAF_LOOKUP_TIMEOUT` is the longest a question waits on an outside source.
 Keep it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question
 waits for `SWWAF_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are
 asked in the background (see "Answering in time" under "`servewaf`" in
 [`SPEC.md`](../SPEC.md)).
 ## `rproxy`
 `smallwebwaf rproxy` reads the settings below and no others, and nothing else
 reads them. They are read once at start, and an invalid value stops the start.
 None can be given as a file, since `rproxy` never touches disk. "`rproxy`" in
 [`SPEC.md`](../SPEC.md) says what they do.
 A time here is a whole number of milliseconds above zero, such as `2000`.
 - `SWRP_WAF_BACKEND` (required, no default): `servewaf`'s URL. An `http` or
  `https` URL with a host and an optional port, and nothing more. `rproxy`
  speaks HTTP/1.1 to it.
 - `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `servewaf`'s
  answer, to a question and to a report. A time; never `off`.
 - `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when
  `servewaf` cannot be connected to, does not answer at all, or does not answer
  within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers
  `503`. It does not apply to an answer `servewaf` gives, such as an error.
 - `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or
  `off`.
 - `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or
  `off`.
 - `SWRP_MAX_REQUEST_TIME_MS` (default `60000`): how long the visitor may take to
  send its request line and headers. It then also bounds, from the end of the
  headers, the time until the app has been sent the whole request. A time or
  `off`.
 - `SWRP_MAX_RESPONSE_TIME_MS` (default `1800000`): how long the answer may take,
  from the end of the request to its last byte reaching the visitor. A time or
  `off`.
 - `SWRP_LISTEN_ADDR` (default `:8080`): where `rproxy` listens, such as `:9000`.
 - `SWRP_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
  `https` URL with a host and an optional port, and nothing more.
 - `SWRP_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
  nothing.
@@ -1,104 +0,0 @@
 # State files
 The five JSON files in `SWWAF_STATE_DIR`, and what each holds. "Persistent
 state" in [`SPEC.md`](../SPEC.md) says how they are written, read and edited.
 Each has a top-level `version` of 1.
 ## `bans.json`
 Active and past bans: every ban an admin made, and up to `SWWAF_MAX_BANS` of
 those `smallwebwaf` made. Per entry:
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
 - `cause`: `attack`, `limit`, `admin` or `crowdsec`;
 - `reason`: a short reason;
 - `lifted`: when an admin lifted it, if one did;
 - `notes`: the notes below.
 An entry an admin adds needs `netblock`, `start` and `expires`; `reason`,
 `notes` and `cause` may be left out, and the cause is then `admin`:
 ```json
 {
    "version": 1,
    "bans": [
        {
            "netblock": "203.0.113.0/24",
            "start": "2026-10-06T12:00:00Z",
            "expires": null,
            "reason": "probes for logins"
        }
    ]
 }
 ```
 "Bans" in [`SPEC.md`](../SPEC.md) says how an edit lifts, keeps or forgets a
 ban. The notes:
 - `asn`, `as_name` and `country`: the client's, added when the lookup answers
  (empty when lookups are off);
 - for a broken limit, `kind` (`requests`, `bytes` or `refusals`), `limit`,
  `window` and `count`: what the limit was on, the limit, its window and the
  count reached;
 - `limit_percent` and `limit_percent_setting`: the client's percentage of that
  limit and the setting that gave it, when a setting lowered it;
 - for a clear sign of attack, `rule_id` and `target`, or `trap_path`;
 - `reputation`: the sources the client was on, each with its `source` and, for
  AbuseIPDB, its `score`;
 - `request`: the request that caused the ban, each text cut to 256 bytes:
    - `time`, `method` and `host`;
    - `path`, with its query string;
    - `status` and `user_agent`;
 - `requests` and `refused`: the netblock's requests since it was first seen, and
  how many this ban has refused so far, kept up to date while the ban lasts;
 - `earlier_bans`: how many earlier bans the netblock had, by cause.
 ## `clients.json`
 Per client, one per line: its minute, hour and day counters, and its history
 since it was first seen:
 - the first and last time seen;
 - the AS number, AS name and country last looked up, and when;
 - total requests, and how many were forwarded and how many refused;
 - bytes in each direction;
 - responses by status class;
 - offences by kind: `limit`, `attack`, `rule_blocked`, `waf_blocked` and
  `token_refused`.
 ## `lookups.json`
 GeoJS answers, one per line:
 - `client`;
 - `asn`, `as_name` and `country`;
 - `answered`: when GeoJS answered;
 - `used`: when the answer was last used.
 ## `reputation.json`
 - the last good copy of each list fetched from a URL, with when it was last
  tried;
 - each DNS blocklist verdict still in use;
 - AbuseIPDB's scores, and the checks spent today.
 ## `alerts.json`
 - the anomaly counters;
 - the alert cooldowns: for each event and netblock, source, file or anomaly
  scope, when it was last sent and the count of repeats held back since;
 - the alerts sent and held back in the current hour;
 - the alerts waiting for each destination.
 ## Sizes
 - `clients.json`: about 1 KiB per client, about 20 MiB at the default
  `SWWAF_MAX_TRACKED_CLIENTS`. Written every 15 minutes, that is under 2 GiB of
  disk writes a day.
 - `bans.json`: about 1.2 KiB per ban, at most about 2.5 KiB, so about 6 MiB at
  the default `SWWAF_MAX_BANS`. Written every 15 minutes, a full file comes to
  about 600 MiB of writes a day, and a hundred new bans a day add about 600 MiB
  more.
 - `lookups.json`: about 150 bytes per answer, under 1.5 GiB of writes a day when
  full.
 - `reputation.json` and `alerts.json`: usually a few MiB or less.
@@ -1,8 +1,8 @@
 // Package alerts sends alerts on bans, on traffic over an anomaly
 // threshold, on a source that fails and on a file with an error to each
 // destination set: to the webhook
-// SWWAF_ALERT_WEBHOOK_URL names, each as one JSON object, as "The JSON
+// SWWAF_ALERT_WEBHOOK_URL names, each as one JSON object, as the "Alert
-// object" in docs/alerts.md describes, to the Slack incoming
+// webhook schema" section of SPEC.md describes, to the Slack incoming
 // webhook SWWAF_ALERT_SLACK_WEBHOOK_URL names, as a message, and to the
 // ntfy topic SWWAF_ALERT_NTFY_URL names. A repeat within
 // SWWAF_ALERT_COOLDOWN is held back, and so is an alert past
@@ -149,17 +149,15 @@ type Params struct {
 }
 // Alert is one alert, as the webhook is sent it and alerts.json holds it,
-// with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
+// with the fields of the "Alert webhook schema" section of SPEC.md. ASN,
-// Country are, for a ban, the client's as the ban's notes give them. Host is
+// ASName and Country are, for a ban, the client's as the ban's notes give
-// the site of the request that raised the alert, while one servewaf serves
+// them.
 // many sites, and "" otherwise.
 //
-//nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case
+//nolint:tagliatelle // SPEC.md's alert webhook schema names its fields in snake_case
 type Alert struct {
 	Instance string       `json:"instance"`
 	Time     time.Time    `json:"time"`
 	Event    string       `json:"event"`
 	Host     string       `json:"host,omitempty"`
 	Client   netip.Addr   `json:"client"`
 	Netblock netip.Prefix `json:"netblock"`
 	ASN      string       `json:"asn"`
@@ -902,16 +900,12 @@ func title(alert *Alert) string {
 }
 // text returns the text of alert in Slack and ntfy: its reason, then a
-// line for each of its host, client, netblock and country, the file,
+// line for each of its client, netblock and country, the file, source,
-// source, error and mode its detail gives, and its suppressed repeats, that
+// error and mode its detail gives, and its suppressed repeats, that it
-// it has.
+// has.
 func text(alert *Alert) string {
 	lines := []string{alert.Reason}
 	if alert.Host != "" {
 		lines = append(lines, "host: "+alert.Host)
 	}
 	if alert.Client.IsValid() {
 		lines = append(lines, "client: "+alert.Client.String())
 	}
@@ -1284,11 +1284,9 @@ func anAlertForEachEvent() []eventMessage {
 				Event: alerts.EventWAFBlock, Client: netip.MustParseAddr("192.0.2.1"),
 				Netblock: netip.MustParsePrefix("192.0.2.1/32"),
 				Reason:   "refused by the Core Rule Set",
 				Host:     "app.example",
 			},
 			"fsn1app1/gitea: waf_block", "default shield",
-			"refused by the Core Rule Set\nhost: app.example\nclient: 192.0.2.1\n" +
+			"refused by the Core Rule Set\nclient: 192.0.2.1\nnetblock: 192.0.2.1/32",
 				"netblock: 192.0.2.1/32",
 		},
 		{
 			alerts.Alert{
@@ -1,8 +1,8 @@
 // Package anomaly counts requests and bytes over a minute and an hour, per
 // client, per surrounding netblock, per AS number, for the whole service
 // and per named netblock, and raises an anomaly alert for a count over its
-// threshold, as "Anomaly thresholds" under "Settings" in SPEC.md
+// threshold, as "Anomaly thresholds" under "Configuration surface" in
-// describes. It refuses and bans nothing. At most 20,000 counters
+// SPEC.md describes. It refuses and bans nothing. At most 20,000 counters
 // are kept, in memory, and written to alerts.json and read from it by the
 // state package.
 package anomaly
@@ -103,8 +103,6 @@ type Counter struct {
 // Request is a request that has ended, as the counters count it.
 type Request struct {
 	// Host is the site the alert names, "" for none.
 	Host string
 	// Client is the client's address, and ClientGroup the client it is
 	// counted as: its IPv4 address, or the IPv6 netblock of
 	// SWWAF_IPV6_GROUP_PREFIX its address is in.
@@ -398,7 +396,6 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 	return alerts.Alert{
 		Event:    alerts.EventAnomaly,
 		Host:     r.Host,
 		Client:   r.Client,
 		Netblock: k.netblock,
 		ASN:      r.ASN,
@@ -61,59 +61,6 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1})
 }
 func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
 	t.Parallel()
 	rules := defaultRules()
 	rules.MaxBans = 2
 	ledger := bans.New(rules)
 	netblock := netip.MustParsePrefix("203.0.113.1/32")
 	other := netip.MustParsePrefix("203.0.113.2/32")
 	// An admin bans the netblock for a minute, and it then breaks a limit
 	// twice, each time after its last ban has ended.
 	ledger.BanForAdmin(netblock, midnight(), midnight().Add(time.Minute),
 		"probes for logins")
 	first, _ := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
 	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 	// A ban on another netblock fills the ledger, and the netblock's first
 	// ban for a limit, its earliest that is not an admin's, goes.
 	ledger.BanForLimit(other, second.Start, bans.Notes{})
 	wantBans(t, ledger, map[netip.Prefix]int{netblock: 2, other: 1})
 	// The netblock's next ban still counts it.
 	third, _ := ledger.BanForLimit(netblock, second.Expires, bans.Notes{})
 	if third.Notes.EarlierBans != (bans.EarlierBans{Limit: 2, Admin: 1}) {
 		t.Errorf("the third ban for a limit has earlier bans %+v, "+
 			"want 2 for a limit and 1 an admin's", third.Notes.EarlierBans)
 	}
 }
 func TestEarlierBansCountABanAnAdminKeepsOnce(t *testing.T) {
 	t.Parallel()
 	ledger := bans.New(defaultRules())
 	netblock := netip.MustParsePrefix("203.0.113.1/32")
 	// The netblock breaks a limit twice, the second time after its first
 	// ban has ended, and the second ban's notes count the first. An admin
 	// then keeps the first ban.
 	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
 	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 	kept := first
 	kept.Cause = bans.CauseAdmin
 	ledger.LoadEdit([]bans.Ban{kept, second})
 	// The netblock's next ban counts the kept ban once, as an admin's.
 	third, _ := ledger.BanForLimit(netblock, second.Expires, bans.Notes{})
 	if third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Admin: 1}) {
 		t.Errorf("the third ban for a limit has earlier bans %+v, "+
 			"want 1 for a limit and 1 an admin's", third.Notes.EarlierBans)
 	}
 }
 func TestReasonOfTheBansSmallwebwafMakes(t *testing.T) {
 	t.Parallel()
@@ -687,51 +687,26 @@ func (l *Ledger) ban(
 }
 // earlierBans returns how many bans a netblock with the bans held, oldest
-// first, has had, by cause. Each ban held gives a count: the bans its
+// first, has had, by cause: the first ban held counts the bans the
-// notes count before it, and one for it and each ban held after it. A
+// netblock had before that one, since dropped to make room, and each ban
-// ban's count misses a ban dropped after it to make room, and that of an
+// held adds one.
 // admin's ban added to bans.json without notes misses the bans before it,
 // so the count that names the most bans is taken, whole: a ban an admin
 // keeps by giving it CauseAdmin is still counted under its old cause in
 // later bans' notes, and taking each cause from another count would count
 // it twice.
 func earlierBans(held []Ban) EarlierBans {
-	// fromHere counts ban and the bans held after it.
+	earlier := held[0].Notes.EarlierBans
 	var most, fromHere EarlierBans
-	for _, ban := range slices.Backward(held) {
+	for _, ban := range held {
 		switch ban.Cause {
 		case CauseLimit:
-			fromHere.Limit++
+			earlier.Limit++
 		case CauseAttack:
-			fromHere.Attack++
+			earlier.Attack++
 		case CauseAdmin:
-			fromHere.Admin++
+			earlier.Admin++
 		case CauseCrowdSec:
-			fromHere.CrowdSec++
+			earlier.CrowdSec++
 		}
 		notes := ban.Notes.EarlierBans
 		count := EarlierBans{
 			Limit:    notes.Limit + fromHere.Limit,
 			Attack:   notes.Attack + fromHere.Attack,
 			Admin:    notes.Admin + fromHere.Admin,
 			CrowdSec: notes.CrowdSec + fromHere.CrowdSec,
 		}
 		// Of counts that name as many bans, the earlier ban's is taken: it
 		// counts more of the bans held by the cause they have now.
 		if count.total() >= most.total() {
 			most = count
 		}
 	}
-	return most
+	return earlier
 }
 // total returns how many bans e counts, of all causes.
 func (e EarlierBans) total() int {
 	return e.Limit + e.Attack + e.Admin + e.CrowdSec
 }
 // markChanged has Changed receive a value, unless one is waiting already.
@@ -1,9 +1,7 @@
-// Package config reads smallwebwaf's settings, and is the one place they are
+// Package config reads smallwebwaf's settings. Every setting is an
-// read. Every setting is an environment variable. The settings of
+// environment variable whose name starts with SWWAF_, or a file such a
-// `smallwebwaf` and `smallwebwaf servewaf` start with SWWAF_, every one of them
+// variable names, every setting has a default, and this package is the
-// has a default, and most can be given as a file instead. Those of `smallwebwaf
+// one place they are read.
 // rproxy` start with SWRP_. Each of them but SWRP_WAF_BACKEND has a default, and
 // none can be given as a file, since rproxy never touches disk.
 package config
 import (
@@ -504,21 +502,21 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		UpstreamRequestTimeout:  env.duration("SWWAF_UPSTREAM_REQUEST_TIMEOUT", "60s"),
 		UpstreamResponseTimeout: env.duration("SWWAF_UPSTREAM_RESPONSE_TIMEOUT", "30m"),
 		RequestMaxBytes:         env.size("SWWAF_REQUEST_MAX_BYTES", "100M"),
-		ResponseMaxBytes:        env.size("SWWAF_RESPONSE_MAX_BYTES", "1G"),
+		ResponseMaxBytes:        env.size("SWWAF_RESPONSE_MAX_BYTES", "5G"),
 		AllowNets:               env.netblocks("SWWAF_ALLOW_NETS", ""),
 		RateLimitExemptNets:     env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
 		DenyNets:                env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
+		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "1000"),
-		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
+		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "10000"),
-		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
+		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "50000"),
 		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
-		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
+		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "10G"),
 		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
-		BytesLimitPerDay:        env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
+		BytesLimitPerDay:        env.size("SWWAF_BYTES_LIMIT_PER_DAY", "50G"),
 		BytesCount:              env.bytesCount("SWWAF_BYTES_COUNT", "both"),
 		LookupSource:            env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
 		LookupDBPath:            env.value("SWWAF_LOOKUP_DB_PATH", ""),
-		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "800ms"),
+		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "1s"),
 		AddLookupHeaders:        env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
 		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
@@ -261,10 +261,10 @@ func TestDefaults(t *testing.T) {
 		UpstreamRequestTimeout:      time.Minute,
 		UpstreamResponseTimeout:     30 * time.Minute,
 		RequestMaxBytes:             100 << 20,
-		ResponseMaxBytes:            1 << 30,
+		ResponseMaxBytes:            5 << 30,
-		RateLimitPerMinute:          500,
+		RateLimitPerMinute:          1000,
-		RateLimitPerHour:            20000,
+		RateLimitPerHour:            10000,
-		RateLimitPerDay:             300000,
+		RateLimitPerDay:             50000,
 		BanResponse:                 403,
 		LimitBanDuration:            time.Hour,
 		LimitBanRepeatWindow:        24 * time.Hour,
@@ -281,11 +281,11 @@ func TestDefaults(t *testing.T) {
 		RulesEnabled:                true,
 	})
 	wantLookupSettings(t, cfg, config.Config{
-		LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond,
+		LookupSource: defaultLookupSource, LookupTimeout: time.Second,
 	})
 	wantByteLimitSettings(t, cfg, config.Config{
-		BytesLimitPerMinute: 4 << 30, BytesLimitPerHour: 20 << 30,
+		BytesLimitPerMinute: 10 << 30, BytesLimitPerHour: 20 << 30,
-		BytesLimitPerDay: 200 << 30, BytesCount: "both",
+		BytesLimitPerDay: 50 << 30, BytesCount: "both",
 	})
 	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
@@ -1165,7 +1165,7 @@ func TestLookupSettingsAsSet(t *testing.T) {
 	cfg = fromEnvironment(t, environment{lookupSource: off})
 	wantLookupSettings(t, cfg, config.Config{
-		LookupSource: off, LookupTimeout: 800 * time.Millisecond,
+		LookupSource: off, LookupTimeout: time.Second,
 	})
 }
@@ -2371,21 +2371,21 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		upstreamRequestTimeout:  "60s",
 		upstreamResponseTimeout: "30m",
 		requestMaxBytes:         "100M",
-		responseMaxBytes:        "1G",
+		responseMaxBytes:        "5G",
 		allowNets:               "",
 		rateLimitExemptNets:     "",
 		denyNets:                "",
-		rateLimitPerMinute:      "500",
+		rateLimitPerMinute:      "1000",
-		rateLimitPerHour:        "20000",
+		rateLimitPerHour:        "10000",
-		rateLimitPerDay:         "300000",
+		rateLimitPerDay:         "50000",
 		rateLimitExemptPaths:    "",
-		bytesLimitPerMinute:     "4G",
+		bytesLimitPerMinute:     "10G",
 		bytesLimitPerHour:       "20G",
-		bytesLimitPerDay:        "200G",
+		bytesLimitPerDay:        "50G",
 		bytesCount:              "both",
 		lookupSource:            defaultLookupSource,
 		lookupDBPath:            "",
-		lookupTimeout:           "800ms",
+		lookupTimeout:           "1s",
 		addLookupHeaders:        "false",
 		deniedCountries:         "",
 		allowedCountries:        "",
@@ -1,167 +0,0 @@
 package config
 import (
 	"errors"
 	"fmt"
 	"log/slog"
 	"math"
 	"net/netip"
 	"net/url"
 	"strconv"
 	"strings"
 	"time"
 )
 // RProxy is the settings of `smallwebwaf rproxy`. A size or time limit of zero
 // is off.
 type RProxy struct {
 	// ListenAddr is where rproxy listens (SWRP_LISTEN_ADDR).
 	ListenAddr string
 	// UpstreamURL is the app (SWRP_UPSTREAM_URL).
 	UpstreamURL *url.URL
 	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
 	// (SWRP_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
 	// WAFBackend is servewaf's URL (SWRP_WAF_BACKEND).
 	WAFBackend *url.URL
 	// Timeout is how long rproxy waits for servewaf's answer to a question,
 	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
 	// DefaultDisposition is what is done with a request when servewaf cannot be
 	// connected to, does not answer at all, or does not answer within Timeout:
 	// allow or deny (SWRP_DEFAULT_DISPOSITION).
 	DefaultDisposition string
 	// MaxRequestSize is the largest request body (SWRP_MAX_REQUEST_SIZE), and
 	// MaxResponseSize the largest response body (SWRP_MAX_RESPONSE_SIZE).
 	MaxRequestSize  int64
 	MaxResponseSize int64
 	// MaxRequestTime bounds sending the whole request: the visitor's request
 	// line and headers, and then, from their end, its body on its way to the
 	// app (SWRP_MAX_REQUEST_TIME_MS). MaxResponseTime bounds the answer, from
 	// the end of the request to its last byte reaching the visitor
 	// (SWRP_MAX_RESPONSE_TIME_MS).
 	MaxRequestTime  time.Duration
 	MaxResponseTime time.Duration
 	// settings are the values read, as given or by default, for the log line
 	// at start.
 	settings []slog.Attr
 }
 var (
 	errNeedsWAFBackend = errors.New(
 		"is required: it is servewaf's URL, such as http://servewaf:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
 	errNotMilliseconds = errors.New(
 		"is not a whole number of milliseconds above zero, such as 2000")
 	errNotMillisecondsOrOff = errors.New(
 		"is not a whole number of milliseconds above zero, such as 60000, or off")
 )
 // RProxyFromEnvironment reads rproxy's settings with lookupEnv, normally
 // os.LookupEnv. A setting that is not set takes its default, and
 // SWRP_WAF_BACKEND, which has none, must be set. A setting that is set but
 // invalid is an error that names it. Since rproxy never touches disk, its
 // settings have no _FILE form.
 func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
 	env := &environment{lookupEnv: func(name string) (string, bool) {
 		if strings.HasSuffix(name, "_FILE") {
 			return "", false
 		}
 		return lookupEnv(name)
 	}}
 	cfg := &RProxy{
 		ListenAddr:         env.address("SWRP_LISTEN_ADDR", defaultListenAddr),
 		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
 		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
 		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
 		Timeout:            env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
 		DefaultDisposition: env.disposition("SWRP_DEFAULT_DISPOSITION", "allow"),
 		MaxRequestSize:     env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
 		MaxResponseSize:    env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
 		MaxRequestTime:     env.millisecondsOrOff("SWRP_MAX_REQUEST_TIME_MS", "60000"),
 		MaxResponseTime:    env.millisecondsOrOff("SWRP_MAX_RESPONSE_TIME_MS", "1800000"),
 	}
 	if env.err != nil {
 		return nil, env.err
 	}
 	cfg.settings = env.settings
 	return cfg, nil
 }
 // LogValue makes an RProxy log as each setting's name with the value it was
 // given, or its default.
 func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 // wafBackend reads the setting that is servewaf's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
 	if value == "" {
 		e.check(name, errNeedsWAFBackend)
 		return nil
 	}
 	backend, err := parseUpstreamURL(value)
 	e.check(name, err)
 	return backend
 }
 // disposition reads the setting that is what is done with a request when servewaf
 // cannot be connected to, does not answer at all, or does not answer in time:
 // allow or deny.
 func (e *environment) disposition(name, defaultValue string) string {
 	value := e.value(name, defaultValue)
 	if value != "allow" && value != "deny" {
 		e.check(name, fmt.Errorf("%q %w", value, errNotDisposition))
 	}
 	return value
 }
 // milliseconds reads a setting that is a whole number of milliseconds above
 // zero.
 func (e *environment) milliseconds(name, defaultValue string) time.Duration {
 	value := e.value(name, defaultValue)
 	duration, valid := parseMilliseconds(value)
 	if !valid {
 		e.check(name, fmt.Errorf("%q %w", value, errNotMilliseconds))
 	}
 	return duration
 }
 // millisecondsOrOff reads a setting that is a whole number of milliseconds
 // above zero, or off, which is 0.
 func (e *environment) millisecondsOrOff(name, defaultValue string) time.Duration {
 	value := e.value(name, defaultValue)
 	if value == off {
 		return 0
 	}
 	duration, valid := parseMilliseconds(value)
 	if !valid {
 		e.check(name, fmt.Errorf("%q %w", value, errNotMillisecondsOrOff))
 	}
 	return duration
 }
 // parseMilliseconds reads a whole number of milliseconds above zero, and
 // reports whether it is one.
 func parseMilliseconds(value string) (time.Duration, bool) {
 	n, err := strconv.ParseInt(value, 10, 64)
 	if err != nil || n <= 0 || n > math.MaxInt64/int64(time.Millisecond) {
 		return 0, false
 	}
 	return time.Duration(n) * time.Millisecond, true
 }
@@ -1,206 +0,0 @@
 package config_test
 import (
 	"net/netip"
 	"os"
 	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 // rproxy's settings, by name, and their values in these tests.
 const (
 	wafBackend        = "SWRP_WAF_BACKEND"
 	rproxyTimeout     = "SWRP_TIMEOUT_MS"
 	rproxyDefault     = "SWRP_DEFAULT_DISPOSITION"
 	rproxyListen      = "SWRP_LISTEN_ADDR"
 	rproxyUpstream    = "SWRP_UPSTREAM_URL"
 	rproxyTrusted     = "SWRP_TRUSTED_PROXIES"
 	rproxyMaxRequest  = "SWRP_MAX_REQUEST_SIZE"
 	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
 	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
 	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
 	backendURL        = "http://servewaf:8080"
 	rproxyDefaultAddr = ":8080"
 	rproxyDefaultApp  = "http://127.0.0.1:8081"
 	notASize          = "a lot"
 )
 // rproxyConfig reads rproxy's settings from env.
 func rproxyConfig(env map[string]string) (*config.RProxy, error) {
 	return config.RProxyFromEnvironment(func(name string) (string, bool) {
 		value, ok := env[name]
 		return value, ok
 	})
 }
 func TestRProxyDefaults(t *testing.T) {
 	t.Parallel()
 	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL})
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
 	if cfg.ListenAddr != rproxyDefaultAddr ||
 		cfg.UpstreamURL.String() != rproxyDefaultApp ||
 		cfg.WAFBackend.String() != backendURL {
 		t.Errorf("addresses %q, %v, %v", cfg.ListenAddr, cfg.UpstreamURL, cfg.WAFBackend)
 	}
 	if cfg.Timeout != 2*time.Second || cfg.DefaultDisposition != "allow" {
 		t.Errorf("timeout %v, default disposition %q", cfg.Timeout, cfg.DefaultDisposition)
 	}
 	if cfg.MaxRequestSize != 100<<20 || cfg.MaxResponseSize != 1<<30 {
 		t.Errorf("sizes %d and %d", cfg.MaxRequestSize, cfg.MaxResponseSize)
 	}
 	if cfg.MaxRequestTime != time.Minute || cfg.MaxResponseTime != 30*time.Minute {
 		t.Errorf("times %v and %v", cfg.MaxRequestTime, cfg.MaxResponseTime)
 	}
 	want := []netip.Prefix{
 		netip.MustParsePrefix("10.0.0.0/8"),
 		netip.MustParsePrefix("172.16.0.0/12"),
 		netip.MustParsePrefix("192.168.0.0/16"),
 	}
 	if !slices.Equal(cfg.TrustedProxies, want) {
 		t.Errorf("trusted proxies %v, want %v", cfg.TrustedProxies, want)
 	}
 }
 func TestRProxySettingsAreRead(t *testing.T) {
 	t.Parallel()
 	cfg, err := rproxyConfig(map[string]string{
 		wafBackend:        "https://waf.example:8443",
 		rproxyListen:      ":9000",
 		rproxyUpstream:    "http://app:3000",
 		rproxyTrusted:     "192.0.2.0/24",
 		rproxyTimeout:     "150",
 		rproxyDefault:     "deny",
 		rproxyMaxRequest:  "1K",
 		rproxyMaxResponse: off,
 		rproxyRequestTime: off,
 		rproxyAnswerTime:  "250",
 	})
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
 	if cfg.ListenAddr != ":9000" || cfg.UpstreamURL.Host != "app:3000" ||
 		cfg.WAFBackend.Host != "waf.example:8443" ||
 		cfg.TrustedProxies[0] != netip.MustParsePrefix("192.0.2.0/24") {
 		t.Errorf("addresses %+v", cfg)
 	}
 	if cfg.Timeout != 150*time.Millisecond || cfg.DefaultDisposition != "deny" ||
 		cfg.MaxRequestSize != 1024 || cfg.MaxResponseSize != 0 ||
 		cfg.MaxRequestTime != 0 || cfg.MaxResponseTime != 250*time.Millisecond {
 		t.Errorf("limits %+v", cfg)
 	}
 }
 func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, value string
 	}{
 		{wafBackend, ""},
 		{wafBackend, "servewaf:8080"},
 		{wafBackend, "http://servewaf:8080/path"},
 		{rproxyTimeout, "0"},
 		{rproxyTimeout, "-1"},
 		{rproxyTimeout, off},
 		{rproxyTimeout, "2s"},
 		{rproxyTimeout, "1.25"},
 		{rproxyTimeout, "99999999999999999"},
 		{rproxyDefault, "maybe"},
 		{rproxyListen, "8080"},
 		{rproxyUpstream, "app"},
 		{rproxyTrusted, "not a netblock"},
 		{rproxyMaxRequest, notASize},
 		{rproxyMaxResponse, notASize},
 		{rproxyRequestTime, "0"},
 		{rproxyRequestTime, "1m"},
 		{rproxyAnswerTime, "0"},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 			_, err := rproxyConfig(map[string]string{wafBackend: backendURL, tc.name: tc.value})
 			if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
 				t.Errorf("error %v, want one naming %s", err, tc.name)
 			}
 		})
 	}
 }
 func TestRProxyNeedsItsBackend(t *testing.T) {
 	t.Parallel()
 	_, err := rproxyConfig(nil)
 	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
 		t.Errorf("error %v, want one saying %s is required", err, wafBackend)
 	}
 }
 func TestRProxyReadsNoFile(t *testing.T) {
 	t.Parallel()
 	path := filepath.Join(t.TempDir(), "backend")
 	err := os.WriteFile(path, []byte("http://from-a-file:8080\n"), 0o600)
 	if err != nil {
 		t.Fatalf("write: %v", err)
 	}
 	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
 	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
 		t.Errorf("error %v, want %s still required", err, wafBackend)
 	}
 	cfg, err := rproxyConfig(map[string]string{
 		wafBackend:              backendURL,
 		rproxyTimeout + "_FILE": "/nonexistent/timeout",
 	})
 	if err != nil {
 		t.Fatalf("settings: %v, with the file left unread", err)
 	}
 	if cfg.Timeout != 2*time.Second {
 		t.Errorf("timeout %v, want the default", cfg.Timeout)
 	}
 }
 func TestRProxySettingsAreLoggedByName(t *testing.T) {
 	t.Parallel()
 	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL})
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
 	group := cfg.LogValue().Group()
 	names := make([]string, 0, len(group))
 	for _, attr := range group {
 		names = append(names, attr.Key)
 	}
 	for _, name := range []string{
 		rproxyListen, rproxyUpstream, rproxyTrusted, wafBackend, rproxyTimeout, rproxyDefault,
 		rproxyMaxRequest, rproxyMaxResponse, rproxyRequestTime, rproxyAnswerTime,
 	} {
 		if !slices.Contains(names, name) {
 			t.Errorf("%s is not logged, only %v", name, names)
 		}
 	}
 }
@@ -179,7 +179,7 @@ func New(params Params) *GeoJS {
 // own address for IPv4, and an address in the same place for an IPv6
 // netblock.
 func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
-	answer, asked := g.answerOrWait(ctx, client, g.wait)
+	answer, asked := g.answerOrWait(ctx, client)
 	if asked == nil {
 		return answer
 	}
@@ -209,14 +209,6 @@ func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
 	return answer
 }
 // LookUpWithoutWaiting is LookUp for a request that does not need the answer,
 // whatever Wait says: it returns the zero Answer at once when none is kept.
 func (g *GeoJS) LookUpWithoutWaiting(ctx context.Context, client netip.Prefix) Answer {
 	answer, _ := g.answerOrWait(ctx, client, false)
 	return answer
 }
 // Kept returns client's answer, if one is kept, without asking GeoJS.
 func (g *GeoJS) Kept(client netip.Prefix) (Answer, bool) {
 	g.mu.Lock()
@@ -271,9 +263,9 @@ func (g *GeoJS) Load(answers []Answer) {
 // answerOrWait returns client's kept answer if it has one. Otherwise it
 // puts the client among those waiting if there is room, has GeoJS asked
 // about them if it can be, and returns what to wait on for the answer, or
-// nil when there is nothing to wait for or mustWait is false.
+// nil when there is nothing to wait for.
 func (g *GeoJS) answerOrWait(
-	ctx context.Context, client netip.Prefix, mustWait bool,
+	ctx context.Context, client netip.Prefix,
 ) (Answer, <-chan struct{}) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
@@ -291,7 +283,7 @@ func (g *GeoJS) answerOrWait(
 	g.ask(ctx)
-	if !mustWait {
+	if !g.wait {
 		return Answer{}, nil // the answer is not needed before the request goes on
 	}
@@ -72,39 +72,6 @@ func TestKeptAnswerIsUsedFor7DaysThenAskedAgain(t *testing.T) {
 	})
 }
 func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
 	t.Parallel()
 	synctest.Test(t, func(t *testing.T) {
 		geojs, clock, g := start()
 		client := netip.MustParsePrefix("203.0.113.9/32")
 		// Wait is set, and GeoJS does not answer.
 		geojs.set(hanging)
 		began := time.Now()
 		answer := g.LookUpWithoutWaiting(t.Context(), client)
 		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
 			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
 		}
 		waitForRequests(t, geojs, 1)
 		wantAsked(t, geojs, 0, "203.0.113.9")
 		// That request is abandoned, and has failed once this returns. GeoJS
 		// answers when it is asked again, and the answer is kept.
 		time.Sleep(timeout)
 		synctest.Wait()
 		geojs.set(answering)
 		waitForCountry(t, g, clock, client, germany)
 		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
 			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
 		}
 	})
 }
 func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	t.Parallel()
@@ -156,8 +123,8 @@ func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing
 	t.Parallel()
 	synctest.Test(t, func(t *testing.T) {
-		// A timeout longer than the default, and a GeoJS that does not
+		// A timeout longer than the default second, and a GeoJS that does
-		// answer.
+		// not answer.
 		const longerTimeout = 3 * time.Second
 		m := metrics.New(1, "app")
@@ -1,7 +1,6 @@
-// Package metrics keeps smallwebwaf's Prometheus metrics, as
+// Package metrics keeps smallwebwaf's Prometheus metrics, as the "Metrics
-// docs/metrics.md lists them, and serves them in the Prometheus text
+// endpoint" section of SPEC.md lists them, and serves them in the
-// format, as the "Metrics endpoint" section of SPEC.md requires. No
+// Prometheus text format. No metric carries a client's address.
 // metric carries a client's address.
 package metrics
 import (
@@ -403,21 +402,28 @@ func (m *Metrics) RequestEnded(
 	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
 ) {
 	m.inFlight.Dec()
 	m.count(line, limit, duration, upstreamDuration)
 }
-// RequestAllowed counts a question of rproxy's, answered allow, as no longer
+	class := statusClass(line.Status)
-// under way. RequestReported counts the request it was about.
+	m.requests.WithLabelValues(class, line.Action).Inc()
-func (m *Metrics) RequestAllowed() {
+	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
-	m.inFlight.Dec()
+	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
-}
+	m.requestDuration.Observe(duration.Seconds())
-// RequestReported counts a request rproxy passed to the app, as RequestEnded
+	if upstreamDuration > 0 {
-// does, from what its report says, which line holds.
+		m.upstreamDuration.Observe(upstreamDuration.Seconds())
-func (m *Metrics) RequestReported(
+	}
-	line *requestlog.Line, duration, upstreamDuration time.Duration,
+
-) {
+	if limit != "" {
-	m.count(line, "", duration, upstreamDuration)
+		m.sizeAndTimeLimitHits.WithLabelValues(limit).Inc()
 	}
 	if line.Country != "" {
 		m.countries.add(line.Country, line)
 	}
 	if line.ASN != "" {
 		m.asns.add(line.ASN, line)
 	}
 }
 // LimitHit counts a request that broke a rate limit, a byte limit or the
@@ -486,33 +492,6 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
 // count counts a request that has ended, as RequestEnded describes.
 func (m *Metrics) count(
 	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
 ) {
 	class := statusClass(line.Status)
 	m.requests.WithLabelValues(class, line.Action).Inc()
 	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
 	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
 	m.requestDuration.Observe(duration.Seconds())
 	if upstreamDuration > 0 {
 		m.upstreamDuration.Observe(upstreamDuration.Seconds())
 	}
 	if limit != "" {
 		m.sizeAndTimeLimitHits.WithLabelValues(limit).Inc()
 	}
 	if line.Country != "" {
 		m.countries.add(line.Country, line)
 	}
 	if line.ASN != "" {
 		m.asns.add(line.ASN, line)
 	}
 }
 // addReputationQueries adds the counter of the queries to source, a DNSBL
 // zone, or of the checks of clients with AbuseIPDB, which count tells.
 func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
@@ -41,15 +41,6 @@ var (
 	errNotAddress = errors.New("is not an address, such as 203.0.113.9")
 )
 // answerHealth answers a request for the health endpoint.
 func (rq *request) answerHealth() {
 	rq.line.Action = requestlog.ActionAdmin
 	// Set here rather than left to Go's server, which would set it only
 	// after the log line has taken the response's headers.
 	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
 	_, _ = io.WriteString(rq.out, "ok\n")
 }
 // answerAdmin answers a request for smallwebwaf itself, under
 // /_smallwebwaf/, once it has passed the checks. Each endpoint needs a
 // token, sent as Authorization: Bearer <token>: the metrics
@@ -15,11 +15,9 @@ func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
 	// anomaly counters, nor a clock, and the request no response: reading
 	// any of them to count the request panics.
 	rq := &request{
-		decision: decision{
+		h:        &handler{config: &config.Config{LookupSource: "geojs"}},
-			client:   netip.MustParseAddr("203.0.113.9"),
+		client:   netip.MustParseAddr("203.0.113.9"),
-			lookedUp: true,
+		lookedUp: true,
 		},
 		h: &handler{config: &config.Config{LookupSource: "geojs"}},
 	}
 	defer func() {
@@ -1,600 +0,0 @@
 package proxy_test
 import (
 	"fmt"
 	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
 	"slices"
 	"strconv"
 	"strings"
 	"testing"
 	"testing/synctest"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 const (
 	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
 	// servewaf has to answer.
 	answerTimeLimit = 2 * time.Second
 	// defaultLookupWait is the default of SWWAF_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
 	headerFieldLimit = 100
 	// cookieHeader is the header the cookie limit counts.
 	cookieHeader = "Cookie"
 	// tooLarge is how servewaf refuses a request over the header limits.
 	tooLarge = http.StatusRequestHeaderFieldsTooLarge
 	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
 	// that unansweredGeoJSURL names too.
 	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
 	// wholeLimit is the percentage of a rate limit that lowers it not at all.
 	wholeLimit = 100
 	// clientsDecision is the CrowdSec decision list holding client alone.
 	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
 		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
 )
 // cookies returns a Cookie header's value with count cookies.
 func cookies(count int) string {
 	parts := make([]string, 0, count)
 	for i := range count {
 		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
 	}
 	return strings.Join(parts, "; ")
 }
 // fillHeaders adds headers to a question until the checks see total header
 // fields: all but ClientHeader and PeerHeader, which servewaf removes. Go's
 // client sends nothing else but Host, which the limit does not count, once
 // User-Agent is set.
 func fillHeaders(req *http.Request, total int) {
 	req.Header.Set("User-Agent", "test")
 	for i := len(req.Header) - 2; i < total; i++ {
 		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
 	}
 }
 func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 	began := time.Now()
 	got := do(t, req)
 	if took := time.Since(began); took >= answerTimeLimit/2 {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 	wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 	if line.DurationWAF != nil {
 		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
 	}
 }
 func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 	t.Parallel()
 	repeated := make([]string, headerFieldLimit)
 	for i := range repeated {
 		repeated[i] = "1"
 	}
 	for _, tc := range []struct {
 		name string
 		make func(*http.Request)
 		// refused is true for a request over a limit, and false for one at it.
 		refused bool
 	}{
 		{"cookies at the limit", func(req *http.Request) {
 			req.Header.Set(cookieHeader, cookies(cookieLimit))
 		}, false},
 		{"cookies over the limit", func(req *http.Request) {
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 		}, true},
 		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
 			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
 		}, false},
 		{"parts of no-break spaces count", func(req *http.Request) {
 			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
 		}, true},
 		{"cookies over the limit across two headers", func(req *http.Request) {
 			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
 		}, true},
 		{"cookies without a value count", func(req *http.Request) {
 			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
 		}, true},
 		{"header fields at the limit", func(req *http.Request) {
 			fillHeaders(req, headerFieldLimit)
 		}, false},
 		{"header fields over the limit", func(req *http.Request) {
 			fillHeaders(req, headerFieldLimit+1)
 		}, true},
 		{"a header sent many times counts each time", func(req *http.Request) {
 			req.Header["X-Filler"] = repeated
 		}, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			s := startServeWAF(t, "", map[string]string{wafMode: block})
 			req := s.question(siteA, client, "/")
 			tc.make(req)
 			got := do(t, req)
 			line := s.out.requestLine(t)
 			if tc.refused {
 				wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 				return
 			}
 			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 			if line.DurationWAF == nil {
 				t.Error("the Core Rule Set did not read a request within the limits")
 			}
 		})
 	}
 }
 func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 	t.Parallel()
 	for _, env := range []map[string]string{
 		{wafMode: off},
 		{wafMode: "detect"},
 		{wafMode: block, "SWWAF_WAF_EXEMPT_PATHS": "/"},
 	} {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
 			s := startServeWAF(t, "", env)
 			req := s.question(siteA, client, "/")
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 			wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 		})
 	}
 }
 func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{wafMode: block, allowNets: client})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 }
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{mode: observe, wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 	began := time.Now()
 	got := do(t, req)
 	if took := time.Since(began); took >= answerTimeLimit/2 {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
 		t.Errorf("would_action %q and duration_waf %v, want %q and none",
 			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
 	}
 }
 func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
 	ask := func() answer {
 		req := s.question(siteA, client, "/")
 		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 		return do(t, req)
 	}
 	wantDisposition(t, ask(), tooLarge, proxy.DispositionDeny)
 	wantDisposition(t, ask(), http.StatusForbidden, proxy.DispositionDeny)
 	lines := s.out.requestLines(t, 2)
 	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
 }
 func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, path, action string
 	}{
 		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
 		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			s := startServeWAF(t, "", map[string]string{
 				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
 			})
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 			wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
 		})
 	}
 }
 func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	t.Parallel()
 	geojsURL, _ := startGeoJS(t)
 	s := startServeWAF(t, geojsURL, map[string]string{
 		unknownLimitPercent: "0", lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 	if line.LimitPercent != nil {
 		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
 	}
 	// The client is under no ban, and GeoJS places it in a country.
 	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, proxy.DispositionAllow)
 }
 func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
 	t.Parallel()
 	geojsURL, _ := startGeoJS(t)
 	s := startServeWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
 	s.server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
 		Answered: s.clock.Now(), Used: s.clock.Now(),
 	}})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
 }
 func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 	geojsURL, _ := startGeoJS(t)
 	s := startServeWAF(t, geojsURL, map[string]string{
 		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	got := do(t, req)
 	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 	if asn != asnDE || country != "DE" {
 		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
 			asn, country, asnDE)
 	}
 }
 func TestWithoutACommandTheHeaderLimitsDoNotApply(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, out := startProxy(t, app.URL, nil)
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	fillHeaders(req, headerFieldLimit+1)
 	wantStatus(t, do(t, req), http.StatusOK)
 	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
 }
 // newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
 // answers, a setting needs its answer, and everything is at its default but
 // for env. No request to it may use the network.
 func newServeWAFInBubble(t *testing.T, env map[string]string) (*proxy.Server, *output) {
 	t.Helper()
 	settings := map[string]string{deniedCountries: "KP"}
 	maps.Copy(settings, env)
 	server, out, _ := newServerWith(t, proxy.NewServeWAF, "http://app.invalid",
 		unansweredGeoJSURL, time.Now, settings)
 	return server, out
 }
 // askDirectly hands a question about a request from client straight to server,
 // as change leaves it, and returns the answer's status and how long it took.
 func askDirectly(
 	t *testing.T, server *proxy.Server, change func(*http.Request),
 ) (int, time.Duration) {
 	t.Helper()
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
 	req.Header.Set(proxy.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
 	change(req)
 	recorder := httptest.NewRecorder()
 	began := time.Now()
 	server.Handler.ServeHTTP(recorder, req)
 	return recorder.Code, time.Since(began)
 }
 // banClient bans client at now.
 func banClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
 }
 // countClient counts one request from client at now for the rate limits.
 func countClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
 }
 // listClient puts client on the blocklist at dropURL.
 func listClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 	err := server.Lists.Load([]reputation.List{{
 		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
 	}})
 	if err != nil {
 		t.Fatalf("load the blocklist: %v", err)
 	}
 }
 // decideOnClient puts client on the CrowdSec decision list.
 func decideOnClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 	loadDecisions(t, server, now, clientsDecision)
 }
 // leaveAsItIs prepares nothing.
 func leaveAsItIs(*testing.T, *proxy.Server, time.Time) {}
 func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	t.Parallel()
 	const forbidden = http.StatusForbidden
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
 		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		// cookie is the request's Cookie header.
 		cookie string
 		status int
 		action string
 	}{
 		{
 			name: "SWWAF_DENY_NETS", env: map[string]string{denyNets: client},
 			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{
 			name:    "a ban",
 			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
 		},
 		{
 			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
 			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
 		},
 		{
 			name:    "the rate limits, with a biased threshold",
 			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
 			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
 		},
 		{
 			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
 			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{
 			name:    "the CrowdSec decision list",
 			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
 			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
 		},
 		{
 			name: "the header limits", cookie: cookies(cookieLimit + 1),
 			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, so that a request that does not wait takes no time at all.
 			synctest.Test(t, func(t *testing.T) {
 				server, out := newServeWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 				status, took := askDirectly(t, server, func(req *http.Request) {
 					req.Header.Set(cookieHeader, tc.cookie)
 				})
 				if status != tc.status || took != 0 {
 					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
 						status, took, tc.status, out.text())
 				}
 				wantLine(t, out.requestLine(t), tc.status, tc.action)
 				// GeoJS's request is abandoned before the bubble ends.
 				time.Sleep(defaultLookupWait)
 			})
 		})
 	}
 }
 func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
 		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		status  int
 		action  string
 	}{
 		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
 		{
 			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
 			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
 		},
 		{
 			"a blocklist that only logs",
 			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
 			listClient, http.StatusOK, requestlog.ActionForward,
 		},
 		{
 			"a blocklist that only limits",
 			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
 			listClient, http.StatusOK, requestlog.ActionForward,
 		},
 		{
 			"over a rate limit on an exempt path",
 			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
 			countClient, http.StatusOK, requestlog.ActionForward,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			synctest.Test(t, func(t *testing.T) {
 				server, out := newServeWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 				status, took := askDirectly(t, server, func(*http.Request) {})
 				if status != tc.status || took != defaultLookupWait {
 					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
 						status, took, tc.status, defaultLookupWait, out.text())
 				}
 				wantLine(t, out.requestLine(t), tc.status, tc.action)
 			})
 		})
 	}
 }
 func TestWithoutACommandARefusedRequestStillWaitsForGeoJS(t *testing.T) {
 	t.Parallel()
 	synctest.Test(t, func(t *testing.T) {
 		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
 			time.Now, map[string]string{deniedCountries: "KP", blocklistURLs: dropURL})
 		listClient(t, server, time.Now())
 		status, took := askDirectly(t, server, func(req *http.Request) {
 			req.RemoteAddr = net.JoinHostPort(client, "1234")
 		})
 		if status != http.StatusForbidden || took != defaultLookupWait {
 			t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
 				status, took, http.StatusForbidden, defaultLookupWait, out.text())
 		}
 		wantLine(t, out.requestLine(t), http.StatusForbidden, requestlog.ActionDenied)
 	})
 }
 func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testing.T) {
 	t.Parallel()
 	held, askedGeoJS, _ := startHeldGeoJS(t)
 	// A resolver that takes every query and answers none.
 	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	t.Cleanup(func() { _ = resolver.Close() })
 	server, out, _ := newServerWith(t, func(params proxy.Params) *proxy.Server {
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 		return proxy.NewServeWAF(params)
 	}, "http://app.invalid", held, time.Now, map[string]string{
 		deniedCountries: "KP", wafMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
 		abuseIPDBKey:  accountKey,
 		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
 		crowdSecURL: held, crowdSecKey: bouncerKey,
 	})
 	// AbuseIPDB is asked only about a client with an offence.
 	group := netip.MustParsePrefix(client + "/32")
 	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
 	go server.Lists.Run(t.Context())
 	status, took := askDirectly(t, server, func(req *http.Request) {
 		req.Header.Set("User-Agent", "test")
 		req.Header.Set("Accept", "*/*")
 		req.Host = siteA
 	})
 	if status != http.StatusOK || took >= answerTimeLimit {
 		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
 			status, took, http.StatusOK, answerTimeLimit, out.text())
 	}
 	// Each outside source was asked, and none has answered. The stand-in for
 	// GeoJS is the lists' too, which name no address.
 	if !slices.Contains(askedGeoJS(), client) {
 		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
 	}
 	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
 		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
 	}
 	if checked := server.AbuseIPDB.Checked(); checked != 1 {
 		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
 	}
 }
@@ -323,7 +323,6 @@ func (rq *request) alertBan(ban bans.Ban) {
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    event,
 		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: ban.Netblock,
 		ASN:      ban.Notes.ASN,
@@ -340,11 +339,11 @@ func (rq *request) alertBan(ban bans.Ban) {
 func (rq *request) noted(now time.Time, status int) bans.Request {
 	return bans.Request{
 		Time:      now,
-		Method:    rq.line.Method,
+		Method:    rq.in.Method,
-		Host:      rq.line.Host,
+		Host:      rq.in.Host,
-		Path:      rq.requestURI,
+		Path:      rq.in.URL.RequestURI(),
 		Status:    status,
-		UserAgent: rq.line.UserAgent,
+		UserAgent: rq.in.UserAgent(),
 	}
 }
@@ -25,8 +25,6 @@ const (
 	userAgent = "ban-test/1.0"
 	// permanent is the log line's ban_expires for a permanent ban.
 	permanent = "permanent"
 	// banResponseClose is the SWWAF_BAN_RESPONSE that closes the connection.
 	banResponseClose = "close"
 )
 func TestBrokenLimitBansTheClient(t *testing.T) {
@@ -239,7 +237,7 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 		{"", http.StatusForbidden},
 		{"403", http.StatusForbidden},
 		{"429", http.StatusTooManyRequests},
-		{banResponseClose, 0},
+		{"close", 0},
 	} {
 		t.Run(banResponse+"="+tc.setting, func(t *testing.T) {
 			t.Parallel()
@@ -34,19 +34,19 @@ func biasedThresholdsSet(cfg *config.Config) bool {
 // percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
 // SWWAF_ASN_LIMIT_PERCENT_URL names gives it, the one
 // SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
-// country, unless its request skipped the wait for GeoJS,
+// country, SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists,
-// SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// the percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a
-// percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a client
+// client a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit,
-// a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
+// the percentage of SWWAF_REPUTATION_ACTION while it is limit. For the
-// percentage of SWWAF_REPUTATION_ACTION while it is limit. For the byte
+// byte limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT
-// limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the
+// take the place of the first three for an AS number or a country they
-// place of the first three for an AS number or a country they list.
+// list.
 func (rq *request) limitPercentages() (percentage, percentage) {
 	cfg := rq.h.config
 	asn, country := rq.line.ASN, rq.line.Country
 	unknown := percentage{percent: whole}
-	if country == "" && !rq.skippedLookupWait {
+	if country == "" {
 		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
 	}
@@ -284,7 +284,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
 			time.Now, map[string]string{unknownLimitPercent: "0"})
-		// Once the time the request waits for its answer is up, the client
+		// Once the second the request waits for its answer is up, the client
 		// counts as without a country, and its zero allowance refuses the
 		// request before it reaches the app.
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
@@ -1,10 +1,8 @@
 package proxy
 import (
 	"bufio"
 	"errors"
 	"io"
 	"net"
 	"net/http"
 	"sync/atomic"
@@ -213,20 +211,9 @@ func (w *responseWriter) FlushError() error {
 	return err
 }
 // Hijack takes over the connection to the client, which ReverseProxy does
 // only to pass on the app's 101 Switching Protocols: that is then the
 // status sent.
 func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
 	if err == nil {
 		w.status = http.StatusSwitchingProtocols
 	}
 	return conn, buffered, err
 }
 // Unwrap lets http.ResponseController reach net/http's own
-// ResponseWriter for what responseWriter does not do itself.
+// ResponseWriter, which is how ReverseProxy takes over the connection of
 // an upgraded request.
 func (w *responseWriter) Unwrap() http.ResponseWriter {
 	return w.ResponseWriter
 }
@@ -23,7 +23,7 @@ import (
 // limit while the Core Rule Set reads it, which it notes nothing of.
 func (rq *request) checkCoreRuleSet() string {
 	cfg := rq.h.config
-	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
+	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in.URL, cfg.WAFExemptPaths) {
 		return ""
 	}
@@ -113,7 +113,6 @@ func (rq *request) alertWAFBlock(result waf.Result) {
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    alerts.EventWAFBlock,
 		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: rq.h.clientGroup(rq.client),
 		ASN:      rq.line.ASN,
@@ -284,9 +284,9 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 // each in an AS of its own, and no other address. It returns its URL, and
 // what returns the addresses it has been asked about. A test that needs
 // the stand-in to be asked or to answer sets SWWAF_LOOKUP_TIMEOUT to an
-// hour, whether or not a request waits for the answer: on the default, a
+// hour, whether or not a request waits for the answer: on the default
-// hold-up of the test process can abandon the request to the stand-in, and
+// second, a hold-up of the test process can abandon the request to the
-// leave the client unknown.
+// stand-in, and leave the client unknown.
 func startGeoJS(t *testing.T) (string, func() []string) {
 	t.Helper()
@@ -4,7 +4,6 @@ import (
 	"context"
 	"net/http"
 	"net/netip"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 )
@@ -24,24 +23,17 @@ const (
 // SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
 // link-local address, which no lookup can place. The lookup database
 // answers at once. With GeoJS, while a setting needs the answer, such as a
-// country list or a biased threshold, a new client's request waits for it,
+// country list or a biased threshold, a new client's request waits for it.
-// unless refusedWhateverTheAnswer reports true. ctx is the request's own
+// ctx is the request's own context.
-// context.
+func (rq *request) lookUp(ctx context.Context) {
 func (rq *request) lookUp(ctx context.Context, now time.Time) {
 	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
 		return
 	}
-	client := rq.h.clientGroup(rq.client)
+	if rq.h.config.LookupSource == "file" {
-
+		rq.lookupAnswer = rq.h.lookupFile.LookUp(rq.h.clientGroup(rq.client))
-	switch {
+	} else {
-	case rq.h.config.LookupSource == "file":
+		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, rq.h.clientGroup(rq.client))
 		rq.lookupAnswer = rq.h.lookupFile.LookUp(client)
 	case rq.h.answersQuestions() && rq.refusedWhateverTheAnswer(now):
 		rq.lookupAnswer = rq.h.geojs.LookUpWithoutWaiting(ctx, client)
 		rq.skippedLookupWait = rq.lookupAnswer.Answered.IsZero()
 	default:
 		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, client)
 	}
 	rq.lookedUp = true
@@ -86,75 +86,6 @@ func TestEveryClientIsLookedUpWithoutWaitingWhileNoSettingNeedsIt(t *testing.T)
 	}
 }
 func TestRequestThatWaitedForItsLookupIsCountedWhenItGoesOn(t *testing.T) {
 	t.Parallel()
 	// The country list has a new client's request wait for its answer,
 	// which the stand-in for GeoJS gives only once released.
 	geojsURL, asked, release := startHeldGeoJS(t)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 58, 0, time.UTC)}
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now,
 		map[string]string{
 			trustedProxies:  trustLocalhost,
 			lookupTimeout:   "1h",
 			deniedCountries: "kp",
 		})
 	requestFromDE := func() *http.Request {
 		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 		req.Header.Set(forwardedFor, fromDE)
 		return req
 	}
 	// fromDE's first request arrives two seconds before a minute ends,
 	// and waits for GeoJS.
 	first, httpClient := requestFromDE(), newClient(t)
 	firstEnded := make(chan error, 1)
 	go func() {
 		res, err := httpClient.Do(first)
 		if err == nil {
 			err = readAnswer(res).err
 		}
 		firstEnded <- err
 	}()
 	waitUntil(func() bool { return len(asked()) == 1 })
 	// Half a second into the next minute, the answer is kept, as an edit
 	// of lookups.json would keep it, while the first request still waits
 	// for GeoJS. The second request goes on at once, and is counted.
 	clk.advance(2500 * time.Millisecond)
 	server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(fromDE + "/32"), ASN: asnDE, ASName: asNameDE,
 		Country: "DE", Answered: clk.Now(), Used: clk.Now(),
 	}})
 	wantStatus(t, do(t, requestFromDE()), http.StatusOK)
 	// GeoJS answers, and the first request goes on.
 	release()
 	err := <-firstEnded
 	if err != nil {
 		t.Fatalf("first request: %v", err)
 	}
 	wantLine(t, out.requestLines(t, 2)[1], http.StatusOK, requestlog.ActionForward)
 	// The third request's count holds all three: the first was counted
 	// when it went on, in the minute under way, and the second's count
 	// was kept.
 	clk.advance(500 * time.Millisecond)
 	wantStatus(t, do(t, requestFromDE()), http.StatusOK)
 	if got := out.requestLines(t, 3)[2].Counts.Minute; got != 3 {
 		t.Errorf("the third request's count in the minute is %v, want 3", got)
 	}
 }
 func TestASNumberAndNameInTheLogLineTheHistoryTheBanNotesAndTheAlert(t *testing.T) {
 	t.Parallel()
@@ -319,7 +250,7 @@ func TestLookupHeadersArePassedToTheAppAndTheClientsOwnRemoved(t *testing.T) {
 	addr, out, _ := startProxyWithClock(t, app.URL, geojsURL, time.Now, map[string]string{
 		trustedProxies:   trustLocalhost,
 		lookupTimeout:    "1h",
-		addLookupHeaders: on,
+		addLookupHeaders: "true",
 	})
 	s := &sender{t: t, addr: addr, out: out}
@@ -383,8 +314,8 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	// network, which would keep that clock from moving on: the request is
 	// handed to the proxy's handler, and GeoJS is one that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		// Not the default. The exclusive list needs the answer, and the app
+		// Not the default second. The exclusive list needs the answer, and
-		// is never reached.
+		// the app is never reached.
 		const timeout = 3 * time.Second
 		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
@@ -207,7 +207,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 		rateLimitPerMinute:  "1",
 		rateLimitExemptNets: scraper,
 		denyNets:            denied,
-		banResponse:         banResponseClose,
+		banResponse:         "close",
 		limitBanDuration:    "1h",
 		maxBanDuration:      "2h",
 	})
@@ -424,8 +424,8 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
-	// The client stops waiting for GeoJS once SWWAF_LOOKUP_TIMEOUT is up, so
+	// The client stops waiting for GeoJS after a second, so GeoJS's
-	// GeoJS's failure can come after its request has ended.
+	// failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, addr)
@@ -74,47 +74,6 @@ func TestPassesRequestAndAnswerUnchanged(t *testing.T) {
 	wantRequestFields(t, line, addr, len(requestBody), len(answerBody))
 }
 func TestPassesThePathAsSent(t *testing.T) {
 	t.Parallel()
 	for _, path := range []string{
 		// An encoded slash and a character Go escapes: |, ^, and é sent
 		// as its UTF-8 bytes.
 		"/a%2Fb|c", "/feat%2Fx/file^1", "/x%2Fy/café",
 		// A path starting with //, which Go would send as a scheme and
 		// host if it were put in URL.Opaque.
 		"//a%2Fb",
 	} {
 		t.Run(path, func(t *testing.T) {
 			t.Parallel()
 			saw := make(chan string, 1)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				saw <- r.RequestURI
 			})
 			addr, out := startProxy(t, app.URL, nil)
 			conn := dial(t, addr)
 			send(t, conn, "GET "+path+"?q=1 HTTP/1.1\r\nHost: "+appHost+"\r\n\r\n")
 			got := readResponse(t, conn)
 			if got.status != http.StatusOK {
 				t.Fatalf("status %d, want %d", got.status, http.StatusOK)
 			}
 			target := <-saw
 			if target != path+"?q=1" {
 				t.Errorf("app saw %s, want %s", target, path+"?q=1")
 			}
 			line := out.requestLine(t)
 			if line.Path != path {
 				t.Errorf("log line has path %s, want %s", line.Path, path)
 			}
 		})
 	}
 }
 // wantAppSaw checks that the app received the test's request unchanged.
 func wantAppSaw(t *testing.T, saw appSaw, body []byte) {
 	t.Helper()
@@ -192,36 +151,6 @@ func wantRequestFields(t *testing.T, line logLine, host string, sent, received i
 	}
 }
 func TestAddsNoContentTypeTheAppDidNotSend(t *testing.T) {
 	t.Parallel()
 	const typed = "text/plain"
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/typed" {
 			w.Header().Set("Content-Type", typed)
 		} else {
 			// The key with no value keeps Go's server from adding one.
 			w.Header()["Content-Type"] = nil
 		}
 		_, _ = io.WriteString(w, "<!doctype html><title>page</title>")
 	})
 	addr, _ := startProxy(t, app.URL, nil)
 	got := get(t, addr, "/")
 	if got.header.Values("Content-Type") != nil {
 		t.Errorf("client got Content-Type %q, want none",
 			got.header.Get("Content-Type"))
 	}
 	got = get(t, addr, "/typed")
 	if got.header.Get("Content-Type") != typed {
 		t.Errorf("client got Content-Type %q, want %q",
 			got.header.Get("Content-Type"), typed)
 	}
 }
 func TestStreamsTheRequestBody(t *testing.T) {
 	t.Parallel()
@@ -380,23 +309,6 @@ func echoAfterUpgrade(w http.ResponseWriter, r *http.Request) {
 	}
 }
 func TestAnswers502WhenTheAppSwitchesToAnotherProtocol(t *testing.T) {
 	t.Parallel()
 	// answerAfterUpgrade switches to websocket whatever the client asked
 	// for, and ReverseProxy passes on a switch only to the protocol the
 	// client asked for, here "websocket, foo".
 	app := startApp(t, answerAfterUpgrade)
 	addr, out := startProxy(t, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET /ws HTTP/1.1\r\nHost: app\r\n"+
 		"Connection: Upgrade\r\nUpgrade: websocket, foo\r\n\r\n")
 	wantStatus(t, readResponse(t, conn), http.StatusBadGateway)
 	wantLine(t, out.requestLine(t), http.StatusBadGateway, requestlog.ActionUpstreamError)
 }
 func TestServerHasTheDefaultLimits(t *testing.T) {
 	t.Parallel()
@@ -1,8 +1,6 @@
-// Package proxy runs the checks on each request and writes its request log
+// Package proxy passes each request to the app and the app's answer back,
-// line. New passes each request it lets through to the app and the app's
+// unchanged, within the size and time limits, and writes one request log
-// answer back, unchanged, within the size and time limits. NewServeWAF instead
+// line for each request.
 // answers rproxy's question about each request, and takes rproxy's report once
 // the visitor's answer has ended, which writes the request a second log line.
 package proxy
 import (
@@ -13,8 +11,6 @@ import (
 	"strings"
 	"time"
 	lru "github.com/hashicorp/golang-lru/v2"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
@@ -23,6 +19,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -56,8 +53,7 @@ const ClientsPath = "/_smallwebwaf/clients/"
 // Params are what New needs.
 type Params struct {
 	Config *config.Config
-	// RequestLog receives one JSON line per request, and from servewaf a second
+	// RequestLog receives one JSON line per request.
 	// when the request's report comes.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
@@ -113,23 +109,6 @@ type Server struct {
 // SWWAF_CLIENT_REQUEST_TIMEOUT while the headers arrive; the proxy
 // applies the timeouts and size limits from then on.
 func New(params Params) *Server {
 	h := newHandler(params)
 	return h.server(&http.Server{
 		Handler:           h,
 		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
 		// Off is an IdleTimeout of 0, which Go's server replaces with
 		// ReadTimeout: no limit, as long as ReadTimeout stays unset.
 		IdleTimeout: params.Config.ClientIdleTimeout,
 		// Go's server reads 4 KiB past MaxHeaderBytes before it
 		// refuses, so the limit a client meets is the setting.
 		MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
 	})
 }
 // newHandler returns the handler with what every request shares, as the
 // settings in params make it.
 func newHandler(params Params) *handler {
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	m := metrics.New(params.Config.MetricsTopN, params.Config.InstanceName)
 	lists, dnsbl, abuseIPDB := newReputation(params, m)
@@ -192,7 +171,29 @@ func newHandler(params Params) *handler {
 	m.AddBansAndClients(h.ledger, h.limiter, params.Now)
 	m.AddRules(params.Rules)
-	return h
+	return &Server{
 		Server: &http.Server{
 			Addr:              params.Config.ListenAddr,
 			Handler:           h,
 			ReadHeaderTimeout: params.Config.ClientRequestTimeout,
 			// Off is an IdleTimeout of 0, which Go's server replaces with
 			// ReadTimeout: no limit, as long as ReadTimeout stays unset.
 			IdleTimeout: params.Config.ClientIdleTimeout,
 			// Go's server reads 4 KiB past MaxHeaderBytes before it
 			// refuses, so the limit a client meets is the setting.
 			MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
 			ErrorLog:       errorLog,
 		},
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
 		GeoJS:      h.geojs,
 		Anomalies:  h.anomalies,
 		LookupFile: h.lookupFile,
 		Lists:      h.lists,
 		DNSBL:      h.dnsbl,
 		AbuseIPDB:  h.abuseIPDB,
 		Metrics:    m,
 	}
 }
 // newReputation returns the lists fetched from URLs, the DNSBL zones'
@@ -273,10 +274,6 @@ type handler struct {
 	rules       *rules.Files
 	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue
 	// awaitingReport holds, in servewaf, the decision on each answered
 	// question by its id until its report comes, and nil for a question still
 	// being handled.
 	awaitingReport *lru.Cache[string, *decision]
 }
 // newTransport returns what carries requests to the app. It never goes
@@ -302,7 +299,11 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// The health endpoint is answered at once, before any check, so that
 	// a health checker is never refused. It does not ask the app.
 	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
-		rq.answerHealth()
+		rq.line.Action = requestlog.ActionAdmin
 		// Set here rather than left to Go's server, which would set it only
 		// after the log line has taken the response's headers.
 		rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		_, _ = io.WriteString(rq.out, "ok\n")
 		return
 	}
@@ -338,23 +339,3 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq.forward(r.Context())
 }
 // server returns the Server of h, which listens at SWWAF_LISTEN_ADDR and
 // logs through h, with what httpServer sets.
 func (h *handler) server(httpServer *http.Server) *Server {
 	httpServer.Addr = h.config.ListenAddr
 	httpServer.ErrorLog = h.errorLog
 	return &Server{
 		Server:     httpServer,
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
 		GeoJS:      h.geojs,
 		Anomalies:  h.anomalies,
 		LookupFile: h.lookupFile,
 		Lists:      h.lists,
 		DNSBL:      h.dnsbl,
 		AbuseIPDB:  h.abuseIPDB,
 		Metrics:    h.metrics,
 	}
 }
@@ -91,9 +91,6 @@ const (
 // off is the value that switches a setting off.
 const off = "off"
 // on is the value that switches a setting that takes true or false on.
 const on = "true"
 // output collects what smallwebwaf writes on stdout.
 type output struct {
 	mu  sync.Mutex
@@ -287,16 +284,6 @@ func newProxy(
 ) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 	return newServerWith(t, proxy.New, appURL, geojsURL, now, env)
 }
 // newServerWith is newProxy for the server build makes.
 func newServerWith(
 	t *testing.T, build func(proxy.Params) *proxy.Server,
 	appURL, geojsURL string, now func() time.Time, env map[string]string,
 ) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 	settings := map[string]string{
 		"SWWAF_UPSTREAM_URL": appURL, rulesDir: t.TempDir(), instanceName: "app",
 		wafMode: off,
@@ -347,7 +334,7 @@ func newServerWith(
 		}
 	}
-	server := build(proxy.Params{
+	server := proxy.New(proxy.Params{
 		Config:       cfg,
 		RequestLog:   out,
 		ProcessLog:   processLog,
@@ -185,9 +185,6 @@ func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
 		"/assets/x%2Fy",
 		"/assets/x%2fy",
 		`/assets/x\y`,
 		// The same with a character Go escapes, |, for which Go's
 		// URL.EscapedPath gives /assets/x/y%7Cz, with no encoded slash.
 		"/assets/x%2Fy|z",
 	} {
 		t.Run(sent, func(t *testing.T) {
 			t.Parallel()
@@ -110,7 +110,6 @@ func (rq *request) noteHit(hit bans.ReputationHit, reason string) {
 	rq.h.metrics.ReputationHit(hit.Source)
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    alerts.EventReputationHit,
 		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: rq.h.clientGroup(rq.client),
 		ASN:      rq.line.ASN,
@@ -8,6 +8,7 @@ import (
 	"net/http/httptrace"
 	"net/http/httputil"
 	"net/netip"
 	"net/url"
 	"os"
 	"slices"
 	"strings"
@@ -21,7 +22,6 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's
@@ -39,29 +39,25 @@ type refusal struct {
 	limit  string
 }
-// decision is what the checks note of a request: its log line, and what
+// request is one request on its way through smallwebwaf, from the moment
-// counting the request needs once it has ended. servewaf keeps a copy of it
+// its headers have been read to its log line.
-// until the request's report comes. It holds no credentials, since the log line
+type request struct {
-// never does, and neither the request's objects nor their bodies.
+	h  *handler
-type decision struct {
+	in *http.Request
-	line   requestlog.Line
+	// rc sets the deadlines of the connection to the client.
-	client netip.Addr
+	rc   *http.ResponseController
-	// requestURI is the path with the query, as a ban's notes keep it.
+	out  *responseWriter
-	requestURI string
+	body *requestBody // nil for a request without a body
-	// site is, in servewaf, the host the visitor asked for, which the
+	line requestlog.Line
-	// alerts name, since one servewaf serves many sites. It is "" otherwise.
+
-	site string
+	client      netip.Addr
-	// allowed is true for a question answered with DispositionAllow.
+	peer        netip.Addr
-	allowed bool
+	peerTrusted bool
 	// lookedUp is true once the client's AS number and country have been
 	// looked up, whether or not an answer was there, and lookupAnswer is
 	// what the lookup gave then, the zero Answer while GeoJS had given none.
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// skippedLookupWait is true for a request that did not wait for GeoJS and
 	// found no answer kept. SWWAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
 	// the byte limits count once it has ended. limitPercent and
 	// bytesPercent are then its client's limit percentages for the rate
@@ -69,37 +65,18 @@ type decision struct {
 	counted                    bool
 	limitPercent, bytesPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
+	// trap path, ruleBlocked for one a block rule refused, wafBlocked for
-	// one the Core Rule Set refused, each an offence its client's history
+	// one the Core Rule Set refused, and tokenRefused for one refused for a
-	// counts.
+	// missing or wrong token, each an offence its client's history counts.
-	attack, ruleBlocked, wafBlocked bool
+	attack, ruleBlocked, wafBlocked, tokenRefused bool
 	// reputation is the reputation sources that list the client, for the
 	// notes of a ban the request makes.
 	reputation []bans.ReputationHit
 }
 // request is one request on its way through smallwebwaf, from the moment
 // its headers have been read to its log line.
 type request struct {
 	decision
 	h  *handler
 	in *http.Request
 	// rc sets the deadlines of the connection to the client.
 	rc   *http.ResponseController
 	out  *responseWriter
 	body *requestBody // nil for a request without a body
 	peer        netip.Addr
 	peerTrusted bool
 	// tokenRefused is true for a request refused for a missing or wrong
 	// token, an offence its client's history counts.
 	tokenRefused bool
 	// blocklisted is true once a blocklist is found to list the client,
 	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
 	// AbuseIPDB's score of it is a hit.
 	blocklisted, dnsblListed, abuseIPDBHit bool
-	start                                  time.Time
+	// reputation is the reputation sources that list the client, for the
 	// notes of a ban the request makes.
 	reputation []bans.ReputationHit
 	start      time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -131,62 +108,50 @@ type request struct {
 	answerStarted time.Time
 }
-// newRequest starts handling r: it works out the client from the TCP peer
+// newRequest starts handling r: it notes the time, counts the request as
-// and X-Forwarded-For, and goes on as startRequest does.
+// under way, works out the client, and starts the log line with what is
 // known of the request.
 func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 	peer := peerAddress(r)
 	trusted := h.config.TrustedProxies
 	client := clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted)
 	return h.startRequest(w, r, client, peer, isInside(peer, trusted))
 }
 // startRequest starts handling r from client, which came through peer: it
 // notes the time, counts the request as under way, and starts the log line
 // with what is known of the request. peerTrusted says whether to believe
 // the request's id and scheme, which r's headers give.
 func (h *handler) startRequest(
 	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, peerTrusted bool,
 ) *request {
 	h.metrics.RequestStarted()
 	start := time.Now()
 	peer := peerAddress(r)
 	trusted := h.config.TrustedProxies
 	peerTrusted := isInside(peer, trusted)
 	forwardedFor := r.Header.Values("X-Forwarded-For")
 	client := clientAddress(peer, forwardedFor, trusted)
 	rq := &request{
 		decision: decision{
 			client:     client,
 			requestURI: r.URL.RequestURI(),
 			line: requestlog.Line{
 				Time:             requestlog.FormatTime(start),
 				Instance:         h.config.InstanceName,
 				ClientIP:         client.String(),
 				Method:           r.Method,
 				Scheme:           scheme(r, peerTrusted),
 				Host:             r.Host,
 				Path:             rules.Path(r),
 				Query:            r.URL.RawQuery,
 				Protocol:         r.Proto,
 				Referer:          r.Referer(),
 				UserAgent:        r.UserAgent(),
 				RequestID:        requestID(r, peerTrusted),
 				PeerIP:           peer.String(),
 				ForwardedFor:     strings.Join(forwardedFor, ", "),
 				ClientGroup:      h.clientGroup(client).String(),
 				ContentType:      r.Header.Get("Content-Type"),
 				RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
 				HasAuthorization: len(r.Header.Values("Authorization")) > 0,
 				HasCookie:        len(r.Header.Values("Cookie")) > 0,
 				Action:           requestlog.ActionForward,
 			},
 		},
 		h:           h,
 		in:          r,
 		rc:          http.NewResponseController(w),
 		out:         &responseWriter{ResponseWriter: w},
 		client:      client,
 		peer:        peer,
 		peerTrusted: peerTrusted,
 		start:       start,
 		line: requestlog.Line{
 			Time:             requestlog.FormatTime(start),
 			Instance:         h.config.InstanceName,
 			ClientIP:         client.String(),
 			Method:           r.Method,
 			Scheme:           scheme(r, peerTrusted),
 			Host:             r.Host,
 			Path:             r.URL.EscapedPath(),
 			Query:            r.URL.RawQuery,
 			Protocol:         r.Proto,
 			Referer:          r.Referer(),
 			UserAgent:        r.UserAgent(),
 			RequestID:        requestID(r, peerTrusted),
 			PeerIP:           peer.String(),
 			ForwardedFor:     strings.Join(forwardedFor, ", "),
 			ClientGroup:      h.clientGroup(client).String(),
 			ContentType:      r.Header.Get("Content-Type"),
 			RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
 			HasAuthorization: len(r.Header.Values("Authorization")) > 0,
 			HasCookie:        len(r.Header.Values("Cookie")) > 0,
 			Action:           requestlog.ActionForward,
 		},
 	}
 	// A length of -1 is a body whose length was not announced.
@@ -226,12 +191,12 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 // is known, before anything reaches the app, and before its body is read,
 // but for the part the Core Rule Set reads. It returns nil to let the
 // request through. The checks of checkClient come first, answered with
-// SWWAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set, or 431 for
+// SWWAF_BAN_RESPONSE, or 403 for a block rule or the Core Rule Set, and
-// servewaf's header limits, and then the size limit, so that a request the
+// then the size limit, so that a request the rate limits count is counted
-// rate limits count is counted even when it is refused for its size. In
+// even when it is refused for its size. In observe mode a request
-// observe mode a request checkClient refuses goes on to the size limit like
+// checkClient refuses goes on to the size limit like any other. A size or
-// any other. A size or time limit the Core Rule Set's reading of the body
+// time limit the Core Rule Set's reading of the body meets ends the
-// meets ends the request in either mode. ctx is the request's own context.
+// request in either mode. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
 	action := rq.checkClient(ctx)
@@ -247,8 +212,6 @@ func (rq *request) check(ctx context.Context) *refusal {
 		rq.line.WouldAction = action
 	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
 		return &refusal{status: http.StatusForbidden, action: action}
 	case action == requestlog.ActionTooLarge:
 		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
 	default:
 		return rq.banResponse(action)
 	}
@@ -277,10 +240,9 @@ func (rq *request) check(ctx context.Context) *refusal {
 // rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, then SWWAF_TRAP_PATHS, then the rule files, then, in
+// percentages, then SWWAF_TRAP_PATHS, then the rule files, and last the
-// servewaf, the header limits, and last the Core Rule Set. A request exempt
+// Core Rule Set. A request exempt from the rate limits is exempt from the
-// from the rate limits is exempt from the byte limits too. ctx is the
+// byte limits too. ctx is the request's own context.
 // request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -297,13 +259,7 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionBanned
 	}
-	rq.lookUp(ctx, now)
+	rq.lookUp(ctx)
 	// The lookup can wait for GeoJS, so the checks after it read the time
 	// again: a request counted at the time it arrived could be counted
 	// after a later one of its client's, which the rate limits would take
 	// for the clock set back.
 	now = rq.h.now()
 	if rq.countryDenied() {
 		return requestlog.ActionCountryDenied
@@ -321,7 +277,8 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionDenied
 	}
-	rq.counted = rq.countedByRateLimits()
+	rq.counted = !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in.URL, cfg.RateLimitExemptPaths)
 	if rq.counted {
 		rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
 		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
@@ -341,24 +298,10 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return action
 	}
 	if rq.overHeaderLimits() {
 		return requestlog.ActionTooLarge
 	}
 	return rq.checkCoreRuleSet()
 }
-// countedByRateLimits reports whether the rate limits count the request: its
+// pathExempt reports whether a request for u is exempt under prefixes,
 // client is not in SWWAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
 // under SWWAF_RATE_LIMIT_EXEMPT_PATHS.
 func (rq *request) countedByRateLimits() bool {
 	cfg := rq.h.config
 	return !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
 }
 // pathExempt reports whether r is exempt under prefixes,
 // SWWAF_RATE_LIMIT_EXEMPT_PATHS or SWWAF_WAF_EXEMPT_PATHS: whether its
 // path as sent, the path the app receives, not percent-decoded, starts
 // with one of prefixes, so that /%61ssets/x is not under /assets/ for an
@@ -367,9 +310,10 @@ func (rq *request) countedByRateLimits() bool {
 // encoded slash (%2F or %2f), never is, since an app may act on it as a
 // path outside every prefix: /assets/..%2Flogin as /login, or /assets%2Fx
 // as one path segment, as Go's router does.
-func pathExempt(r *http.Request, prefixes []string) bool {
+func pathExempt(u *url.URL, prefixes []string) bool {
-	decoded := r.URL.Path
+	decoded := u.Path
-	sent := rules.Path(r)
+	// EscapedPath is the path as the app receives it, not decoded.
 	sent := u.EscapedPath()
 	if strings.Contains(decoded, "..") || strings.Contains(decoded, `\`) ||
 		strings.Contains(strings.ToLower(sent), "%2f") {
@@ -425,17 +369,6 @@ func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	// ReverseProxy drops query parameters it cannot parse; the app gets
 	// the query as the client sent it.
 	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
 	// ReverseProxy sends the path URL.EscapedPath gives, which, for a path
 	// holding a character Go escapes, such as |, is the whole path decoded
 	// and escaped again, %2F turned into /. Opaque is sent as it is, so the
 	// app gets the path as the client sent it. Left out are a target that
 	// is no path, such as *, and a path starting with //, which Go would
 	// send in Opaque as a scheme and host.
 	path := rules.Path(pr.In)
 	if strings.HasPrefix(path, "/") && !strings.HasPrefix(path, "//") {
 		pr.Out.URL.Opaque = path
 	}
 	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
 	pr.Out.Header.Set(requestIDHeader, rq.line.RequestID)
 	pr.Out.Header.Del(asnHeader)
@@ -456,10 +389,8 @@ func (rq *request) modifyResponse(res *http.Response) error {
 		// timeouts. ReverseProxy writes this answer straight to the
 		// connection it takes over, not through rq.out, and then copies
 		// what passes each way through res.Body, the connection to the app.
 		// It may still refuse the switch, as when the app's Upgrade is not
 		// the client's, so the status is noted only once it has taken over
 		// the connection, by rq.out's Hijack.
 		rq.stopTimers()
 		rq.out.status = res.StatusCode
 		rq.line.Websocket = true
 		conn, ok := res.Body.(io.ReadWriteCloser)
@@ -482,13 +413,6 @@ func (rq *request) modifyResponse(res *http.Response) error {
 		return errResponseTooLarge
 	}
 	// Go's server adds a Content-Type it guesses from the body to a
 	// response whose headers have no Content-Type key. The key with no
 	// value sends none, as the app sent none.
 	if res.Header.Get("Content-Type") == "" {
 		rq.out.Header()["Content-Type"] = nil
 	}
 	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
 	rq.startClientResponseTimeout()
@@ -498,13 +422,6 @@ func (rq *request) modifyResponse(res *http.Response) error {
 // answerError is ReverseProxy's ErrorHandler: the request could not be
 // passed to the app, or the app's answer cannot be passed on.
 func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
 	if rq.upgraded != nil {
 		// The app switched protocols, but the switch was not passed on,
 		// and ReverseProxy leaves the app's connection open when it
 		// refuses it.
 		_ = rq.upgraded.Close()
 	}
 	refused := rq.refused.Load()
 	if refused == nil {
 		if rq.in.Context().Err() != nil {
@@ -620,20 +537,10 @@ func (rq *request) finish() {
 	}
 	// Counted before the log line is written, so that the metrics count
-	// every request whose line is out. An allowed request is the exception:
+	// every request whose line is out.
-	// its report gives the status, bytes and times the metrics count.
+	rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
 	if rq.allowed {
 		rq.h.metrics.RequestAllowed()
 	} else {
 		rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
 	}
-	rq.writeLine()
+	err := requestlog.Write(rq.h.requestLog, line)
 }
 // writeLine writes the request's log line.
 func (rq *request) writeLine() {
 	err := requestlog.Write(rq.h.requestLog, &rq.line)
 	if err != nil {
 		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
 	}
@@ -695,7 +602,6 @@ func (rq *request) countAnomalies() {
 	answer, _ := rq.answerAtTheEnd()
 	rq.h.anomalies.Count(rq.h.now(), anomaly.Request{
 		Host:        rq.site,
 		Client:      rq.client,
 		ClientGroup: rq.h.clientGroup(rq.client),
 		ASN:         answer.ASN,
@@ -798,16 +704,6 @@ func (rq *request) requestTimedOut(limit string) {
 	}
 	if rq.body == nil || !rq.body.waiting.Load() {
 		// Once the app has answered, the transport, ReverseProxy and Go's
 		// server each close the client's body, and closing it reads what
 		// is left of a body under 256 KiB without requestBody.Read, so
 		// waiting is false while that read waits for the client. That
 		// read ends now, before refuse: should smallwebwaf still answer
 		// itself, answer then sets the deadline it gives its own answers.
 		if !rq.answerStarted.IsZero() {
 			rq.stopReadingBody(time.Now())
 		}
 		rq.refuse(refusal{
 			status: http.StatusGatewayTimeout,
 			action: requestlog.ActionTimedOut,
@@ -1,55 +0,0 @@
 package proxy
 import (
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			rq := &request{
 				h:   &handler{config: &config.Config{}},
 				out: &responseWriter{ResponseWriter: w},
 			}
 			app := &http.Response{
 				StatusCode: http.StatusOK,
 				Header:     http.Header{},
 				Body:       http.NoBody,
 			}
 			err := rq.modifyResponse(app)
 			if err != nil {
 				t.Errorf("modifyResponse: %v", err)
 			}
 			// The headers go out with this, the first part of the body,
 			// which Go's server would guess a Content-Type from.
 			_, _ = io.WriteString(w, "<!doctype html><title>page</title>")
 		}))
 	t.Cleanup(srv.Close)
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, srv.URL,
 		http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
 	res, err := srv.Client().Do(req)
 	if err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	_ = res.Body.Close()
 	if res.Header.Values("Content-Type") != nil {
 		t.Errorf("client got Content-Type %q, want none",
 			res.Header.Get("Content-Type"))
 	}
 }
@@ -1,527 +0,0 @@
 package proxy
 import (
 	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/netip"
 	"strconv"
 	"strings"
 	"time"
 	"unicode/utf8"
 	lru "github.com/hashicorp/golang-lru/v2"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 // The headers of rproxy's question and of servewaf's answer, as
 // "servewaf" in SPEC.md gives them.
 const (
 	// ClientHeader marks a request as rproxy's question, and gives the
 	// visitor's address.
 	ClientHeader = "X-Smallwebwaf-Client"
 	// PeerHeader gives the address of rproxy's own TCP peer.
 	PeerHeader = "X-Smallwebwaf-Peer"
 	// ContentLengthHeader gives the body length the visitor announced.
 	ContentLengthHeader = "X-Smallwebwaf-Content-Length"
 	// DispositionHeader gives servewaf's answer.
 	DispositionHeader = "X-Smallwebwaf-Disposition"
 )
 // The values of DispositionHeader.
 const (
 	// DispositionAllow tells rproxy to pass the request to the app.
 	DispositionAllow = "allow"
 	// DispositionDeny tells rproxy to give the visitor the answer's status,
 	// headers and body.
 	DispositionDeny = "deny"
 	// DispositionClose tells rproxy to close the visitor's connection
 	// without an answer, which SWWAF_BAN_RESPONSE asks for when it is close.
 	// servewaf closing the question's connection instead would read as
 	// servewaf being down, and rproxy would then let the request through.
 	DispositionClose = "close"
 )
 // ReportPath is where rproxy sends the report of each request servewaf
 // answered.
 const ReportPath = "/_smallwebwaf/report"
 // QuestionBodyMaxBytes is the most of a visitor's body a question carries.
 const QuestionBodyMaxBytes = 64 << 10
 // The header limits: the most cookies and header fields a request may have
 // when the checks reach the Core Rule Set. Real clients never reach them.
 const (
 	maxCookies      = 50
 	maxHeaderFields = 100
 )
 const (
 	// maxAwaitingReport is the most answered requests held until their
 	// reports come. Past it, the request answered longest ago is dropped.
 	maxAwaitingReport = 10000
 	// maxRequestIDBytes is the longest id a question may give.
 	maxRequestIDBytes = 128
 	// reportBodyMaxBytes is the most of a report's body that is read. It is
 	// far above any report's.
 	reportBodyMaxBytes = 1 << 20
 	// maxHTTPStatus is the highest status a report may give.
 	maxHTTPStatus = 599
 	// maxReportedBytes is the most bytes a report may give for each way, 1
 	// PiB, so that adding them up cannot overflow.
 	maxReportedBytes = 1 << 50
 	// maxReportedMilliseconds is the longest duration a report may give,
 	// about 31 years, so that it fits a time.Duration.
 	maxReportedMilliseconds = 1e12
 	// serveWAFTimeout bounds how long a request to servewaf takes to arrive,
 	// and its answer to leave, and serveWAFIdleTimeout how long a kept-open
 	// connection waits for its next request.
 	serveWAFTimeout     = 60 * time.Second
 	serveWAFIdleTimeout = 120 * time.Second
 )
 var (
 	errReportFieldMissing = errors.New("a field is missing")
 	errReportValue        = errors.New("a value is out of range")
 )
 // Report is the JSON object rproxy posts to ReportPath once the visitor's
 // answer has ended, its fields named as the request log's of the same
 // meaning. RequestID is the question's id. Status is what the visitor got, 0
 // if nothing. The durations are in milliseconds.
 //
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Report struct {
 	RequestID             string  `json:"request_id"`
 	Status                int     `json:"status"`
 	RequestBytes          int64   `json:"request_bytes"`
 	ResponseBytes         int64   `json:"response_bytes"`
 	DurationTotal         float64 `json:"duration_total"`
 	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
 }
 // NewServeWAF returns the server `smallwebwaf servewaf` runs. It answers
 // rproxy's questions with the checks New runs, takes rproxy's reports and
 // answers its own endpoints. It passes nothing to an app. rproxy applies
 // the size and time limits to the visitor, so their settings do not apply
 // here. Go's default limit on a request's line and headers, 1 MiB, stays:
 // it is far above rproxy's, and a question refused for its size would have
 // rproxy let the request through.
 func NewServeWAF(params Params) *Server {
 	cfg := *params.Config
 	cfg.RequestMaxBytes = 0
 	cfg.ClientRequestTimeout = serveWAFTimeout
 	// The server's WriteTimeout does this. It sets a new deadline for each
 	// request, where a deadline a handler sets stays on a kept-open
 	// connection, and would run out under a later request's answer.
 	cfg.ClientResponseTimeout = 0
 	// A question's body of QuestionBodyMaxBytes may be cut short, and the
 	// Core Rule Set does not read a JSON or XML body over its limit.
 	cfg.WAFBodyLimit = min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1)
 	params.Config = &cfg
 	h := newHandler(params)
 	awaitingReport, err := lru.New[string, *decision](maxAwaitingReport)
 	if err != nil {
 		panic(err) // New fails only for a size below one
 	}
 	h.awaitingReport = awaitingReport
 	return h.server(&http.Server{
 		Handler:      http.HandlerFunc(h.serveWAF),
 		ReadTimeout:  serveWAFTimeout,
 		WriteTimeout: serveWAFTimeout,
 		IdleTimeout:  serveWAFIdleTimeout,
 	})
 }
 // serveWAF handles one request to servewaf: a request carrying
 // ClientHeader is rproxy's question, and any other is for servewaf itself.
 func (h *handler) serveWAF(w http.ResponseWriter, r *http.Request) {
 	if len(r.Header.Values(ClientHeader)) > 0 {
 		h.answerQuestion(w, r)
 		return
 	}
 	h.answerOwnEndpoint(w, r)
 }
 // answersQuestions reports whether h is servewaf, which alone holds requests
 // for their reports.
 func (h *handler) answersQuestions() bool {
 	return h.awaitingReport != nil
 }
 // refusedWhateverTheAnswer reports whether the request is one that does not wait
 // for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
 // its client: it is over the header limits, a blocklist lists its client while
 // SWWAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
 // over a whole rate limit. In observe mode, which refuses nothing, none is.
 // rproxy lets a request through when servewaf answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 	if rq.h.config.Observe {
 		return false
 	}
 	lists := rq.h.lists
 	_, decided := lists.CrowdSecDecision(rq.client, now)
 	return decided || rq.overHeaderLimits() ||
 		(rq.h.config.BlocklistAction == deny && len(lists.ListedBy(rq.client)) > 0) ||
 		(rq.countedByRateLimits() &&
 			rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now))
 }
 // overHeaderLimits reports whether servewaf refuses the request for its
 // headers: it has more than maxHeaderFields fields, each value of a header sent
 // twice being one, or more than maxCookies cookies, each part of a Cookie header
 // between semicolons being one unless it is empty or only spaces and tabs. The
 // Core Rule Set runs each of its rules on each cookie, so that thousands of small
 // cookies keep it busy for over a second. It trims only spaces and control
 // characters, of which a header value can hold only tabs, so a part of Unicode
 // spaces is a cookie to it.
 func (rq *request) overHeaderLimits() bool {
 	if !rq.h.answersQuestions() {
 		return false
 	}
 	fields, cookies := 0, 0
 	for _, values := range rq.in.Header {
 		fields += len(values)
 	}
 	for _, value := range rq.in.Header.Values("Cookie") {
 		for part := range strings.SplitSeq(value, ";") {
 			if strings.Trim(part, " \t") != "" {
 				cookies++
 			}
 		}
 	}
 	return fields > maxHeaderFields || cookies > maxCookies
 }
 // answerQuestion runs the checks on the visitor's request a question
 // carries, and answers rproxy what to do with it. A denied request's counting
 // is finished here, and an allowed one's by its report.
 func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 	client, body, ok := h.readQuestion(w, r)
 	if !ok {
 		return
 	}
 	// One that cannot be read leaves the log line's peer_ip invalid.
 	peer, _ := netip.ParseAddr(r.Header.Get(PeerHeader))
 	rq := h.startRequest(w, asTheVisitorSentIt(r, body), client.Unmap(), peer.Unmap(),
 		true)
 	// The last deferred runs first, so that what is held has the finished log
 	// line. Go's server sends the answer only once this function has
 	// returned, so the report cannot come before it is held.
 	defer rq.holdForReport()
 	defer rq.finish()
 	rq.site = r.Host
 	rq.line.ServeWAFLine = requestlog.ServeWAFLineDecision
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()
 	underOwnPrefix := strings.HasPrefix(r.URL.Path, adminPrefix)
 	if refused == nil && !underOwnPrefix {
 		// In observe mode, what enforce mode would have refused counts here.
 		defer rq.countRefusal()
 		rq.allow()
 		return
 	}
 	// The last deferred runs first, as in ServeHTTP.
 	defer rq.addToHistory()
 	defer rq.countAnomalies()
 	defer rq.countRefusal()
 	if refused != nil {
 		rq.deny(*refused)
 		return
 	}
 	// The app never sees this prefix. servewaf's own endpoints are at its
 	// own address, so this answers as a path with no endpoint does.
 	rq.line.Action = requestlog.ActionAdmin
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
 	http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 }
 // readQuestion returns the visitor's address and the body a question carries,
 // and whether servewaf takes the question. It answers a question it does not
 // take with 400 and no disposition, which rproxy treats as it treats no
 // answer. The id of a question it takes is held from here on, without a
 // decision yet, so that another question with that id is refused while this
 // one is being handled.
 //
 // The body is read before any check, since Go's server does not send an answer
 // until it has read the body. A question whose body stops arriving gets no
 // answer, and is not looked at.
 func (h *handler) readQuestion(
 	w http.ResponseWriter, r *http.Request,
 ) (netip.Addr, []byte, bool) {
 	client, err := netip.ParseAddr(r.Header.Get(ClientHeader))
 	if err != nil || client.Zone() != "" {
 		h.refuseQuestion(w, ClientHeader+" is not an address without a zone")
 		return netip.Addr{}, nil, false
 	}
 	id := r.Header.Get(requestIDHeader)
 	if id == "" || len(id) > maxRequestIDBytes || !utf8.ValidString(id) {
 		h.refuseQuestion(w, requestIDHeader+" is not a valid id")
 		return netip.Addr{}, nil, false
 	}
 	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, QuestionBodyMaxBytes))
 	if _, tooLarge := errors.AsType[*http.MaxBytesError](err); tooLarge {
 		h.refuseQuestion(w, "the body is over 64 KiB")
 		return netip.Addr{}, nil, false
 	}
 	if err != nil {
 		h.processLog.Warn("a question's body stopped arriving", "error", err.Error())
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing.
 		panic(http.ErrAbortHandler)
 	}
 	held, _ := h.awaitingReport.ContainsOrAdd(id, nil)
 	if held {
 		h.refuseQuestion(w, requestIDHeader+" is the id of a request servewaf holds")
 		return netip.Addr{}, nil, false
 	}
 	return client, body, true
 }
 // refuseQuestion answers a question servewaf does not take, for reason.
 func (h *handler) refuseQuestion(w http.ResponseWriter, reason string) {
 	h.processLog.Warn("a question is refused", "reason", reason)
 	http.Error(w, reason, http.StatusBadRequest)
 }
 // asTheVisitorSentIt returns a copy of r, a question, as the checks and the
 // log line are to see it: without the headers rproxy adds for servewaf, with
 // body, which has been read of r, and with the length the visitor announced,
 // as -1 when it announced none. The question's own length covers only the part
 // of the body it carries.
 func asTheVisitorSentIt(r *http.Request, body []byte) *http.Request {
 	sent := r.Clone(r.Context())
 	announced := sent.Header.Get(ContentLengthHeader)
 	sent.Header.Del(ClientHeader)
 	sent.Header.Del(PeerHeader)
 	sent.Header.Del(ContentLengthHeader)
 	sent.Header.Del("Content-Length")
 	sent.ContentLength = -1
 	length, err := strconv.ParseInt(announced, 10, 64)
 	if err == nil && length >= 0 {
 		sent.ContentLength = length
 		sent.Header.Set("Content-Length", announced)
 	}
 	sent.Body = http.NoBody
 	if len(body) > 0 {
 		sent.Body = io.NopCloser(bytes.NewReader(body))
 	}
 	return sent
 }
 // allow answers a question with DispositionAllow and, while
 // SWWAF_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
 func (rq *request) allow() {
 	rq.allowed = true
 	header := rq.out.Header()
 	header.Set(DispositionHeader, DispositionAllow)
 	if rq.h.config.AddLookupHeaders {
 		setLookupHeaders(header, rq.line.ASN, rq.line.Country)
 	}
 	rq.out.WriteHeader(http.StatusOK)
 }
 // holdForReport holds a copy of what the report's steps need, by the request's
 // id. A report only ever reaches that copy, never the request being handled.
 func (rq *request) holdForReport() {
 	held := rq.decision
 	rq.h.awaitingReport.Add(rq.line.RequestID, &held)
 }
 // deny answers a question with what the visitor is to get for r.
 func (rq *request) deny(r refusal) {
 	if r.status == 0 {
 		// SWWAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
 		// status stays 0: the visitor is sent nothing.
 		rq.refused.CompareAndSwap(nil, &r)
 		rq.out.Header().Set(DispositionHeader, DispositionClose)
 		rq.out.ResponseWriter.WriteHeader(http.StatusOK)
 		return
 	}
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
 	rq.answer(r)
 }
 // answerOwnEndpoint answers a request to servewaf's own address. No check
 // runs on it: the address is on the private network, where the peers are
 // rproxy and the admin's tools, not visitors.
 func (h *handler) answerOwnEndpoint(w http.ResponseWriter, r *http.Request) {
 	if r.Method == http.MethodPost && r.URL.Path == ReportPath {
 		h.takeReport(w, r)
 		return
 	}
 	peer := peerAddress(r)
 	rq := h.startRequest(w, r, peer, peer, false)
 	defer rq.finish()
 	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
 		rq.answerHealth()
 		return
 	}
 	rq.answerAdmin()
 }
 // takeReport answers POST ReportPath: it finishes the request the report
 // names, if it holds that request's decision, and ignores the report
 // otherwise.
 func (h *handler) takeReport(w http.ResponseWriter, r *http.Request) {
 	report, err := readReport(w, r)
 	if err != nil {
 		h.processLog.Warn("a report is refused", "error", err.Error())
 		http.Error(w, "the body is not a report", http.StatusBadRequest)
 		return
 	}
 	held, found := h.awaitingReport.Peek(report.RequestID)
 	// Remove reports true to one report only, of several that name the id.
 	if found && held != nil && h.awaitingReport.Remove(report.RequestID) {
 		h.finishWith(held, report)
 	}
 	w.WriteHeader(http.StatusNoContent)
 }
 // readReport reads a report from r's body, which must be one JSON object with
 // all of Report's fields, in the ranges SPEC.md gives.
 func readReport(w http.ResponseWriter, r *http.Request) (Report, error) {
 	var report Report
 	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, reportBodyMaxBytes))
 	if err != nil {
 		return report, fmt.Errorf("read the body: %w", err)
 	}
 	var fields map[string]json.RawMessage
 	err = json.Unmarshal(body, &fields)
 	if err != nil {
 		return report, fmt.Errorf("decode the body: %w", err)
 	}
 	for _, name := range []string{
 		"request_id", "status", "request_bytes", "response_bytes",
 		"duration_total", "duration_upstream_total",
 	} {
 		value, there := fields[name]
 		if !there || string(value) == "null" {
 			return report, fmt.Errorf("%w: %s", errReportFieldMissing, name)
 		}
 	}
 	err = json.Unmarshal(body, &report)
 	if err != nil {
 		return report, fmt.Errorf("decode the body: %w", err)
 	}
 	return report, report.checkRanges()
 }
 // checkRanges returns an error for a value of the report that cannot be true.
 func (report *Report) checkRanges() error {
 	switch {
 	case report.Status != 0 &&
 		(report.Status < http.StatusContinue || report.Status > maxHTTPStatus):
 		return fmt.Errorf("%w: status", errReportValue)
 	case report.RequestBytes < 0 || report.RequestBytes > maxReportedBytes:
 		return fmt.Errorf("%w: request_bytes", errReportValue)
 	case report.ResponseBytes < 0 || report.ResponseBytes > maxReportedBytes:
 		return fmt.Errorf("%w: response_bytes", errReportValue)
 	case report.DurationTotal < 0 || report.DurationTotal > maxReportedMilliseconds:
 		return fmt.Errorf("%w: duration_total", errReportValue)
 	case report.DurationUpstreamTotal < 0 ||
 		report.DurationUpstreamTotal > maxReportedMilliseconds:
 		return fmt.Errorf("%w: duration_upstream_total", errReportValue)
 	}
 	return nil
 }
 // finishWith finishes a request with what its report says, and writes the
 // request's last log line, which holds its decision's fields and the report's.
 // For an allowed request it first takes the steps ServeHTTP takes once a
 // request passed to the app has ended, with the status and bytes of the report
 // in place of those it would have seen. A denied request's counting was
 // finished at its decision.
 func (h *handler) finishWith(held *decision, report Report) {
 	rq := &request{
 		decision: *held,
 		h:        h,
 		out:      &responseWriter{status: report.Status, bytes: report.ResponseBytes},
 		body:     &requestBody{},
 	}
 	rq.body.bytes.Store(report.RequestBytes)
 	rq.line.ServeWAFLine = requestlog.ServeWAFLineReport
 	rq.line.Status = report.Status
 	rq.line.RequestBytes = report.RequestBytes
 	rq.line.ResponseBytes = report.ResponseBytes
 	rq.line.DurationTotal = report.DurationTotal
 	if rq.allowed {
 		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
 		// addToHistory goes by this for whether the request reached the app.
 		rq.upstreamStart = time.Now()
 		rq.countBytes()
 		rq.countAnomalies()
 		rq.addToHistory()
 		rq.h.metrics.RequestReported(&rq.line,
 			time.Duration(report.DurationTotal*float64(time.Millisecond)),
 			time.Duration(report.DurationUpstreamTotal*float64(time.Millisecond)))
 	}
 	rq.writeLine()
 }
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -198,25 +197,9 @@ func sendLargeBody(t *testing.T, addr string) net.Conn {
 func TestClientStopsSendingAfterTheAppHasAnswered(t *testing.T) {
 	t.Parallel()
-	// answeredAt is when the app answered, or nil if the bytes the client
+	// The app answers at once without reading the body, as an app does
-	// sent never reached it.
+	// for a path it does not serve.
-	var answeredAt atomic.Pointer[time.Time]
+	app := startApp(t, http.NotFound)
 	// The app answers without reading the whole body, as an app does for
 	// a path it does not serve, and only once smallwebwaf waits for the
 	// rest of it: the app takes the bytes the client sent, and then waits
 	// half the timeout, far longer than smallwebwaf takes to go on to
 	// wait.
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, err := io.ReadFull(r.Body, make([]byte, len("the first bytes")))
 		if err != nil {
 			return
 		}
 		time.Sleep(shortTimeout / 2)
 		answeredAt.Store(new(time.Now()))
 		http.NotFound(w, r)
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		clientRequestTimeout: shortTimeoutSetting,
 		metricsToken:         token,
@@ -226,120 +209,13 @@ func TestClientStopsSendingAfterTheAppHasAnswered(t *testing.T) {
 	got := readResponse(t, sendPartOfBody(t, addr))
 	wantTimedOut(t, start)
 	// Close returns once the app has finished with the request.
 	app.Close()
 	// The app's answer came before the time ran out, so the client is
-	// sent that answer, not smallwebwaf's 408. Only a hold-up of the test
+	// sent that answer, not smallwebwaf's 408.
-	// process can make it come later, and SPEC.md then asks for 408, as
+	wantStatus(t, got, http.StatusNotFound)
-	// smallwebwaf was waiting for the client, or for 504 if the bytes the
+	wantLine(t, out.requestLine(t), http.StatusNotFound, requestlog.ActionTimedOut)
 	// client sent had not reached the app.
 	at := answeredAt.Load()
 	want := http.StatusNotFound
 	switch {
 	case at == nil:
 		want = http.StatusGatewayTimeout
 	case at.Sub(start) >= shortTimeout:
 		want = http.StatusRequestTimeout
 	}
 	wantStatus(t, got, want)
 	wantLine(t, out.requestLine(t), want, requestlog.ActionTimedOut)
 	wantLimitHits(t, addr, clientRequestTimeout, 1)
 }
 func TestClientStopsSendingWithLittleOfItsBodyLeft(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		// limit is the setting set to shortTimeout, which runs out, and
 		// clientTimeout what SWWAF_CLIENT_REQUEST_TIMEOUT is set to when it
 		// is not limit.
 		limit, clientTimeout string
 	}{
 		{
 			name:  "client request timeout",
 			limit: clientRequestTimeout,
 		},
 		{
 			name:          "upstream request timeout, client request timeout off",
 			limit:         upstreamRequestTimeout,
 			clientTimeout: off,
 		},
 		{
 			name:          "upstream request timeout, client request timeout longer",
 			limit:         upstreamRequestTimeout,
 			clientTimeout: longTimeoutSetting,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			// appClosed is closed once smallwebwaf has closed its
 			// connection to the app, which it does once it has the app's
 			// answer.
 			appClosed := make(chan struct{})
 			// The app answers without reading the rest of the body, and
 			// says it closes the connection, only once smallwebwaf waits
 			// for the client to send more: it takes the bytes the client
 			// sent, and then waits half the timeout, far longer than
 			// smallwebwaf takes to go on to wait.
 			app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 				conn, buf, err := http.NewResponseController(w).Hijack()
 				if err != nil {
 					return
 				}
 				_, _ = io.ReadFull(buf.Reader, make([]byte, len("the first bytes")))
 				time.Sleep(shortTimeout / 2)
 				_, _ = buf.WriteString("HTTP/1.1 404 Not Found\r\n" +
 					"Content-Length: 0\r\nConnection: close\r\n\r\n")
 				_ = buf.Flush()
 				_, _ = io.Copy(io.Discard, buf.Reader)
 				_ = conn.Close()
 				close(appClosed)
 			})
 			env := map[string]string{tc.limit: shortTimeoutSetting, metricsToken: token}
 			if tc.clientTimeout != "" {
 				env[clientRequestTimeout] = tc.clientTimeout
 			}
 			addr, out := startProxy(t, app.URL, env)
 			// Less than 256 KiB of the body is left after the first bytes,
 			// little enough for Go's server in smallwebwaf to read the rest
 			// itself before it sends the app's answer.
 			start := time.Now()
 			conn := dial(t, addr)
 			send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: 200000\r\n\r\n"+
 				"the first bytes")
 			select {
 			case <-appClosed:
 			case <-time.After(waitLimit):
 				t.Fatal("smallwebwaf did not close its connection to the app")
 			}
 			// More of the body, which can no longer go to the app, and then
 			// nothing.
 			send(t, conn, strings.Repeat("x", 8<<10))
 			got := readResponse(t, conn)
 			wantTimedOut(t, start)
 			wantStatus(t, got, http.StatusNotFound)
 			wantLine(t, out.requestLine(t), http.StatusNotFound, requestlog.ActionTimedOut)
 			wantLimitHits(t, addr, tc.limit, 1)
 		})
 	}
 }
 func TestAppTooSlowToAnswer(t *testing.T) {
 	t.Parallel()
@@ -206,7 +206,7 @@ type Hit struct {
 // Counts are a client's requests and bytes in the minute, the hour and
 // the day that end at a request, that request's included.
 //
-//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
+//nolint:tagliatelle // SPEC.md's request log names its fields in snake_case
 type Counts struct {
 	Minute      float64 `json:"minute"`
 	Hour        float64 `json:"hour"`
@@ -228,30 +228,6 @@ func (l *Limiter) Count(
 	return l.count(client, now, 1, 0, percent)
 }
 // OverARateLimit reports whether one more request from client at now would
 // take it over a whole rate limit. A client's percentage can only lower a
 // limit, so that request is over the limit at any percentage. It counts
 // nothing, and does not make the client the most recently seen.
 func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	c, seen := l.clients.Peek(client)
 	if !seen {
 		return false
 	}
 	buckets := c.buckets()
 	for i, w := range l.windows {
 		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
 			return true
 		}
 	}
 	return false
 }
 // CountBytes counts bytes, those of a request from client that has ended,
 // at now, in every window, and returns the client's counts in each window.
 // It reports whether the bytes take the client over a byte limit, of which
@@ -26,50 +26,6 @@ const (
 	hour   = "hour"
 )
 func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.T) {
 	t.Parallel()
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
 	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
 		tableSize)
 	if limiter.OverARateLimit(client, now) {
 		t.Error("a client never seen is over a rate limit")
 	}
 	if limiter.Len() != 0 {
 		t.Error("asking about a client never seen added it to the table")
 	}
 	for range limit {
 		if limiter.OverARateLimit(client, now) {
 			t.Error("a client with room for another request is over a rate limit")
 		}
 		wantCount(t, limiter, client, now, "")
 	}
 	if !limiter.OverARateLimit(client, now) {
 		t.Error("a client at its limit is not over a rate limit")
 	}
 	held, _ := limiter.Client(client)
 	if held.Minute.Current != limit {
 		t.Errorf("the client's minute holds %d requests, want %d", held.Minute.Current, limit)
 	}
 	wantCount(t, limiter, client, now, minute)
 	// A limit that is off is never gone over.
 	off := ratelimit.New(ratelimit.Limits{}, tableSize)
 	off.Count(client, now, whole)
 	if off.OverARateLimit(client, now) {
 		t.Error("a client is over a rate limit that is off")
 	}
 }
 func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 	t.Parallel()
@@ -1,7 +1,6 @@
 // Package requestlog writes the lines smallwebwaf prints on stdout: one
-// JSON object per request, two from servewaf and a short one from rproxy, marked
+// JSON object per request, marked "type":"request", and the process's own
-// "type":"request", and the process's own messages as JSON lines marked
+// messages as JSON lines marked "type":"process".
 // "type":"process".
 package requestlog
 import (
@@ -19,8 +18,7 @@ import (
 const (
 	// ActionForward is a request passed to the app.
 	ActionForward = "forward"
-	// ActionTooLarge is a request or response over its size limit, or, in
+	// ActionTooLarge is a request or response over its size limit.
 	// servewaf, a request over the header limits.
 	ActionTooLarge = "too_large"
 	// ActionTimedOut is a request or response that ran out of time.
 	ActionTimedOut = "timed_out"
@@ -62,29 +60,17 @@ const OffenceLimit = "limit"
 // that broke the error burst.
 const LimitHitErrorBurst = "error_burst"
 // The servewaf_line a request line names, which says which of servewaf's two
 // lines about a question it is.
 const (
 	// ServeWAFLineDecision is servewaf's line at its decision.
 	ServeWAFLineDecision = "decision"
 	// ServeWAFLineReport is servewaf's line when rproxy's report comes, with
 	// the decision's fields and the report's together.
 	ServeWAFLineReport = "report"
 )
 // timeLayout is RFC 3339 with milliseconds.
 const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 // Line is one request's line in the request log. The field names, and
-// their order, are those of docs/request-log.md. A field that may not
+// their order, are those of the "Request log" section of SPEC.md. A field
-// apply to a request is left out of its line when it does not.
+// that may not apply to a request is left out of its line when it does
 // not.
 //
-//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
+//nolint:tagliatelle // SPEC.md's request log names its fields in snake_case
 type Line struct {
 	Type string `json:"type"`
 	// ServeWAFLine is ServeWAFLineDecision or ServeWAFLineReport on servewaf's
 	// two lines about a question.
 	ServeWAFLine string `json:"servewaf_line,omitempty"`
 	// The standard web log fields. Scheme is how the client reached
 	// smallwebwaf, or the trusted proxy in front of it.
@@ -141,8 +127,7 @@ type Line struct {
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
 	// ActionBanned, ActionCountryDenied, ActionRateLimited,
-	// ActionRuleBlocked, ActionWAFBlocked, or, in servewaf, ActionTooLarge
+	// ActionRuleBlocked or ActionWAFBlocked.
 	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
@@ -196,51 +181,10 @@ type Line struct {
 	DurationUpstreamTotal     *float64 `json:"duration_upstream_total,omitempty"`
 }
 // RProxyLine is rproxy's short line in the request log about one request. The
 // field names, and their order, are those of docs/request-log.md. A field that
 // does not apply to a request is left out of its line.
 //
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type RProxyLine struct {
 	Type          string `json:"type"`
 	Time          string `json:"time"`
 	RequestID     string `json:"request_id"`
 	ClientIP      string `json:"client_ip"`
 	Host          string `json:"host"`
 	Method        string `json:"method"`
 	Path          string `json:"path"`
 	Query         string `json:"query"`
 	Status        int    `json:"status"`
 	RequestBytes  int64  `json:"request_bytes"`
 	ResponseBytes int64  `json:"response_bytes"`
 	// DurationRequest runs in milliseconds from the request's headers being read
 	// until the app has been sent the whole request, or the answer has started
 	// if that is sooner. DurationResponse runs from then until the answer ends.
 	DurationRequest  float64 `json:"duration_request"`
 	DurationResponse float64 `json:"duration_response"`
 	// Disposition is the valid disposition servewaf answered or, while
 	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`
 	DefaultDisposition bool   `json:"default_disposition,omitempty"`
 }
 // Write writes line to w as one JSON line marked "type":"request".
 func Write(w io.Writer, line *Line) error {
 	line.Type = "request"
 	return writeJSONLine(w, line)
 }
 // WriteRProxyLine writes line to w as one JSON line marked "type":"request".
 func WriteRProxyLine(w io.Writer, line *RProxyLine) error {
 	line.Type = "request"
 	return writeJSONLine(w, line)
 }
 // writeJSONLine writes line to w as one JSON line.
 func writeJSONLine(w io.Writer, line any) error {
 	encoded, err := json.Marshal(line)
 	if err != nil {
 		return fmt.Errorf("encode the request log line: %w", err)
@@ -67,28 +67,6 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	}
 }
 func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
 	t.Parallel()
 	var out bytes.Buffer
 	err := requestlog.WriteRProxyLine(&out, &requestlog.RProxyLine{
 		RequestID:   "an-id",
 		Disposition: "allow",
 	})
 	if err != nil {
 		t.Fatalf("write: %v", err)
 	}
 	const want = `{"type":"request","time":"","request_id":"an-id","client_ip":"",` +
 		`"host":"","method":"","path":"","query":"","status":0,"request_bytes":0,` +
 		`"response_bytes":0,"duration_request":0,"duration_response":0,` +
 		`"disposition":"allow"}` + "\n"
 	if out.String() != want {
 		t.Errorf("wrote %s, want %s", out.String(), want)
 	}
 }
 func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 	t.Parallel()
@@ -1,211 +0,0 @@
 package rproxy
 import (
 	"bufio"
 	"errors"
 	"io"
 	"net"
 	"net/http"
 	"sync/atomic"
 )
 // errResponseTooLarge ends an app's response body that is longer than
 // SWRP_MAX_RESPONSE_SIZE.
 var errResponseTooLarge = errors.New(
 	"the response body is over SWRP_MAX_RESPONSE_SIZE")
 // requestBody is the visitor's request body. rproxy first reads up to the first
 // 64 KiB of it into held, and then, on its way to the app, the transport reads
 // it on a goroutine of its own.
 type requestBody struct {
 	// body is the visitor's body, ending in an *http.MaxBytesError past
 	// SWRP_MAX_REQUEST_SIZE.
 	body io.ReadCloser
 	rq   *request
 	// held is the part read before the request goes to the app, which Read gives
 	// first.
 	held []byte
 	// waiting is true while a Read waits for the visitor to send more.
 	waiting atomic.Bool
 	// received is true once the visitor has sent the whole body.
 	received atomic.Bool
 	// bytes is how much of the body has been read.
 	bytes atomic.Int64
 }
 // Read reads from the visitor's body, after the part held, which has been
 // counted already.
 func (b *requestBody) Read(p []byte) (int, error) {
 	if len(b.held) > 0 {
 		n := copy(p, b.held)
 		b.held = b.held[n:]
 		return n, nil
 	}
 	b.waiting.Store(true)
 	n, err := b.body.Read(p)
 	b.waiting.Store(false)
 	b.bytes.Add(int64(n))
 	var tooLarge *http.MaxBytesError
 	switch {
 	case errors.Is(err, io.EOF):
 		b.received.Store(true)
 	case errors.As(err, &tooLarge):
 		b.rq.refuse(http.StatusRequestEntityTooLarge)
 	}
 	return n, err
 }
 // Close closes the visitor's body.
 func (b *requestBody) Close() error {
 	return b.body.Close()
 }
 // responseBody is the app's response body on its way to the visitor.
 type responseBody struct {
 	// body is the app's body, ending in an *http.MaxBytesError past
 	// SWRP_MAX_RESPONSE_SIZE.
 	body io.ReadCloser
 	rq   *request
 }
 // Read reads from the app's body.
 func (b *responseBody) Read(p []byte) (int, error) {
 	n, err := b.body.Read(p)
 	if err == nil {
 		return n, nil
 	}
 	var tooLarge *http.MaxBytesError
 	switch {
 	case errors.Is(err, io.EOF):
 		b.rq.responseReceived()
 	case errors.As(err, &tooLarge):
 		b.rq.refuse(http.StatusBadGateway)
 		return n, errResponseTooLarge
 	case b.rq.in.Context().Err() == nil:
 		// The answer broke off, not because the visitor went away. If a time
 		// limit cut it, that refusal came first and is the one kept.
 		b.rq.refuse(http.StatusBadGateway)
 	}
 	return n, err
 }
 // Close closes the app's body.
 func (b *responseBody) Close() error {
 	return b.body.Close()
 }
 // upgradedConn is the connection to the app once the app has switched
 // protocols, as for a WebSocket. ReverseProxy writes to it what the visitor
 // sends and reads from it what the app sends, on goroutines of its own, until
 // the connection closes; it counts the bytes each way, for the report.
 type upgradedConn struct {
 	io.ReadWriteCloser
 	// fromApp is how many bytes the app has sent, and toApp how many the
 	// visitor has.
 	fromApp atomic.Int64
 	toApp   atomic.Int64
 }
 // Read reads what the app sends.
 func (c *upgradedConn) Read(p []byte) (int, error) {
 	n, err := c.ReadWriteCloser.Read(p)
 	c.fromApp.Add(int64(n))
 	return n, err
 }
 // Write sends the app what the visitor sent.
 func (c *upgradedConn) Write(p []byte) (int, error) {
 	n, err := c.ReadWriteCloser.Write(p)
 	c.toApp.Add(int64(n))
 	return n, err
 }
 // CloseWrite tells the app that the visitor sends no more, while what the app
 // sends still passes. ReverseProxy calls it once the visitor has stopped
 // sending, and closes the connection there if it is not supported.
 func (c *upgradedConn) CloseWrite() error {
 	conn, ok := c.ReadWriteCloser.(interface{ CloseWrite() error })
 	if !ok {
 		return http.ErrNotSupported
 	}
 	return conn.CloseWrite()
 }
 // limitBody returns body, cut off with an *http.MaxBytesError after maxBytes, or
 // unchanged if maxBytes is zero, which is off.
 func limitBody(body io.ReadCloser, maxBytes int64) io.ReadCloser {
 	if maxBytes == 0 {
 		return body
 	}
 	// Without a ResponseWriter, MaxBytesReader only counts and cuts off.
 	return http.MaxBytesReader(nil, body, maxBytes)
 }
 // responseWriter is the response to the visitor. It notes the status and size
 // for the log line and the report.
 type responseWriter struct {
 	http.ResponseWriter
 	// status is the final status sent, or zero before one is.
 	status int
 	bytes  int64
 }
 // WriteHeader sends the status and headers. An informational 1xx status is
 // passed on and the final status still comes later.
 func (w *responseWriter) WriteHeader(status int) {
 	if status >= http.StatusOK && w.status == 0 {
 		w.status = status
 	}
 	w.ResponseWriter.WriteHeader(status)
 }
 // Write sends part of the body.
 func (w *responseWriter) Write(p []byte) (int, error) {
 	if w.status == 0 {
 		w.status = http.StatusOK
 	}
 	n, err := w.ResponseWriter.Write(p) //nolint:gosec // the answer, as it was given
 	w.bytes += int64(n)
 	return n, err
 }
 // FlushError sends what has been written so far. http.ResponseController calls
 // it, as ReverseProxy does after each write.
 func (w *responseWriter) FlushError() error {
 	return http.NewResponseController(w.ResponseWriter).Flush()
 }
 // Hijack takes over the connection to the visitor, which ReverseProxy does only
 // to pass on the app's 101 Switching Protocols: that is then the status sent.
 func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
 	if err == nil {
 		w.status = http.StatusSwitchingProtocols
 	}
 	return conn, buffered, err
 }
 // Unwrap lets http.ResponseController reach net/http's own ResponseWriter for
 // what responseWriter does not do itself.
 func (w *responseWriter) Unwrap() http.ResponseWriter {
 	return w.ResponseWriter
 }
@@ -1,122 +0,0 @@
 package rproxy
 import (
 	"net/http"
 	"net/netip"
 	"slices"
 	"strings"
 )
 // The headers rproxy sets on the requests it passes to the app. Go writes every
 // header name in this form, as it sends it and as it receives it, so
 // X-Client-ASN arrives as X-Client-Asn, and Del removes a visitor's own whatever
 // their case; header names are not case-sensitive.
 const (
 	requestIDHeader = "X-Request-ID"
 	asnHeader       = "X-Client-Asn"
 	countryHeader   = "X-Client-Country"
 )
 // peerAddress is the address of the request's TCP peer, normally traefik, without
 // any IPv6 zone, which servewaf refuses.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
 		return netip.Addr{}
 	}
 	return addrPort.Addr().Unmap().WithZone("")
 }
 // clientAddress works out who the visitor is. A peer outside the trusted
 // proxies is the visitor, and what it says in X-Forwarded-For is ignored. For a
 // peer inside them, X-Forwarded-For is read from the right, and the first
 // address outside them is the visitor; if every address in it is inside, the
 // leftmost is, and with no header, the peer. An entry that is not an address
 // ends the reading, since nothing to its left can be believed. The visitor's
 // address never has an IPv6 zone, which servewaf refuses.
 func clientAddress(
 	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
 ) netip.Addr {
 	client := peer
 	if !isInside(peer, trusted) {
 		return client
 	}
 	entries := strings.Split(strings.Join(forwardedFor, ","), ",")
 	for _, entry := range slices.Backward(entries) {
 		addr, err := netip.ParseAddr(strings.TrimSpace(entry))
 		if err != nil {
 			break
 		}
 		client = addr.Unmap().WithZone("")
 		if !isInside(client, trusted) {
 			break
 		}
 	}
 	return client
 }
 // scheme is how the visitor reached traefik, as a trusted proxy says in
 // X-Forwarded-Proto, or otherwise http, the only scheme rproxy serves.
 func scheme(r *http.Request, peerTrusted bool) string {
 	proto := r.Header.Get("X-Forwarded-Proto")
 	if !peerTrusted || proto == "" {
 		return "http"
 	}
 	return proto
 }
 // isInside reports whether addr is in one of the netblocks.
 func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {
 		return netblock.Contains(addr)
 	})
 }
 // setForwardedHeaders sets the headers in which the app learns about the
 // visitor, so that it sees what it would see from traefik directly. A trusted
 // proxy's forwarded headers pass on, with the proxy's own address added to
 // X-Forwarded-For. Those of any other peer are its own claims and are replaced:
 // X-Forwarded-For names the peer, X-Forwarded-Host the host it asked for, and
 // X-Forwarded-Proto plain http, which is how it reached rproxy.
 func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 	forwardedFor := peer.String()
 	if trusted {
 		// ReverseProxy removes these from out before Rewrite.
 		for _, name := range []string{"Forwarded", "X-Forwarded-Host", "X-Forwarded-Proto"} {
 			values, ok := in.Header[name]
 			if ok {
 				out.Header[name] = values
 			}
 		}
 		prior := in.Header.Values("X-Forwarded-For")
 		if len(prior) > 0 {
 			forwardedFor = strings.Join(prior, ", ") + ", " + forwardedFor
 		}
 		out.Header.Set("X-Forwarded-For", forwardedFor)
 		return
 	}
 	// ReverseProxy has removed Forwarded and the three set below; these are the
 	// other headers in which traefik tells the app about the visitor and its
 	// request.
 	for _, name := range []string{
 		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
 		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	} {
 		out.Header.Del(name)
 	}
 	out.Header.Set("X-Forwarded-For", forwardedFor)
 	out.Header.Set("X-Forwarded-Host", in.Host)
 	out.Header.Set("X-Forwarded-Proto", "http")
 }
@@ -1,811 +0,0 @@
 package rproxy_test
 import (
 	"bytes"
 	"io"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 )
 // post is the start of a POST whose headers end with what follows it.
 const post = "POST / HTTP/1.1\r\nHost: site.example\r\n"
 // announcedLength is the header that announces a body of size bytes, and the
 // end of the headers.
 func announcedLength(size int) string {
 	return "Content-Length: " + strconv.Itoa(size) + "\r\n\r\n"
 }
 func TestServerHasTheFixedLimits(t *testing.T) {
 	t.Parallel()
 	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
 		if name == "SWRP_WAF_BACKEND" {
 			return nowhere, true
 		}
 		return "", false
 	})
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: io.Discard,
 		ProcessLog: requestlog.NewProcessLogger(io.Discard, "test", slog.LevelInfo),
 	})
 	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
 		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
 		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
 			"header timeout %s", server.Addr, server.MaxHeaderBytes,
 			server.IdleTimeout, server.ReadHeaderTimeout)
 	}
 }
 func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, limit string
 		size, asked int
 	}{
 		{"with the limit within the first part", "1K", 1025, 1024},
 		{"with the limit past the first part", "128K", 129 << 10, questionBodyMaxBytes},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestSize: tc.limit,
 			})
 			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 				bytes.NewReader(make([]byte, tc.size))))
 			if got.status != http.StatusRequestEntityTooLarge {
 				t.Errorf("answered %+v, want 413", got)
 			}
 			if asked := servewaf.question(t); len(asked.body) != tc.asked {
 				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
 			}
 			report := servewaf.report(t)
 			if report.Status != http.StatusRequestEntityTooLarge {
 				t.Errorf("report %+v, want status 413", report)
 			}
 		})
 	}
 }
 func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestSize: "1K",
 	})
 	got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 		bytes.NewReader(make([]byte, 1025))))
 	if got.status != http.StatusForbidden {
 		t.Errorf("answered %+v, want servewaf's 403", got)
 	}
 }
 func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, limit string
 		size        int
 		// mayReachApp is true when the part of the body the limit lets through
 		// goes on to the app before the limit is met. The app may still not have
 		// started on the request when it is cut off.
 		mayReachApp bool
 	}{
 		{"within the first part", "1K", 2 << 10, false},
 		{"past the first part", "128K", 129 << 10, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			var asked atomic.Bool
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				asked.Store(true)
 				greet(w, r)
 			})
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestSize: tc.limit,
 			})
 			conn := dial(t, addr)
 			send(t, conn, post+"Transfer-Encoding: chunked\r\n\r\n"+
 				strconv.FormatInt(int64(tc.size), 16)+"\r\n"+strings.Repeat("x", tc.size)+
 				"\r\n0\r\n\r\n")
 			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
 				t.Errorf("status %d, want 413", status)
 			}
 			if asked.Load() && !tc.mayReachApp {
 				t.Error("the app was asked")
 			}
 		})
 	}
 }
 func TestAResponseOverItsLimit(t *testing.T) {
 	t.Parallel()
 	large := strings.Repeat("x", 2<<10)
 	t.Run("announced, is refused", func(t *testing.T) {
 		t.Parallel()
 		servewaf := startServeWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
 			_, _ = io.WriteString(w, large)
 		})
 		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 			maxResponseSize: "1K",
 		})
 		got := get(t, addr, "/")
 		if got.status != http.StatusBadGateway {
 			t.Errorf("answered %d, want 502", got.status)
 		}
 		if report := servewaf.report(t); report.Status != http.StatusBadGateway {
 			t.Errorf("report %+v, want status 502", report)
 		}
 	})
 	t.Run("not announced, is cut off", func(t *testing.T) {
 		t.Parallel()
 		servewaf := startServeWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = io.WriteString(w, large[:1])
 			_ = http.NewResponseController(w).Flush()
 			_, _ = io.WriteString(w, large[1:])
 		})
 		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 			maxResponseSize: "1K",
 		})
 		conn := dial(t, addr)
 		send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 		text, err := io.ReadAll(conn)
 		if err != nil || bytes.Contains(text, []byte(large)) {
 			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
 		}
 		report := servewaf.report(t)
 		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
 			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
 		}
 	})
 }
 func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.T) {
 	t.Parallel()
 	const announced = "2048"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseSize: "1K",
 	})
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusOK || got.header.Get(contentLengthHeader) != announced {
 		t.Errorf("answered %+v, want the app's 200 announcing %s bytes", got, announced)
 	}
 }
 func TestASettingOfOffSetsNoLimit(t *testing.T) {
 	t.Parallel()
 	for _, setting := range []string{
 		maxRequestSize, maxResponseSize, maxRequestTime, maxResponseTime,
 	} {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				setting: "off",
 			})
 			// A body and an answer that a limit of zero would cut off, as it would the
 			// next answer, which rproxy gives itself.
 			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 				strings.NewReader("a body"))))
 			if got := get(t, addr, proxy.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
 	}
 }
 func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, rest string
 	}{
 		{"with its length announced", announcedLength(100) + "some of it"},
 		{"with no length announced", "Transfer-Encoding: chunked\r\n\r\na\r\nsome of it\r\n"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestTime: "500",
 			})
 			conn := dial(t, addr)
 			send(t, conn, post+tc.rest)
 			if status := readStatus(t, conn); status != http.StatusRequestTimeout {
 				t.Errorf("status %d, want 408", status)
 			}
 			line := out.requestLine(t)
 			if line["disposition"] != nil || line["request_bytes"] != 10.0 {
 				t.Errorf("line %v, want no disposition and 10 bytes", line)
 			}
 			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 			servewaf.wantNoReport(t)
 		})
 	}
 }
 func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(100)+"some of it")
 	_ = conn.Close()
 	line := out.requestLine(t)
 	if line["status"] != 0.0 || line["disposition"] != nil {
 		t.Errorf("line %v, want no answer and no disposition", line)
 	}
 	if len(servewaf.questions) != 0 {
 		t.Error("servewaf was asked")
 	}
 }
 func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, request string
 		stopsSending  bool
 	}{
 		{
 			"a malformed chunk", post + "Transfer-Encoding: chunked\r\n\r\nnot a chunk\r\n",
 			false,
 		},
 		{"a visitor that stops sending", post + announcedLength(100) + "some of it", true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 			conn := dial(t, addr)
 			send(t, conn, tc.request)
 			if tc.stopsSending {
 				tcpConn, ok := conn.(*net.TCPConn)
 				if !ok {
 					t.Fatalf("the connection is a %T", conn)
 				}
 				err := tcpConn.CloseWrite()
 				if err != nil {
 					t.Fatalf("stop sending: %v", err)
 				}
 			}
 			text, err := io.ReadAll(conn)
 			if err != nil || len(text) != 0 {
 				t.Errorf("read %q (%v), want the connection closed without an answer",
 					text, err)
 			}
 			line := out.requestLine(t)
 			if line["status"] != 0.0 || line["disposition"] != nil {
 				t.Errorf("line %v, want no answer and no disposition", line)
 			}
 			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 		})
 	}
 }
 // deadlineRecorder notes the time limits rproxy sets on reading the visitor's body
 // and on sending its answer.
 type deadlineRecorder struct {
 	*httptest.ResponseRecorder
 	readDeadline  time.Time
 	writeDeadline time.Time
 }
 // SetReadDeadline notes deadline.
 func (w *deadlineRecorder) SetReadDeadline(deadline time.Time) error {
 	w.readDeadline = deadline
 	return nil
 }
 // SetWriteDeadline notes deadline.
 func (w *deadlineRecorder) SetWriteDeadline(deadline time.Time) error {
 	w.writeDeadline = deadline
 	return nil
 }
 func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 	t.Parallel()
 	const (
 		limit = 5 * time.Minute
 		// announced is over what Go's server reads of a body left unread, so that
 		// the app's own server answers without waiting for the rest.
 		announced = 100 * questionBodyMaxBytes
 	)
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
 	_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
 	})
 	// The visitor sends the first part and a little more, and then nothing.
 	stalled, stop := io.Pipe()
 	t.Cleanup(func() { _ = stop.Close() })
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
 		io.MultiReader(bytes.NewReader(make([]byte, questionBodyMaxBytes+1)), stalled))
 	req.ContentLength = announced
 	req.Header.Set(contentLengthHeader, strconv.Itoa(announced))
 	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 	before := time.Now()
 	server.Handler.ServeHTTP(w, req)
 	if w.Code != http.StatusNoContent {
 		t.Errorf("status %d, want the app's 204", w.Code)
 	}
 	if w.readDeadline.Before(before.Add(limit)) ||
 		w.readDeadline.After(time.Now().Add(limit)) {
 		t.Errorf("the reading of the body ends at %s, want %s from the request",
 			w.readDeadline, limit)
 	}
 }
 func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 	t.Parallel()
 	const limit = 5 * time.Minute
 	for _, tc := range []struct {
 		name, target string
 		status       int
 	}{
 		{"servewaf's deny", "/", http.StatusForbidden},
 		{"rproxy's own 400", "x:admin", http.StatusBadRequest},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
 			_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
 			})
 			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, tc.target,
 				http.NoBody)
 			w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 			before := time.Now()
 			server.Handler.ServeHTTP(w, req)
 			if w.Code != tc.status {
 				t.Errorf("status %d, want %d", w.Code, tc.status)
 			}
 			if w.writeDeadline.Before(before.Add(limit)) ||
 				w.writeDeadline.After(time.Now().Add(limit)) {
 				t.Errorf("the time limit on sending ends at %s, want %s from the answer",
 					w.writeDeadline, limit)
 			}
 		})
 	}
 }
 func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
 	})
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(2*questionBodyMaxBytes)+
 		strings.Repeat("x", questionBodyMaxBytes+1))
 	if status := readStatus(t, conn); status != http.StatusRequestTimeout {
 		t.Errorf("status %d, want 408", status)
 	}
 	if asked := servewaf.question(t); len(asked.body) != questionBodyMaxBytes {
 		t.Errorf("the question carries %d bytes", len(asked.body))
 	}
 	if report := servewaf.report(t); report.Status != http.StatusRequestTimeout {
 		t.Errorf("report %+v, want status 408", report)
 	}
 }
 // startAppThatTakesNothing starts an app that accepts connections and never
 // reads from them, and returns its URL.
 func startAppThatTakesNothing(t *testing.T) string {
 	t.Helper()
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	stopped := make(chan struct{})
 	t.Cleanup(func() {
 		close(stopped)
 		_ = listener.Close()
 	})
 	go func() {
 		for {
 			conn, err := listener.Accept()
 			if err != nil {
 				return
 			}
 			go func() {
 				<-stopped
 				_ = conn.Close()
 			}()
 		}
 	}()
 	return "http://" + listener.Addr().String()
 }
 func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
 	t.Parallel()
 	// More than the connections hold while nobody reads, written a little at a
 	// time, so that rproxy soon waits for the app.
 	const (
 		bodySize  = 64 << 20
 		writeSize = 32 << 10
 	)
 	servewaf := startServeWAF(t, allow)
 	addr, _ := startRProxy(t, servewaf.URL, startAppThatTakesNothing(t),
 		map[string]string{maxRequestTime: "3000"})
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(bodySize))
 	go func() {
 		part := make([]byte, writeSize)
 		for range bodySize / writeSize {
 			_, err := conn.Write(part)
 			if err != nil {
 				return
 			}
 		}
 	}()
 	if status := readStatus(t, conn); status != http.StatusGatewayTimeout {
 		t.Errorf("status %d, want 504", status)
 	}
 }
 func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	t.Parallel()
 	release := make(chan struct{})
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		<-release
 	})
 	t.Cleanup(func() { close(release) })
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "300",
 	})
 	got := get(t, addr, "/")
 	if got.status != http.StatusGatewayTimeout {
 		t.Errorf("answered %d, want 504", got.status)
 	}
 	if report := servewaf.report(t); report.Status != http.StatusGatewayTimeout {
 		t.Errorf("report %+v, want status 504", report)
 	}
 }
 func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 	t.Parallel()
 	release := make(chan struct{})
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, "the start")
 		_ = http.NewResponseController(w).Flush()
 		<-release
 	})
 	t.Cleanup(func() { close(release) })
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "300",
 	})
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	// dial's deadline ends this read with an error if the connection stays open.
 	_, err := io.ReadAll(conn)
 	if err != nil {
 		t.Errorf("read: %v, want the connection closed", err)
 	}
 	if report := servewaf.report(t); report.Status != http.StatusOK {
 		t.Errorf("report %+v, want the status the visitor got", report)
 	}
 }
 func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 	t.Parallel()
 	// More than the connections hold while nobody reads.
 	const (
 		bodySize  = 64 << 20
 		writeSize = 32 << 10
 	)
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		part := make([]byte, writeSize)
 		for range bodySize / writeSize {
 			_, err := w.Write(part)
 			if err != nil {
 				return
 			}
 		}
 	})
 	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseTime: "500",
 	})
 	// The visitor asks, and never reads the answer.
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	line := out.requestLine(t)
 	responseBytes, _ := line["response_bytes"].(float64)
 	if line["status"] != float64(http.StatusOK) || responseBytes >= bodySize {
 		t.Errorf("line %v, want status 200 and the answer cut off", line)
 	}
 	report := servewaf.report(t)
 	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
 		t.Errorf("report %+v, want status 200 and the answer cut off", report)
 	}
 }
 func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 	got := get(t, addr, "/")
 	if got.status != http.StatusBadGateway {
 		t.Errorf("answered %d, want 502", got.status)
 	}
 	if report := servewaf.report(t); report.Status != http.StatusBadGateway {
 		t.Errorf("report %+v, want status 502", report)
 	}
 }
 func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
 	})
 	// Far more announced than sent, so that Go's server answers for the app
 	// without waiting for the rest.
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(100*questionBodyMaxBytes)+
 		strings.Repeat("x", questionBodyMaxBytes))
 	if status := readStatus(t, conn); status != http.StatusOK {
 		t.Errorf("status %d, want the app's 200", status)
 	}
 }
 func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 	working := make(chan struct{})
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
 	})
 	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	select {
 	case <-working:
 	case <-time.After(waitLimit):
 		t.Fatal("the app was not asked")
 	}
 	tcpConn, ok := conn.(*net.TCPConn)
 	if !ok {
 		t.Fatalf("the connection is a %T", conn)
 	}
 	err := tcpConn.CloseWrite()
 	if err != nil {
 		t.Fatalf("stop sending: %v", err)
 	}
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
 		t.Errorf("read %q (%v), want the connection closed without an answer", text, err)
 	}
 	if line := out.requestLine(t); line["status"] != 0.0 {
 		t.Errorf("line %v, want status 0", line)
 	}
 }
 func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing.T) {
 	t.Parallel()
 	const answer = "the end of a long answer"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		_ = http.NewResponseController(w).Flush()
 		time.Sleep(2100 * time.Millisecond)
 		_, _ = io.WriteString(w, answer)
 	})
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: "2000",
 	})
 	got := visit(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body")))
 	if got.status != http.StatusOK || got.body != answer {
 		t.Errorf("answered %d %q, want the app's whole answer", got.status, got.body)
 	}
 }
 func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, start string
 		status      int
 	}{
 		{"a deny", post, http.StatusForbidden},
 		{
 			"the health check",
 			"GET " + proxy.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				maxRequestTime: "500",
 			})
 			// Go's server waits for a little of the body left before it sends an answer,
 			// and the time for sending the request ends that wait.
 			conn := dial(t, addr)
 			send(t, conn, tc.start+announcedLength(questionBodyMaxBytes+100)+
 				strings.Repeat("x", questionBodyMaxBytes))
 			if status := readStatus(t, conn); status != tc.status {
 				t.Errorf("status %d, want %d", status, tc.status)
 			}
 		})
 	}
 }
@@ -1,477 +0,0 @@
 package rproxy_test
 import (
 	"bytes"
 	"crypto/rand"
 	"io"
 	"maps"
 	"net/http"
 	"net/http/httptest"
 	"slices"
 	"strconv"
 	"strings"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 // questionBodyMaxBytes is the most of a body a question carries.
 const questionBodyMaxBytes = proxy.QuestionBodyMaxBytes
 // chunked is the encoding of a body whose length the visitor did not announce.
 const chunked = "chunked"
 // pathGoReencodes is a path Go's client would decode and escape again, %2F turned
 // into / and | into %7C, unless told to send it as it is. A test sets it as the
 // visitor's URL.Opaque, so that the visitor sends it unchanged too.
 const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
 func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
 	req := newRequest(t, http.MethodDelete, addr, target, http.NoBody)
 	req.URL.Opaque = pathGoReencodes
 	req.Host = site
 	req.Header.Set("X-Test", "from the visitor")
 	req.Header.Set(forwardedForHeader, "198.51.100.1")
 	req.Header.Set(forwardedProtoHeader, "gopher")
 	req.Header.Set(requestIDHeader, "the-visitor's")
 	req.Header.Set(proxy.ClientHeader, "198.51.100.2")
 	req.Header.Set(proxy.PeerHeader, "198.51.100.3")
 	req.Header.Set(proxy.ContentLengthHeader, "12345")
 	// Go's client then sends no User-Agent, so that one in the question would be
 	// Go's own.
 	req.Header["User-Agent"] = nil
 	wantGreeting(t, visit(t, req))
 	asked := servewaf.question(t)
 	if asked.method != http.MethodDelete || asked.target != target ||
 		asked.host != site {
 		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
 	}
 	if asked.header.Get(requestIDHeader) == "the-visitor's" {
 		t.Error("the question carries the visitor's id")
 	}
 	// Exactly these: visit's connection has the visitor send Connection: close.
 	want := http.Header{}
 	want.Set("Connection", "close")
 	want.Set("X-Test", "from the visitor")
 	want.Set(forwardedForHeader, "198.51.100.1")
 	want.Set(forwardedProtoHeader, "http")
 	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
 	want.Set(proxy.ClientHeader, localhost)
 	want.Set(proxy.PeerHeader, localhost)
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
 		t.Errorf("the question's headers are %v, want %v", asked.header, want)
 	}
 }
 func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 	t.Parallel()
 	const visitor = "203.0.113.9"
 	for _, tc := range []struct {
 		name, trusted, client, proto, forwarded string
 	}{
 		{
 			"from a trusted proxy", localhost + "/32", visitor, "https",
 			visitor + ", " + localhost,
 		},
 		{"from a peer not trusted", "10.0.0.0/8", localhost, "http", localhost},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			forwarded := make(chan http.Header, 1)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				forwarded <- r.Header.Clone()
 				greet(w, r)
 			})
 			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: tc.trusted,
 			})
 			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 			req.Header.Set(forwardedForHeader, visitor)
 			req.Header.Set(forwardedProtoHeader, "https")
 			wantGreeting(t, visit(t, req))
 			asked := servewaf.question(t)
 			if asked.header.Get(proxy.ClientHeader) != tc.client ||
 				asked.header.Get(proxy.PeerHeader) != localhost ||
 				asked.header.Get(forwardedForHeader) != visitor ||
 				asked.header.Get(forwardedProtoHeader) != tc.proto {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 			if line := out.requestLine(t); line["client_ip"] != tc.client {
 				t.Errorf("line %v, want client_ip %s", line, tc.client)
 			}
 			if got := (<-forwarded).Get(forwardedForHeader); got != tc.forwarded {
 				t.Errorf("the app saw %s %q, want %q", forwardedForHeader, got, tc.forwarded)
 			}
 		})
 	}
 }
 // randomBytes returns n random bytes.
 func randomBytes(n int) []byte {
 	body := make([]byte, n)
 	_, _ = rand.Read(body) // it never returns an error
 	return body
 }
 func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
 	t.Parallel()
 	for _, size := range []int{
 		1, questionBodyMaxBytes - 1, questionBodyMaxBytes, questionBodyMaxBytes + 1,
 		5 * questionBodyMaxBytes,
 	} {
 		for _, announced := range []bool{true, false} {
 			name := strconv.Itoa(size) + " bytes, length announced: " +
 				strconv.FormatBool(announced)
 			t.Run(name, func(t *testing.T) {
 				t.Parallel()
 				body := randomBytes(size)
 				servewaf := startServeWAF(t, allow)
 				received := make(chan []byte, 1)
 				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 					whole, _ := io.ReadAll(r.Body)
 					received <- whole
 					greet(w, r)
 				})
 				addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
 				if !announced {
 					// Go's client sends a body of unknown length in chunks.
 					req.ContentLength = -1
 				}
 				wantGreeting(t, visit(t, req))
 				asked := servewaf.question(t)
 				want := body[:min(size, questionBodyMaxBytes)]
 				wantQuestionBody(t, asked, want, size, announced)
 				if !bytes.Equal(<-received, body) {
 					t.Error("the app did not get the whole body")
 				}
 				if report := servewaf.report(t); report.RequestBytes != int64(size) {
 					t.Errorf("report %+v, of %d bytes", report, size)
 				}
 			})
 		}
 	}
 }
 // wantQuestionBody checks the body a question carries, want, and how it gives
 // the length of the visitor's body, of size bytes.
 func wantQuestionBody(
 	t *testing.T, asked question, want []byte, size int, announced bool,
 ) {
 	t.Helper()
 	if !bytes.Equal(asked.body, want) {
 		t.Errorf("the question carries %d bytes, want the first %d", len(asked.body),
 			len(want))
 	}
 	values := asked.header.Values(proxy.ContentLengthHeader)
 	if announced {
 		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
 			asked.contentLength != int64(len(want)) {
 			t.Errorf("announced %v and length %d, want %d and %d", values,
 				asked.contentLength, size, len(want))
 		}
 		return
 	}
 	if len(values) != 0 || !slices.Equal(asked.transferEncoding, []string{chunked}) {
 		t.Errorf("announced %v and encoded %v, want none and chunked", values,
 			asked.transferEncoding)
 	}
 }
 func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	// Far more announced than sent. Go's server does not wait for that much, so
 	// the answer comes at once.
 	conn := dial(t, addr)
 	send(t, conn, post+announcedLength(100*questionBodyMaxBytes)+
 		strings.Repeat("x", questionBodyMaxBytes))
 	if status := readStatus(t, conn); status != http.StatusForbidden {
 		t.Errorf("status %d, want servewaf's 403", status)
 	}
 	if report := servewaf.report(t); report.RequestBytes != questionBodyMaxBytes {
 		t.Errorf("report %+v, want the first part's bytes", report)
 	}
 }
 func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, framing, body string
 		encoding            []string
 	}{
 		{
 			chunked, "Transfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n", "body",
 			[]string{chunked},
 		},
 		{
 			"chunked and empty", "Transfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "",
 			[]string{chunked},
 		},
 		{"with its length", announcedLength(4) + "body", "body", nil},
 	} {
 		for _, method := range []string{
 			http.MethodGet, http.MethodDelete, http.MethodPost,
 		} {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
 				servewaf := startServeWAF(t, deny)
 				addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 				conn := dial(t, addr)
 				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
 				if status := readStatus(t, conn); status != http.StatusForbidden {
 					t.Errorf("status %d, want servewaf's 403", status)
 				}
 				asked := servewaf.question(t)
 				if string(asked.body) != tc.body ||
 					!slices.Equal(asked.transferEncoding, tc.encoding) {
 					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
 						asked.body, asked.transferEncoding, tc.body, tc.encoding)
 				}
 			})
 		}
 	}
 }
 func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 	t.Parallel()
 	for _, method := range []string{http.MethodTrace, "PROPFIND", "LOCK", "BREW"} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
 			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
 				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY" {
 				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
 			}
 			line := out.requestLine(t)
 			if line["status"] != float64(http.StatusMethodNotAllowed) ||
 				line["disposition"] != nil || line["default_disposition"] != nil {
 				t.Errorf("line %v, want status 405 and no disposition", line)
 			}
 			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 			servewaf.wantNoReport(t)
 		})
 	}
 }
 func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 	t.Parallel()
 	for _, method := range []string{
 		http.MethodGet, http.MethodHead, http.MethodPost, http.MethodOptions,
 		http.MethodPut, http.MethodDelete, http.MethodPatch, "QUERY",
 	} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 			reached := make(chan string, 1)
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusOK {
 				t.Errorf("answered %+v, want the app's 200", got)
 			}
 			if asked := servewaf.question(t); asked.method != method {
 				t.Errorf("servewaf was asked about %s", asked.method)
 			}
 			if atApp := <-reached; atApp != method {
 				t.Errorf("the app was asked %s", atApp)
 			}
 		})
 	}
 }
 func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 	t.Parallel()
 	const host = "Host: site.example\r\n\r\n"
 	for name, request := range map[string]string{
 		"a target of a scheme":    "GET x:admin HTTP/1.1\r\n" + host,
 		"a target of a URL":       "GET http://site.example/ HTTP/1.1\r\n" + host,
 		"a host Go will not send": "GET http://a<b/ HTTP/1.1\r\n" + host,
 		"a target of a host":      "GET site.example:443 HTTP/1.1\r\n" + host,
 		"a target of *":           "GET * HTTP/1.1\r\n" + host,
 		"a target of //":          "GET //x/y HTTP/1.1\r\n" + host,
 		"a target of // escaped":  "GET //x%2Fadmin| HTTP/1.1\r\n" + host,
 		"an empty Host":           "GET / HTTP/1.1\r\nHost:\r\n\r\n",
 		"HTTP/1.0 with no Host":   "GET / HTTP/1.0\r\n\r\n",
 		"a Host with a zone":      "GET / HTTP/1.1\r\nHost: [fe80::1%25eth0]:80\r\n\r\n",
 		"two User-Agents": "GET / HTTP/1.1\r\nUser-Agent: a\r\nUser-Agent: b\r\n" +
 			host,
 	} {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 			conn := dial(t, addr)
 			send(t, conn, request)
 			if status := readStatus(t, conn); status != http.StatusBadRequest {
 				t.Errorf("status %d, want 400", status)
 			}
 			line := out.requestLine(t)
 			if line["status"] != float64(http.StatusBadRequest) ||
 				line["disposition"] != nil || line["default_disposition"] != nil {
 				t.Errorf("line %v, want status 400 and no disposition", line)
 			}
 			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 			servewaf.wantNoReport(t)
 		})
 	}
 }
 func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
 	t.Parallel()
 	const host = "a%b"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: "+host+"\r\n\r\n")
 	if status := readStatus(t, conn); status != http.StatusOK {
 		t.Errorf("status %d, want the app's 200", status)
 	}
 	if asked := servewaf.question(t); asked.host != host {
 		t.Errorf("asked about the host %q, want %q", asked.host, host)
 	}
 }
 func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 	t.Parallel()
 	const want = "http"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 	wantGreeting(t, get(t, addr, "/"))
 	asked := servewaf.question(t)
 	if got := asked.header.Get(forwardedProtoHeader); got != want {
 		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
 	}
 }
 func TestAQuestionNamesNoZone(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, remoteAddr, forwardedFor, client, peer string
 	}{
 		{"from a link-local peer", "[fe80::1%eth0]:1234", "", "fe80::1", "fe80::1"},
 		{
 			"from X-Forwarded-For through a trusted peer", localhost + ":1234",
 			"2001:db8::1%eth0", "2001:db8::1", localhost,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
 			_, out, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32",
 			})
 			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 			req.RemoteAddr = tc.remoteAddr
 			req.Header.Set(forwardedForHeader, tc.forwardedFor)
 			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 			asked := servewaf.question(t)
 			if asked.header.Get(proxy.ClientHeader) != tc.client ||
 				asked.header.Get(proxy.PeerHeader) != tc.peer {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 			if line := out.requestLine(t); line["client_ip"] != tc.client {
 				t.Errorf("line %v, want client_ip %s", line, tc.client)
 			}
 		})
 	}
 }
@@ -1,593 +0,0 @@
 package rproxy
 import (
 	"context"
 	"crypto/rand"
 	"errors"
 	"io"
 	"net/http"
 	"net/http/httptrace"
 	"net/http/httputil"
 	"net/netip"
 	"net/url"
 	"os"
 	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
 // soon as it arrives.
 const flushAfterEachWrite time.Duration = -1
 // reportStatusMax is the highest status servewaf takes in a report. An app can
 // send a higher one, up to 999, and the visitor gets that as it is.
 const reportStatusMax = 599
 // plainText is the Content-Type of the answers rproxy gives itself.
 const plainText = "text/plain; charset=utf-8"
 // request is one request on its way through rproxy, from the moment its headers
 // have been read to its log line and report.
 type request struct {
 	h  *handler
 	in *http.Request
 	// rc sets the deadlines of the connection to the visitor.
 	rc   *http.ResponseController
 	out  *responseWriter
 	body *requestBody // nil for a request without a body
 	// id is the fresh id made for the request when it arrived.
 	id          string
 	client      netip.Addr
 	peer        netip.Addr
 	peerTrusted bool
 	start       time.Time
 	// disposition is what is done with the request: servewaf's valid disposition,
 	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
 	disposition string
 	// answered is true when servewaf gave disposition, which makes a report due,
 	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
 	answered  bool
 	byDefault bool
 	// asn and country are servewaf's X-Client-ASN and X-Client-Country, for the
 	// app.
 	asn, country string
 	// upstreamStart is when the request was handed to the app.
 	upstreamStart time.Time
 	// cancel ends the request to the app.
 	cancel context.CancelFunc
 	// refused is the status of the first refusal, from whichever goroutine meets
 	// it: what the visitor is answered if the response has not started yet.
 	refused atomic.Int64
 	// upgraded is the connection to the app once the app has switched protocols,
 	// as for a WebSocket, and nil otherwise.
 	upgraded *upgradedConn
 	// mu guards what follows. The time limits run on goroutines of their own,
 	// and the transport starts and stops them, and notes the times below, from
 	// its own; once timersStopped is set, neither time limit acts any more.
 	mu            sync.Mutex
 	timersStopped bool
 	requestTimer  *time.Timer
 	responseTimer *time.Timer
 	// requestEnd is when the app had been sent the whole request, or the answer
 	// started, if that was sooner.
 	requestEnd time.Time
 	// answerStarted is when the first byte of the app's answer arrived.
 	answerStarted time.Time
 }
 // newRequest starts handling r: it notes the time, works out the visitor from
 // the TCP peer and X-Forwarded-For, and makes the request's id.
 func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 	peer := peerAddress(r)
 	trusted := h.config.TrustedProxies
 	rq := &request{
 		h:           h,
 		in:          r,
 		rc:          http.NewResponseController(w),
 		out:         &responseWriter{ResponseWriter: w},
 		id:          rand.Text(),
 		client:      clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted),
 		peer:        peer,
 		peerTrusted: isInside(peer, trusted),
 		start:       time.Now(),
 	}
 	if r.Body != http.NoBody {
 		rq.body = &requestBody{body: limitBody(r.Body, h.config.MaxRequestSize), rq: rq}
 	}
 	return rq
 }
 // answerHealth answers the health check.
 func (rq *request) answerHealth() {
 	rq.prepareOwnAnswer(rq.requestDeadline())
 	rq.out.Header().Set("Content-Type", plainText)
 	rq.send(http.StatusOK, []byte("ok\n"))
 }
 // readFirstPartOfBody reads up to the first 64 KiB of the body into memory,
 // within SWRP_MAX_REQUEST_TIME_MS, and reports whether the request goes on. A
 // visitor too slow to send it is answered 408. For a malformed chunk, or a
 // visitor that went away or stopped its sending side, the connection is closed
 // without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
 // read, so that servewaf is asked first; passToApp then refuses it.
 func (rq *request) readFirstPartOfBody() bool {
 	if rq.body == nil {
 		return true
 	}
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
 	held, err := io.ReadAll(io.LimitReader(rq.body, proxy.QuestionBodyMaxBytes))
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
 	rq.body.held = held
 	switch {
 	case err == nil || rq.refused.Load() != 0:
 		return true
 	case errors.Is(err, os.ErrDeadlineExceeded):
 		rq.answer(http.StatusRequestTimeout)
 		return false
 	default:
 		// This panic has Go's server close the connection without an answer, and
 		// log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)
 	}
 }
 // setPathAsSent has out, the URL of a request made from in, send the path as the
 // visitor sent it. Go sends the path URL.EscapedPath gives, which, for a path
 // holding a character Go escapes, such as |, is the whole path decoded and
 // escaped again, %2F turned into /. Opaque is sent as it is.
 func setPathAsSent(out *url.URL, in *http.Request) {
 	out.Opaque = rules.Path(in)
 }
 // forward passes the request to the app, the part of the body held and then the
 // rest, and the app's answer back. ctx is the request's own context.
 func (rq *request) forward(ctx context.Context) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	rq.cancel = cancel
 	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
 		WroteRequest:         rq.wroteRequest,
 		GotFirstResponseByte: rq.gotFirstResponseByte,
 	})
 	out := rq.in.WithContext(ctx)
 	if rq.body != nil {
 		out.Body = rq.body
 	}
 	reverseProxy := &httputil.ReverseProxy{
 		Rewrite:        rq.rewrite,
 		Transport:      rq.h.transport,
 		FlushInterval:  flushAfterEachWrite,
 		ErrorLog:       rq.h.errorLog,
 		ModifyResponse: rq.modifyResponse,
 		ErrorHandler:   rq.answerError,
 	}
 	rq.startRequestTimer()
 	rq.upstreamStart = time.Now()
 	reverseProxy.ServeHTTP(rq.out, out)
 }
 // rewrite makes the request the app receives: the visitor's request, unchanged,
 // sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
 // without any X-Client-ASN or X-Client-Country the visitor sent, and with
 // servewaf's.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	upstream := rq.h.config.UpstreamURL
 	pr.Out.URL.Scheme = upstream.Scheme
 	pr.Out.URL.Host = upstream.Host
 	// ReverseProxy drops query parameters it cannot parse; the app gets the
 	// query as the visitor sent it.
 	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
 	setPathAsSent(pr.Out.URL, pr.In)
 	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
 	pr.Out.Header.Set(requestIDHeader, rq.id)
 	pr.Out.Header.Del(asnHeader)
 	pr.Out.Header.Del(countryHeader)
 	if rq.asn != "" {
 		pr.Out.Header.Set(asnHeader, rq.asn)
 	}
 	if rq.country != "" {
 		pr.Out.Header.Set(countryHeader, rq.country)
 	}
 }
 // modifyResponse looks at the app's answer before ReverseProxy passes it on.
 func (rq *request) modifyResponse(res *http.Response) error {
 	if res.StatusCode == http.StatusSwitchingProtocols {
 		// An upgraded connection, such as a WebSocket, is not cut by the time
 		// limits. ReverseProxy writes this answer straight to the connection it
 		// takes over, not through rq.out, and then copies what passes each way
 		// through res.Body, the connection to the app. It may still refuse the
 		// switch, as when the app's Upgrade is not the visitor's, so the status
 		// is noted only once it has taken over the connection, by rq.out's
 		// Hijack.
 		rq.stopTimers()
 		conn, ok := res.Body.(io.ReadWriteCloser)
 		if ok {
 			rq.upgraded = &upgradedConn{ReadWriteCloser: conn}
 			res.Body = rq.upgraded
 		}
 		return nil
 	}
 	maxBytes := rq.h.config.MaxResponseSize
 	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
 		rq.refuse(http.StatusBadGateway)
 		return errResponseTooLarge
 	}
 	// Go's server adds a Content-Type it guesses from the body to a response
 	// whose headers have no Content-Type key. The key with no value sends none,
 	// as the app sent none.
 	if res.Header.Get("Content-Type") == "" {
 		rq.out.Header()["Content-Type"] = nil
 	}
 	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
 	rq.setResponseDeadline()
 	return nil
 }
 // answerError is ReverseProxy's ErrorHandler: the request could not be passed to
 // the app, or the app's answer cannot be passed on.
 func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
 	if rq.upgraded != nil {
 		// The app switched protocols, but the switch was not passed on, and
 		// ReverseProxy leaves the app's connection open when it refuses it.
 		_ = rq.upgraded.Close()
 	}
 	status := int(rq.refused.Load())
 	if status == 0 {
 		if rq.in.Context().Err() != nil {
 			// The visitor went away or stopped its sending side. This panic has Go's
 			// server close the connection without an answer, and log nothing; the
 			// deferred finish still runs.
 			panic(http.ErrAbortHandler)
 		}
 		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
 		status = http.StatusBadGateway
 	}
 	rq.answer(status)
 }
 // answer sends rproxy's own answer, unless the response has already started.
 func (rq *request) answer(status int) {
 	rq.refused.CompareAndSwap(0, int64(status))
 	if rq.out.status != 0 {
 		return // too late to answer: the connection can only be cut
 	}
 	// A visitor found too slow is read no more; any other may go on sending until
 	// its time is up, so that Go's server can read the rest of the body and end
 	// the request cleanly.
 	deadline := rq.requestDeadline()
 	if status == http.StatusRequestTimeout {
 		deadline = time.Now()
 	}
 	rq.prepareOwnAnswer(deadline)
 	header := rq.out.Header()
 	header.Set("Content-Type", plainText)
 	header.Set("X-Content-Type-Options", "nosniff")
 	rq.send(status, []byte(http.StatusText(status)+"\n"))
 }
 // send gives the visitor an answer rproxy holds whole: status, the headers set so
 // far and body. Go's server would otherwise send so short an answer only once the
 // handler has returned, after finish has written the log line and sent the report.
 // Without Content-Length, the flush would send the body in chunks, the last of
 // which would still wait for the handler. A HEAD's answer has no body, so any
 // Content-Length it has stays as servewaf gave it.
 func (rq *request) send(status int, body []byte) {
 	if rq.in.Method != http.MethodHead {
 		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
 	}
 	rq.out.WriteHeader(status)
 	_, _ = rq.out.Write(body)
 	_ = rq.rc.Flush()
 }
 // prepareOwnAnswer readies the connection for an answer rproxy gives itself: the
 // reading of a body that has not arrived whole ends at deadline, and the answer
 // has SWRP_MAX_RESPONSE_TIME_MS from now to reach the visitor, even when the app
 // used that time up first.
 func (rq *request) prepareOwnAnswer(deadline time.Time) {
 	rq.stopReadingBody(deadline)
 	rq.endRequest()
 	limit := rq.h.config.MaxResponseTime
 	if limit > 0 {
 		_ = rq.rc.SetWriteDeadline(time.Now().Add(limit))
 	}
 }
 // refuse records status, unless an earlier refusal was, and ends the request to
 // the app, if one was made.
 func (rq *request) refuse(status int) {
 	rq.refused.CompareAndSwap(0, int64(status))
 	if rq.cancel != nil {
 		rq.cancel()
 	}
 }
 // finish ends the request's time limits, writes its log line and, if servewaf
 // answered the question, sends the report. ctx is the request's own context.
 func (rq *request) finish(ctx context.Context) {
 	rq.stopTimers()
 	if rq.refused.Load() == 0 {
 		rq.stopReadingBody(rq.requestDeadline())
 	}
 	requestEnd := rq.endRequest()
 	end := time.Now()
 	requestBytes, responseBytes := rq.bytesEachWay()
 	err := requestlog.WriteRProxyLine(rq.h.requestLog, &requestlog.RProxyLine{
 		Time:               requestlog.FormatTime(rq.start),
 		RequestID:          rq.id,
 		ClientIP:           rq.client.String(),
 		Host:               rq.in.Host,
 		Method:             rq.in.Method,
 		Path:               rules.Path(rq.in),
 		Query:              rq.in.URL.RawQuery,
 		Status:             rq.out.status,
 		RequestBytes:       requestBytes,
 		ResponseBytes:      responseBytes,
 		DurationRequest:    requestlog.Milliseconds(requestEnd.Sub(rq.start)),
 		DurationResponse:   requestlog.Milliseconds(end.Sub(requestEnd)),
 		Disposition:        rq.disposition,
 		DefaultDisposition: rq.byDefault,
 	})
 	if err != nil {
 		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
 	}
 	if !rq.answered {
 		return
 	}
 	report := &proxy.Report{
 		RequestID:     rq.id,
 		Status:        min(rq.out.status, reportStatusMax),
 		RequestBytes:  requestBytes,
 		ResponseBytes: responseBytes,
 		DurationTotal: requestlog.Milliseconds(end.Sub(rq.start)),
 	}
 	if !rq.upstreamStart.IsZero() {
 		report.DurationUpstreamTotal = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
 	}
 	rq.h.sendReport(ctx, report)
 }
 // bytesEachWay returns the body bytes of the request and of the answer. For an
 // upgraded connection, such as a WebSocket, which has closed by then, what it
 // carried from the visitor counts with the request's and what it carried from the
 // app with the answer's.
 func (rq *request) bytesEachWay() (int64, int64) {
 	var requestBytes int64
 	if rq.body != nil {
 		requestBytes = rq.body.bytes.Load()
 	}
 	responseBytes := rq.out.bytes
 	if rq.upgraded != nil {
 		requestBytes += rq.upgraded.toApp.Load()
 		responseBytes += rq.upgraded.fromApp.Load()
 	}
 	return requestBytes, responseBytes
 }
 // requestDeadline is when the visitor must have sent its whole request, or zero
 // when SWRP_MAX_REQUEST_TIME_MS is off.
 func (rq *request) requestDeadline() time.Time {
 	limit := rq.h.config.MaxRequestTime
 	if limit == 0 {
 		return time.Time{}
 	}
 	return rq.start.Add(limit)
 }
 // stopReadingBody ends, at deadline, the reading of a visitor's body that has not
 // arrived whole: Go's server then reads no more of it, and closes the connection
 // after the answer.
 func (rq *request) stopReadingBody(deadline time.Time) {
 	if rq.body == nil || rq.body.received.Load() {
 		return
 	}
 	_ = rq.rc.SetReadDeadline(deadline)
 }
 // startRequestTimer starts SWRP_MAX_REQUEST_TIME_MS, which runs from the
 // request's headers being read until the app has been sent the whole request.
 func (rq *request) startRequestTimer() {
 	deadline := rq.requestDeadline()
 	if deadline.IsZero() {
 		return
 	}
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	rq.requestTimer = time.AfterFunc(time.Until(deadline), rq.requestTimedOut)
 }
 // requestTimedOut is called when SWRP_MAX_REQUEST_TIME_MS runs out while the
 // request is still on its way to the app. The answer names the side rproxy was
 // waiting on at that moment: 408 when it was waiting for the visitor to send more
 // of its body, 504 when it was waiting for the app to be reached or to take what
 // it had.
 func (rq *request) requestTimedOut() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if rq.timersStopped {
 		return
 	}
 	if rq.body == nil || !rq.body.waiting.Load() {
 		// Once the app has answered, the transport, ReverseProxy and Go's server
 		// each close the visitor's body, and closing it reads what is left of a
 		// body under 256 KiB without requestBody.Read, so waiting is false while
 		// that read waits for the visitor. That read ends now, before refuse:
 		// should rproxy still answer itself, answer then sets the deadline it
 		// gives its own answers.
 		if !rq.answerStarted.IsZero() {
 			rq.stopReadingBody(time.Now())
 		}
 		rq.refuse(http.StatusGatewayTimeout)
 		return
 	}
 	rq.refuse(http.StatusRequestTimeout)
 	// The transport gives up on the app only once its Read of the visitor's body
 	// returns, so that Read is ended now. The lock keeps this from reaching the
 	// connection after the request is handled.
 	_ = rq.rc.SetReadDeadline(time.Now())
 }
 // gotFirstResponseByte is called once the first byte of the app's answer has
 // arrived.
 func (rq *request) gotFirstResponseByte() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	rq.answerStarted = time.Now()
 }
 // wroteRequest is called once the app has been sent the whole request:
 // SWRP_MAX_REQUEST_TIME_MS ends and SWRP_MAX_RESPONSE_TIME_MS starts.
 func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
 	if info.Err != nil {
 		return // the transport gives up, or tries again
 	}
 	requestEnd := rq.endRequest()
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if rq.timersStopped {
 		return
 	}
 	stopTimer(rq.requestTimer)
 	limit := rq.h.config.MaxResponseTime
 	if limit > 0 {
 		rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
 			rq.responseTimedOut)
 	}
 }
 // responseTimedOut is called when SWRP_MAX_RESPONSE_TIME_MS runs out before the
 // app has sent its whole answer.
 func (rq *request) responseTimedOut() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if !rq.timersStopped {
 		rq.refuse(http.StatusGatewayTimeout)
 	}
 }
 // responseReceived is called once the app has sent its whole answer. An app may
 // answer before the visitor has sent its whole body, as with a 404 it sends
 // without reading it. The time limits then run on: until the transport's read of
 // the body returns, Go's server cannot send the answer, and
 // SWRP_MAX_REQUEST_TIME_MS is what ends that read for a visitor that stops
 // sending.
 func (rq *request) responseReceived() {
 	if rq.body != nil && !rq.body.received.Load() {
 		return
 	}
 	rq.stopTimers()
 }
 // setResponseDeadline sets SWRP_MAX_RESPONSE_TIME_MS on the connection to the
 // visitor: the app's answer must reach the visitor within it of the end of the
 // request.
 func (rq *request) setResponseDeadline() {
 	requestEnd := rq.endRequest()
 	limit := rq.h.config.MaxResponseTime
 	if limit > 0 {
 		_ = rq.rc.SetWriteDeadline(requestEnd.Add(limit))
 	}
 }
 // endRequest notes now as the end of the request, unless an end is noted, and
 // returns the end noted.
 func (rq *request) endRequest() time.Time {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if rq.requestEnd.IsZero() {
 		rq.requestEnd = time.Now()
 	}
 	return rq.requestEnd
 }
 // stopTimers stops the request's time limits and keeps any from starting later:
 // the app's answer is complete, the connection upgraded, or the request handled.
 func (rq *request) stopTimers() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	rq.timersStopped = true
 	stopTimer(rq.requestTimer)
 	stopTimer(rq.responseTimer)
 }
 // stopTimer stops t, which is nil when its time limit is off.
 func stopTimer(t *time.Timer) {
 	if t != nil {
 		t.Stop()
 	}
 }
@@ -1,228 +0,0 @@
 // Package rproxy is the reverse proxy in front of one app that asks servewaf
 // about each request. It passes a request servewaf allows to the app and the
 // app's answer back, within the size and time limits. Any other answer from
 // servewaf goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
 // decides only when servewaf cannot be connected to, does not answer at all, or
 // does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
 // method it does not pass on, or one it cannot put to servewaf as the visitor
 // sent it. It keeps nothing between requests and never touches disk. "rproxy" in
 // SPEC.md says what it does.
 package rproxy
 import (
 	"context"
 	"io"
 	"log"
 	"log/slog"
 	"net/http"
 	"net/url"
 	"slices"
 	"strings"
 	"sync"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 // How rproxy keeps connections to the app and to servewaf open between
 // requests.
 const (
 	idleConns       = 100
 	idleConnTimeout = 90 * time.Second
 )
 // The limits on a connection from a visitor that have no setting.
 const (
 	// requestHeaderMaxBytes is the largest request line and headers a visitor
 	// may send.
 	requestHeaderMaxBytes = 32 << 10
 	// goServerExtraHeaderBytes is how far past MaxHeaderBytes Go's server reads
 	// before it refuses.
 	goServerExtraHeaderBytes = 4 << 10
 	// idleTimeout is how long a kept-open connection may wait for its next
 	// request.
 	idleTimeout = 120 * time.Second
 )
 // adminPrefix starts the path of every request for smallwebwaf itself, which
 // never reaches the app.
 const adminPrefix = "/_smallwebwaf/"
 // allowedMethods lists the methods rproxy passes on, as an Allow header gives
 // them. It answers any other method 405 itself.
 const allowedMethods = "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY"
 // Params are what New needs.
 type Params struct {
 	Config *config.RProxy
 	// RequestLog receives one short JSON line per request.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
 }
 // Server is the server `smallwebwaf rproxy` runs.
 type Server struct {
 	*http.Server
 	h *handler
 }
 // New returns the server `smallwebwaf rproxy` runs. Go's server itself refuses
 // a request line and headers over requestHeaderMaxBytes, with 431, closes a
 // connection idle for idleTimeout, and applies SWRP_MAX_REQUEST_TIME_MS while
 // the headers arrive. The handler applies the time and size limits from then
 // on.
 func New(params Params) *Server {
 	backend := params.Config.WAFBackend
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	h := &handler{
 		config:            params.Config,
 		requestLog:        params.RequestLog,
 		processLog:        params.ProcessLog,
 		errorLog:          errorLog,
 		transport:         newTransport(),
 		serveWAFTransport: newServeWAFTransport(),
 		reportURL: (&url.URL{
 			Scheme: backend.Scheme, Host: backend.Host, Path: proxy.ReportPath,
 		}).String(),
 	}
 	return &Server{
 		Server: &http.Server{
 			Addr:              params.Config.ListenAddr,
 			Handler:           h,
 			ErrorLog:          errorLog,
 			ReadHeaderTimeout: params.Config.MaxRequestTime,
 			IdleTimeout:       idleTimeout,
 			MaxHeaderBytes:    requestHeaderMaxBytes - goServerExtraHeaderBytes,
 		},
 		h: h,
 	}
 }
 // WaitForReports returns once the reports being sent have gone or failed,
 // which SWRP_TIMEOUT_MS bounds. Any report after this call is dropped: that of
 // a WebSocket that closes while rproxy stops, for one.
 func (s *Server) WaitForReports() {
 	s.h.reportsMu.Lock()
 	s.h.reportsStopped = true
 	s.h.reportsMu.Unlock()
 	s.h.reports.Wait()
 }
 // handler is the proxy. It holds what every request shares; what belongs to
 // one request is in a request.
 type handler struct {
 	config     *config.RProxy
 	requestLog io.Writer
 	processLog *slog.Logger
 	errorLog   *log.Logger
 	// transport carries requests to the app, and serveWAFTransport questions and
 	// reports to servewaf.
 	transport         http.RoundTripper
 	serveWAFTransport http.RoundTripper
 	// reportURL is where the reports go.
 	reportURL string
 	// reports waits for the reports being sent. reportsMu guards starting one
 	// against reportsStopped, which is set once nothing is to wait for another.
 	reports        sync.WaitGroup
 	reportsMu      sync.Mutex
 	reportsStopped bool
 }
 // newTransport returns what carries requests to the app. It never goes through
 // a proxy named in the environment, and leaves answers compressed or not as they
 // were sent.
 func newTransport() *http.Transport {
 	return &http.Transport{
 		MaxIdleConns:        idleConns,
 		MaxIdleConnsPerHost: idleConns,
 		IdleConnTimeout:     idleConnTimeout,
 		DisableCompression:  true,
 	}
 }
 // newServeWAFTransport returns what carries questions and reports to servewaf.
 // It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send a visitor's Upgrade
 // header, or a Connection header other than close or keep-alive, and that would
 // read as servewaf giving no answer.
 func newServeWAFTransport() *http.Transport {
 	transport := newTransport()
 	transport.Protocols = new(http.Protocols)
 	transport.Protocols.SetHTTP1(true)
 	return transport
 }
 // ServeHTTP handles one request: it answers the health check itself, refuses a
 // request with a method it does not pass on or one it cannot put to servewaf as
 // the visitor sent it, and for any other request reads the first part of the
 // body, asks servewaf, and does what the answer says. Once the answer has ended,
 // it writes the request's log line and sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
 	if r.Method == http.MethodGet && r.URL.Path == proxy.HealthPath {
 		rq.answerHealth()
 		return
 	}
 	if !slices.Contains(strings.Split(allowedMethods, ", "), r.Method) {
 		rq.out.Header().Set("Allow", allowedMethods)
 		rq.answer(http.StatusMethodNotAllowed)
 		return
 	}
 	if !canBeAsked(r) {
 		rq.answer(http.StatusBadRequest)
 		return
 	}
 	if !rq.readFirstPartOfBody() {
 		return
 	}
 	answer, err := rq.ask(r.Context())
 	if err != nil {
 		rq.handleNoUsableAnswer(r.Context(), err)
 		return
 	}
 	rq.noteAnswer(answer)
 	switch rq.disposition {
 	case proxy.DispositionAllow:
 		rq.passToApp(r.Context())
 	case proxy.DispositionClose:
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)
 	default: // a deny, an error, or an answer without a valid disposition
 		rq.answerWith(answer)
 	}
 }
 // passToApp passes the request on to the app, unless a limit or its path keeps
 // it from the app. servewaf answers a path under adminPrefix itself, so such a
 // request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {
 	maxBytes := rq.h.config.MaxRequestSize
 	switch {
 	case rq.refused.Load() != 0 || (maxBytes > 0 && rq.in.ContentLength > maxBytes):
 		rq.answer(http.StatusRequestEntityTooLarge)
 	case strings.HasPrefix(rq.in.URL.Path, adminPrefix):
 		rq.answer(http.StatusNotFound)
 	default:
 		rq.forward(ctx)
 	}
 }
@@ -1,266 +0,0 @@
 package rproxy
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"maps"
 	"net/http"
 	"strings"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
 // answerBodyMaxBytes is the most of the body of servewaf's answer that is read.
 // It is far above any answer's.
 const answerBodyMaxBytes = 1 << 20
 // reportAnswerMaxBytes is the most of the answer to a report that is read,
 // which has no body when servewaf takes the report.
 const reportAnswerMaxBytes = 4 << 10
 var (
 	errCannotPassOn  = errors.New("the answer cannot be passed to the visitor")
 	errReportRefused = errors.New("the report was answered")
 )
 // servewafAnswer is what servewaf answered to a question.
 type servewafAnswer struct {
 	status int
 	header http.Header
 	body   []byte
 }
 // noteAnswer notes what servewaf answered. An answer without a valid disposition
 // notes nothing, and no report is due for it: servewaf holds no decision to report
 // on.
 func (rq *request) noteAnswer(answer *servewafAnswer) {
 	disposition := answer.header.Get(proxy.DispositionHeader)
 	switch disposition {
 	case proxy.DispositionAllow, proxy.DispositionDeny, proxy.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
 		rq.country = answer.header.Get(countryHeader)
 	}
 }
 // handleNoUsableAnswer deals with a request whose question ended in err, which
 // leaves no answer to act on. ctx is the request's own context.
 func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	switch {
 	case ctx.Err() != nil:
 		// The visitor went away while servewaf was being asked. servewaf has not
 		// failed, and nothing is noted. This panic has Go's server close the
 		// connection without an answer, and log nothing; the deferred finish still
 		// runs.
 		panic(http.ErrAbortHandler)
 	case errors.Is(err, errCannotPassOn):
 		rq.h.processLog.Warn("servewaf's answer is dropped", "error", err.Error())
 		rq.answer(http.StatusBadGateway)
 	default:
 		// servewaf cannot be connected to, does not answer at all, or does not answer
 		// within SWRP_TIMEOUT_MS. A request that keeps servewaf busy past
 		// SWRP_TIMEOUT_MS, like any request while servewaf is overloaded, gets
 		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
 		// whenever servewaf is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
 		rq.h.processLog.Warn("servewaf gave no answer", "error", err.Error())
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
 		if rq.disposition == proxy.DispositionAllow {
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
 		}
 	}
 }
 // ask sends servewaf the question, and returns its answer, which must have come
 // whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
 // away.
 func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
 	defer cancel()
 	question, err := rq.newQuestion(ctx)
 	if err != nil {
 		return nil, err
 	}
 	res, err := rq.h.serveWAFTransport.RoundTrip(question)
 	if err != nil {
 		return nil, fmt.Errorf("send the question: %w", err)
 	}
 	defer func() {
 		_ = res.Body.Close()
 	}()
 	// The body of a 101 is the connection itself, and the time limit does not end
 	// a read of that. Go's client also takes a status below 100, which Go's server
 	// panics when asked to send.
 	if res.StatusCode < http.StatusOK {
 		return nil, fmt.Errorf("%w: its status is %d", errCannotPassOn, res.StatusCode)
 	}
 	body, err := io.ReadAll(io.LimitReader(res.Body, answerBodyMaxBytes+1))
 	if err != nil {
 		return nil, fmt.Errorf("read the answer: %w", err)
 	}
 	if len(body) > answerBodyMaxBytes {
 		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
 	}
 	return &servewafAnswer{res.StatusCode, res.Header, body}, nil
 }
 // canBeAsked reports whether Go's client can send servewaf r as the visitor sent
 // it. It cannot send these as they came:
 //   - a target that does not start with /, or that starts with //;
 //   - an empty Host, for which it sends servewaf's own address;
 //   - a Host holding an IPv6 zone, which it removes;
 //   - more than one User-Agent, of which it sends the first;
 //   - an empty User-Agent, which it leaves out, the one case that still goes to
 //     servewaf.
 func canBeAsked(r *http.Request) bool {
 	target, host := r.RequestURI, r.Host
 	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
 	return strings.HasPrefix(target, "/") && !strings.HasPrefix(target, "//") &&
 		host != "" && !hostHasZone && len(r.Header.Values("User-Agent")) <= 1
 }
 // newQuestion returns the question about the request, as "The question" in
 // SPEC.md gives it: the visitor's request as the visitor sent it, with the part
 // of the body it holds and rproxy's headers.
 func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	in := rq.in
 	var held []byte
 	if rq.body != nil {
 		held = rq.body.held
 	}
 	question, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
 		ctx, in.Method, rq.h.config.WAFBackend.String(), bytes.NewReader(held))
 	if err != nil {
 		return nil, fmt.Errorf("make the question: %w", err)
 	}
 	backend := question.URL
 	target := *in.URL
 	target.Scheme = backend.Scheme
 	target.Host = backend.Host
 	setPathAsSent(&target, in)
 	question.URL = &target
 	question.Host = in.Host
 	// The length NewRequestWithContext set is that of what is held. This line makes
 	// a body whose length the visitor did not announce go chunked, as "The question"
 	// in SPEC.md requires.
 	question.TransferEncoding = in.TransferEncoding
 	question.Header = in.Header.Clone()
 	question.Header.Set(proxy.ClientHeader, rq.client.String())
 	question.Header.Set(proxy.PeerHeader, rq.peer.String())
 	question.Header.Del(proxy.ContentLengthHeader)
 	announced := in.Header.Get("Content-Length")
 	if announced != "" {
 		question.Header.Set(proxy.ContentLengthHeader, announced)
 	}
 	question.Header.Set(requestIDHeader, rq.id)
 	question.Header.Set("X-Forwarded-Proto", scheme(in, rq.peerTrusted))
 	// Go's client adds a User-Agent of its own to a request without the key.
 	_, sent := question.Header["User-Agent"]
 	if !sent {
 		question.Header["User-Agent"] = nil
 	}
 	return question, nil
 }
 // answerWith gives the visitor servewaf's answer, less its disposition.
 func (rq *request) answerWith(answer *servewafAnswer) {
 	rq.prepareOwnAnswer(rq.requestDeadline())
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
 	header.Del(proxy.DispositionHeader)
 	// Go's server adds a Content-Type it guesses from the body to a response whose
 	// headers have no Content-Type key. The key with no value sends none.
 	if header.Get("Content-Type") == "" {
 		header["Content-Type"] = nil
 	}
 	rq.send(answer.status, answer.body)
 }
 // sendReport sends servewaf report on a goroutine of its own, so that the
 // visitor does not wait for it. The report goes on after ctx, the request's own
 // context, has ended.
 func (h *handler) sendReport(ctx context.Context, report *proxy.Report) {
 	h.reportsMu.Lock()
 	defer h.reportsMu.Unlock()
 	if h.reportsStopped {
 		return
 	}
 	h.reports.Go(func() {
 		err := h.postReport(context.WithoutCancel(ctx), report)
 		if err != nil {
 			h.processLog.Warn("a report is dropped", "error", err.Error())
 		}
 	})
 }
 // postReport posts report to servewaf, and waits for its answer for up to
 // SWRP_TIMEOUT_MS.
 func (h *handler) postReport(ctx context.Context, report *proxy.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {
 		return fmt.Errorf("encode the report: %w", err)
 	}
 	ctx, cancel := context.WithTimeout(ctx, h.config.Timeout)
 	defer cancel()
 	req, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
 		ctx, http.MethodPost, h.reportURL, bytes.NewReader(body))
 	if err != nil {
 		return fmt.Errorf("make the request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
 	res, err := h.serveWAFTransport.RoundTrip(req)
 	if err != nil {
 		return fmt.Errorf("send the report: %w", err)
 	}
 	// The body of a 101 is the connection itself, and the time limit does not end
 	// a read of that.
 	if res.StatusCode >= http.StatusOK {
 		_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
 	}
 	_ = res.Body.Close()
 	if res.StatusCode != http.StatusNoContent {
 		return fmt.Errorf("%w %s", errReportRefused, res.Status)
 	}
 	return nil
 }
@@ -60,19 +60,8 @@ func TestHealthCheck(t *testing.T) {
 		}, 0, "")
 	}
-	// Another test can take a closed server's port at once, so the app's
+	app.Close()
-	// address here is a multicast address, to which TCP cannot connect.
+	wantHealthCheck(t, env, 1, "unhealthy: connect to the app: ")
 	wantHealthCheck(t, map[string]string{
 		listenAddr:  ":" + port,
 		upstreamURL: "http://224.0.0.1",
 	}, 1, "unhealthy: connect to the app: ")
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
 	wantHealthCheck(t, map[string]string{listenAddr: ":0"}, 1,
 		"unhealthy: ask smallwebwaf: ")
 	wantHealthCheck(t, map[string]string{listenAddr: "8080"}, 1,
 		"unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
 	stop()
@@ -81,6 +70,10 @@ func TestHealthCheck(t *testing.T) {
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")
 	}
 	wantHealthCheck(t, env, 1, "unhealthy: ask smallwebwaf: ")
 	wantHealthCheck(t, map[string]string{listenAddr: "8080"}, 1,
 		"unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
 }
 func TestHealthCheckRefusesAnArgument(t *testing.T) {
@@ -1,99 +0,0 @@
 package smallwebwaf
 import (
 	"context"
 	"errors"
 	"log/slog"
 	"net"
 	"net/http"
 	"os"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 )
 // RunRProxy is `smallwebwaf rproxy`: it reads rproxy's settings, then serves
 // requests until ctx is done. Then it gives the requests in progress
 // shutdownTimeout to finish, and the reports being sent SWRP_TIMEOUT_MS. It
 // returns the process's exit status, 1 when rproxy cannot start. Its process
 // messages name the host's name as instance, and it writes those at info or
 // more severe: rproxy has no setting for either.
 func RunRProxy(ctx context.Context, params Params) int {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
 	processLog := requestlog.NewProcessLogger(params.Stdout, hostname, slog.LevelInfo)
 	cfg, err := config.RProxyFromEnvironment(params.LookupEnv)
 	if err != nil {
 		processLog.Error("invalid setting", "error", err.Error())
 		return 1
 	}
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: params.Stdout,
 		ProcessLog: processLog,
 	})
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
 		processLog.Error("cannot listen on SWRP_LISTEN_ADDR", "error", err.Error())
 		return 1
 	}
 	processLog.Info("starting",
 		"version", params.Version,
 		"address", listener.Addr().String(),
 		"settings", cfg)
 	return serveRProxy(ctx, server, listener, processLog)
 }
 // serveRProxy serves requests on listener until ctx is done, and then stops as
 // RunRProxy says.
 func serveRProxy(
 	ctx context.Context, server *rproxy.Server, listener net.Listener,
 	processLog *slog.Logger,
 ) int {
 	served := make(chan error, 1)
 	go func() {
 		served <- server.Serve(listener)
 	}()
 	select {
 	case err := <-served:
 		processLog.Error("serving failed", "error", err.Error())
 		return 1
 	case <-ctx.Done():
 	}
 	processLog.Info("stopping")
 	shutdownCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx),
 		shutdownTimeout)
 	defer cancel()
 	err := server.Shutdown(shutdownCtx)
 	if err != nil {
 		processLog.Warn("requests still in progress were cut off",
 			"error", err.Error())
 		_ = server.Close()
 	}
 	err = <-served
 	if !errors.Is(err, http.ErrServerClosed) {
 		processLog.Error("serving failed", "error", err.Error())
 		return 1
 	}
 	server.WaitForReports()
 	processLog.Info("stopped")
 	return 0
 }
@@ -1,787 +0,0 @@
 package smallwebwaf_test
 import (
 	"bufio"
 	"context"
 	"encoding/pem"
 	"io"
 	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"sync/atomic"
 	"syscall"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 const (
 	// wafBackend is the setting that names servewaf to rproxy.
 	wafBackend = "SWRP_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
 	rproxyListenAddr = "SWRP_LISTEN_ADDR"
 	// rproxyTimeout is the setting that says how long rproxy waits for servewaf.
 	rproxyTimeout = "SWRP_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
 	// otherClient is a client the tests do not ban.
 	otherClient = "198.51.100.7"
 )
 // runRProxy runs `smallwebwaf rproxy` with the settings in env until ctx is
 // done, and returns its exit status.
 func runRProxy(ctx context.Context, env map[string]string, out *output) int {
 	return smallwebwaf.RunRProxy(ctx, smallwebwaf.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
 			return value, ok
 		},
 		Stdout: out,
 	})
 }
 // startRProxy runs rproxy with servewaf at backend and the app at appURL, and
 // returns its URL and what it writes. It believes X-Forwarded-For from the
 // tests. It stops as the test ends, and that it stopped in order is checked.
 func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 	t.Helper()
 	ctx, stop := context.WithCancel(t.Context())
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runRProxy(ctx, map[string]string{
 			rproxyListenAddr:       localhost + ":0",
 			"SWRP_UPSTREAM_URL":    appURL,
 			"SWRP_TRUSTED_PROXIES": localhost + "/32",
 			wafBackend:             backend,
 		}, out)
 	}()
 	t.Cleanup(func() {
 		stop()
 		select {
 		case status := <-exited:
 			if status != 0 {
 				t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
 			}
 		case <-time.After(waitLimit):
 			t.Error("rproxy still running after being told to stop")
 		}
 		out.line(t, "msg", "stopped")
 	})
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	return "http://" + addr, out
 }
 // startServeWAF runs servewaf with the settings in env, and returns its address
 // and URL, what it writes, and what stops it, which checks that it stopped in
 // order.
 func startServeWAF(t *testing.T, env map[string]string) (string, *output, func()) {
 	t.Helper()
 	ctx, stop := context.WithCancel(t.Context())
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runAs(ctx, true, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	return addr, out, func() {
 		stop()
 		select {
 		case status := <-exited:
 			if status != 0 {
 				t.Fatalf("servewaf's exit status %d, want 0; output:\n%s", status, out.text())
 			}
 		case <-time.After(waitLimit):
 			t.Fatal("servewaf still running after being told to stop")
 		}
 	}
 }
 // serveWAFSettings are servewaf's settings with the default rule file, to listen
 // at any free port.
 func serveWAFSettings(t *testing.T) map[string]string {
 	t.Helper()
 	return map[string]string{
 		listenAddr: localhost + ":0",
 		stateDir:   t.TempDir(),
 		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
 	}
 }
 func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	t.Parallel()
 	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
 	defer stop()
 	backend := "http://" + addr
 	first, firstOut := startRProxy(t, backend, startApp(t))
 	second, _ := startRProxy(t, backend, startApp(t))
 	wantStatus(t, first+"/", placed, http.StatusOK)
 	wantStatus(t, second+"/", placed, http.StatusOK)
 	// The default rule file bans a probe for this.
 	wantStatus(t, first+bannedProbe, placed, http.StatusForbidden)
 	wantStatus(t, second+"/", placed, http.StatusForbidden)
 	wantStatus(t, second+"/", otherClient, http.StatusOK)
 	// One request's three lines carry one id, rproxy's with servewaf's answer.
 	line := firstOut.line(t, "path", bannedProbe)
 	if line["disposition"] != proxy.DispositionDeny || line["client_ip"] != placed {
 		t.Errorf("rproxy's line is %v", line)
 	}
 	id, _ := line["request_id"].(string)
 	decision := serveWAFLine(t, serveWAFOut, id, "decision")
 	report := serveWAFLine(t, serveWAFOut, id, "report")
 	if decision["host"] != line["host"] || decision["client_ip"] != placed ||
 		report["status"] != float64(http.StatusForbidden) {
 		t.Errorf("servewaf's lines are %v and %v", decision, report)
 	}
 }
 // serveWAFLine waits for servewaf's line with request id and servewaf_line kind.
 func serveWAFLine(t *testing.T, out *output, id, kind string) map[string]any {
 	t.Helper()
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
 		line := out.findLine(t, func(fields map[string]any) bool {
 			return fields["request_id"] == id && fields["servewaf_line"] == kind
 		})
 		if line != nil {
 			return line
 		}
 		time.Sleep(pollInterval)
 	}
 	t.Fatalf("no %s line for %s in:\n%s", kind, id, out.text())
 	return nil
 }
 func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
 	t.Parallel()
 	env := serveWAFSettings(t)
 	addr, _, stop := startServeWAF(t, env)
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
 	// A visitor who keeps asking throughout, and is never refused.
 	visitorDone := make(chan struct{})
 	visitorStop := make(chan struct{})
 	var refused atomic.Int64
 	go func() {
 		defer close(visitorDone)
 		for {
 			select {
 			case <-visitorStop:
 				return
 			case <-time.After(pollInterval):
 			}
 			if !answersNormally(t.Context(), site+"/", otherClient) {
 				refused.Add(1)
 			}
 		}
 	}()
 	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
 	wantStatus(t, site+"/", placed, http.StatusForbidden)
 	stop()
 	// With servewaf down, the site answers, and rproxy says the default did it.
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 	line := out.line(t, "path", "/after-stop")
 	if line["disposition"] != proxy.DispositionAllow ||
 		line["default_disposition"] != true {
 		t.Errorf("rproxy's line is %v", line)
 	}
 	// Back at its address, with its state files, it applies the ban again.
 	restarted := maps.Clone(env)
 	restarted[listenAddr] = addr
 	_, _, stop = startServeWAF(t, restarted)
 	defer stop()
 	wantStatus(t, site+"/", placed, http.StatusForbidden)
 	close(visitorStop)
 	<-visitorDone
 	if refused.Load() != 0 {
 		t.Errorf("the site refused its visitor %d times", refused.Load())
 	}
 }
 // answersNormally reports whether a request to url from the client at from, as
 // X-Forwarded-For names it, gets the app's answer.
 func answersNormally(ctx context.Context, url, from string) bool {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
 	if err != nil {
 		return false
 	}
 	req.Header.Set("X-Forwarded-For", from)
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()
 	res, err := transport.RoundTrip(req)
 	if err != nil {
 		return false
 	}
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 	return err == nil && res.StatusCode == http.StatusOK && string(body) == greeting
 }
 // sendRaw sends request, as it is, to rproxy at site, and returns the status of
 // the answer.
 func sendRaw(t *testing.T, site, request string) int {
 	t.Helper()
 	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp",
 		strings.TrimPrefix(site, "http://"))
 	if err != nil {
 		t.Fatalf("dial: %v", err)
 	}
 	defer func() {
 		_ = conn.Close()
 	}()
 	err = conn.SetDeadline(time.Now().Add(waitLimit))
 	if err != nil {
 		t.Fatalf("set the deadline: %v", err)
 	}
 	_, err = io.WriteString(conn, request)
 	if err != nil {
 		t.Fatalf("send: %v", err)
 	}
 	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
 	if err != nil {
 		t.Fatalf("read the answer: %v", err)
 	}
 	_ = res.Body.Close()
 	return res.StatusCode
 }
 func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
 	t.Parallel()
 	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
 	defer stop()
 	site, _ := startRProxy(t, "http://"+addr, startApp(t))
 	// Read as a further request, this body would ban otherClient on every site.
 	const smuggledID = "smuggled-request"
 	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
 		proxy.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
 		"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
 		strconv.FormatInt(int64(len(smuggled)), 16)+"\r\n"+smuggled+"\r\n0\r\n\r\n")
 	if status != http.StatusOK {
 		t.Errorf("status %d, want the app's 200", status)
 	}
 	// Read as a further request, it would act straight after the answer.
 	for range 20 {
 		wantStatus(t, site+"/", otherClient, http.StatusOK)
 		time.Sleep(pollInterval)
 	}
 	line := serveWAFOut.findLine(t, func(fields map[string]any) bool {
 		return fields["request_id"] == smuggledID
 	})
 	if line != nil {
 		t.Errorf("servewaf read the body as a request: %v", line)
 	}
 }
 func TestATargetThatCannotGoToServeWAFIsRefusedForABannedClient(t *testing.T) {
 	t.Parallel()
 	addr, _, stop := startServeWAF(t, serveWAFSettings(t))
 	defer stop()
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
 	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
 	status := sendRaw(t, site, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n"+
 		"X-Forwarded-For: "+placed+"\r\n\r\n")
 	if status != http.StatusBadRequest {
 		t.Errorf("status %d, want 400", status)
 	}
 	line := out.line(t, "path", "admin")
 	if line["disposition"] != nil || line["default_disposition"] != nil {
 		t.Errorf("rproxy's line is %v, want no disposition", line)
 	}
 }
 func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 	t.Parallel()
 	const zoned = "2001:db8::1%eth0"
 	addr, _, stop := startServeWAF(t, serveWAFSettings(t))
 	defer stop()
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
 	wantStatus(t, site+bannedProbe, zoned, http.StatusForbidden)
 	wantStatus(t, site+"/", zoned, http.StatusForbidden)
 	wantStatus(t, site+"/", "2001:db8::1", http.StatusForbidden)
 	line := out.line(t, "path", bannedProbe)
 	if line["client_ip"] != "2001:db8::1" || line["default_disposition"] != nil {
 		t.Errorf("rproxy's line is %v", line)
 	}
 }
 func TestAStatusServeWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 	t.Parallel()
 	const status = 799
 	app := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(status)
 		}))
 	t.Cleanup(app.Close)
 	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
 	defer stop()
 	site, out := startRProxy(t, "http://"+addr, app.URL)
 	wantStatus(t, site+"/", placed, status)
 	line := out.line(t, "path", "/")
 	if line["status"] != float64(status) {
 		t.Errorf("rproxy's line is %v, want the status the visitor got", line)
 	}
 	id, _ := line["request_id"].(string)
 	report := serveWAFLine(t, serveWAFOut, id, "report")
 	if report["status"] != 599.0 {
 		t.Errorf("servewaf's line is %v, want status 599", report)
 	}
 }
 // startRProxyProcess runs `smallwebwaf rproxy` in a process of its own, with the
 // settings in env, each as NAME=value. It returns where rproxy listens, the
 // process, and what rproxy writes.
 func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output) {
 	t.Helper()
 	binary, err := os.Executable()
 	if err != nil {
 		t.Fatalf("find the test binary: %v", err)
 	}
 	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
 	t.Cleanup(cancel)
 	out := &output{}
 	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
 	cmd.Stdout = out
 	cmd.Env = append(os.Environ(),
 		commandForMain+"=rproxy",
 		"SWRP_LISTEN_ADDR="+localhost+":0")
 	cmd.Env = append(cmd.Env, env...)
 	err = cmd.Start()
 	if err != nil {
 		t.Fatalf("start: %v", err)
 	}
 	t.Cleanup(func() {
 		_ = cmd.Process.Kill()
 		_ = cmd.Wait()
 	})
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	return addr, cmd, out
 }
 func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	t.Parallel()
 	protocols := make(chan string, 10)
 	backend := httptest.NewUnstartedServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
 			if r.Header.Get(proxy.ClientHeader) != "" {
 				protocols <- r.Proto
 				w.Header().Set(proxy.DispositionHeader, proxy.DispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
 			}
 		}))
 	backend.EnableHTTP2 = true
 	backend.StartTLS()
 	t.Cleanup(backend.Close)
 	// rproxy has no setting for the certificates it trusts, so it is told of this
 	// one as Go's client is told of any, in a process of its own.
 	certificates := filepath.Join(t.TempDir(), "servewaf.pem")
 	err := os.WriteFile(certificates, pem.EncodeToMemory(&pem.Block{
 		Type: "CERTIFICATE", Bytes: backend.Certificate().Raw,
 	}), 0o600)
 	if err != nil {
 		t.Fatalf("write the certificate: %v", err)
 	}
 	addr, _, _ := startRProxyProcess(t,
 		wafBackend+"="+backend.URL,
 		"SWRP_UPSTREAM_URL="+startApp(t),
 		"SSL_CERT_FILE="+certificates)
 	for name, headers := range map[string]string{
 		"no such header":      "",
 		"Upgrade":             "Upgrade: anything\r\n",
 		"Connection":          "Connection: anything\r\n",
 		"a WebSocket upgrade": "Connection: Upgrade\r\nUpgrade: websocket\r\n",
 	} {
 		status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n")
 		if status != http.StatusForbidden {
 			t.Errorf("with %s: status %d, want servewaf's 403", name, status)
 		}
 		select {
 		case protocol := <-protocols:
 			if protocol != "HTTP/1.1" {
 				t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol)
 			}
 		case <-time.After(waitLimit):
 			t.Errorf("with %s: servewaf was not asked", name)
 		}
 	}
 }
 func TestRProxyProcessLinesNameTheHostAndComeAtInfo(t *testing.T) {
 	t.Parallel()
 	hostname, err := os.Hostname()
 	if err != nil {
 		t.Fatalf("the host's name: %v", err)
 	}
 	// Nothing listens at the backend's address; no request asks it.
 	_, out := startRProxy(t, "http://127.0.0.1:9", startApp(t))
 	line := out.line(t, "msg", "starting")
 	if line["instance"] != hostname || line["level"] != "INFO" {
 		t.Errorf("rproxy's line is %v, want instance %s at INFO", line, hostname)
 	}
 }
 func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	t.Parallel()
 	reportGotThere := make(chan struct{})
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
 			if r.Header.Get(proxy.ClientHeader) != "" {
 				w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 				return
 			}
 			close(reportGotThere)
 			<-release
 			w.WriteHeader(http.StatusNoContent)
 		}))
 	t.Cleanup(backend.Close)
 	ctx, stop := context.WithCancel(t.Context())
 	defer stop()
 	env := map[string]string{
 		rproxyListenAddr:    localhost + ":0",
 		"SWRP_UPSTREAM_URL": startApp(t),
 		rproxyTimeout:       "60000",
 		wafBackend:          backend.URL,
 	}
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runRProxy(ctx, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	wantStatus(t, "http://"+addr+"/", placed, http.StatusOK)
 	select {
 	case <-reportGotThere:
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 	}
 	stop()
 	select {
 	case <-exited:
 		t.Error("rproxy stopped with a report on its way")
 		close(release)
 		return
 	case <-time.After(10 * pollInterval):
 	}
 	close(release)
 	select {
 	case status := <-exited:
 		if status != 0 {
 			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running, the report having been answered")
 	}
 }
 // sendAndKeepOpen sends request to rproxy at addr, and returns the connection. A
 // read from it ends with an error once waitLimit is up.
 func sendAndKeepOpen(t *testing.T, addr, request string) net.Conn {
 	t.Helper()
 	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp", addr)
 	if err != nil {
 		t.Fatalf("dial: %v", err)
 	}
 	t.Cleanup(func() {
 		_ = conn.Close()
 	})
 	err = conn.SetDeadline(time.Now().Add(waitLimit))
 	if err != nil {
 		t.Fatalf("set the deadline: %v", err)
 	}
 	_, err = io.WriteString(conn, request)
 	if err != nil {
 		t.Fatalf("send: %v", err)
 	}
 	return conn
 }
 func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 	t.Parallel()
 	const (
 		cutOffAfter     = 5 * time.Second
 		upstreamSetting = "SWRP_UPSTREAM_URL"
 	)
 	asked := make(chan struct{})
 	release := make(chan struct{})
 	app := httptest.NewServer(http.HandlerFunc(
 		func(http.ResponseWriter, *http.Request) {
 			close(asked)
 			<-release
 		}))
 	t.Cleanup(app.Close)
 	t.Cleanup(func() { close(release) })
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 	ctx, stop := context.WithCancel(t.Context())
 	defer stop()
 	env := map[string]string{
 		rproxyListenAddr: localhost + ":0",
 		upstreamSetting:  app.URL,
 		wafBackend:       backend.URL,
 	}
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runRProxy(ctx, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	conn := sendAndKeepOpen(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	select {
 	case <-asked:
 	case <-time.After(waitLimit):
 		t.Fatal("the app was not asked")
 	}
 	stopped := time.Now()
 	stop()
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
 		t.Errorf("read %q (%v), want the connection cut off", text, err)
 	}
 	if elapsed := time.Since(stopped); elapsed < cutOffAfter {
 		t.Errorf("cut off after %s, want %s", elapsed, cutOffAfter)
 	}
 	select {
 	case status := <-exited:
 		if status != 0 {
 			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running after the cut-off")
 	}
 	out.line(t, "msg", "requests still in progress were cut off")
 }
 func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, setting string
 		env           map[string]string
 	}{
 		{"no backend", wafBackend, nil},
 		{
 			"another invalid", rproxyTimeout,
 			map[string]string{wafBackend: "http://servewaf:8080", rproxyTimeout: "soon"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			out := &output{}
 			if status := runRProxy(t.Context(), tc.env, out); status != 1 {
 				t.Errorf("exit status %d, want 1", status)
 			}
 			line := out.line(t, "msg", "invalid setting")
 			message, _ := line["error"].(string)
 			if !strings.HasPrefix(message, tc.setting+": ") {
 				t.Errorf("start refused with %v, want it to name %s", line, tc.setting)
 			}
 		})
 	}
 }
 func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	t.Parallel()
 	taken, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	defer func() {
 		_ = taken.Close()
 	}()
 	out := &output{}
 	status := runRProxy(t.Context(), map[string]string{
 		wafBackend:       "http://servewaf:8080",
 		rproxyListenAddr: taken.Addr().String(),
 	}, out)
 	if status != 1 {
 		t.Errorf("exit status %d, want 1", status)
 	}
 	out.line(t, "msg", "cannot listen on SWRP_LISTEN_ADDR")
 }
 func TestMainRunsRProxy(t *testing.T) {
 	t.Parallel()
 	// Nothing listens there; the health check does not ask.
 	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
 		"http://"+addr+proxy.HealthPath, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()
 	res, err := transport.RoundTrip(req)
 	if err != nil {
 		t.Fatalf("health check: %v", err)
 	}
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 	if err != nil || string(body) != "ok\n" {
 		t.Errorf("health check answered %q (%v)", body, err)
 	}
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
 		t.Fatalf("signal: %v", err)
 	}
 	err = cmd.Wait()
 	if err != nil {
 		t.Errorf("exit: %v; output:\n%s", err, out.text())
 	}
 }
@@ -1,210 +0,0 @@
 package smallwebwaf_test
 import (
 	"context"
 	"crypto/rand"
 	"io"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"syscall"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 // commandForMain, while set in the environment, has this test binary run Main
 // with the command it gives, in place of the tests, so that a test can run
 // Main in a process of its own.
 const commandForMain = "SMALLWEBWAF_TEST_COMMAND"
 func TestMain(m *testing.M) {
 	command, set := os.LookupEnv(commandForMain)
 	if !set {
 		os.Exit(m.Run())
 	}
 	os.Args = strings.Fields("smallwebwaf " + command)
 	os.Exit(smallwebwaf.Main(testVersion))
 }
 func TestMainAnswersQuestionsOnlyAsServeWAF(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		command, disposition string
 	}{
 		{"servewaf", proxy.DispositionAllow},
 		{"", ""},
 	} {
 		t.Run("command "+tc.command, func(t *testing.T) {
 			t.Parallel()
 			binary, err := os.Executable()
 			if err != nil {
 				t.Fatalf("find the test binary: %v", err)
 			}
 			ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
 			defer cancel()
 			out := &output{}
 			cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
 			cmd.Stdout = out
 			cmd.Env = append(os.Environ(),
 				commandForMain+"="+tc.command,
 				listenAddr+"="+localhost+":0",
 				upstreamURL+"="+startApp(t),
 				stateDir+"="+t.TempDir(),
 				rulesDir+"="+t.TempDir(),
 				lookupSource+"=off")
 			err = cmd.Start()
 			if err != nil {
 				t.Fatalf("start: %v", err)
 			}
 			t.Cleanup(func() {
 				_ = cmd.Process.Kill()
 				_ = cmd.Wait()
 			})
 			addr, _ := out.line(t, "msg", "starting")["address"].(string)
 			ask(t, addr, "/", http.StatusOK, tc.disposition)
 			err = cmd.Process.Signal(syscall.SIGTERM)
 			if err != nil {
 				t.Fatalf("signal: %v", err)
 			}
 			err = cmd.Wait()
 			if err != nil {
 				t.Errorf("exit: %v; output:\n%s", err, out.text())
 			}
 		})
 	}
 }
 // ask sends servewaf at addr rproxy's question about a request for path from
 // placed, checks the answer's status and disposition, and closes it.
 func ask(t *testing.T, addr, path string, status int, disposition string) {
 	t.Helper()
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
 		"http://"+addr+path, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
 	req.Header.Set(proxy.ClientHeader, placed)
 	req.Header.Set("X-Request-ID", rand.Text())
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()
 	res, err := (&http.Client{Transport: transport}).Do(req)
 	if err != nil {
 		t.Fatalf("question: %v", err)
 	}
 	_, _ = io.Copy(io.Discard, res.Body)
 	_ = res.Body.Close()
 	if res.StatusCode != status ||
 		res.Header.Get(proxy.DispositionHeader) != disposition {
 		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
 			res.Header.Get(proxy.DispositionHeader), status, disposition)
 	}
 }
 // runServeWAF runs `smallwebwaf servewaf` with the settings in env, has use
 // send it requests at the address it listens on, stops it as SIGTERM does, and
 // checks that it stopped in order.
 func runServeWAF(t *testing.T, env map[string]string, use func(addr string)) {
 	t.Helper()
 	ctx, stop := context.WithCancel(t.Context())
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runAs(ctx, true, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	use(addr)
 	stop()
 	select {
 	case status := <-exited:
 		if status != 0 {
 			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
 		}
 	case <-time.After(waitLimit):
 		t.Fatal("still running after being told to stop")
 	}
 	out.line(t, "msg", "stopped")
 }
 func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 	t.Parallel()
 	env := map[string]string{
 		listenAddr: localhost + ":0",
 		stateDir:   t.TempDir(),
 		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
 	}
 	runServeWAF(t, env, func(addr string) {
 		ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
 		// The default rule file bans a probe for this.
 		ask(t, addr, "/.env", http.StatusForbidden, proxy.DispositionDeny)
 	})
 	runServeWAF(t, env, func(addr string) {
 		ask(t, addr, "/", http.StatusForbidden, proxy.DispositionDeny)
 	})
 }
 func TestWithoutACommandTheClientHeaderIsNoQuestion(t *testing.T) {
 	t.Parallel()
 	runUntilStopped(t, map[string]string{
 		listenAddr:  localhost + ":0",
 		upstreamURL: startApp(t),
 		stateDir:    t.TempDir(),
 		rulesDir:    t.TempDir(),
 	}, func(url string) {
 		req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
 			http.NoBody)
 		if err != nil {
 			t.Fatalf("new request: %v", err)
 		}
 		req.Header.Set(proxy.ClientHeader, placed)
 		transport := &http.Transport{}
 		defer transport.CloseIdleConnections()
 		res, err := (&http.Client{Transport: transport}).Do(req)
 		if err != nil {
 			t.Fatalf("request: %v", err)
 		}
 		body, err := io.ReadAll(res.Body)
 		_ = res.Body.Close()
 		if err != nil || string(body) != greeting ||
 			res.Header.Get(proxy.DispositionHeader) != "" {
 			t.Errorf("answered %q (%v) with disposition %q, want the app's greeting",
 				body, err, res.Header.Get(proxy.DispositionHeader))
 		}
 	})
 }
@@ -1,10 +1,7 @@
 // Package smallwebwaf runs the smallwebwaf process: it reads the settings,
 // the rule files, the lookup database and the state files, serves requests
 // until it is told to stop, and then stops in an orderly way, writing the
-// state files. It serves them in front of an app, or, as `smallwebwaf
+// state files.
 // servewaf`, by answering rproxy's questions about them. As `smallwebwaf
 // rproxy`, it instead reads rproxy's settings alone, and runs the reverse proxy
 // in front of one app that asks servewaf about each request.
 package smallwebwaf
 import (
@@ -48,17 +45,11 @@ type Params struct {
 	LookupEnv func(string) (string, bool)
 	// Stdout receives the request log and the process's own messages.
 	Stdout io.Writer
 	// ServeWAF makes it `smallwebwaf servewaf`, which answers rproxy's
 	// questions, rather than the proxy in front of an app.
 	ServeWAF bool
 }
 // Main runs smallwebwaf until SIGTERM or SIGINT, and returns the
-// process's exit status. Run as `smallwebwaf servewaf`, it answers
+// process's exit status. Run as `smallwebwaf healthcheck`, it is the
-// rproxy's questions rather than pass requests to an app. Run as
+// container's health check instead.
 // `smallwebwaf rproxy`, it is the reverse proxy that asks those questions.
 // Run as `smallwebwaf healthcheck`, it is the container's health check
 // instead.
 func Main(version string) int {
 	if len(os.Args) > 1 && os.Args[1] == "healthcheck" {
 		return HealthCheck(context.Background(), os.Args[2:], os.LookupEnv, os.Stderr)
@@ -68,18 +59,11 @@ func Main(version string) int {
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
-	params := Params{
+	return Run(ctx, Params{
 		Version:   version,
 		LookupEnv: os.LookupEnv,
 		Stdout:    os.Stdout,
-		ServeWAF:  len(os.Args) > 1 && os.Args[1] == "servewaf",
+	})
 	}
 	if len(os.Args) > 1 && os.Args[1] == "rproxy" {
 		return RunRProxy(ctx, params)
 	}
 	return Run(ctx, params)
 }
 // Run reads the settings, the rule files, the lookup database and the
@@ -133,12 +117,7 @@ func Run(ctx context.Context, params Params) int {
 		return 1
 	}
-	newProxy := proxy.New
+	server, err := newServer(cfg, stdout, processLog, now, ruleFiles, alertQueue)
 	if params.ServeWAF {
 		newProxy = proxy.NewServeWAF
 	}
 	server, err := newServer(newProxy, cfg, stdout, processLog, now, ruleFiles, alertQueue)
 	if err != nil {
 		processLog.Error("cannot use the lookup database", "error", err.Error())
@@ -172,12 +151,10 @@ func Run(ctx context.Context, params Params) int {
 	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
 }
-// newServer returns the server smallwebwaf runs, which newProxy makes, with
+// newServer returns the server smallwebwaf runs, with the metrics of the
-// the metrics of the alerts, after reading the lookup database while
+// alerts, after reading the lookup database while SWWAF_LOOKUP_SOURCE is
-// SWWAF_LOOKUP_SOURCE is file. A lookup database that cannot be read is an
+// file. A lookup database that cannot be read is an error.
 // error.
 func newServer(
 	newProxy func(proxy.Params) *proxy.Server,
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 ) (*proxy.Server, error) {
@@ -197,7 +174,7 @@ func newServer(
 		}
 	}
-	server := newProxy(proxy.Params{
+	server := proxy.New(proxy.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -76,11 +76,21 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
-		fields := o.findLine(t, func(fields map[string]any) bool {
+		o.mu.Lock()
-			return fields[key] == value
+		text := o.buf.String()
-		})
+		o.mu.Unlock()
-		if fields != nil {
+
-			return fields
+		for line := range strings.Lines(text) {
 			var fields map[string]any
 			err := json.Unmarshal([]byte(line), &fields)
 			if err != nil {
 				t.Fatalf("output line %q is not JSON: %v", line, err)
 			}
 			if fields[key] == value {
 				return fields
 			}
 		}
 		time.Sleep(pollInterval)
@@ -91,29 +101,6 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 	return nil
 }
 // findLine returns the first line written so far for which matches is true, or
 // nil.
 func (o *output) findLine(
 	t *testing.T, matches func(map[string]any) bool,
 ) map[string]any {
 	t.Helper()
 	for line := range strings.Lines(o.text()) {
 		var fields map[string]any
 		err := json.Unmarshal([]byte(line), &fields)
 		if err != nil {
 			t.Fatalf("output line %q is not JSON: %v", line, err)
 		}
 		if matches(fields) {
 			return fields
 		}
 	}
 	return nil
 }
 // text returns everything written so far.
 func (o *output) text() string {
 	o.mu.Lock()
@@ -126,13 +113,6 @@ func (o *output) text() string {
 // returns its exit status. SWWAF_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
 	return runAs(ctx, false, env, out)
 }
 // runAs is run as `smallwebwaf servewaf` while serveWAF is true.
 func runAs(
 	ctx context.Context, serveWAF bool, env map[string]string, out *output,
 ) int {
 	return smallwebwaf.Run(ctx, smallwebwaf.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
@@ -143,8 +123,7 @@ func runAs(
 			return value, ok
 		},
-		Stdout:   out,
+		Stdout: out,
 		ServeWAF: serveWAF,
 	})
 }
@@ -1261,13 +1240,13 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 		"SWWAF_UPSTREAM_REQUEST_TIMEOUT":        "60s",
 		"SWWAF_UPSTREAM_RESPONSE_TIMEOUT":       "30m",
 		"SWWAF_REQUEST_MAX_BYTES":               "100M",
-		"SWWAF_RESPONSE_MAX_BYTES":              "1G",
+		"SWWAF_RESPONSE_MAX_BYTES":              "5G",
 		"SWWAF_ALLOW_NETS":                      "",
 		rateLimitExemptNets:                     "",
 		"SWWAF_DENY_NETS":                       "",
-		"SWWAF_RATE_LIMIT_PER_MINUTE":           "500",
+		"SWWAF_RATE_LIMIT_PER_MINUTE":           "1000",
-		"SWWAF_RATE_LIMIT_PER_HOUR":             "20000",
+		"SWWAF_RATE_LIMIT_PER_HOUR":             "10000",
-		rateLimitPerDay:                         "300000",
+		rateLimitPerDay:                         "50000",
 		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":         "",
 		"SWWAF_DENIED_COUNTRIES":                "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",
@@ -1,6 +1,5 @@
 // Package state keeps smallwebwaf's state in JSON files in
-// SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md requires
+// SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md describes:
 // and docs/state-files.md lists them:
 // bans.json holds the bans, clients.json each client's counters and
 // history, lookups.json GeoJS's answers, reputation.json the last try and
 // last good copy of each list fetched from a URL, the DNSBL zones'
@@ -62,7 +61,6 @@ var (
 	// errMissing is for an entry without a field it needs.
 	errMissing     = errors.New("has no")
 	errCause       = errors.New("is not limit, attack, admin or crowdsec")
 	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
 	errScope       = errors.New("is not client, net, asn, total or watch")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
@@ -648,10 +646,8 @@ func (e BanEntry) ban() bans.Ban {
 // client, a start, from which the length of the netblock's next ban is
 // worked out, or an expires, which would make it permanent. A permanent
 // ban's expires is null, which Bans cannot tell from a missing one, so
-// each expires is read again as written. An expires not after the start
+// each expires is read again as written. A cause other than limit,
-// is refused too, since the netblock's next ban for a broken limit, three
+// attack, admin or crowdsec, most likely misspelt, is refused too.
 // times as long as this one, would then refuse nothing; and so is a cause
 // other than limit, attack, admin or crowdsec, most likely misspelt.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -672,8 +668,6 @@ func (f *bansFile) check(data []byte) error {
 			return missing(i, "start")
 		case written.Bans[i].Expires == nil:
 			return missing(i, "expires")
 		case entry.Expires != nil && !entry.Expires.After(entry.Start):
 			return fmt.Errorf("entry %d's expires %w", i+1, errExpires)
 		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
 			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin &&
 			entry.Cause != bans.CauseCrowdSec:
@@ -865,21 +865,6 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
 		`: entry 4's cause "atack" is not limit, attack, admin or crowdsec`)
 }
 func TestBanThatDoesNotEndAfterItsStartStopsTheStart(t *testing.T) {
 	t.Parallel()
 	// The first ban ends a second after its start; the second ends as it
 	// starts, or an hour before.
 	for _, expires := range []string{`"2026-10-06T00:00:00Z"`, `"2026-10-05T23:00:00Z"`} {
 		wantRefused(t, bansJSON, `{"version": 1, "bans": [`+
 			`{"netblock": "203.0.113.9/32", "start": "2026-10-06T00:00:00Z", `+
 			`"expires": "2026-10-06T00:00:01Z"}, `+
 			`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
 			`"expires": `+expires+`}]}`,
 			`: entry 2's expires is not after its start`)
 	}
 }
 func TestUnknownVersionStopsTheStart(t *testing.T) {
 	t.Parallel()
@@ -1019,8 +1004,8 @@ func TestEditJustBeforeAScheduledWriteSurvivesIt(t *testing.T) {
 		edit(t, dir, bansJSON, permanentBansJSON)
 		// The write takes the edit in first, and writes it back. The second
-		// ban, made after the admin opened the file, is lost, as the
+		// ban, made after the admin opened the file, is lost, as "Edits
-		// "Persistent state" section of SPEC.md says.
+		// while running" in SPEC.md says.
 		time.Sleep(time.Nanosecond)
 		synctest.Wait()
@@ -1,8 +1,8 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
 // body while SWWAF_WAF_BODY_LIMIT is set, with the six changes smallwebwaf
-// makes to it, as "Attack detection" under "Settings" in SPEC.md describes
+// makes to it, as "Attack detection" under "Configuration surface" in
-// them. It reads no response.
+// SPEC.md describes them. It reads no response.
 //
 // smallwebwaf writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
@@ -5,15 +5,12 @@
 # served through smallwebwaf, that a second one in a minute bans the
 # client, that a probe for /.env bans another client, which its next
 # request bans for good, that `sv stop` stops smallwebwaf in order, that
-# `docker stop` stops the container without having to kill it, that a
+# `docker stop` stops the container without having to kill it, and that
-# new container on the same volume still refuses the banned client, that
+# a new container on the same volume still refuses the banned client. The
 # a container with its state files on a new volume mounted at the
 # directory SWWAF_STATE_DIR_FILE names becomes healthy, and that one whose
 # SWWAF_STATE_DIR does not exist logs smallwebwaf's message about it. The
 # containers run with SWWAF_LOOKUP_SOURCE=off, so that no address is sent
-# to GeoJS. The containers, the volumes and both images are removed
+# to GeoJS. The containers, the volume and both images are removed however
-# however the script ends. Building the app needs network access, for
+# the script ends. Building the app needs network access, for nixpkgs'
-# nixpkgs' binary cache. script/check does not run this.
+# binary cache. script/check does not run this.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -26,15 +23,10 @@ IMAGE="$NAME-base"
 APP_IMAGE="$NAME-app"
 CONTAINER="$NAME"
 VOLUME="$NAME-state"
 # The volumes of the container whose state directory SWWAF_STATE_DIR_FILE
 # names: its state files, and the file that names their directory.
 MOVED_VOLUME="$NAME-moved-state"
 SETTINGS_VOLUME="$NAME-settings"
 cleanup() {
    docker rm --force "$CONTAINER" >/dev/null 2>&1 || true
-    docker volume rm --force "$VOLUME" "$MOVED_VOLUME" "$SETTINGS_VOLUME" \
+    docker volume rm --force "$VOLUME" >/dev/null 2>&1 || true
        >/dev/null 2>&1 || true
    docker rmi --force "$APP_IMAGE" "$IMAGE" >/dev/null 2>&1 || true
 }
@@ -84,27 +76,6 @@ start_container() {
    address="$(docker port "$CONTAINER" 8080/tcp)"
 }
 # start_moved_container: run the app's container with the state files on
 # a new volume at /srv/state, which SWWAF_STATE_DIR_FILE names in a file
 # only the smallwebwaf user can read, as under "Settings given as files"
 # in docs/settings.md, and wait until it is healthy. smallwebwaf can write the
 # new volume only once the run script has given it to that user.
 start_moved_container() {
    docker volume create "$MOVED_VOLUME" >/dev/null
    docker volume create "$SETTINGS_VOLUME" >/dev/null
    docker run --rm --volume "$SETTINGS_VOLUME:/settings" \
        --entrypoint bash "$IMAGE" -c 'echo /srv/state > /settings/state-dir &&
            chown smallwebwaf:smallwebwaf /settings/state-dir &&
            chmod 0400 /settings/state-dir'
    docker run --detach --name "$CONTAINER" \
        --volume "$MOVED_VOLUME:/srv/state" \
        --volume "$SETTINGS_VOLUME:/etc/smallwebwaf/settings:ro" \
        --env SWWAF_STATE_DIR_FILE=/etc/smallwebwaf/settings/state-dir \
        --env SWWAF_LOOKUP_SOURCE=off \
        "$APP_IMAGE" >/dev/null
    wait_for "the health check did not pass" healthy
 }
 # refused: a request to the container gets 403, SWWAF_BAN_RESPONSE's
 # default.
 refused() {
@@ -169,20 +140,6 @@ main() {
    wait_for "smallwebwaf logged no request refused under the ban" \
        logged '"action":"banned"'
    echo "example-app: a new container on the same volume keeps the ban"
    docker rm --force "$CONTAINER" >/dev/null
    start_moved_container
    echo "example-app: the run script gives the state files' directory named" \
        "by SWWAF_STATE_DIR_FILE to the smallwebwaf user"
    docker rm --force "$CONTAINER" >/dev/null
    docker run --detach --name "$CONTAINER" \
        --env SWWAF_STATE_DIR=/srv/missing \
        --env SWWAF_LOOKUP_SOURCE=off \
        "$APP_IMAGE" >/dev/null
    wait_for "smallwebwaf did not report the missing state directory" \
        logged "SWWAF_STATE_DIR cannot be written"
    echo "example-app: smallwebwaf reports a state directory that does not exist"
 }
 main "$@"
@@ -1,336 +0,0 @@
 #!/bin/sh
 # script/gitea-requests: build the image and run gitea 1.27.3 behind it,
 # with every setting of smallwebwaf at its default but SWWAF_UPSTREAM_URL,
 # which names gitea's container. Then send through it the gitea requests
 # that reading gitea's source found the Core Rule Set refuses, which
 # docs/gitea.md records, and a short sample of gitea's ordinary use:
 # signing in, pages of files and commits, a diff, the API, a push, clone
 # and fetch over HTTP, and two container image pushes. Last, print each
 # request smallwebwaf logged, with what it did with it and the ids of the
 # Core Rule Set's rules that matched it.
 # Every request comes from one client, docker's gateway, so more than
 # SWWAF_ERROR_BURST_THRESHOLD, 30, refusals in a minute would ban it, and
 # the requests after would show as banned. The containers, the network,
 # the images and the files the script makes are removed however it ends;
 # gitea's own image stays, as the base images of a build do. It needs
 # network access, and a docker daemon that pushes to a registry on
 # localhost over plain HTTP, as docker does by default. script/check does
 # not run this.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 # gitea 1.27.3, 2026-08-29
 GITEA_IMAGE="gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef"
 # Named after this run, so that runs in other clones on the same host
 # never touch each other's.
 NAME="$("$SCRIPT_DIR/projectname")-gitea-$$"
 IMAGE="$NAME-image"
 NETWORK="$NAME"
 SMALLWEBWAF="$NAME-smallwebwaf"
 GITEA="$NAME-gitea"
 # gitea's one user, who owns the repository and the container images.
 PASSWORD="owner-password"
 BROWSER="Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0"
 # The files the script makes, and smallwebwaf's address once it runs,
 # localhost and the port docker publishes it on: a host name, since the
 # Core Rule Set takes a Host that is an IP address for a warning (920350).
 WORK=""
 address=""
 cleanup() {
    # So that a signal cannot stop it partway through.
    trap '' HUP INT TERM
    docker rm --force --volumes "$SMALLWEBWAF" "$GITEA" >/dev/null 2>&1 || true
    docker network rm "$NETWORK" >/dev/null 2>&1 || true
    docker rmi --force "$IMAGE" >/dev/null 2>&1 || true
    if [ -n "$address" ]; then
        docker rmi --force "$address/owner/python3-app:1" "$address/owner/app:1" \
            >/dev/null 2>&1 || true
    fi
    rm -rf "$WORK"
 }
 fail() {
    echo "gitea-requests: $*" >&2
    report
    exit 1
 }
 # wait_for <what fails> <command>...: run the command every second until
 # it succeeds, for at most a minute.
 wait_for() {
    failure="$1"
    shift
    tries=0
    until "$@"; do
        tries=$((tries + 1))
        [ "$tries" -lt 60 ] || fail "$failure"
        sleep 1
    done
 }
 healthy() {
    status="$(docker inspect --format '{{.State.Health.Status}}' "$SMALLWEBWAF")"
    [ "$status" = healthy ]
 }
 # logged <text>...: a line of smallwebwaf's output holds every text, in
 # any order.
 logged() {
    lines="$(docker logs "$SMALLWEBWAF" 2>&1)"
    for text in "$@"; do
        lines="$(printf '%s\n' "$lines" | grep -F "$text")" || return 1
    done
 }
 # send <label> <path> <curl option>...: send a request for path to
 # smallwebwaf, with label as its X-Request-ID, which the report gives,
 # and keep the body of the answer in $WORK/answer. The Core Rule Set
 # reads that header too, so a label names no file the cases name.
 send() {
    label="$1"
    path="$2"
    shift 2
    curl --silent --show-error --max-time 30 --output "$WORK/answer" \
        --header "X-Request-ID: $label" "$@" "http://$address$path"
 }
 # page <label> <path> <curl option>...: send the request as a browser
 # does, with the cookies gitea has set. Its Referer is the repository's
 # page, which links to the others, and never a page the Core Rule Set
 # refused: its address would have the next request refused too.
 page() {
    label="$1"
    path="$2"
    shift 2
    send "$label" "$path" --compressed --user-agent "$BROWSER" \
        --header "Accept: text/html,application/xhtml+xml,*/*;q=0.8" \
        --header "Accept-Language: en-US,en;q=0.5" \
        --cookie "$WORK/cookies" --cookie-jar "$WORK/cookies" \
        --referer "http://$address/owner/repo" "$@"
 }
 # api <label> <path> <curl option>...: send the request as a client of
 # gitea's API does, as the owner.
 api() {
    label="$1"
    path="$2"
    shift 2
    send "$label" "$path" --user "owner:$PASSWORD" \
        --header "Accept: application/json" "$@"
 }
 # repo_git <git argument>...: run git as the owner, without the host's
 # own git settings, so that nothing it does is kept outside $WORK.
 repo_git() {
    GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 git \
        -c user.name=owner -c user.email=owner@example.invalid "$@"
 }
 # lines: forty lines of text, enough for a diff to hide some of them.
 lines() {
    i=1
    while [ "$i" -le 40 ]; do
        echo "line $i"
        i=$((i + 1))
    done
 }
 # make_repository: create the repository owner/repo, holding a file of
 # each name the cases name, and push it, which is the push over HTTP of
 # the sample. The second commit adds a line at the end of Runtime.java,
 # so that its diff hides the lines above.
 make_repository() {
    status="$(api create-repository /api/v1/user/repos \
        --header "Content-Type: application/json" --data '{"name":"repo"}' \
        --write-out '%{http_code}')"
    [ "$status" = 201 ] || fail "creating the repository was answered $status"
    dir="$WORK/repo"
    repo_git init --quiet --initial-branch=main "$dir"
    for file in \
        src/java.base/share/classes/java/lang/Runtime.java \
        java.lang.String.md \
        META-INF/services/org.apache.commons.logging.LogFactory \
        document.write.js \
        process.env.d.ts \
        test/fixtures/__proto__.json \
        install-script.sh \
        src/backend/catalog/information_schema.sql \
        .../notes.txt \
        README.md; do
        mkdir -p "$dir/$(dirname "$file")"
        lines >"$dir/$file"
        repo_git -C "$dir" add "$file"
    done
    repo_git -C "$dir" commit --quiet --message "Add the files"
    echo "line 41" >>"$dir/src/java.base/share/classes/java/lang/Runtime.java"
    repo_git -C "$dir" commit --quiet --all --message "Add a line"
    repo_git -C "$dir" -c "http.extraHeader=X-Request-ID: git-push" push --quiet \
        "http://owner:$PASSWORD@$address/owner/repo.git" main ||
        fail "the push of the repository failed"
 }
 # browse: sign in, then open pages as a person does. The cases are those
 # of https://git.eeqj.de/sneak/smallwebwaf/issues/30.
 browse() {
    # Case: gitea sends a visitor who is not signed in to the sign-in
    # page, with the page asked for in redirect_to, when that page needs
    # signing in, as a file's edit page does.
    page issue-30-case /owner/repo/_edit/main/document.write.js --location
    page sign-in /user/login
    status="$(page sign-in /user/login --header "Origin: http://$address" \
        --data-urlencode user_name=owner --data-urlencode "password=$PASSWORD" \
        --write-out '%{http_code}')"
    [ "$status" = 303 ] || fail "signing in was answered $status"
    page browse /
    page browse /owner/repo
    page browse /owner/repo/src/branch/main/README.md
    page browse /owner/repo/commits/branch/main
    page browse "/owner/repo/commit/$(repo_git -C "$WORK/repo" rev-parse HEAD)"
    # Case: expanding the lines the diff hides, by the link the diff's
    # page gives for it.
    excerpt="$(sed -n 's/.*data-fetch-url="\([^"]*blob_excerpt[^"]*\)".*/\1/p' \
        "$WORK/answer" | head -n 1 | sed 's/&amp;/\&/g')"
    [ -n "$excerpt" ] || fail "the diff's page has no link to its hidden lines"
    page issue-30-case "$excerpt"
    # Cases: the commit graph of one file, and the pages of files whose
    # path the Core Rule Set takes for an attack.
    page issue-30-case "/owner/repo/graph?file=src/java.base/share/classes/java/lang/Runtime.java"
    page issue-30-case /owner/repo/src/branch/main/META-INF/services/org.apache.commons.logging.LogFactory
    page issue-30-case /owner/repo/src/branch/main/java.lang.String.md
    page issue-30-case /owner/repo/src/branch/main/process.env.d.ts
    page issue-30-case /owner/repo/src/branch/main/.../notes.txt
 }
 # call_api: the API's calls the cases name: the commits of a file, for a
 # file of each name the Core Rule Set takes for an attack in the query
 # parameter path, and the file-contents call, which takes its list of
 # files as JSON in the query parameter body.
 call_api() {
    for file in \
        src/java.base/share/classes/java/lang/Runtime.java \
        java.lang.String.md \
        document.write.js \
        process.env.d.ts \
        test/fixtures/__proto__.json \
        install-script.sh \
        src/backend/catalog/information_schema.sql; do
        api issue-30-case /api/v1/repos/owner/repo/commits --get --data-urlencode "path=$file"
    done
    api issue-30-case /api/v1/repos/owner/repo/file-contents --get \
        --data-urlencode 'body={"files":["src/java.base/share/classes/java/lang/Runtime.java"]}'
 }
 # push_images: push a container image to owner/python3-app, then the same
 # image to owner/app. For the second, the case, docker asks gitea to take
 # its layer from owner/python3-app, naming it in the query parameter
 # from. docker sends no X-Request-ID, so its requests have the ids
 # smallwebwaf gives them. The image is one small file, imported rather
 # than built.
 push_images() {
    echo "$NAME" >"$WORK/layer.txt"
    tar -cf - -C "$WORK" layer.txt |
        docker import - "$address/owner/python3-app:1" >/dev/null
    docker tag "$address/owner/python3-app:1" "$address/owner/app:1"
    # The login is written here rather than made with docker login, which
    # would keep it in the host's credential helper when it has one.
    mkdir "$WORK/docker"
    printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$address" \
        "$(printf 'owner:%s' "$PASSWORD" | base64)" >"$WORK/docker/config.json"
    for image in "$address/owner/python3-app:1" "$address/owner/app:1"; do
        DOCKER_CONFIG="$WORK/docker" docker push --quiet "$image" >/dev/null ||
            echo "gitea-requests: the push of $image failed" >&2
    done
 }
 # clone_and_fetch: the clone and fetch over HTTP of the sample.
 clone_and_fetch() {
    repo_git -c "http.extraHeader=X-Request-ID: git-clone" clone --quiet \
        "http://owner:$PASSWORD@$address/owner/repo.git" "$WORK/clone" ||
        fail "the clone failed"
    repo_git -C "$WORK/clone" -c "http.extraHeader=X-Request-ID: git-fetch" fetch --quiet ||
        fail "the fetch failed"
 }
 # field <name> <line>: the text of the field name in line, a line of the
 # request log, or nothing when it has none.
 field() {
    printf '%s\n' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p"
 }
 # report: print a line for each request smallwebwaf logged, but its
 # health checks: what it did with the request, the ids of the Core Rule
 # Set's rules that matched it, its X-Request-ID, and the request.
 # waf_blocked is a refusal by the Core Rule Set, and forward a request
 # passed on to gitea, whatever gitea answered.
 report() {
    docker logs "$SMALLWEBWAF" 2>/dev/null | grep '"type":"request"' |
        grep -v '"action":"admin"' | sed 's/\\u0026/\&/g' >"$WORK/requests"
    while IFS= read -r line; do
        ids="$(printf '%s\n' "$line" | sed -n 's/.*"waf_rule_ids":\[\([0-9,]*\)\].*/\1/p')"
        query="$(field query "$line")"
        printf '%-11s %-13s %-17s %s %s%s\n' "$(field action "$line")" "${ids:--}" \
            "$(field request_id "$line")" "$(field method "$line")" \
            "$(field path "$line")" "${query:+?$query}"
    done <"$WORK/requests"
    echo "gitea-requests: $(grep -c . "$WORK/requests") requests," \
        "$(grep -c '"action":"waf_blocked"' "$WORK/requests") refused by the Core Rule Set"
 }
 main() {
    cd "$ROOT"
    trap cleanup EXIT
    trap 'exit 1' HUP INT TERM
    WORK="$(mktemp -d)"
    docker build --no-cache -t "$IMAGE" .
    # smallwebwaf first, so that gitea can be given the address it is
    # reached at, and gitea's image pulled before, so that gitea starts
    # within the minute smallwebwaf's health check waits for it.
    docker pull --quiet "$GITEA_IMAGE" >/dev/null
    docker network create "$NETWORK" >/dev/null
    docker run --detach --name "$SMALLWEBWAF" --network "$NETWORK" \
        --publish 127.0.0.1::8080 \
        --env SWWAF_UPSTREAM_URL="http://$GITEA:3000" \
        "$IMAGE" >/dev/null
    published="$(docker port "$SMALLWEBWAF" 8080/tcp)"
    address="localhost:${published##*:}"
    docker run --detach --name "$GITEA" --network "$NETWORK" \
        --env GITEA__security__INSTALL_LOCK=true \
        --env GITEA__server__ROOT_URL="http://$address/" \
        "$GITEA_IMAGE" >/dev/null
    # smallwebwaf's health check passes once gitea takes connections.
    wait_for "the health check did not pass" healthy
    docker exec --user git "$GITEA" gitea admin user create --admin \
        --username owner --password "$PASSWORD" --email owner@example.invalid \
        --must-change-password=false >/dev/null
    make_repository
    browse
    call_api
    push_images
    clone_and_fetch
    # The fetch's last request is the last of all; once it is logged, so
    # is every other.
    wait_for "smallwebwaf logged no line for the fetch" \
        logged '"request_id":"git-fetch"' '"method":"POST"'
    report
 }
 main "$@"
@@ -5,32 +5,12 @@ set -euo pipefail
 # exits; the wait spaces out the restarts. The state directory and every
 # file in it are given to the smallwebwaf user, so that a volume mounted
 # there needs no change of owner; chown -R changes a symbolic link itself,
-# never what it points to. When SWWAF_STATE_DIR, in either form, cannot be
+# never what it points to. exec, so that the signal `sv stop` sends
-# read or is not the absolute path of a directory, no owner is changed,
+# reaches smallwebwaf itself.
 # and smallwebwaf starts and stops with a message naming the setting. A
 # change of owner that fails, as on a volume mounted read-only, does not
 # end the script either: smallwebwaf reports a directory it cannot write.
 # exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
 main() {
    sleep 1
-    local dir
+    chown -R smallwebwaf:smallwebwaf "${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}"
    if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
        chown -R smallwebwaf:smallwebwaf "$dir" || true
    fi
    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
 }
 # state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,
 # or what is in the file SWWAF_STATE_DIR_FILE names, less every newline at
 # its end. It fails when both are set or the file cannot be read.
 state_dir() {
    if [[ ! -v SWWAF_STATE_DIR_FILE ]]; then
        printf '%s\n' "${SWWAF_STATE_DIR-/var/lib/smallwebwaf}"
    elif [[ ! -v SWWAF_STATE_DIR ]]; then
        cat -- "$SWWAF_STATE_DIR_FILE" 2>/dev/null
    else
        return 1
    fi
 }
 main "$@"