rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171 )

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over HTTP/1.1, and passes what servewaf allows to the app within its own size and time limits. It reports each request servewaf answered. SWRP_DEFAULT_DISPOSITION decides when servewaf gives no answer. A request it cannot put to servewaf as sent, it refuses itself. Duplication: internal/rproxy copies passing-on code from internal/proxy until #172 removes the originals. Rule suppressed: gosec G704 on servewaf's URL, a setting. Rule suppressed: gosec G705 on the answer written to the visitor. Judgement call: the SWRP_ size and time limits take off; SWRP_TIMEOUT_MS does not. Judgement call: every target not starting with / gets 400, not only x:admin. Model: opus-5-5
2026-11-05 01:12:42 +00:00
80 changed files with 5713 additions and 4900 deletions
@@ -117,9 +117,8 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
    && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
        -o /usr/local/bin/runsvinit .
-# The image, described under "Deployment" in SPEC.md. It runs rproxy unless
+# The image an app's Dockerfile builds FROM, described under "Deployment"
-# SMALLWEBWAF_COMMAND says servewaf, and an app's Dockerfile can build FROM it.
+# in SPEC.md. It is the last stage, so a plain `docker build .` builds it.
 # It is the last stage, so a plain `docker build .` builds it.
 #
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
@@ -133,11 +132,32 @@ RUN mkdir /etc/sysusers.d \
    && echo 'u  _runit-log  -  "runit svlogd user"  /nonexistent  /sbin/nologin' \
        > /etc/sysusers.d/runit.conf
-# ca-certificates, nix-bin and runit, from Ubuntu's normal mirrors: the
+# ca-certificates, nix-bin and runit, from Ubuntu's archive as it was at
-# live archive the image's own sources name, over plain HTTP, so no CA
+# the snapshot moment, which is never earlier than the Ubuntu image above.
-# certificate is needed and none is borrowed from the Go image.
+# apt checks every package against the snapshot's InRelease files, and
-RUN apt-get update \
+# this step checks those against the hashes named here, which are those
 # of the amd64 archive: other architectures use Ubuntu's ports archive.
 # apt also fetches the live archive's InRelease files, which change daily
 # and which the install does not use. The snapshot service is HTTPS only
 # and this image has no CA certificates yet, so this step uses the Go
 # image's. The snapshot service answers 503 at times; apt retries a
 # failed download, waiting twice as long before each retry, and this
 # step gives it five retries, about half a minute in all, where its
 # default of three gives up after seven seconds.
 RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,target=/tmp/go-image-ca.crt \
    apt-get update --snapshot 20261001T000000Z \
        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
        -o Acquire::Retries=5 \
    && printf '%s\n' \
        '45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute_InRelease' \
        '802e675dd9de4c7f3916434a95e7c1d8eec0e82886622d7805ab19a2c6fe0365  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-updates_InRelease' \
        '64b3353f0bd4970b4f7271962245bcea9ff24d4cc7bea16b433f8a60e42ca3dd  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-backports_InRelease' \
        '1d5041572116a8b23aabf79ac7439ad8af83d57ad3fb0f9aa0d4523ec10c5908  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-security_InRelease' \
        | (cd /var/lib/apt/lists && sha256sum --check --strict) \
    && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
        --snapshot 20261001T000000Z \
        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
        -o Acquire::Retries=5 \
        ca-certificates nix-bin runit \
    && rm -rf /var/lib/apt/lists/*
@@ -177,11 +197,11 @@ RUN groupadd --system --gid 65532 smallwebwaf \
 # The state files' directory, SWWAF_STATE_DIR by default, where a volume
 # is mounted to keep them across deploys. The run script gives it to the
-# smallwebwaf user at each start of servewaf.
+# smallwebwaf user at each start.
 RUN mkdir /var/lib/smallwebwaf
-# The default rule file, in SWWAF_RULES_DIR by default, where a Dockerfile
+# The default rule file, in SWWAF_RULES_DIR by default, where an app's
-# built FROM this image can copy rule files of its own beside it.
+# Dockerfile can copy rule files of its own beside it.
 COPY share/rules.d/00-default.rules /etc/smallwebwaf/rules.d/00-default.rules
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv
@@ -1,29 +1,19 @@
 # smallwebwaf
 `smallwebwaf` is an MIT-licensed web application firewall, written in Go by
-[@sneak](https://sneak.berlin), for self-hosted web apps. It refuses the
+[@sneak](https://sneak.berlin), for one self-hosted web app. It runs inside the
-requests of scrapers, scanners and other abusers before they reach an app.
+app's own container, in front of the app. It refuses the requests of scrapers,
 scanners and other abusers before they reach the app.
 A web application firewall reads each request on its way to a web app and
-refuses the ones that look like abuse. `smallwebwaf` is one binary with two
+refuses the ones that look like abuse. `smallwebwaf` is also a reverse proxy: it
-commands that do this together:
+accepts requests on the app's behalf, passes them to the app, and passes the
 app's answers back.
- `smallwebwaf rproxy` is a small reverse proxy in front of one app. It accepts
+It needs no setting. Every `SWWAF_` setting has a default chosen for a service
-  requests on the app's behalf and asks `servewaf` about each one. It passes the
+on the open internet. [`SPEC.md`](SPEC.md) says how `smallwebwaf` behaves and
-  allowed ones to the app, and the app's answers back. It keeps nothing, and
+why. The reference documents under [`docs/`](docs/) are listed under "Documents"
-  never touches disk.
+below.
 - `smallwebwaf servewaf` decides. It runs the checks, and keeps the bans,
  counters and history. One `servewaf` serves many sites.
 The site keeps answering while `servewaf` is down, slow or restarting. `rproxy`
 waits at most 2 seconds for `servewaf`'s answer, and without one passes the
 request to the app.
 `rproxy` requires one setting, `SWRP_WAF_BACKEND`, which says where `servewaf`
 is. In a container of its own, it also needs `SWRP_UPSTREAM_URL`, which says
 where the app is. Every other setting has a default chosen for a service on the
 open internet. [`SPEC.md`](SPEC.md) says how `smallwebwaf` behaves and why. The
 reference documents under [`docs/`](docs/) are listed under "Documents" below.
 ## What it protects against
@@ -64,7 +54,7 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 For the operator, it:
- logs each request as JSON lines, saying what it did and why (see
+- writes one JSON log line for every request, saying what it did and why (see
  [`docs/request-log.md`](docs/request-log.md));
 - sends alerts to a webhook, Slack or ntfy (see
  [`docs/alerts.md`](docs/alerts.md));
@@ -75,8 +65,8 @@ For the operator, it:
 Not built, and not planned:
- TLS and routing by host name. Both stay with traefik, the reverse proxy in
+- TLS and routing for several apps. Both stay with traefik, the reverse proxy in
-  front of `rproxy`.
+  front of the container.
 - Browser challenges such as captchas.
 - A web console.
 - Defence against floods large enough to fill the host's network link.
@@ -94,68 +84,14 @@ cd smallwebwaf
 make docker
 ```
-Push the image to a registry your hosts pull from.
+Push the image to a registry your hosts pull from. Then build the app's own
-
+image on it. The app's `Dockerfile` starts `FROM` the `smallwebwaf` image, named
-The image runs `rproxy` by default. To run `servewaf` from the same image, set
+by digest, and adds:
 the container's `SMALLWEBWAF_COMMAND` to `servewaf`.
 ### The usual setup: three containers
 The usual setup is three containers on one private network:
 - the app;
 - `rproxy`, in front of the app, which traefik routes to;
 - `servewaf`, with a volume for its state files.
 ```sh
 docker network create site
 docker run --detach --name servewaf --network site \
    --env SMALLWEBWAF_COMMAND=servewaf \
    --volume servewaf-state:/var/lib/smallwebwaf \
    <registry>/smallwebwaf@sha256:<digest>
 docker run --detach --name app --network site \
    <registry>/app@sha256:<digest>
 docker run --detach --name rproxy --network site \
    --env SWRP_WAF_BACKEND=http://servewaf:8080 \
    --env SWRP_UPSTREAM_URL=http://app:8081 \
    <registry>/smallwebwaf@sha256:<digest>
 ```
 Here the app listens on port 8081, at its container's address on that network.
 Point traefik's labels at port 8080 of `rproxy`
 (`traefik.http.services.<name>.loadbalancer.server.port=8080`). Publish no port
 of the app or of `servewaf`. Anything on that network can reach the app around
 `rproxy`, and can ask `servewaf` questions.
 With no setting, `servewaf` sends the address of every new visitor to GeoJS, a
 web service, to find its country and network. `SWWAF_LOOKUP_SOURCE=off` sends
 nothing. `SWWAF_LOOKUP_SOURCE=file`, with `SWWAF_LOOKUP_DB_PATH` naming a
 database file on your own host, looks addresses up in that file (see "Lookup of
 AS number and country" in [`SPEC.md`](SPEC.md)).
 ### Many sites, one `servewaf`
 Run one `rproxy` for each app, all with `SWRP_WAF_BACKEND` naming the same
 `servewaf`. It keeps one table of clients and bans for all of them:
 - A client banned through one site is refused on all of them.
 - A client's requests on all of them count toward one set of limits.
 - Log lines, alerts and ban notes name the site by its host.
 ### `rproxy` in the app's container
 An app's image can also be built on the `smallwebwaf` image, so that `rproxy`
 runs beside the app. `servewaf` still runs in a container of its own. The app's
 `Dockerfile` starts `FROM` the `smallwebwaf` image, named by digest, and adds:
 - the app's binary;
 - the packages the app needs, from the nixpkgs in the image;
 - a user for the app;
- a `run` script that starts the app listening on `127.0.0.1:8081`, the default
+- a `run` script that starts the app listening on `127.0.0.1:8081`.
  of `SWRP_UPSTREAM_URL`.
 ```dockerfile
 # The smallwebwaf image, pinned by digest.
@@ -190,43 +126,38 @@ main "$@"
 ```
 Leave `ENTRYPOINT` and `USER` out of the app's `Dockerfile`. The image's own
-entrypoint starts `rproxy` and the app side by side, each as its own user. Run
+entrypoint starts `smallwebwaf` and the app side by side, each as its own user.
-the app's image with `SWRP_WAF_BACKEND` set.
+
 Deploy the app's image as you deploy any app. Point traefik's labels at port
 8080 (`traefik.http.services.<name>.loadbalancer.server.port=8080`). Mount a
 volume at `/var/lib/smallwebwaf`, so that bans and history survive a deploy. For
 example, with no setting:
 ```sh
 docker run --detach --name app \
    --volume app-smallwebwaf:/var/lib/smallwebwaf \
    <registry>/app@sha256:<digest>
 ```
 With no setting, the address of every new visitor is sent to GeoJS, a web
 service, to find its country and network. `SWWAF_LOOKUP_SOURCE=off` sends
 nothing. `SWWAF_LOOKUP_SOURCE=file`, with `SWWAF_LOOKUP_DB_PATH` naming a
 database file on your own host, looks addresses up in that file (see "Lookup of
 AS number and country" in [`SPEC.md`](SPEC.md)).
 `deploy/example-app` is such an app. `make example-app` builds it and checks it
-(see "Checking that it works" below). To run `rproxy` and `servewaf` on the host
+(see "Checking that it works" below). To run `smallwebwaf` outside the image
-while working on them, see `script/run` under "Entrypoints" below.
+while working on it, see "Entrypoints" below.
 ### When `servewaf` is down, slow or overloaded
 `SWRP_DEFAULT_DISPOSITION` decides what `rproxy` does with a request when
 `servewaf`:
 - cannot be connected to;
 - does not answer at all;
 - does not answer within `SWRP_TIMEOUT_MS`, 2 seconds by default.
 Its default, `allow`, passes the request to the app without `servewaf`'s answer.
 `deny` answers `503` instead. Either way the request gets no report, so its
 bytes are not counted and it is not added to its client's history. When
 `servewaf` does answer, a `deny` or an error goes to the visitor as `servewaf`
 gave it, and `SWRP_DEFAULT_DISPOSITION` plays no part.
 ## What happens to a request
-A request goes through fifteen steps, in this order. Once `servewaf` refuses a
+`smallwebwaf` handles each request in fifteen steps, in this order. Once a step
-request, the steps after that are skipped, apart from the report of step 15, and
+refuses a request, the steps after it are skipped, apart from step 15, and
 nothing of the request reaches the app. "What happens to a request" in
 [`SPEC.md`](SPEC.md) gives each step in full, under the same numbers.
 `rproxy` takes the first two:
 1. The health check, `GET /_smallwebwaf/healthz`, is answered at once.
-2. The visitor's address is worked out, and `servewaf` is asked about the
+2. The client is identified.
   request.
 `servewaf` takes the checks:
 3. The static lists, `SWWAF_ALLOW_NETS` and `SWWAF_DENY_NETS`.
 4. The bans.
 5. The lookup of the client's AS number and country.
@@ -236,36 +167,31 @@ nothing of the request reaches the app. "What happens to a request" in
 9. The rate limits.
 10. The trap paths.
 11. The rule files.
-12. The header limits, and then the Core Rule Set.
+12. The Core Rule Set.
-13. A path under `/_smallwebwaf/` is answered `404`, so that the app never sees
+13. `smallwebwaf`'s own endpoints, under `/_smallwebwaf/`.
    that prefix.
 `rproxy` takes the rest, with `servewaf` counting at the end:
 14. The request is passed to the app.
-15. After the answer, `rproxy` sends `servewaf` a report. For an allowed
+15. After the answer: the byte limits, the error burst and the client's history.
    request, `servewaf` counts the byte limits and adds the request to the
    client's history.
 A refused visitor is answered with `SWWAF_BAN_RESPONSE`, `403` by default (see
 "Ban lengths, response and scope" in [`SPEC.md`](SPEC.md)). A `block` rule or a
-Core Rule Set match answers `403`. `rproxy` itself answers `405` to a method it
+Core Rule Set match answers `403`. A missing or wrong token gets `401`. A
-does not pass on, and the status for a size or time limit, such as `413` for a
+request over a size or time limit gets the status for that limit, such as `413`
-body too large (see "`rproxy`" in [`SPEC.md`](SPEC.md)).
+for a body too large (see "Size and time limits" in [`SPEC.md`](SPEC.md)).
 ## Settings you are likely to touch
-Each setting is an environment variable, read at start. Those of `servewaf`
+Each setting is an environment variable of the app's container, such as
-start with `SWWAF_`, and those of `rproxy` with `SWRP_`.
+`docker run -e SWWAF_MODE=observe ...`, read at start.
 [`docs/settings.md`](docs/settings.md) lists every setting, its default and the
 values it takes. The ones most deployments touch:
- `SWWAF_MODE=observe`: `servewaf` refuses nothing and makes no ban of its own.
+- `SWWAF_MODE=observe`: `smallwebwaf` makes no ban of its own, and refuses a
-  A request it would have refused is passed to the app, and its log line says
+  request only for a size or time limit or a missing or wrong token. A request
-  what `enforce` mode would have done. For trying a configuration before
+  it would have refused is passed to the app, and its log line says what
-  enforcing it. The limits of `rproxy` still apply.
+  `enforce` mode would have done. For trying a configuration before enforcing
  it.
 - `SWWAF_ALLOW_NETS`: netblocks you trust, such as your monitoring. Their
-  clients skip `servewaf`'s checks.
+  clients are refused only for a size or time limit or a missing or wrong token.
 - `SWWAF_RATE_LIMIT_EXEMPT_NETS`: netblocks exempt from rate limiting and the
  byte limits, such as a machine that talks to the app all day.
 - `SWWAF_TRAP_PATHS`: paths only scanners ask for, such as
@@ -275,49 +201,39 @@ values it takes. The ones most deployments touch:
  refuses your app's ordinary requests. The log line names the rules a request
  matched. Keep the six default ids in a list you give (see
  [`docs/settings.md`](docs/settings.md)).
- `SWRP_MAX_REQUEST_SIZE` and `SWRP_MAX_REQUEST_TIME_MS`: raise them for an app
+- `SWWAF_REQUEST_MAX_BYTES`, `SWWAF_CLIENT_REQUEST_TIMEOUT` and
-  that takes uploads over 100 MiB or slower than 60 seconds.
+  `SWWAF_UPSTREAM_REQUEST_TIMEOUT`: raise them for an app that takes uploads
- `SWRP_DEFAULT_DISPOSITION`: `allow` (the default) or `deny`, as above.
+  over 100 MiB or slower than 60 seconds.
 - `SWRP_TRUSTED_PROXIES`: the netblocks whose `X-Forwarded-For` `rproxy`
  believes, by default the private address ranges.
 - `SWWAF_LOOKUP_SOURCE`: `geojs` (the default), `file` or `off`, as above.
 - `SWWAF_ADMIN_TOKEN` and `SWWAF_METRICS_TOKEN`: switch on the ban endpoints and
-  the metrics, at `servewaf`'s own address.
+  the metrics. Give them as files to keep them from the app.
 - `SWWAF_ALERT_WEBHOOK_URL`, `SWWAF_ALERT_SLACK_WEBHOOK_URL` or
  `SWWAF_ALERT_NTFY_URL`: where alerts go.
- `SWWAF_INSTANCE_NAME`: the name in every line `servewaf` logs, and in every
+- `SWWAF_INSTANCE_NAME`: the name in every log line, alert and metric, such as
-  alert and metric, such as `fsn1/servewaf`.
+  `fsn1app1/gitea`.
 ## Checking that it works
 - `docker inspect --format '{{.State.Health.Status}}' <container>` says
-  `healthy` for each container of `smallwebwaf`:
+  `healthy` once `smallwebwaf` answers and the app accepts connections. A log
-    - for `rproxy`, once it answers and the app accepts connections, whether or
+  line with `"msg":"starting"` gives the version, the address and every setting
-      not `servewaf` answers;
+  in effect, with secrets masked.
-    - for `servewaf`, once it answers.
+- A request to the site through traefik gets the app's answer, and its log line
- A log line with `"msg":"starting"` gives the version, the address and every
+  has `"action":"forward"`. `https://<site>/_smallwebwaf/healthz` answers `ok`.
-  setting in effect, with secrets masked.
+- To see a refusal without banning yourself, run the container with
- A request to the site through traefik gets the app's answer.
+  `SWWAF_MODE=observe` and ask for `/.env`. The request reaches the app. Its log
-  `https://<site>/_smallwebwaf/healthz` answers `ok`. `servewaf`'s log lines
+  line has `"would_action":"banned"` and `"rule_ids":["env-file"]`. In `enforce`
-  about the request have `"action":"forward"`.
+  mode the same request bans your address for seven days, and your next request
- To see a refusal without banning yourself, run `servewaf` with
+  makes the ban permanent. Lift the ban by editing `bans.json` (see "Bans" in
-  `SWWAF_MODE=observe` and ask for `/.env`. The request reaches the app.
+  [`SPEC.md`](SPEC.md)).
-  `servewaf`'s log lines have `"would_action":"banned"` and
+- With `SWWAF_METRICS_TOKEN` set,
-  `"rule_ids":["env-file"]`. In `enforce` mode the same request bans your
+  `curl -H "Authorization: Bearer $TOKEN" https://<site>/_smallwebwaf/metrics`
-  address for seven days, and your next request makes the ban permanent. Lift
+  answers with the metrics.
-  the ban by editing `bans.json` (see "Bans" in [`SPEC.md`](SPEC.md)).
+- `make example-app` builds the image and the example app on it, runs the app,
- With `SWWAF_METRICS_TOKEN` set, this answers with the metrics, from a host on
+  and checks it. It needs network access. It checks:
-  `servewaf`'s network:
+    - the health check;
-  `curl -H "Authorization: Bearer $TOKEN" http://servewaf:8080/_smallwebwaf/metrics`.
+    - a request forwarded to the app;
 - `make example-app` builds the image and the example app on it, runs the app
  with `rproxy` in its container and `servewaf` in another, and checks them. It
  needs network access. It checks:
    - the health checks;
    - a request passed to the app;
    - a ban for a broken limit, and a ban for a probe made permanent;
    - that only `servewaf`'s container changes the state directory's owner;
    - with `servewaf` stopped, the app still answering through `rproxy`;
    - with `servewaf` started again, bans applying again;
    - orderly stops with `sv stop` and `docker stop`;
    - bans surviving a new container on the same volume;
    - a setting given as a file.
@@ -360,26 +276,21 @@ on the host.
 - `script/install-precommit`: installs that hook. `make hooks`.
 - `script/build`: builds `bin/smallwebwaf` with the Go on your host.
  `make build`.
- `script/run`: builds `bin/smallwebwaf` and runs `servewaf` and `rproxy` on the
+- `script/run`: builds `bin/smallwebwaf` and runs it with the settings in your
-  host, with the settings in your environment. `make run`. Unless your settings
+  environment, listening on port 8080 in front of an app at
-  say otherwise:
+  `SWWAF_UPSTREAM_URL`. Its state files go in `bin/state` and its rule files are
-    - `rproxy` listens on port 8080, in front of an app at
+  those of `share/rules.d`, unless `SWWAF_STATE_DIR` and `SWWAF_RULES_DIR` say
-      `http://127.0.0.1:8081`;
+  otherwise. `make run`.
-    - `servewaf` listens on port 8090;
+- `script/example-app`: builds the image and the example app on it, runs it with
-    - its state files go in `bin/state`;
+  a volume, and checks it as "Checking that it works" above describes. Then it
-    - its rule files are those of `share/rules.d`.
+  removes the containers, volumes and images. Needs network access.
- `script/example-app`: builds the image and the example app on it, runs them
+  `make example-app`.
-  with a volume, and checks them as "Checking that it works" above describes.
+- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind it at
-  Then it removes the containers, the network, the volumes and the images. Needs
+  the defaults. It sends through it a sample of gitea's ordinary use and the
-  network access. `make example-app`.
+  requests the Core Rule Set is known to refuse, and prints what `smallwebwaf`
- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind
+  did with each. Needs network access, and a docker daemon that pushes to a
-  `rproxy` and `servewaf`, three containers on one network. Every setting is at
+  registry on `localhost` over plain HTTP. [`docs/gitea.md`](docs/gitea.md)
-  its default, but for those that join the containers and the header that labels
+  records the results. `make gitea-requests`.
  each request. It sends through them a sample of gitea's ordinary use and the
  requests the Core Rule Set is known to refuse, and prints what `servewaf` did
  with each. Needs network access, and a docker daemon that pushes to a registry
  on `localhost` over plain HTTP. [`docs/gitea.md`](docs/gitea.md) records the
  results. `make gitea-requests`.
 ## Rationale
@@ -392,16 +303,16 @@ Small self-hosted sites receive a great deal of traffic nobody asked for:
 Most of it comes from a small number of hosting networks and countries. A
 single-person operation has no abuse desk and no CDN contract. It needs
-something small that can be put in front of its services and left alone.
+something small that can be put in front of one service and left alone.
 The existing tools each solve part of this. Rule-based firewalls catch attack
 payloads but do not limit request rates. Rate limiters count requests but cannot
 tell a residential visitor from a rented server farm. The products that do most
-of it want a database and a web console. None of them can say "clients from
+of it want several containers, a database and a web console. None of them can
-these networks are banned after half as many requests as anyone else". That is
+say "clients from these networks are banned after half as many requests as
-the useful thing to say when nearly all abuse comes from a known list of AS
+anyone else". That is the useful thing to say when nearly all abuse comes from a
-numbers. [`EVALUATION.md`](EVALUATION.md) goes through the candidates one by
+known list of AS numbers. [`EVALUATION.md`](EVALUATION.md) goes through the
-one.
+candidates one by one.
 `smallwebwaf` fills that gap with:
@@ -409,8 +320,8 @@ one.
 - lower limits for the networks and countries abuse comes from;
 - bans that grow with repetition;
 - a log that is easy to search and ship;
- a site that keeps answering while the part that decides is down;
+- one binary in the app's own container, with no database and no required
- one binary, with no database and one required setting.
+  setting.
 ## Design
@@ -420,36 +331,45 @@ nixpkgs fixed at one release. An app's `Dockerfile` installs a package with
 [`docs/image.md`](docs/image.md) lists what the image holds and how each part is
 pinned.
- runit, a service supervisor, runs `smallwebwaf` and starts it again when it
+- runit, a service supervisor, runs `smallwebwaf` and the app side by side, each
-  exits. In an app's image built on the `smallwebwaf` image, it runs `rproxy`
+  as its own user, and starts either again when it exits. The app cannot touch
-  and the app side by side, each as its own user.
+  the state files or the process of `smallwebwaf`.
- `rproxy` listens on port 8080 and passes requests to the app at
+- `smallwebwaf` listens on port 8080 and passes requests to the app on
-  `SWRP_UPSTREAM_URL`. It answers the health check itself, and the refusals and
+  `127.0.0.1:8081`. The app listens on `127.0.0.1` only, so nothing reaches it
-  errors "`rproxy`" in [`SPEC.md`](SPEC.md) lists.
+  except through `smallwebwaf`. `smallwebwaf`'s own endpoints are under
- `servewaf` listens on port 8080 of its own container. Nothing should route the
+  `/_smallwebwaf/`, on the same port.
  internet there. Its own endpoints, under `/_smallwebwaf/`, are for your admin
  tools and your metrics collector.
 - `rproxy` and `servewaf` use no token between them. Anything on their private
  network can ask `servewaf` a question, or send it a report.
 - The app sees the headers traefik sent, with traefik's address added to
-  `X-Forwarded-For`, from a TCP peer that is `rproxy`. So the app must trust
+  `X-Forwarded-For`, from a TCP peer on `127.0.0.1`. So the app must trust
-  `rproxy`'s address for forwarded headers. With `rproxy` in the app's
+  `127.0.0.1` and `::1` for forwarded headers, besides the private address
-  container, that address is `127.0.0.1` or `::1`, which the private address
+  ranges.
-  ranges leave out.
+- Both processes start with the container's environment variables, so every
- The state files live in `/var/lib/smallwebwaf` in `servewaf`'s container. A
+  setting of this `smallwebwaf` process starts with `SWWAF_`, and the app can
-  volume mounted there keeps them across a deploy.
+  read a token given as one. A token given as a file that only the `smallwebwaf`
- `docker stop` gives requests in progress five seconds to finish. With `rproxy`
+  user can read is out of its reach (see "Settings given as files" in
-  in the app's container, the app must keep answering for five seconds after
+  [`docs/settings.md`](docs/settings.md)).
-  `SIGTERM` for that to help them.
+- The state files live in `/var/lib/smallwebwaf`. A volume mounted there keeps
  them across a deploy.
 - `smallwebwaf servewaf` runs the same checks for the sites that ask it about
  each request, and passes nothing to an app (see "`servewaf`" in
  [`SPEC.md`](SPEC.md)).
 - `smallwebwaf rproxy` is the reverse proxy in front of one app that asks
  `smallwebwaf servewaf` about each request, and keeps the site answering while
  `servewaf` is down. Its settings start with `SWRP_`, and it needs
  `SWRP_WAF_BACKEND`, `servewaf`'s URL (see "`rproxy`" in [`SPEC.md`](SPEC.md)).
 - `docker stop` stops both processes at once. `smallwebwaf` gives the requests
  in progress five seconds to finish, so the app must keep answering for five
  seconds after `SIGTERM`.
-"Deployment" in [`SPEC.md`](SPEC.md) has the rest: the health checks, what
+"Deployment" in [`SPEC.md`](SPEC.md) has the rest: the health check, what
-happens when a process stops, moving a port, and the forwarded headers.
+happens when a process stops, moving `smallwebwaf` to another port, and the
-"Architecture" in [`SPEC.md`](SPEC.md) lists the packages and what each does.
+forwarded headers. "Architecture" in [`SPEC.md`](SPEC.md) lists the packages and
 what each does.
 ## TODO
- Planned, as "Planned, not built" in [`SPEC.md`](SPEC.md) describes: sending
+- Planned, as "Planned, not built" in [`SPEC.md`](SPEC.md) describes:
-  the log over RELP.
+    - sharing bans between the instances of several apps;
    - sending the log over RELP.
 ## Documents
@@ -1,8 +1,8 @@
-// Command smallwebwaf is a web application firewall. `smallwebwaf rproxy` is
+// Command smallwebwaf is a web application firewall for one app: it runs
-// the reverse proxy in front of one app, which asks servewaf about each request.
+// between traefik and the app and passes requests through within its limits,
-// `smallwebwaf servewaf` decides, for many sites, and keeps what lasts.
+// or, as `smallwebwaf servewaf`, answers rproxy's questions about them, or, as
-// `smallwebwaf healthcheck` is the container's health check. Everything it does
+// `smallwebwaf rproxy`, is the reverse proxy that asks those questions.
-// is in internal/smallwebwaf.
+// Everything it does is in internal/smallwebwaf.
 package main
 import (
@@ -1,8 +1,8 @@
 # Admin endpoints
 The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
-`smallwebwaf servewaf` answers them at its own address, on the private network.
+"Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
-"Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work.
+and how their tokens work.
 - `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
 - `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
@@ -20,41 +20,40 @@ The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
    - one that names an IPv4-mapped netblock, or an address with a zone.
 - `DELETE /_smallwebwaf/bans/<client>`: lifts every active ban covering the
  address `<client>`. It answers `404` when none is active.
- `GET /_smallwebwaf/clients/<ip>`: what `servewaf` knows of the client. Under
+- `GET /_smallwebwaf/clients/<ip>`: what `smallwebwaf` knows of the client.
-  `client`, its counters and history as `clients.json` holds them, or `null`
+  Under `client`, its counters and history as `clients.json` holds them, or
-  when `clients.json` does not hold it. Under `bans`, every ban covering the
+  `null` when `clients.json` does not hold it. Under `bans`, every ban covering
-  address, with its notes.
+  the address, with its notes.
 - `POST /_smallwebwaf/report`: takes `rproxy`'s report, without a token. It
  answers `204`, or `400` to a body that is no report (see "The report" in
  [`SPEC.md`](../SPEC.md)).
 No check runs on these requests. A missing or wrong token is answered `401`. An
 endpoint whose token is unset answers `404`, as does any other path.
 `smallwebwaf rproxy` answers only the health check of these, at its own address.
 It asks `servewaf` about any other request under `/_smallwebwaf/`. One that
 passes the checks is answered `404`, so that the app never sees that prefix (see
 "`rproxy`" in [`SPEC.md`](../SPEC.md)).
 ## Examples
-With `SWWAF_ADMIN_TOKEN` set, the token in `$TOKEN`, and `servewaf` reached as
+With `SWWAF_ADMIN_TOKEN` set, and the token in `$TOKEN`:
 `servewaf:8080` on its network:
 ```sh
 # Every ban.
-curl -H "Authorization: Bearer $TOKEN" http://servewaf:8080/_smallwebwaf/bans
+curl -H "Authorization: Bearer $TOKEN" https://app.example/_smallwebwaf/bans
 # Ban 203.0.113.0/24 for seven days.
 curl -H "Authorization: Bearer $TOKEN" \
    --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
-    http://servewaf:8080/_smallwebwaf/bans
+    https://app.example/_smallwebwaf/bans
 # Lift the bans on 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" -X DELETE \
-    http://servewaf:8080/_smallwebwaf/bans/203.0.113.9
+    https://app.example/_smallwebwaf/bans/203.0.113.9
-# What servewaf knows of 203.0.113.9.
+# What smallwebwaf knows of 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" \
-    http://servewaf:8080/_smallwebwaf/clients/203.0.113.9
+    https://app.example/_smallwebwaf/clients/203.0.113.9
 ```
 ## `servewaf`
 `smallwebwaf servewaf` answers these endpoints at its own address. No check runs
 on those requests (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).
 ## `rproxy`
 `smallwebwaf rproxy` answers only the health check, at its own address. It asks
 `servewaf` about any other request under `/_smallwebwaf/` (see "`rproxy`" in
 [`SPEC.md`](../SPEC.md)).
@@ -6,7 +6,7 @@ back or dropped.
 ## Events
- `ban`: a ban `servewaf` made.
+- `ban`: a ban `smallwebwaf` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
  a request.
 - `waf_block`: the Core Rule Set scored a request at or over the threshold. The
@@ -34,10 +34,9 @@ on one line:
 ```json
 {
-    "instance": "fsn1/servewaf",
+    "instance": "fsn1app1/gitea",
    "time": "2026-10-06T12:00:50.123461Z",
    "event": "ban",
    "host": "app.example",
    "client": "203.0.113.9",
    "netblock": "203.0.113.9/32",
    "asn": "",
@@ -79,9 +78,9 @@ on one line:
 - `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
  one of the events above.
- `host`: the site of the request that raised the alert, since one `servewaf`
+- `host`: the site of the request that raised the alert. Only `servewaf` sends
-  serves many sites. It is left out of `source_failure`, `file_error` and
+  this field, since it serves many sites, and not for `source_failure`,
-  `summary`.
+  `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
  `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -111,7 +110,7 @@ on one line:
 ## Slack and ntfy
 Slack and ntfy get a message with a title and a text. The title is the instance
-and the event, such as `fsn1/servewaf: ban`. The text is the `reason`, then one
+and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
 line for each of these that the alert has:
 - the host, the client, the netblock and the country;
@@ -2,11 +2,10 @@
 These notes record what `smallwebwaf` does in front of gitea at the default
 settings. They are observations, not requirements; the requirements are in
-[`SPEC.md`](../SPEC.md). `script/gitea-requests` runs gitea behind `rproxy` and
+[`SPEC.md`](../SPEC.md). `script/gitea-requests` runs gitea behind the image and
-`servewaf`, and sends through them a sample of gitea's ordinary use and the
+sends through it a sample of gitea's ordinary use and the requests named below.
-requests named below. It reports each request the Core Rule Set refuses, so that
+It reports each request the Core Rule Set refuses, so that these notes can be
-these notes can be checked again when gitea or the Core Rule Set changes
+checked again when gitea or the Core Rule Set changes version.
 version.
 ## What the defaults cover
@@ -14,7 +13,7 @@ version.
  by it.
 - A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the
  repository is large or the link slow. A repository whose clone is larger than
-  1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised, and the byte limits with it
+  1 GiB needs `SWWAF_RESPONSE_MAX_BYTES` raised, and the byte limits with it
  ("Byte limits, per client" in `SPEC.md`).
 - A push is a request, and so is every other upload:
    - a git push;
@@ -24,9 +23,10 @@ version.
    - a release attachment.
    At the defaults, an upload larger than 100 MiB or taking more than 60
-    seconds is cut off ("`rproxy`'s limits" in `SPEC.md`). A gitea that takes
+    seconds is cut off ("Size and time limits" in `SPEC.md`). A gitea that takes
-    large uploads needs `SWRP_MAX_REQUEST_SIZE` and `SWRP_MAX_REQUEST_TIME_MS`
+    large uploads needs `SWWAF_REQUEST_MAX_BYTES`,
-    raised to fit.
+    `SWWAF_CLIENT_REQUEST_TIMEOUT` and `SWWAF_UPSTREAM_REQUEST_TIMEOUT` raised
    to fit.
 - Archive download and blame or history pages are what scrapers hammer. The
  request limits do most of the work there.
@@ -1,15 +1,14 @@
 # What the image holds
-The contents of the `smallwebwaf` image, and how each part is pinned. The image
+The contents of the `smallwebwaf` image, and how each part is pinned.
 runs `rproxy` by default, or `servewaf` with `SMALLWEBWAF_COMMAND=servewaf`.
 "Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
 is pinned that way.
 ## Contents
 - Ubuntu 26.04 LTS, pinned by digest.
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's normal mirrors, the
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
-  live archive, not a dated snapshot.
+  archive at `20261001T000000Z`.
 - Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
  `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
  Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
@@ -19,15 +18,16 @@ is pinned that way.
 - The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
 - The service directory `/etc/service/smallwebwaf`, with the `run` script
  `share/smallwebwaf.run`.
- `/var/lib/smallwebwaf` for `servewaf`'s state files, and
+- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
-  `/etc/smallwebwaf/rules.d` with the default rule file
+  with the default rule file `share/rules.d/00-default.rules`.
  `share/rules.d/00-default.rules`.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
 ## Pins
- Ubuntu's packages are not pinned: they come from the live archive, whose
+- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
-  packages change with every update.
+  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
  `apt-get update`. The hashes are the amd64 archive's.
 - nixpkgs: the release file `nixexprs.tar.xz` of
  `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
  SHA-256 hash.
@@ -1,9 +1,8 @@
 # The metrics
-What `GET /_smallwebwaf/metrics` answers with, at `servewaf`'s own address.
+What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
-"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
+[`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
-keeps the `instance` label as `exported_instance` unless the scrape sets
+label as `exported_instance` unless the scrape sets `honor_labels: true`.
 `honor_labels: true`. `rproxy` has no metrics.
 ## Traffic
@@ -12,13 +11,13 @@ keeps the `instance` label as `exported_instance` unless the scrape sets
  `action`;
 - `smallwebwaf_request_duration_seconds` and
  `smallwebwaf_upstream_duration_seconds`, as histograms;
- `smallwebwaf_requests_in_flight`: the questions and requests to its own
+- `smallwebwaf_requests_in_flight`.
  endpoints that `servewaf` is handling.
 ## Limits and bans
 - `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
  `bytes` or `refusals`);
 - `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed;
 - `smallwebwaf_offences_total`, by `kind`;
 - `smallwebwaf_bans_made_total`, by `cause`;
 - `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
@@ -81,11 +80,11 @@ By `file`:
  `smallwebwaf_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
-## When a request is counted
+## `servewaf`
-`servewaf` counts a denied request at its decision, and a request to its own
+`smallwebwaf servewaf` counts a denied request at its decision. It counts an
-endpoints when it is answered. It counts an allowed request when its report
+allowed request when its report comes, with the status, bytes and times the
-comes, with the status, bytes and times the report gives. These are not counted:
+report gives. These are not counted:
 - a report itself;
 - an allowed request whose report never comes;
@@ -1,9 +1,123 @@
 # The request log's fields
-The fields of the JSON objects `rproxy` and `servewaf` write about each request.
+The fields of the JSON object `smallwebwaf` writes for each request. "Request
-"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is
+log" in [`SPEC.md`](../SPEC.md) says when a line is written and how the log is
-written and how the log is sent to a syslog server. A field that does not apply
+sent to a syslog server. A field that does not apply to a request is left out.
-to a request is left out.
+`smallwebwaf rproxy` writes a shorter line, which "`rproxy`'s line" below gives.
 ## Example
 ```
 {"type":"request","time":"2026-10-03T12:00:00.123Z","instance":"fsn1app1/gitea","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"response_content_type":"text/html; charset=utf-8","upstream_status":200,"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"duration_total":3.217,"duration_checks":0.041,"duration_upstream_connect":0.052,"duration_upstream_first_byte":2.874,"duration_upstream_total":3.104}
 ```
 ## Every line
 Every line but `rproxy`'s has:
 - `type`: `request` (the process's own messages have `process`);
 - the standard web log fields;
 - `request_id`, `peer_ip` and `client_group`;
 - `asn`, `as_name` and `country`;
 - `action` and `duration_total`.
 ## Standard web log fields
 - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC;
 - `instance`: `SWWAF_INSTANCE_NAME`;
 - `client_ip`, `method`, `scheme`, `host`, `path`, `query`, `protocol`;
 - `status`: what the client was sent, `0` if nothing;
 - `request_bytes` and `response_bytes`: body bytes each way;
 - `referer` and `user_agent`.
 ## Request detail
 - `request_id`: the `X-Request-ID` a trusted proxy sent, or a new random one of
  26 letters and digits.
 - `peer_ip`: the TCP peer, normally traefik.
 - `forwarded_for`: the `X-Forwarded-For` header as received.
 - `client_group`: the client as rate limiting counts it, an IPv4 address as a
  /32 or an IPv6 group.
 - `asn`, `as_name` and `country`: the client's, as looked up. Each is empty
  when:
    - lookups are off;
    - the client is not looked up;
    - the source cannot place the client;
    - GeoJS had not answered by the time the request went on.
 - `content_type` and `content_length`: the request's own.
 - `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
  in lower case.
 - `has_authorization` and `has_cookie`: true when the request had those headers.
  Their values are never logged.
 - `websocket`: true when the app switched the connection to another protocol.
 ## Response detail
 - `upstream_status`: what the app answered. It differs from `status` when
  `smallwebwaf` answered itself.
 - `response_content_type`, `cache_control` and `location`: the answer's headers.
 - `aborted`: true when the client went away early.
 ## Decision
 - `action`: what was done:
    - `forward`: passed to the app;
    - `denied`: refused for `SWWAF_DENY_NETS`, or for a reputation source with
      the action `deny`;
    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
      CrowdSec decision, each of which bans the client;
    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
      refused by that check;
    - `too_large` and `timed_out`: a size or time limit was passed;
    - `upstream_error`: the app could not be reached, or its answer broke off;
    - `admin`: answered at one of `smallwebwaf`'s own endpoints.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
  request it would have refused. `action` then names what was done, normally
  `forward`.
 - `limit_percent` and `limit_percent_setting`: the client's percentage of the
  rate limits and the setting that lowered it, when one did. `bytes_percent` and
  `bytes_percent_setting` do the same for the byte limits.
 - `counts`: the client's totals as rate limiting counts them, this request
  included. It is left out when rate limiting did not count the request. It
  holds:
    - `minute`, `hour` and `day`: requests;
    - `minute_bytes`, `hour_bytes` and `day_bytes`: bytes.
    A count can have a fraction (see "Counting method" in
    [`SPEC.md`](../SPEC.md)).
 - `limit_hit`: the limit broken:
    - `minute`, `hour` or `day` for a rate limit;
    - `minute_bytes`, `hour_bytes` or `day_bytes` for a byte limit;
    - `error_burst`.
    A request whose bytes broke a limit was passed on whole, so its `action`
    stays `forward`.
 - `rule_ids`: the rule file rules that matched, in order, up to the one that
  refused.
 - `waf_score` and `waf_rule_ids`: the Core Rule Set's score and the rules that
  matched, for a request it inspected.
 - `reputation`: the sources the client is on, in this order:
    - blocklist URLs;
    - the CrowdSec decision list's URL;
    - DNS blocklist zones;
    - `abuseipdb`.
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
  refused under one: a time, or `permanent`.
 ## Timings
 All in milliseconds:
 - `duration_total`: from the request's headers being read to its log line;
 - `duration_checks`: to the end of the checks, before forwarding;
 - `duration_waf`: the part of that the Core Rule Set took;
 - `duration_upstream_connect`: from the hand-over to the app until there was a
  connection;
 - `duration_upstream_first_byte`: until the first byte of the answer;
 - `duration_upstream_total`: until the end of the answer.
 ## `servewaf`'s lines
@@ -23,151 +137,50 @@ These questions write no line:
  [`SPEC.md`](../SPEC.md));
 - a question whose body stopped arriving, which gets no answer.
-A `report` line:
+### The `decision` line
-```
+It has the fields above, with these meanings where they differ:
 {"type":"request","servewaf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/servewaf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"waf_score":0,"duration_total":3.217,"duration_checks":0.041,"duration_waf":0.029,"duration_upstream_total":3.104}
 ```
-### Every line
+- `client_ip`: `X-Smallwebwaf-Client`.
-
+- `peer_ip`: `X-Smallwebwaf-Peer`.
 Every one of these lines has:
 - `type`: `request` (the process's own messages have `process`);
 - the standard web log fields;
 - `request_id`, `peer_ip` and `client_group`;
 - `asn`, `as_name` and `country`;
 - `action` and `duration_total`.
 ### Standard web log fields
 - `time`: when `servewaf` had read the question's body, RFC 3339 with
  milliseconds, in UTC. The `report` line gives the same time as the `decision`
  line.
 - `instance`: `SWWAF_INSTANCE_NAME`.
 - `client_ip`: the visitor's address, as `rproxy` worked it out.
 - `method`, `path` and `query`: the visitor's request.
 - `scheme`: how the visitor reached `rproxy` or the trusted proxy in front of
  it.
 - `host`: the site the visitor asked for.
 - `protocol`: the question's own, `HTTP/1.1`.
- `status`:
+- `content_length`: `X-Smallwebwaf-Content-Length`.
-    - on the `decision` line, what `servewaf` answered: `200` for `allow`, the
+- `request_id`: the question's `X-Request-ID`.
-      status of `deny`, or `0` for `close`, as the visitor is then sent nothing;
+- `status`: what `servewaf` answered: `200` for `allow`, the status of `deny`,
-    - on the `report` line, what the visitor got, `0` if nothing.
+  or `0` for `close`, as the visitor is then sent nothing.
- `request_bytes`:
+- `request_bytes`: how much of the question's body the Core Rule Set read.
-    - on the `decision` line, how much of the question's body the Core Rule Set
+- `response_bytes`: the body of `servewaf`'s answer.
-      read;
+- `action`: `forward` for `allow`, and `admin` for the `404` for a path under
-    - on the `report` line, the bytes of the visitor's body that `rproxy` read,
+  `/_smallwebwaf/`.
      with what a WebSocket carried from the visitor.
 - `response_bytes`:
    - on the `decision` line, the body of `servewaf`'s answer;
    - on the `report` line, the bytes of the answer's body, with what a
      WebSocket carried from the app.
 - `referer` and `user_agent`.
 ### Request detail
 - `request_id`: the id `rproxy` made for the request when it arrived.
 - `peer_ip`: the address of `rproxy`'s TCP peer, normally traefik.
 - `forwarded_for`: the `X-Forwarded-For` header the visitor's request came with.
 - `client_group`: the client as rate limiting counts it, an IPv4 address as a
  /32 or an IPv6 group.
 - `asn`, `as_name` and `country`: the client's, as looked up. Each is empty
  when:
    - lookups are off;
    - the client is not looked up;
    - the source cannot place the client;
    - GeoJS had not answered by the time `servewaf` answered.
 - `content_type`: the visitor's `Content-Type`.
 - `content_length`: the body length the visitor announced.
 - `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
  in lower case.
 - `has_authorization` and `has_cookie`: true when the request had those headers.
  Their values are never logged.
 ### Response detail
 - `response_content_type`: the type of `servewaf`'s own answer.
 - `aborted`: true when `rproxy` went away before the answer.
 - `duration_total`: from `servewaf` having read the question's body to the line.
 - `time`: when `servewaf` had read the question's body.
-### Decision
+The line leaves out `upstream_status`, `websocket` and the
 `duration_upstream_...` fields, since `servewaf` passes nothing to the app.
- `action`: what was done:
+The bytes of an allowed request are counted when its report comes. So `counts`
-    - `forward`: answered `allow`, so that `rproxy` passes it to the app;
+holds the client's bytes without this request's.
    - `denied`: refused for `SWWAF_DENY_NETS`, or for a reputation source with
      the action `deny`;
    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
      CrowdSec decision, each of which bans the client;
    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
      refused by that check;
    - `too_large`: over a header limit;
    - `admin`: answered at one of `servewaf`'s own endpoints, or `404` for a
      path under `/_smallwebwaf/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
  request it would have refused. `action` then names what was done, normally
  `forward`.
 - `limit_percent` and `limit_percent_setting`: the client's percentage of the
  rate limits and the setting that lowered it, when one did. `bytes_percent` and
  `bytes_percent_setting` do the same for the byte limits.
 - `counts`: the client's totals as rate limiting counts them, this request
  included. It is left out when rate limiting did not count the request. It
  holds:
    - `minute`, `hour` and `day`: requests;
    - `minute_bytes`, `hour_bytes` and `day_bytes`: bytes.
-    A count can have a fraction (see "Counting method" in
+### The `report` line
    [`SPEC.md`](../SPEC.md)). The bytes of an allowed request are counted when
    its report comes. So on the `decision` line, the bytes are without this
    request's.
- `limit_hit`: the limit broken:
+It has every field of the `decision` line, and `time` stays as the `decision`
-    - `minute`, `hour` or `day` for a rate limit;
+line gives it. These fields say what the report says:
    - `minute_bytes`, `hour_bytes` or `day_bytes` for a byte limit;
    - `error_burst`.
-    A request whose bytes broke a limit was passed on whole, so its `action`
+- `status`: what the visitor got, `0` if nothing;
-    stays `forward`. Only its `report` line gives that limit.
+- `request_bytes` and `response_bytes`: the body bytes each way, with what a
  WebSocket carried each way;
 - `duration_total`: from the request's headers being read by `rproxy` to the end
  of the answer;
 - `duration_upstream_total`: from the hand-over to the app to the end of the
  answer, for an allowed request.
- `rule_ids`: the rule file rules that matched, in order, up to the one that
+For an allowed request, the report's counting also changes these fields:
  refused.
 - `waf_score` and `waf_rule_ids`: the Core Rule Set's score and the rules that
  matched, for a request it inspected.
 - `reputation`: the sources the client is on, in this order:
    - blocklist URLs;
    - the CrowdSec decision list's URL;
    - DNS blocklist zones;
    - `abuseipdb`.
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
  refused under one: a time, or `permanent`.
-### Timings
+- `counts`: the byte totals now include this request's;
-
+- `limit_hit`, `offence` and `ban_expires`: set when the report's bytes broke a
-All in milliseconds:
+  byte limit.
 - `duration_total`:
    - on the `decision` line, from `servewaf` having read the question's body to
      the line;
    - on the `report` line, from `rproxy` having read the request's headers to
      the end of the answer.
 - `duration_checks`: to the end of the checks;
 - `duration_waf`: the part of that the Core Rule Set took;
 - `duration_upstream_total`: on the `report` line of an allowed request, from
  the hand-over to the app to the end of the answer.
 ### Requests to its own endpoints
 The line of a request to `servewaf`'s own endpoints has these fields, with these
 meanings where they differ:
 - `client_ip` and `peer_ip`: the request's TCP peer.
 - `request_id`: a new random one of 26 letters and digits.
 - `scheme`: `http`.
 - `time`: when the request's headers had been read.
 - `request_bytes`: the bytes read of a ban to add, and otherwise `0`.
 - `action`: `admin`.
 - `duration_total`: from the request's headers being read to the line.
 ## `rproxy`'s line
@@ -191,11 +204,8 @@ it to `servewaf`'s two. It has these fields and no others:
 - `duration_response`: milliseconds from then until the end of the answer.
 - `disposition`: what was done with the request: `allow`, `deny` or `close`. It
  is `servewaf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left
-  out when:
+  out when `servewaf` was not asked, as for the health check, and when the
-    - `servewaf` was not asked, as for the health check;
+  visitor went away while it was being asked.
    - the visitor went away while `servewaf` was being asked;
    - `servewaf`'s answer had no valid `X-Smallwebwaf-Disposition`;
    - `rproxy` could not pass on `servewaf`'s answer, and answered `502`.
 - `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
  `disposition`, and otherwise left out.
@@ -54,19 +54,14 @@ empty-agent      user_agent  log     ^$
 ## A file of your own
-`servewaf` reads the rule files in its own container. Rules of your own go in a
+An app's `Dockerfile` adds rules of its own in a file named to sort after the
-file named to sort after the default, such as `50-gitea.rules`:
+default, such as `50-gitea.rules`:
 ```
 # 50-gitea.rules: WordPress probes, which gitea never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 A `Dockerfile` built on the `smallwebwaf` image, for `servewaf` to run from,
 adds it:
 ```dockerfile
 COPY 50-gitea.rules /etc/smallwebwaf/rules.d/50-gitea.rules
 ```
 Or mount it there. A `path` rule applies on every site behind that `servewaf`.
@@ -4,10 +4,6 @@ Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
 that take `off`, the `_FILE` form, and what each group does and why.
 The settings that start with `SWWAF_` are `servewaf`'s. Those that start with
 `SWRP_` are `rproxy`'s, and are under "`rproxy`" below. `SMALLWEBWAF_COMMAND`
 chooses between the two (see "The image's command" below).
 ## Forms of values
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
@@ -28,22 +24,26 @@ chooses between the two (see "The image's command" below).
 ## Core
- `SWWAF_LISTEN_ADDR` (default `:8080`): where `servewaf` listens: `:` and a
+- `SWWAF_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
  `https` URL with a host and an optional port, and nothing more.
 - `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens: `:` and a
  port, such as `:9000`. Leave the host out (see "Ports" in
  [`SPEC.md`](../SPEC.md)).
 - `SWWAF_INSTANCE_NAME` (default: the container's host name): the `instance`
-  name in each line `servewaf` logs, and in each alert and metric, such as
+  name in every log line, alert and metric, such as `fsn1app1/gitea`. Valid
-  `fsn1/servewaf`. Valid UTF-8. No control character while
+  UTF-8. No control character while `SWWAF_ALERT_NTFY_URL` is set. 1 to 48
-  `SWWAF_ALERT_NTFY_URL` is set. 1 to 48 printable ASCII characters without a
+  printable ASCII characters without a space while `SWWAF_LOG_REMOTE_URL` is set
-  space while `SWWAF_LOG_REMOTE_URL` is set and `SWWAF_LOG_REMOTE_APP_NAME` is
+  and `SWWAF_LOG_REMOTE_APP_NAME` is not.
  not.
 - `SWWAF_MODE` (default `enforce`): `enforce` or `observe`.
 - `SWWAF_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
  nothing.
 - `SWWAF_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6
  client's group, from 32 to 128.
 - `SWWAF_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
  number above zero.
- `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `servewaf` keeps,
+- `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `smallwebwaf`
-  a whole number above zero.
+  keeps, a whole number above zero.
 ## Tokens
@@ -63,7 +63,7 @@ chooses between the two (see "The image's command" below).
 ## Logging
- `SWWAF_LOG_LEVEL` (default `info`): the least severe of `servewaf`'s own
+- `SWWAF_LOG_LEVEL` (default `info`): the least severe of `smallwebwaf`'s own
  messages that are written: `debug`, `info`, `warn` or `error`.
 - `SWWAF_LOG_REQUEST_HEADERS` (default
  `accept,accept-language,accept-encoding,content-type,origin,range`): the
@@ -125,6 +125,27 @@ chooses between the two (see "The image's command" below).
 - `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
  `response`, `request` or `both`.
 ## Size and time limits
 - `SWWAF_CLIENT_REQUEST_TIMEOUT` (default `60s`): how long a client may take to
  send its request line and headers, and then, from the end of the headers, its
  body. A duration or `off`.
 - `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest request
  line and headers. A size over `4K`; never `off`.
 - `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open connection
  may wait for its next request before it is closed. A duration or `off`.
 - `SWWAF_CLIENT_RESPONSE_TIMEOUT` (default `30m`): how long the answer may take
  to reach the client, from the end of the request to the last byte. A duration
  or `off`.
 - `SWWAF_UPSTREAM_REQUEST_TIMEOUT` (default `60s`): how long connecting to the
  app and sending it the whole request may take. A duration or `off`.
 - `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` (default `30m`): how long the app may take
  to send its whole answer. A duration or `off`.
 - `SWWAF_REQUEST_MAX_BYTES` (default `100M`): the largest request body. A size
  or `off`.
 - `SWWAF_RESPONSE_MAX_BYTES` (default `1G`): the largest response body. A size
  or `off`.
 ## Lookup of AS number and country
 - `SWWAF_LOOKUP_SOURCE` (default `geojs`): `geojs`, `file` or `off`. `off` stops
@@ -136,12 +157,11 @@ chooses between the two (see "The image's command" below).
    - an anomaly threshold per AS number.
 - `SWWAF_LOOKUP_DB_PATH` (default empty): the IPinfo Lite database file, in its
  `.mmdb` form, for `SWWAF_LOOKUP_SOURCE=file`.
- `SWWAF_LOOKUP_TIMEOUT` (default `800ms`): how long a request waits for its
+- `SWWAF_LOOKUP_TIMEOUT` (default `1s`): how long a request waits for its
  client's first answer from GeoJS, and how long a request to GeoJS may take. A
  duration; never `off`.
- `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` has `rproxy` pass the app
+- `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` passes the app the
-  the client's AS number in `X-Client-ASN` and its country in
+  client's AS number in `X-Client-ASN` and its country in `X-Client-Country`.
  `X-Client-Country`.
 ## Country lists
@@ -186,9 +206,7 @@ chooses between the two (see "The image's command" below).
 - `SWWAF_WAF_EXEMPT_PATHS` (default empty): path prefixes the Core Rule Set does
  not inspect.
 - `SWWAF_WAF_BODY_LIMIT` (default `off`): `off`, or how much of a request body
-  the Core Rule Set reads, a size of at most `64K`. A question carries no more
+  the Core Rule Set reads, a size of at most `1G`.
  of a body than 64 KiB, and the Core Rule Set reads at most 64 KiB less one
  byte of it, whatever the value (see "The answer" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
  in a minute (see "Attack detection" in `SPEC.md`). A count or `off`.
@@ -309,7 +327,6 @@ Then mount its directory into the container read-only, and name the file:
 ```sh
 docker run \
    -v /srv/app/tokens:/etc/smallwebwaf/tokens:ro \
    -e SMALLWEBWAF_COMMAND=servewaf \
    -e SWWAF_METRICS_TOKEN_FILE=/etc/smallwebwaf/tokens/metrics \
    ...
 ```
@@ -324,28 +341,33 @@ A few limits are fixed rather than settings:
 - at most 20,000 anomaly counters are kept;
 - each alert destination's queue holds at most 1,000 alerts;
 - `servewaf` holds at most 10,000 answered requests awaiting their reports;
- `servewaf` refuses a request with more than 50 cookies or more than 100 header
+- `rproxy` takes a request line and headers of at most 32 KiB, closes a
-  fields (see "Answering in time" under "`servewaf`" in
+  kept-open connection idle for 120 seconds, and reads at most 1 MiB of the body
-  [`SPEC.md`](../SPEC.md));
+  of `servewaf`'s answer.
 - `rproxy` takes a request line and headers of at most 32 KiB, and closes a
  kept-open connection idle for 120 seconds;
 - `rproxy` reads at most 1 MiB of the body of `servewaf`'s answer, and answers
  `502` to a longer one.
-## `servewaf`'s answer and `rproxy`'s wait
+## `servewaf`
-`SWWAF_LOOKUP_TIMEOUT` is the longest a question waits on an outside source.
+`smallwebwaf servewaf` uses every `SWWAF_` setting but these, which it ignores:
-Keep it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question
+
-waits for `SWWAF_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are
+- `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
-asked in the background (see "Answering in time" under "`servewaf`" in
+- the five timeouts under "Size and time limits";
-[`SPEC.md`](../SPEC.md)).
+- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`, `SWWAF_REQUEST_MAX_BYTES` and
  `SWWAF_RESPONSE_MAX_BYTES`.
 An invalid value of one of these still stops the start, and the line of settings
 at start still shows them.
 `SWWAF_ADD_LOOKUP_HEADERS` puts the headers on the answer to `rproxy`, not on a
 request to an app. `SWWAF_WAF_BODY_LIMIT` has an effect up to 64 KiB less one
 byte, whatever its value. A question carries no more of a body than 64 KiB (see
 "`servewaf`" in [`SPEC.md`](../SPEC.md)).
 ## `rproxy`
-`smallwebwaf rproxy` reads the settings below and no others. They are read once
+`smallwebwaf rproxy` reads the settings below and no others, and nothing else
-at start, and an invalid value stops the start. None can be given as a file,
+reads them. They are read once at start, and an invalid value stops the start.
-since `rproxy` never touches disk. "`rproxy`" in [`SPEC.md`](../SPEC.md) says
+None can be given as a file, since `rproxy` never touches disk. "`rproxy`" in
-what they do.
+[`SPEC.md`](../SPEC.md) says what they do.
 A time here is a whole number of milliseconds above zero, such as `2000`.
@@ -354,10 +376,9 @@ A time here is a whole number of milliseconds above zero, such as `2000`.
  speaks HTTP/1.1 to it.
 - `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `servewaf`'s
  answer, to a question and to a report. A time; never `off`.
- `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when
+- `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request
-  `servewaf` cannot be connected to, does not answer at all, or does not answer
+  `servewaf` gives no answer about. `allow` passes it to the app, and `deny`
-  within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers
+  answers `503`.
  `503`. It does not apply to an answer `servewaf` gives, such as an error.
 - `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or
  `off`.
 - `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or
@@ -374,29 +395,4 @@ A time here is a whole number of milliseconds above zero, such as `2000`.
  `https` URL with a host and an optional port, and nothing more.
 - `SWRP_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
-  nothing. A client outside these netblocks cannot claim another address. Where
+  nothing.
  other containers reach `rproxy` directly, or visitors on a private network
  reach traefik, they can name another address in the header. Narrowing the
  setting to traefik's own network closes that gap.
 ## The image's command
 `SMALLWEBWAF_COMMAND` (default `rproxy`) chooses what the image runs and what
 its health check checks: `rproxy` or `servewaf` (see "Deployment" in
 [`SPEC.md`](../SPEC.md)). It cannot be given as a file.
 ## Where earlier settings went
 Nothing reads these names any more:
 - `SWWAF_UPSTREAM_URL` is `SWRP_UPSTREAM_URL`.
 - `SWWAF_TRUSTED_PROXIES` is `SWRP_TRUSTED_PROXIES`.
 - `SWWAF_REQUEST_MAX_BYTES` is `SWRP_MAX_REQUEST_SIZE`.
 - `SWWAF_RESPONSE_MAX_BYTES` is `SWRP_MAX_RESPONSE_SIZE`.
 - `SWWAF_CLIENT_REQUEST_TIMEOUT` and `SWWAF_UPSTREAM_REQUEST_TIMEOUT` are
  `SWRP_MAX_REQUEST_TIME_MS`, in milliseconds.
 - `SWWAF_CLIENT_RESPONSE_TIMEOUT` and `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` are
  `SWRP_MAX_RESPONSE_TIME_MS`, in milliseconds.
 - `SWWAF_CLIENT_IDLE_TIMEOUT` and `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` have
  no setting. `rproxy` closes a kept-open connection idle for 120 seconds, and
  takes a request line and headers of at most 32 KiB.
@@ -7,7 +7,7 @@ Each has a top-level `version` of 1.
 ## `bans.json`
 Active and past bans: every ban an admin made, and up to `SWWAF_MAX_BANS` of
-those `servewaf` made. Per entry:
+those `smallwebwaf` made. Per entry:
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
 - `cause`: `attack`, `limit`, `admin` or `crowdsec`;
@@ -63,8 +63,8 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - bytes in each direction;
 - responses by status class;
- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
+- offences by kind: `limit`, `attack`, `rule_blocked`, `waf_blocked` and
-  may also hold `token_refused`, which is kept, and which nothing adds to.
+  `token_refused`.
 ## `lookups.json`
@@ -1,10 +1,9 @@
 // Package config reads smallwebwaf's settings, and is the one place they are
-// read. Every setting is an environment variable. The settings of `smallwebwaf
+// read. Every setting is an environment variable. The settings of
-// servewaf` start with SWWAF_, every one of them has a default, and most can be
+// `smallwebwaf` and `smallwebwaf servewaf` start with SWWAF_, every one of them
-// given as a file instead. Those of `smallwebwaf rproxy` start with SWRP_. Each
+// has a default, and each can be given as a file instead. Those of `smallwebwaf
-// of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
+// rproxy` start with SWRP_. Each of them but SWRP_WAF_BACKEND has a default, and
-// since rproxy never touches disk. SMALLWEBWAF_COMMAND chooses which of the two
+// none can be given as a file, since rproxy never touches disk.
 // the image runs.
 package config
 import (
@@ -31,11 +30,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
-// Config is the settings of `smallwebwaf servewaf`. A time or size limit of
+// Config is smallwebwaf's settings. A timeout, size or rate limit of zero
-// zero is off.
+// is off.
 type Config struct {
-	// ListenAddr is where servewaf listens (SWWAF_LISTEN_ADDR).
+	// ListenAddr is where smallwebwaf listens (SWWAF_LISTEN_ADDR).
 	ListenAddr string
 	// UpstreamURL is the app (SWWAF_UPSTREAM_URL).
 	UpstreamURL *url.URL
 	// InstanceName is the name every log line and alert gives as instance,
 	// and every metric carries as its label instance (SWWAF_INSTANCE_NAME),
 	// by default the host's name, which docker sets to the first 12
@@ -44,14 +45,42 @@ type Config struct {
 	// Observe is true in observe mode, when SWWAF_MODE is observe rather
 	// than enforce: a request that SWWAF_DENY_NETS, a ban, the country
 	// lists, a rate limit, a rule or the Core Rule Set would refuse is
-	// allowed instead, and no ban is made.
+	// passed to the app instead, and no ban is made.
 	Observe bool
 	// TrustedProxies are the netblocks whose X-Forwarded-For is
 	// believed (SWWAF_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
 	// IPv6GroupPrefix is the length of the IPv6 netblock that is one client
 	// (SWWAF_IPV6_GROUP_PREFIX), from 32 to 128.
 	IPv6GroupPrefix int
 	// MaxTrackedClients is the most clients the table of clients holds, in
 	// memory and in clients.json (SWWAF_MAX_TRACKED_CLIENTS).
 	MaxTrackedClients int
 	// ClientRequestTimeout bounds reading the whole request from the
 	// client (SWWAF_CLIENT_REQUEST_TIMEOUT).
 	ClientRequestTimeout time.Duration
 	// ClientRequestHeaderMaxBytes is the largest request line and headers
 	// a client may send (SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES). It is
 	// never off, and always more than 4K.
 	ClientRequestHeaderMaxBytes int64
 	// ClientIdleTimeout bounds how long a kept-open client connection
 	// may wait for its next request (SWWAF_CLIENT_IDLE_TIMEOUT).
 	ClientIdleTimeout time.Duration
 	// ClientResponseTimeout bounds writing the whole response to the
 	// client (SWWAF_CLIENT_RESPONSE_TIMEOUT).
 	ClientResponseTimeout time.Duration
 	// UpstreamRequestTimeout bounds connecting to the app and writing
 	// the whole request to it (SWWAF_UPSTREAM_REQUEST_TIMEOUT).
 	UpstreamRequestTimeout time.Duration
 	// UpstreamResponseTimeout bounds reading the whole response from
 	// the app (SWWAF_UPSTREAM_RESPONSE_TIMEOUT).
 	UpstreamResponseTimeout time.Duration
 	// RequestMaxBytes is the largest request body
 	// (SWWAF_REQUEST_MAX_BYTES).
 	RequestMaxBytes int64
 	// ResponseMaxBytes is the largest response body
 	// (SWWAF_RESPONSE_MAX_BYTES).
 	ResponseMaxBytes int64
 	// AllowNets are the netblocks whose clients skip every check
 	// (SWWAF_ALLOW_NETS). RateLimitExemptNets are those whose clients the
 	// rate limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_NETS).
@@ -231,8 +260,9 @@ type Config struct {
 	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that servewaf may refuse after a rule file or Core Rule Set match; one
+	// that smallwebwaf may refuse after a rule file or Core Rule Set match
-	// more breaks a limit (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
+	// or for a missing or wrong token; one more breaks a limit
 	// (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
 	// (SWWAF_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
@@ -335,8 +365,8 @@ const (
 	// masked is what the log shows for a token that is set, and in place of
 	// a secret in another setting.
 	masked = "********"
-	// defaultListenAddr is the default of SWWAF_LISTEN_ADDR and
+	// defaultListenAddr and defaultUpstreamURL are the defaults of
-	// SWRP_LISTEN_ADDR, and defaultUpstreamURL that of SWRP_UPSTREAM_URL.
+	// SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL.
 	defaultListenAddr  = ":8080"
 	defaultUpstreamURL = "http://127.0.0.1:8081"
 )
@@ -364,14 +394,13 @@ var (
 	errHeaderTakenOut = errors.New(
 		"is taken out of every request by Go's HTTP server, so it can never " +
 			"be logged")
-	errOnBothLists     = errors.New("is in SWWAF_DENIED_COUNTRIES too")
+	errOnBothLists          = errors.New("is in SWWAF_DENIED_COUNTRIES too")
-	errNotLookupSource = errors.New("is not geojs, file or off")
+	errNotLookupSource      = errors.New("is not geojs, file or off")
-	errNeedsLookups    = errors.New("it needs each client looked up")
+	errNeedsLookups         = errors.New("it needs each client looked up")
-	errNeedsDBPath     = errors.New("it names the file to look clients up in")
+	errNeedsDBPath          = errors.New("it names the file to look clients up in")
-	errDBPathUnused    = errors.New("only file reads it")
+	errDBPathUnused         = errors.New("only file reads it")
-	errOver64K         = errors.New(
+	errNotOver4K            = errors.New("is not a size of more than 4K, such as 32K")
-		"is more than 64K, the most servewaf gets of a body")
+	errOver1G               = errors.New("is more than 1G, the most Coraza reads")
 	errNotCommand           = errors.New("is not rproxy or servewaf")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -460,27 +489,38 @@ var (
 func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
-		ListenAddr:           env.address("SWWAF_LISTEN_ADDR"),
+		ListenAddr:           env.address("SWWAF_LISTEN_ADDR", defaultListenAddr),
 		UpstreamURL:          env.appURL("SWWAF_UPSTREAM_URL", defaultUpstreamURL),
 		InstanceName:         env.instanceName(),
 		Observe:              env.observe("SWWAF_MODE", "enforce"),
 		TrustedProxies:       env.netblocks("SWWAF_TRUSTED_PROXIES", privateRanges),
 		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWWAF_IPV6_GROUP_PREFIX", "64"),
 		MaxTrackedClients:    env.numberNotOff("SWWAF_MAX_TRACKED_CLIENTS", "20000"),
-		AllowNets:            env.netblocks("SWWAF_ALLOW_NETS", ""),
+		ClientRequestTimeout: env.duration("SWWAF_CLIENT_REQUEST_TIMEOUT", "60s"),
-		RateLimitExemptNets:  env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
+		ClientRequestHeaderMaxBytes: env.headerSize(
-		DenyNets:             env.netblocks("SWWAF_DENY_NETS", ""),
+			"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES", "32K"),
-		RateLimitPerMinute:   env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
+		ClientIdleTimeout:       env.duration("SWWAF_CLIENT_IDLE_TIMEOUT", "120s"),
-		RateLimitPerHour:     env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
+		ClientResponseTimeout:   env.duration("SWWAF_CLIENT_RESPONSE_TIMEOUT", "30m"),
-		RateLimitPerDay:      env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
+		UpstreamRequestTimeout:  env.duration("SWWAF_UPSTREAM_REQUEST_TIMEOUT", "60s"),
-		RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
+		UpstreamResponseTimeout: env.duration("SWWAF_UPSTREAM_RESPONSE_TIMEOUT", "30m"),
-		BytesLimitPerMinute:  env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
+		RequestMaxBytes:         env.size("SWWAF_REQUEST_MAX_BYTES", "100M"),
-		BytesLimitPerHour:    env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
+		ResponseMaxBytes:        env.size("SWWAF_RESPONSE_MAX_BYTES", "1G"),
-		BytesLimitPerDay:     env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
+		AllowNets:               env.netblocks("SWWAF_ALLOW_NETS", ""),
-		BytesCount:           env.bytesCount("SWWAF_BYTES_COUNT", "both"),
+		RateLimitExemptNets:     env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
-		LookupSource:         env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
+		DenyNets:                env.netblocks("SWWAF_DENY_NETS", ""),
-		LookupDBPath:         env.value("SWWAF_LOOKUP_DB_PATH", ""),
+		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
-		LookupTimeout:        env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "800ms"),
+		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
-		AddLookupHeaders:     env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
+		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
-		DeniedCountries:      env.countries("SWWAF_DENIED_COUNTRIES", ""),
+		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
 		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
 		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
 		BytesLimitPerDay:        env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
 		BytesCount:              env.bytesCount("SWWAF_BYTES_COUNT", "both"),
 		LookupSource:            env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
 		LookupDBPath:            env.value("SWWAF_LOOKUP_DB_PATH", ""),
 		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "1s"),
 		AddLookupHeaders:        env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
 		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
 			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
 		ASNLimitPercent:      env.percents("SWWAF_ASN_LIMIT_PERCENT", ParseASN),
@@ -572,30 +612,22 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	return cfg, nil
 }
-// Command reads only SMALLWEBWAF_COMMAND, the command the image runs and its
+// ListenAddrAndUpstreamURL reads only SWWAF_LISTEN_ADDR and
-// health check checks: rproxy when it is unset or empty, or servewaf. It cannot
+// SWWAF_UPSTREAM_URL, either of which may be given as a file, as
-// be given as a file. Any other value is an error that names the setting.
+// FromEnvironment does. The health check needs no other setting, so it
-func Command(lookupEnv func(string) (string, bool)) (string, error) {
+// reads no other, nor a file that another names.
-	command, _ := lookupEnv("SMALLWEBWAF_COMMAND")
+func ListenAddrAndUpstreamURL(
-
+	lookupEnv func(string) (string, bool),
-	switch command {
+) (string, *url.URL, error) {
 	case "", "rproxy":
 		return "rproxy", nil
 	case "servewaf":
 		return command, nil
 	default:
 		return "", fmt.Errorf("SMALLWEBWAF_COMMAND: %q %w", command, errNotCommand)
 	}
 }
 // ServeWAFListenAddr reads only SWWAF_LISTEN_ADDR, which may be given as a
 // file, as FromEnvironment does. The health check in servewaf's container needs
 // no other setting, so it reads no other, nor a file that another names.
 func ServeWAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
 	env := &environment{lookupEnv: lookupEnv}
-	listenAddr := env.address("SWWAF_LISTEN_ADDR")
+	listenAddr := env.address("SWWAF_LISTEN_ADDR", defaultListenAddr)
 	upstreamURL := env.appURL("SWWAF_UPSTREAM_URL", defaultUpstreamURL)
-	return listenAddr, env.err
+	if env.err != nil {
 		return "", nil, env.err
 	}
 	return listenAddr, upstreamURL, nil
 }
 // InstanceName reads only SWWAF_INSTANCE_NAME, which may be given as a
@@ -677,10 +709,9 @@ func (e *environment) check(name string, err error) {
 	}
 }
-// address reads a setting that is an address to listen on, by default
+// address reads a setting that is an address to listen on.
-// defaultListenAddr.
+func (e *environment) address(name, defaultValue string) string {
-func (e *environment) address(name string) string {
+	address, err := parseListenAddr(e.value(name, defaultValue))
 	address, err := parseListenAddr(e.value(name, defaultListenAddr))
 	e.check(name, err)
 	return address
@@ -748,6 +779,15 @@ func (e *environment) wafBodyLimit(name, defaultValue string) int64 {
 	return limit
 }
 // headerSize reads the setting that is the largest request line and
 // headers.
 func (e *environment) headerSize(name, defaultValue string) int64 {
 	size, err := parseHeaderSize(e.value(name, defaultValue))
 	e.check(name, err)
 	return size
 }
 // count reads a setting that is a number of requests.
 func (e *environment) count(name, defaultValue string) int64 {
 	count, err := parseCount(e.value(name, defaultValue))
@@ -1394,17 +1434,30 @@ func parseSize(value string) (int64, error) {
 	return n * unit, nil
 }
 // parseHeaderSize reads the largest request line and headers: a size as
 // parseSize reads it, but more than 4K and never off. Go's server reads 4K
 // past the limit it is given before it refuses, so proxy.New gives it this
 // size less 4K, which must leave a limit.
 func parseHeaderSize(value string) (int64, error) {
 	size, err := parseSize(value)
 	if err != nil || size <= 4*kibibyte {
 		return 0, fmt.Errorf("%q %w", value, errNotOver4K)
 	}
 	return size, nil
 }
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 64K, since servewaf
+// reads: a size as parseSize reads it, or off, but at most 1G, since
-// gets no more of a body than that.
+// Coraza, which runs the Core Rule Set, refuses to load with more.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)
 	if err != nil {
 		return 0, err
 	}
-	if limit > 64*kibibyte {
+	if limit > gibibyte {
-		return 0, fmt.Errorf("%q %w", value, errOver64K)
+		return 0, fmt.Errorf("%q %w", value, errOver1G)
 	}
 	return limit, nil
@@ -23,88 +23,98 @@ import (
 // The settings, by name.
 const (
-	listenAddr           = "SWWAF_LISTEN_ADDR"
+	listenAddr              = "SWWAF_LISTEN_ADDR"
-	mode                 = "SWWAF_MODE"
+	upstreamURL             = "SWWAF_UPSTREAM_URL"
-	ipv6GroupPrefix      = "SWWAF_IPV6_GROUP_PREFIX"
+	mode                    = "SWWAF_MODE"
-	maxTrackedClients    = "SWWAF_MAX_TRACKED_CLIENTS"
+	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
-	allowNets            = "SWWAF_ALLOW_NETS"
+	ipv6GroupPrefix         = "SWWAF_IPV6_GROUP_PREFIX"
-	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
+	maxTrackedClients       = "SWWAF_MAX_TRACKED_CLIENTS"
-	denyNets             = "SWWAF_DENY_NETS"
+	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
-	rateLimitPerMinute   = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
-	rateLimitPerHour     = "SWWAF_RATE_LIMIT_PER_HOUR"
+	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
-	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
+	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	rateLimitExemptPaths = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
-	bytesLimitPerMinute  = "SWWAF_BYTES_LIMIT_PER_MINUTE"
+	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
-	bytesLimitPerHour    = "SWWAF_BYTES_LIMIT_PER_HOUR"
+	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
-	bytesLimitPerDay     = "SWWAF_BYTES_LIMIT_PER_DAY"
+	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
-	bytesCount           = "SWWAF_BYTES_COUNT"
+	allowNets               = "SWWAF_ALLOW_NETS"
-	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
-	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
+	denyNets                = "SWWAF_DENY_NETS"
-	lookupTimeout        = "SWWAF_LOOKUP_TIMEOUT"
+	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
-	addLookupHeaders     = "SWWAF_ADD_LOOKUP_HEADERS"
+	rateLimitPerHour        = "SWWAF_RATE_LIMIT_PER_HOUR"
-	deniedCountries      = "SWWAF_DENIED_COUNTRIES"
+	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
-	allowedCountries     = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
-	asnLimitPercent      = "SWWAF_ASN_LIMIT_PERCENT"
+	bytesLimitPerMinute     = "SWWAF_BYTES_LIMIT_PER_MINUTE"
-	countryLimitPercent  = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	bytesLimitPerHour       = "SWWAF_BYTES_LIMIT_PER_HOUR"
-	asnBytesPercent      = "SWWAF_ASN_BYTES_PERCENT"
+	bytesLimitPerDay        = "SWWAF_BYTES_LIMIT_PER_DAY"
-	countryBytesPercent  = "SWWAF_COUNTRY_BYTES_PERCENT"
+	bytesCount              = "SWWAF_BYTES_COUNT"
-	unknownLimitPercent  = "SWWAF_UNKNOWN_LIMIT_PERCENT"
+	lookupSource            = "SWWAF_LOOKUP_SOURCE"
-	asnLimitPercentURL   = "SWWAF_ASN_LIMIT_PERCENT_URL"
+	lookupDBPath            = "SWWAF_LOOKUP_DB_PATH"
-	blocklistURLs        = "SWWAF_BLOCKLIST_URLS"
+	lookupTimeout           = "SWWAF_LOOKUP_TIMEOUT"
-	blocklistRefresh     = "SWWAF_BLOCKLIST_REFRESH"
+	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
-	blocklistAction      = "SWWAF_BLOCKLIST_ACTION"
+	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
-	dnsblZones           = "SWWAF_DNSBL_ZONES"
+	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	dnsblResolver        = "SWWAF_DNSBL_RESOLVER"
+	asnLimitPercent         = "SWWAF_ASN_LIMIT_PERCENT"
-	abuseIPDBKey         = "SWWAF_ABUSEIPDB_KEY"
+	countryLimitPercent     = "SWWAF_COUNTRY_LIMIT_PERCENT"
-	abuseIPDBMinScore    = "SWWAF_ABUSEIPDB_MIN_SCORE"
+	asnBytesPercent         = "SWWAF_ASN_BYTES_PERCENT"
-	abuseIPDBDailyBudget = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
+	countryBytesPercent     = "SWWAF_COUNTRY_BYTES_PERCENT"
-	reputationAction     = "SWWAF_REPUTATION_ACTION"
+	unknownLimitPercent     = "SWWAF_UNKNOWN_LIMIT_PERCENT"
-	reputationCacheTTL   = "SWWAF_REPUTATION_CACHE_TTL"
+	asnLimitPercentURL      = "SWWAF_ASN_LIMIT_PERCENT_URL"
-	reputationTimeout    = "SWWAF_REPUTATION_TIMEOUT"
+	blocklistURLs           = "SWWAF_BLOCKLIST_URLS"
-	crowdSecURL          = "SWWAF_CROWDSEC_LAPI_URL"
+	blocklistRefresh        = "SWWAF_BLOCKLIST_REFRESH"
-	crowdSecKey          = "SWWAF_CROWDSEC_LAPI_KEY"
+	blocklistAction         = "SWWAF_BLOCKLIST_ACTION"
-	banResponse          = "SWWAF_BAN_RESPONSE"
+	dnsblZones              = "SWWAF_DNSBL_ZONES"
-	limitBanDuration     = "SWWAF_LIMIT_BAN_DURATION"
+	dnsblResolver           = "SWWAF_DNSBL_RESOLVER"
-	limitBanRepeatWindow = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	abuseIPDBKey            = "SWWAF_ABUSEIPDB_KEY"
-	maxBanDuration       = "SWWAF_MAX_BAN_DURATION"
+	abuseIPDBMinScore       = "SWWAF_ABUSEIPDB_MIN_SCORE"
-	attackBanDuration    = "SWWAF_ATTACK_BAN_DURATION"
+	abuseIPDBDailyBudget    = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
-	maxBans              = "SWWAF_MAX_BANS"
+	reputationAction        = "SWWAF_REPUTATION_ACTION"
-	banScopeV4Prefix     = "SWWAF_BAN_SCOPE_V4_PREFIX"
+	reputationCacheTTL      = "SWWAF_REPUTATION_CACHE_TTL"
-	stateDir             = "SWWAF_STATE_DIR"
+	reputationTimeout       = "SWWAF_REPUTATION_TIMEOUT"
-	stateWriteDelay      = "SWWAF_STATE_WRITE_DELAY"
+	crowdSecURL             = "SWWAF_CROWDSEC_LAPI_URL"
-	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
+	crowdSecKey             = "SWWAF_CROWDSEC_LAPI_KEY"
-	adminToken           = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	banResponse             = "SWWAF_BAN_RESPONSE"
-	metricsToken         = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
-	metricsTopN          = "SWWAF_METRICS_TOP_N"
+	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
-	instanceName         = "SWWAF_INSTANCE_NAME"
+	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
-	logRequestHeaders    = "SWWAF_LOG_REQUEST_HEADERS"
+	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
-	logLevel             = "SWWAF_LOG_LEVEL"
+	maxBans                 = "SWWAF_MAX_BANS"
-	rulesDir             = "SWWAF_RULES_DIR"
+	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
-	rulesEnabled         = "SWWAF_RULES_ENABLED"
+	stateDir                = "SWWAF_STATE_DIR"
-	wafMode              = "SWWAF_WAF_MODE"
+	stateWriteDelay         = "SWWAF_STATE_WRITE_DELAY"
-	wafParanoiaLevel     = "SWWAF_WAF_PARANOIA_LEVEL"
+	stateCounterInterval    = "SWWAF_STATE_COUNTER_INTERVAL"
-	wafAnomalyThreshold  = "SWWAF_WAF_ANOMALY_THRESHOLD"
+	adminToken              = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	wafDisabledRules     = "SWWAF_WAF_DISABLED_RULES"
+	metricsToken            = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
-	wafExemptPaths       = "SWWAF_WAF_EXEMPT_PATHS"
+	metricsTopN             = "SWWAF_METRICS_TOP_N"
-	wafBodyLimit         = "SWWAF_WAF_BODY_LIMIT"
+	instanceName            = "SWWAF_INSTANCE_NAME"
-	trapPaths            = "SWWAF_TRAP_PATHS"
+	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
-	errorBurstThreshold  = "SWWAF_ERROR_BURST_THRESHOLD"
+	logLevel                = "SWWAF_LOG_LEVEL"
-	logRemoteURL         = "SWWAF_LOG_REMOTE_URL"
+	rulesDir                = "SWWAF_RULES_DIR"
-	logRemoteTLSCAFile   = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
+	rulesEnabled            = "SWWAF_RULES_ENABLED"
-	logRemoteBuffer      = "SWWAF_LOG_REMOTE_BUFFER"
+	wafMode                 = "SWWAF_WAF_MODE"
-	logRemoteFacility    = "SWWAF_LOG_REMOTE_FACILITY"
+	wafParanoiaLevel        = "SWWAF_WAF_PARANOIA_LEVEL"
-	logRemoteAppName     = "SWWAF_LOG_REMOTE_APP_NAME"
+	wafAnomalyThreshold     = "SWWAF_WAF_ANOMALY_THRESHOLD"
-	alertWebhookURL      = "SWWAF_ALERT_WEBHOOK_URL"
+	wafDisabledRules        = "SWWAF_WAF_DISABLED_RULES"
-	alertWebhookHeaders  = "SWWAF_ALERT_WEBHOOK_HEADERS"
+	wafExemptPaths          = "SWWAF_WAF_EXEMPT_PATHS"
-	alertSlackWebhookURL = "SWWAF_ALERT_SLACK_WEBHOOK_URL"
+	wafBodyLimit            = "SWWAF_WAF_BODY_LIMIT"
-	alertNtfyURL         = "SWWAF_ALERT_NTFY_URL"
+	trapPaths               = "SWWAF_TRAP_PATHS"
-	alertNtfyToken       = "SWWAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
+	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
-	alertEvents          = "SWWAF_ALERT_EVENTS"
+	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
-	alertCooldown        = "SWWAF_ALERT_COOLDOWN"
+	logRemoteTLSCAFile      = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
-	alertMaxPerHour      = "SWWAF_ALERT_MAX_PER_HOUR"
+	logRemoteBuffer         = "SWWAF_LOG_REMOTE_BUFFER"
-	anomalyNetV4Prefix   = "SWWAF_ANOMALY_NET_V4_PREFIX"
+	logRemoteFacility       = "SWWAF_LOG_REMOTE_FACILITY"
-	anomalyNetV6Prefix   = "SWWAF_ANOMALY_NET_V6_PREFIX"
+	logRemoteAppName        = "SWWAF_LOG_REMOTE_APP_NAME"
-	watchNets            = "SWWAF_WATCH_NETS"
+	alertWebhookURL         = "SWWAF_ALERT_WEBHOOK_URL"
 	alertWebhookHeaders     = "SWWAF_ALERT_WEBHOOK_HEADERS"
 	alertSlackWebhookURL    = "SWWAF_ALERT_SLACK_WEBHOOK_URL"
 	alertNtfyURL            = "SWWAF_ALERT_NTFY_URL"
 	alertNtfyToken          = "SWWAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
 	alertEvents             = "SWWAF_ALERT_EVENTS"
 	alertCooldown           = "SWWAF_ALERT_COOLDOWN"
 	alertMaxPerHour         = "SWWAF_ALERT_MAX_PER_HOUR"
 	anomalyNetV4Prefix      = "SWWAF_ANOMALY_NET_V4_PREFIX"
 	anomalyNetV6Prefix      = "SWWAF_ANOMALY_NET_V6_PREFIX"
 	watchNets               = "SWWAF_WATCH_NETS"
 )
 // The anomaly thresholds: each of the prefixes below, which name a scope,
@@ -242,34 +252,48 @@ func TestDefaults(t *testing.T) {
 	cfg := fromEnvironment(t, environment{})
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:           ":8080",
+		ListenAddr:                  ":8080",
-		Observe:              false,
+		Observe:                     false,
-		RateLimitPerMinute:   500,
+		ClientRequestTimeout:        time.Minute,
-		RateLimitPerHour:     20000,
+		ClientRequestHeaderMaxBytes: 32 << 10,
-		RateLimitPerDay:      300000,
+		ClientIdleTimeout:           2 * time.Minute,
-		BanResponse:          403,
+		ClientResponseTimeout:       30 * time.Minute,
-		LimitBanDuration:     time.Hour,
+		UpstreamRequestTimeout:      time.Minute,
-		LimitBanRepeatWindow: 24 * time.Hour,
+		UpstreamResponseTimeout:     30 * time.Minute,
-		MaxBanDuration:       7 * 24 * time.Hour,
+		RequestMaxBytes:             100 << 20,
-		AttackBanDuration:    7 * 24 * time.Hour,
+		ResponseMaxBytes:            1 << 30,
-		MaxBans:              5000,
+		RateLimitPerMinute:          500,
-		BanScopeV4Prefix:     32,
+		RateLimitPerHour:            20000,
-		StateDir:             "/var/lib/smallwebwaf",
+		RateLimitPerDay:             300000,
-		StateWriteDelay:      10 * time.Second,
+		BanResponse:                 403,
-		StateCounterInterval: 15 * time.Minute,
+		LimitBanDuration:            time.Hour,
-		MetricsToken:         "",
+		LimitBanRepeatWindow:        24 * time.Hour,
-		MetricsTopN:          50,
+		MaxBanDuration:              7 * 24 * time.Hour,
-		RulesDir:             "/etc/smallwebwaf/rules.d",
+		AttackBanDuration:           7 * 24 * time.Hour,
-		RulesEnabled:         true,
+		MaxBans:                     5000,
 		BanScopeV4Prefix:            32,
 		StateDir:                    "/var/lib/smallwebwaf",
 		StateWriteDelay:             10 * time.Second,
 		StateCounterInterval:        15 * time.Minute,
 		MetricsToken:                "",
 		MetricsTopN:                 50,
 		RulesDir:                    "/etc/smallwebwaf/rules.d",
 		RulesEnabled:                true,
 	})
 	wantLookupSettings(t, cfg, config.Config{
-		LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond,
+		LookupSource: defaultLookupSource, LookupTimeout: time.Second,
 	})
 	wantByteLimitSettings(t, cfg, config.Config{
 		BytesLimitPerMinute: 4 << 30, BytesLimitPerHour: 20 << 30,
 		BytesLimitPerDay: 200 << 30, BytesCount: "both",
 	})
 	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
 		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
 	}
 	wantNetblocks(t, cfg.TrustedProxies,
 		"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
 	wantNetblocks(t, cfg.AllowNets)
 	wantNetblocks(t, cfg.RateLimitExemptNets)
 	wantNetblocks(t, cfg.DenyNets)
@@ -298,13 +322,8 @@ func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
 	cfg := fromEnvironment(t, environment{})
 	rproxy, err := rproxyConfig(map[string]string{wafBackend: backendURL})
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
 	// The largest request body and the largest response, both counted.
-	largest := rproxy.MaxRequestSize + rproxy.MaxResponseSize
+	largest := cfg.RequestMaxBytes + cfg.ResponseMaxBytes
 	for _, limit := range []int64{
 		cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.BytesLimitPerDay,
 	} {
@@ -318,54 +337,77 @@ func TestValuesAsSet(t *testing.T) {
 	t.Parallel()
 	cfg := fromEnvironment(t, environment{
-		listenAddr:           "127.0.0.1:9000",
+		listenAddr:              "127.0.0.1:9000",
-		mode:                 "observe",
+		upstreamURL:             "https://app.internal:8443/",
-		allowNets:            "192.0.2.7",
+		mode:                    "observe",
-		rateLimitExemptNets:  "2001:db8::/48, 10.9.8.7",
+		trustedProxies:          " 192.0.2.1, 10.1.2.3/8 ,2001:db8::/32",
-		denyNets:             "198.51.100.0/24",
+		clientRequestTimeout:    "90s",
-		rateLimitPerMinute:   "60",
+		clientHeaderMaxBytes:    "8K",
-		rateLimitPerHour:     "600",
+		clientIdleTimeout:       "5m",
-		rateLimitPerDay:      "6000",
+		clientResponseTimeout:   "7d",
-		deniedCountries:      "cn, RU,kp,Xk",
+		upstreamRequestTimeout:  "1h30m",
-		allowedCountries:     "de",
+		upstreamResponseTimeout: off,
-		banResponse:          "429",
+		requestMaxBytes:         "512K",
-		limitBanDuration:     "15m",
+		responseMaxBytes:        "1234",
-		limitBanRepeatWindow: "2d",
+		allowNets:               "192.0.2.7",
-		maxBanDuration:       "30d",
+		rateLimitExemptNets:     "2001:db8::/48, 10.9.8.7",
-		attackBanDuration:    "1d",
+		denyNets:                "198.51.100.0/24",
-		maxBans:              "100",
+		rateLimitPerMinute:      "60",
-		banScopeV4Prefix:     "24",
+		rateLimitPerHour:        "600",
-		stateDir:             "/srv/waf-state",
+		rateLimitPerDay:         "6000",
-		stateWriteDelay:      "500ms",
+		deniedCountries:         "cn, RU,kp,Xk",
-		stateCounterInterval: "1h",
+		allowedCountries:        "de",
-		metricsToken:         token,
+		banResponse:             "429",
-		metricsTopN:          "10",
+		limitBanDuration:        "15m",
-		rulesDir:             "/srv/waf-rules",
+		limitBanRepeatWindow:    "2d",
-		rulesEnabled:         "false",
+		maxBanDuration:          "30d",
 		attackBanDuration:       "1d",
 		maxBans:                 "100",
 		banScopeV4Prefix:        "24",
 		stateDir:                "/srv/waf-state",
 		stateWriteDelay:         "500ms",
 		stateCounterInterval:    "1h",
 		metricsToken:            token,
 		metricsTopN:             "10",
 		rulesDir:                "/srv/waf-rules",
 		rulesEnabled:            "false",
 	})
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:           "127.0.0.1:9000",
+		ListenAddr:                  "127.0.0.1:9000",
-		Observe:              true,
+		Observe:                     true,
-		RateLimitPerMinute:   60,
+		ClientRequestTimeout:        90 * time.Second,
-		RateLimitPerHour:     600,
+		ClientRequestHeaderMaxBytes: 8 << 10,
-		RateLimitPerDay:      6000,
+		ClientIdleTimeout:           5 * time.Minute,
-		BanResponse:          429,
+		ClientResponseTimeout:       7 * 24 * time.Hour,
-		LimitBanDuration:     15 * time.Minute,
+		UpstreamRequestTimeout:      90 * time.Minute,
-		LimitBanRepeatWindow: 48 * time.Hour,
+		UpstreamResponseTimeout:     0,
-		MaxBanDuration:       30 * 24 * time.Hour,
+		RequestMaxBytes:             512 << 10,
-		AttackBanDuration:    24 * time.Hour,
+		ResponseMaxBytes:            1234,
-		MaxBans:              100,
+		RateLimitPerMinute:          60,
-		BanScopeV4Prefix:     24,
+		RateLimitPerHour:            600,
-		StateDir:             "/srv/waf-state",
+		RateLimitPerDay:             6000,
-		StateWriteDelay:      500 * time.Millisecond,
+		BanResponse:                 429,
-		StateCounterInterval: time.Hour,
+		LimitBanDuration:            15 * time.Minute,
-		MetricsToken:         token,
+		LimitBanRepeatWindow:        48 * time.Hour,
-		MetricsTopN:          10,
+		MaxBanDuration:              30 * 24 * time.Hour,
-		RulesDir:             "/srv/waf-rules",
+		AttackBanDuration:           24 * time.Hour,
-		RulesEnabled:         false,
+		MaxBans:                     100,
 		BanScopeV4Prefix:            24,
 		StateDir:                    "/srv/waf-state",
 		StateWriteDelay:             500 * time.Millisecond,
 		StateCounterInterval:        time.Hour,
 		MetricsToken:                token,
 		MetricsTopN:                 10,
 		RulesDir:                    "/srv/waf-rules",
 		RulesEnabled:                false,
 	})
 	if cfg.UpstreamURL.String() != "https://app.internal:8443/" {
 		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
 	}
 	wantNetblocks(t, cfg.TrustedProxies, "192.0.2.1/32", "10.0.0.0/8", "2001:db8::/32")
 	wantNetblocks(t, cfg.AllowNets, "192.0.2.7/32")
 	wantNetblocks(t, cfg.RateLimitExemptNets, "2001:db8::/48", "10.9.8.7/32")
 	wantNetblocks(t, cfg.DenyNets, "198.51.100.0/24")
@@ -539,13 +581,13 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
-				wafBodyLimit: "32K",
+				wafBodyLimit: "128K",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
 				WAFDisabledRules: []int{942100, 920350},
 				WAFExemptPaths:   []string{"/api/", "/static/"},
-				WAFBodyLimit:     32 << 10,
+				WAFBodyLimit:     128 << 10,
 			},
 		},
 		{
@@ -573,12 +615,12 @@ func TestCoreRuleSetSettings(t *testing.T) {
 	}
 }
-func TestWAFBodyLimitOf64K(t *testing.T) {
+func TestWAFBodyLimitOf1G(t *testing.T) {
 	t.Parallel()
-	cfg := fromEnvironment(t, environment{wafBodyLimit: "64K"})
+	cfg := fromEnvironment(t, environment{wafBodyLimit: "1G"})
-	if cfg.WAFBodyLimit != 64<<10 {
+	if cfg.WAFBodyLimit != 1<<30 {
-		t.Errorf("64K read as %d", cfg.WAFBodyLimit)
+		t.Errorf("1G read as %d", cfg.WAFBodyLimit)
 	}
 }
@@ -627,10 +669,10 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafBodyLimit, "128KB",
 			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
 		},
-		{wafBodyLimit, "65K", `"65K" is more than 64K, the most servewaf gets of a body`},
+		{wafBodyLimit, "2G", `"2G" is more than 1G, the most Coraza reads`},
 		{
-			wafBodyLimit, "65537",
+			wafBodyLimit, "1073741825",
-			`"65537" is more than 64K, the most servewaf gets of a body`,
+			`"1073741825" is more than 1G, the most Coraza reads`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
@@ -1123,7 +1165,7 @@ func TestLookupSettingsAsSet(t *testing.T) {
 	cfg = fromEnvironment(t, environment{lookupSource: off})
 	wantLookupSettings(t, cfg, config.Config{
-		LookupSource: off, LookupTimeout: 800 * time.Millisecond,
+		LookupSource: off, LookupTimeout: time.Second,
 	})
 }
@@ -1925,15 +1967,45 @@ func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 	cfg := fromEnvironment(t, environment{
-		bytesLimitPerMinute: "3G",
+		requestMaxBytes:      "3G",
-		bytesLimitPerHour:   off,
+		responseMaxBytes:     off,
-		alertCooldown:       off,
+		clientRequestTimeout: off,
 		clientIdleTimeout:    off,
 	})
-	if cfg.BytesLimitPerMinute != 3<<30 || cfg.BytesLimitPerHour != 0 ||
+	if cfg.RequestMaxBytes != 3<<30 || cfg.ResponseMaxBytes != 0 ||
-		cfg.AlertCooldown != 0 {
+		cfg.ClientRequestTimeout != 0 || cfg.ClientIdleTimeout != 0 {
-		t.Errorf("3G, off and off read as %d, %d and %s",
+		t.Errorf("3G, off, off and off read as %d, %d, %s and %s",
-			cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.AlertCooldown)
+			cfg.RequestMaxBytes, cfg.ResponseMaxBytes, cfg.ClientRequestTimeout,
 			cfg.ClientIdleTimeout)
 	}
 }
 func TestRequestHeaderMaxBytesJustOver4K(t *testing.T) {
 	t.Parallel()
 	cfg := fromEnvironment(t, environment{clientHeaderMaxBytes: "4097"})
 	if cfg.ClientRequestHeaderMaxBytes != 4097 {
 		t.Errorf("4097 read as %d", cfg.ClientRequestHeaderMaxBytes)
 	}
 }
 func TestRequestHeaderMaxBytesRefusalNeverOffersOff(t *testing.T) {
 	t.Parallel()
 	for _, value := range []string{"32KB", "0", "4K", off} {
 		t.Run(value, func(t *testing.T) {
 			t.Parallel()
 			_, err := config.FromEnvironment(
 				environment{clientHeaderMaxBytes: value}.lookupEnv)
 			want := clientHeaderMaxBytes + `: "` + value +
 				`" is not a size of more than 4K, such as 32K`
 			if err == nil || err.Error() != want {
 				t.Errorf("error %v, want %s", err, want)
 			}
 		})
 	}
 }
@@ -1962,12 +2034,34 @@ func TestBanResponseCloseIsZero(t *testing.T) {
 	}
 }
 func TestTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
 	t.Parallel()
 	cfg := fromEnvironment(t, environment{trustedProxies: ""})
 	if len(cfg.TrustedProxies) != 0 {
 		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
 	}
 }
 func TestInvalidValueStopsTheStart(t *testing.T) {
 	t.Parallel()
 	wantStartStopped(t, []struct{ name, value string }{
 		{listenAddr, "8080"}, {listenAddr, ":http"}, {listenAddr, ":65536"},
 		{upstreamURL, "127.0.0.1:8081"},
 		{upstreamURL, "ftp://127.0.0.1:8081"},
 		{upstreamURL, "http://"},
 		{upstreamURL, "http://:8081"},
 		{upstreamURL, "http://127.0.0.1:0"},
 		{upstreamURL, "http://127.0.0.1:99999"},
 		{upstreamURL, "http://127.0.0.1:8081/app"},
 		{upstreamURL, "http://127.0.0.1:8081/?a=1"},
 		{upstreamURL, "http://user:secret@127.0.0.1:8081"},
 		{mode, "Observe"}, {mode, "block"}, {mode, ""},
 		{trustedProxies, "10.0.0.0/33"},
 		{trustedProxies, "traefik"},
 		{trustedProxies, "10.0.0.0/8,,192.168.0.0/16"},
 		{trustedProxies, "fe80::1%eth0"},
 		{ipv6GroupPrefix, "31"}, {ipv6GroupPrefix, "129"}, {ipv6GroupPrefix, "/64"},
 		{ipv6GroupPrefix, off}, {ipv6GroupPrefix, ""},
 		{maxTrackedClients, "0"}, {maxTrackedClients, "-1"}, {maxTrackedClients, off},
@@ -1975,18 +2069,19 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{allowNets, "192.0.2.0/24,monitoring"},
 		{rateLimitExemptNets, "2001:db8::/129"},
 		{denyNets, "198.51.100.0/24,"},
-		{alertCooldown, "60"}, {alertCooldown, ""},
+		{clientRequestTimeout, "60"}, {clientRequestTimeout, ""},
-		{alertCooldown, "0s"},
+		{clientIdleTimeout, "0s"},
-		{alertCooldown, "2 minutes"},
+		{clientIdleTimeout, "2 minutes"},
-		{alertCooldown, "1y"},
+		{clientResponseTimeout, "1y"},
-		{alertCooldown, "-1s"},
+		{upstreamRequestTimeout, "-1s"},
-		{alertCooldown, "1.5d"},
+		{upstreamResponseTimeout, "0s"},
-		{bytesLimitPerMinute, "100MB"},
+		{upstreamResponseTimeout, "1.5d"},
-		{bytesLimitPerMinute, "100m"},
+		{requestMaxBytes, "100MB"},
-		{bytesLimitPerMinute, "1.5M"},
+		{requestMaxBytes, "100m"},
-		{bytesLimitPerHour, "0"},
+		{requestMaxBytes, "1.5M"},
-		{bytesLimitPerHour, "-5"},
+		{responseMaxBytes, "0"},
-		{bytesLimitPerHour, "99999999999G"},
+		{responseMaxBytes, "-5"},
 		{responseMaxBytes, "99999999999G"},
 		{rateLimitPerMinute, ""},
 		{rateLimitPerMinute, "1K"},
 		{rateLimitPerHour, "0"},
@@ -2151,10 +2246,10 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 	t.Parallel()
 	_, err := config.FromEnvironment(environment{
-		bytesLimitPerMinute + "_FILE": writeFile(t, "lots\n"),
+		requestMaxBytes + "_FILE": writeFile(t, "lots\n"),
 	}.lookupEnv)
-	want := bytesLimitPerMinute + `: "lots" is not a size such as 512K, 100M or 5G, or off`
+	want := requestMaxBytes + `: "lots" is not a size such as 512K, 100M or 5G, or off`
 	if err == nil || err.Error() != want {
 		t.Errorf("error %v, want %s", err, want)
 	}
@@ -2259,89 +2354,99 @@ func writeFile(t *testing.T, contents string) string {
 func TestLogsEachSettingWithItsValue(t *testing.T) {
 	t.Parallel()
-	cfg := fromEnvironment(t, environment{rateLimitPerMinute: "45"})
+	cfg := fromEnvironment(t, environment{clientRequestTimeout: "45s"})
 	hostname, _ := os.Hostname()
 	want := map[string]string{
-		listenAddr:           ":8080",
+		listenAddr:              ":8080",
-		mode:                 "enforce",
+		upstreamURL:             "http://127.0.0.1:8081",
-		ipv6GroupPrefix:      "64",
+		mode:                    "enforce",
-		maxTrackedClients:    "20000",
+		trustedProxies:          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
-		allowNets:            "",
+		ipv6GroupPrefix:         "64",
-		rateLimitExemptNets:  "",
+		maxTrackedClients:       "20000",
-		denyNets:             "",
+		clientRequestTimeout:    "45s",
-		rateLimitPerMinute:   "45",
+		clientHeaderMaxBytes:    "32K",
-		rateLimitPerHour:     "20000",
+		clientIdleTimeout:       "120s",
-		rateLimitPerDay:      "300000",
+		clientResponseTimeout:   "30m",
-		rateLimitExemptPaths: "",
+		upstreamRequestTimeout:  "60s",
-		bytesLimitPerMinute:  "4G",
+		upstreamResponseTimeout: "30m",
-		bytesLimitPerHour:    "20G",
+		requestMaxBytes:         "100M",
-		bytesLimitPerDay:     "200G",
+		responseMaxBytes:        "1G",
-		bytesCount:           "both",
+		allowNets:               "",
-		lookupSource:         defaultLookupSource,
+		rateLimitExemptNets:     "",
-		lookupDBPath:         "",
+		denyNets:                "",
-		lookupTimeout:        "800ms",
+		rateLimitPerMinute:      "500",
-		addLookupHeaders:     "false",
+		rateLimitPerHour:        "20000",
-		deniedCountries:      "",
+		rateLimitPerDay:         "300000",
-		allowedCountries:     "",
+		rateLimitExemptPaths:    "",
-		asnLimitPercent:      "",
+		bytesLimitPerMinute:     "4G",
-		countryLimitPercent:  "",
+		bytesLimitPerHour:       "20G",
-		asnBytesPercent:      "",
+		bytesLimitPerDay:        "200G",
-		countryBytesPercent:  "",
+		bytesCount:              "both",
-		unknownLimitPercent:  "100",
+		lookupSource:            defaultLookupSource,
-		asnLimitPercentURL:   "",
+		lookupDBPath:            "",
-		blocklistURLs:        "",
+		lookupTimeout:           "1s",
-		blocklistRefresh:     "24h",
+		addLookupHeaders:        "false",
-		blocklistAction:      actionDeny,
+		deniedCountries:         "",
-		dnsblZones:           "",
+		allowedCountries:        "",
-		dnsblResolver:        "",
+		asnLimitPercent:         "",
-		abuseIPDBKey:         "",
+		countryLimitPercent:     "",
-		abuseIPDBMinScore:    "75",
+		asnBytesPercent:         "",
-		abuseIPDBDailyBudget: "900",
+		countryBytesPercent:     "",
-		reputationAction:     "limit:25",
+		unknownLimitPercent:     "100",
-		reputationCacheTTL:   defaultReputationCacheTTL,
+		asnLimitPercentURL:      "",
-		reputationTimeout:    "2s",
+		blocklistURLs:           "",
-		crowdSecURL:          "",
+		blocklistRefresh:        "24h",
-		crowdSecKey:          "",
+		blocklistAction:         actionDeny,
-		banResponse:          "403",
+		dnsblZones:              "",
-		limitBanDuration:     "1h",
+		dnsblResolver:           "",
-		limitBanRepeatWindow: "24h",
+		abuseIPDBKey:            "",
-		maxBanDuration:       "7d",
+		abuseIPDBMinScore:       "75",
-		attackBanDuration:    "7d",
+		abuseIPDBDailyBudget:    "900",
-		maxBans:              "5000",
+		reputationAction:        "limit:25",
-		banScopeV4Prefix:     "32",
+		reputationCacheTTL:      defaultReputationCacheTTL,
-		stateDir:             "/var/lib/smallwebwaf",
+		reputationTimeout:       "2s",
-		stateWriteDelay:      "10s",
+		crowdSecURL:             "",
-		stateCounterInterval: "15m",
+		crowdSecKey:             "",
-		adminToken:           "",
+		banResponse:             "403",
-		metricsToken:         "",
+		limitBanDuration:        "1h",
-		metricsTopN:          "50",
+		limitBanRepeatWindow:    "24h",
-		instanceName:         hostname,
+		maxBanDuration:          "7d",
-		logRequestHeaders:    defaultLogRequestHeaders,
+		attackBanDuration:       "7d",
-		logLevel:             "info",
+		maxBans:                 "5000",
-		rulesDir:             "/etc/smallwebwaf/rules.d",
+		banScopeV4Prefix:        "32",
-		rulesEnabled:         "true",
+		stateDir:                "/var/lib/smallwebwaf",
-		wafMode:              config.WAFModeBlock,
+		stateWriteDelay:         "10s",
-		wafParanoiaLevel:     "1",
+		stateCounterInterval:    "15m",
-		wafAnomalyThreshold:  "5",
+		adminToken:              "",
-		wafDisabledRules:     defaultWAFDisabledRules,
+		metricsToken:            "",
-		wafExemptPaths:       "",
+		metricsTopN:             "50",
-		wafBodyLimit:         off,
+		instanceName:            hostname,
-		trapPaths:            "",
+		logRequestHeaders:       defaultLogRequestHeaders,
-		errorBurstThreshold:  "30",
+		logLevel:                "info",
-		logRemoteURL:         "",
+		rulesDir:                "/etc/smallwebwaf/rules.d",
-		logRemoteTLSCAFile:   "",
+		rulesEnabled:            "true",
-		logRemoteBuffer:      "10000",
+		wafMode:                 config.WAFModeBlock,
-		logRemoteFacility:    "local0",
+		wafParanoiaLevel:        "1",
-		logRemoteAppName:     hostname,
+		wafAnomalyThreshold:     "5",
-		alertWebhookURL:      "",
+		wafDisabledRules:        defaultWAFDisabledRules,
-		alertWebhookHeaders:  "",
+		wafExemptPaths:          "",
-		alertSlackWebhookURL: "",
+		wafBodyLimit:            off,
-		alertNtfyURL:         "",
+		trapPaths:               "",
-		alertNtfyToken:       "",
+		errorBurstThreshold:     "30",
-		alertEvents:          defaultAlertEvents,
+		logRemoteURL:            "",
-		alertCooldown:        defaultAlertCooldown,
+		logRemoteTLSCAFile:      "",
-		alertMaxPerHour:      "60",
+		logRemoteBuffer:         "10000",
 		logRemoteFacility:       "local0",
 		logRemoteAppName:        hostname,
 		alertWebhookURL:         "",
 		alertWebhookHeaders:     "",
 		alertSlackWebhookURL:    "",
 		alertNtfyURL:            "",
 		alertNtfyToken:          "",
 		alertEvents:             defaultAlertEvents,
 		alertCooldown:           defaultAlertCooldown,
 		alertMaxPerHour:         "60",
 	}
 	maps.Copy(want, loggedAnomalyDefaults())
@@ -2376,6 +2481,14 @@ func wantSettings(t *testing.T, got *config.Config, want config.Config) {
 	if got.ListenAddr != want.ListenAddr ||
 		got.Observe != want.Observe ||
 		got.ClientRequestTimeout != want.ClientRequestTimeout ||
 		got.ClientRequestHeaderMaxBytes != want.ClientRequestHeaderMaxBytes ||
 		got.ClientIdleTimeout != want.ClientIdleTimeout ||
 		got.ClientResponseTimeout != want.ClientResponseTimeout ||
 		got.UpstreamRequestTimeout != want.UpstreamRequestTimeout ||
 		got.UpstreamResponseTimeout != want.UpstreamResponseTimeout ||
 		got.RequestMaxBytes != want.RequestMaxBytes ||
 		got.ResponseMaxBytes != want.ResponseMaxBytes ||
 		got.RateLimitPerMinute != want.RateLimitPerMinute ||
 		got.RateLimitPerHour != want.RateLimitPerHour ||
 		got.RateLimitPerDay != want.RateLimitPerDay {
@@ -27,9 +27,8 @@ type RProxy struct {
 	// Timeout is how long rproxy waits for servewaf's answer to a question,
 	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
-	// DefaultDisposition is what is done with a request when servewaf cannot be
+	// DefaultDisposition is what is done with a request servewaf gives no
-	// connected to, does not answer at all, or does not answer within Timeout:
+	// answer about, allow or deny (SWRP_DEFAULT_DISPOSITION).
 	// allow or deny (SWRP_DEFAULT_DISPOSITION).
 	DefaultDisposition string
 	// MaxRequestSize is the largest request body (SWRP_MAX_REQUEST_SIZE), and
 	// MaxResponseSize the largest response body (SWRP_MAX_RESPONSE_SIZE).
@@ -64,9 +63,15 @@ var (
 // invalid is an error that names it. Since rproxy never touches disk, its
 // settings have no _FILE form.
 func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
-	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	env := &environment{lookupEnv: func(name string) (string, bool) {
 		if strings.HasSuffix(name, "_FILE") {
 			return "", false
 		}
 		return lookupEnv(name)
 	}}
 	cfg := &RProxy{
-		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
+		ListenAddr:         env.address("SWRP_LISTEN_ADDR", defaultListenAddr),
 		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
 		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
 		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
@@ -87,37 +92,6 @@ func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, erro
 	return cfg, nil
 }
 // RProxyListenAddrAndUpstreamURL reads only SWRP_LISTEN_ADDR and
 // SWRP_UPSTREAM_URL. The health check in rproxy's container needs no other
 // setting, so it reads no other.
 func RProxyListenAddrAndUpstreamURL(
 	lookupEnv func(string) (string, bool),
 ) (string, *url.URL, error) {
 	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
 	listenAddr := env.address("SWRP_LISTEN_ADDR")
 	upstreamURL := env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL)
 	if env.err != nil {
 		return "", nil, env.err
 	}
 	return listenAddr, upstreamURL, nil
 }
 // withoutFileForms returns lookupEnv finding no setting named with _FILE, since
 // rproxy never touches disk.
 func withoutFileForms(
 	lookupEnv func(string) (string, bool),
 ) func(string) (string, bool) {
 	return func(name string) (string, bool) {
 		if strings.HasSuffix(name, "_FILE") {
 			return "", false
 		}
 		return lookupEnv(name)
 	}
 }
 // LogValue makes an RProxy log as each setting's name with the value it was
 // given, or its default.
 func (c *RProxy) LogValue() slog.Value {
@@ -139,9 +113,8 @@ func (e *environment) wafBackend(name string) *url.URL {
 	return backend
 }
-// disposition reads the setting that is what is done with a request when servewaf
+// disposition reads the setting that is what is done with a request servewaf
-// cannot be connected to, does not answer at all, or does not answer in time:
+// gives no answer about: allow or deny.
 // allow or deny.
 func (e *environment) disposition(name, defaultValue string) string {
 	value := e.value(name, defaultValue)
 	if value != "allow" && value != "deny" {
@@ -125,19 +125,7 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		{rproxyDefault, "maybe"},
 		{rproxyListen, "8080"},
 		{rproxyUpstream, "app"},
 		{rproxyUpstream, "127.0.0.1:8081"},
 		{rproxyUpstream, "ftp://127.0.0.1:8081"},
 		{rproxyUpstream, "http://"},
 		{rproxyUpstream, "http://:8081"},
 		{rproxyUpstream, "http://127.0.0.1:0"},
 		{rproxyUpstream, "http://127.0.0.1:99999"},
 		{rproxyUpstream, "http://127.0.0.1:8081/app"},
 		{rproxyUpstream, "http://127.0.0.1:8081/?a=1"},
 		{rproxyUpstream, "http://user:secret@127.0.0.1:8081"},
 		{rproxyTrusted, "not a netblock"},
 		{rproxyTrusted, "10.0.0.0/33"},
 		{rproxyTrusted, "10.0.0.0/8,,192.168.0.0/16"},
 		{rproxyTrusted, "fe80::1%eth0"},
 		{rproxyMaxRequest, notASize},
 		{rproxyMaxResponse, notASize},
 		{rproxyRequestTime, "0"},
@@ -155,19 +143,6 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 	}
 }
 func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
 	t.Parallel()
 	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}
 	if len(cfg.TrustedProxies) != 0 {
 		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
 	}
 }
 func TestRProxyNeedsItsBackend(t *testing.T) {
 	t.Parallel()
@@ -179,7 +179,7 @@ func New(params Params) *GeoJS {
 // own address for IPv4, and an address in the same place for an IPv6
 // netblock.
 func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
-	answer, asked := g.answerOrWait(ctx, client, g.wait)
+	answer, asked := g.answerOrWait(ctx, client)
 	if asked == nil {
 		return answer
 	}
@@ -209,14 +209,6 @@ func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
 	return answer
 }
 // LookUpWithoutWaiting is LookUp for a request that does not need the answer,
 // whatever Wait says: it returns the zero Answer at once when none is kept.
 func (g *GeoJS) LookUpWithoutWaiting(ctx context.Context, client netip.Prefix) Answer {
 	answer, _ := g.answerOrWait(ctx, client, false)
 	return answer
 }
 // Kept returns client's answer, if one is kept, without asking GeoJS.
 func (g *GeoJS) Kept(client netip.Prefix) (Answer, bool) {
 	g.mu.Lock()
@@ -271,9 +263,9 @@ func (g *GeoJS) Load(answers []Answer) {
 // answerOrWait returns client's kept answer if it has one. Otherwise it
 // puts the client among those waiting if there is room, has GeoJS asked
 // about them if it can be, and returns what to wait on for the answer, or
-// nil when there is nothing to wait for or mustWait is false.
+// nil when there is nothing to wait for.
 func (g *GeoJS) answerOrWait(
-	ctx context.Context, client netip.Prefix, mustWait bool,
+	ctx context.Context, client netip.Prefix,
 ) (Answer, <-chan struct{}) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
@@ -291,7 +283,7 @@ func (g *GeoJS) answerOrWait(
 	g.ask(ctx)
-	if !mustWait {
+	if !g.wait {
 		return Answer{}, nil // the answer is not needed before the request goes on
 	}
@@ -72,39 +72,6 @@ func TestKeptAnswerIsUsedFor7DaysThenAskedAgain(t *testing.T) {
 	})
 }
 func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
 	t.Parallel()
 	synctest.Test(t, func(t *testing.T) {
 		geojs, clock, g := start()
 		client := netip.MustParsePrefix("203.0.113.9/32")
 		// Wait is set, and GeoJS does not answer.
 		geojs.set(hanging)
 		began := time.Now()
 		answer := g.LookUpWithoutWaiting(t.Context(), client)
 		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
 			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
 		}
 		waitForRequests(t, geojs, 1)
 		wantAsked(t, geojs, 0, "203.0.113.9")
 		// That request is abandoned, and has failed once this returns. GeoJS
 		// answers when it is asked again, and the answer is kept.
 		time.Sleep(timeout)
 		synctest.Wait()
 		geojs.set(answering)
 		waitForCountry(t, g, clock, client, germany)
 		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
 			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
 		}
 	})
 }
 func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	t.Parallel()
@@ -156,8 +123,8 @@ func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing
 	t.Parallel()
 	synctest.Test(t, func(t *testing.T) {
-		// A timeout longer than the default, and a GeoJS that does not
+		// A timeout longer than the default second, and a GeoJS that does
-		// answer.
+		// not answer.
 		const longerTimeout = 3 * time.Second
 		m := metrics.New(1, "app")
@@ -28,15 +28,16 @@ type Metrics struct {
 	registry prometheus.Registerer
 	handler  http.Handler
-	inFlight         prometheus.Gauge
+	inFlight             prometheus.Gauge
-	requests         *prometheus.CounterVec
+	requests             *prometheus.CounterVec
-	requestBytes     *prometheus.CounterVec
+	requestBytes         *prometheus.CounterVec
-	responseBytes    *prometheus.CounterVec
+	responseBytes        *prometheus.CounterVec
-	requestDuration  prometheus.Histogram
+	requestDuration      prometheus.Histogram
-	upstreamDuration prometheus.Histogram
+	upstreamDuration     prometheus.Histogram
-	rateLimitHits    *prometheus.CounterVec
+	rateLimitHits        *prometheus.CounterVec
-	offences         *prometheus.CounterVec
+	sizeAndTimeLimitHits *prometheus.CounterVec
-	wafMatches       *prometheus.CounterVec
+	offences             *prometheus.CounterVec
 	wafMatches           *prometheus.CounterVec
 	// ruleMatches are made by AddRules, and reputationHits by
 	// AddReputation.
 	ruleMatches    *prometheus.CounterVec
@@ -99,6 +100,9 @@ func New(topN int, instanceName string) *Metrics {
 			"Requests that broke a rate limit, a byte limit or the error burst, by "+
 				"its window and its kind, requests, bytes or refusals.",
 			[]string{"window", "kind"}),
 		sizeAndTimeLimitHits: counterVec("smallwebwaf_size_and_time_limit_hits_total",
 			"Requests that passed a size or time limit, by its setting.",
 			[]string{"limit"}),
 		offences: counterVec("smallwebwaf_offences_total",
 			"Offences, by kind.", []string{"kind"}),
 		wafMatches: counterVec("smallwebwaf_waf_matches_total",
@@ -139,7 +143,7 @@ func New(topN int, instanceName string) *Metrics {
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
 		m.inFlight, m.requests, m.requestBytes, m.responseBytes,
 		m.requestDuration, m.upstreamDuration,
-		m.rateLimitHits, m.offences, m.wafMatches,
+		m.rateLimitHits, m.sizeAndTimeLimitHits, m.offences, m.wafMatches,
 		m.countries, m.asns,
 		m.GeoJSRequests, m.GeoJSFailures, m.GeoJSUnanswered,
 		m.stateFileWrites, m.stateFileWriteFailures,
@@ -391,11 +395,15 @@ func (m *Metrics) RequestStarted() {
 	m.inFlight.Inc()
 }
-// RequestEnded counts a request that has ended without being passed to the app,
+// RequestEnded counts a request that has ended, from its log line. limit
-// from its log line. duration is how long the request took.
+// is the setting whose size or time limit the request passed, "" if none.
-func (m *Metrics) RequestEnded(line *requestlog.Line, duration time.Duration) {
+// duration is how long the request took, and upstreamDuration how long it
 // took from when it was passed to the app, zero if it was not.
 func (m *Metrics) RequestEnded(
 	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
 ) {
 	m.inFlight.Dec()
-	m.count(line, duration, 0)
+	m.count(line, limit, duration, upstreamDuration)
 }
 // RequestAllowed counts a question of rproxy's, answered allow, as no longer
@@ -404,13 +412,12 @@ func (m *Metrics) RequestAllowed() {
 	m.inFlight.Dec()
 }
-// RequestReported counts a request rproxy passed to the app, from what its
+// RequestReported counts a request rproxy passed to the app, as RequestEnded
-// report says, which line holds: duration is how long the request took, and
+// does, from what its report says, which line holds.
 // upstreamDuration how long it took from when it was passed to the app.
 func (m *Metrics) RequestReported(
 	line *requestlog.Line, duration, upstreamDuration time.Duration,
 ) {
-	m.count(line, duration, upstreamDuration)
+	m.count(line, "", duration, upstreamDuration)
 }
 // LimitHit counts a request that broke a rate limit, a byte limit or the
@@ -424,10 +431,11 @@ func (m *Metrics) LimitHit(hit ratelimit.Hit) {
 // them.
 func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
-		"limit":        r.BrokeLimit,
+		"limit":         r.BrokeLimit,
-		"attack":       r.Attack,
+		"attack":        r.Attack,
-		"rule_blocked": r.RuleBlocked,
+		"rule_blocked":  r.RuleBlocked,
-		"waf_blocked":  r.WAFBlocked,
+		"waf_blocked":   r.WAFBlocked,
 		"token_refused": r.TokenRefused,
 	} {
 		if committed {
 			m.offences.WithLabelValues(kind).Inc()
@@ -478,10 +486,9 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
-// count counts a request that has ended, as RequestEnded and RequestReported
+// count counts a request that has ended, as RequestEnded describes.
 // describe.
 func (m *Metrics) count(
-	line *requestlog.Line, duration, upstreamDuration time.Duration,
+	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
 ) {
 	class := statusClass(line.Status)
 	m.requests.WithLabelValues(class, line.Action).Inc()
@@ -493,6 +500,10 @@ func (m *Metrics) count(
 		m.upstreamDuration.Observe(upstreamDuration.Seconds())
 	}
 	if limit != "" {
 		m.sizeAndTimeLimitHits.WithLabelValues(limit).Inc()
 	}
 	if line.Country != "" {
 		m.countries.add(line.Country, line)
 	}
@@ -9,6 +9,7 @@ import (
 	"io"
 	"net/http"
 	"net/netip"
 	"os"
 	"strings"
 	"time"
@@ -49,13 +50,16 @@ func (rq *request) answerHealth() {
 	_, _ = io.WriteString(rq.out, "ok\n")
 }
-// answerAdmin answers a request for one of servewaf's own endpoints. Each
+// answerAdmin answers a request for smallwebwaf itself, under
-// needs a token, sent as Authorization: Bearer <token>: the metrics
+// /_smallwebwaf/, once it has passed the checks. Each endpoint needs a
-// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without it is
+// token, sent as Authorization: Bearer <token>: the metrics
-// refused with 401. An endpoint whose token is unset answers 404, as any other
+// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without
-// path does.
+// it is refused with 401, which counts toward the error burst. An
 // endpoint whose token is unset answers 404, as any other request under
 // /_smallwebwaf/ does.
 func (rq *request) answerAdmin() {
 	rq.line.Action = requestlog.ActionAdmin
 	rq.startClientResponseTimeout()
 	token, answer := rq.endpoint()
@@ -63,8 +67,12 @@ func (rq *request) answerAdmin() {
 	case token == "":
 		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 	case !hasToken(rq.in, token):
 		rq.tokenRefused = true
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
-		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		rq.answer(refusal{
 			status: http.StatusUnauthorized,
 			action: requestlog.ActionAdmin,
 		})
 	default:
 		answer()
 	}
@@ -121,7 +129,26 @@ type banToAdd struct {
 // an admin, from now for the duration the body gives, with its reason,
 // and answers with that ban.
 func (rq *request) addBan() {
 	// The body must arrive within SWWAF_CLIENT_REQUEST_TIMEOUT, as any
 	// other request's must.
 	rq.stopReadingBody(rq.clientRequestDeadline())
 	toAdd, err := rq.readBanToAdd()
 	if refused := rq.refused.Load(); refused != nil {
 		rq.answer(*refused) // the body is over SWWAF_REQUEST_MAX_BYTES
 		return
 	}
 	if errors.Is(err, os.ErrDeadlineExceeded) {
 		rq.answer(refusal{
 			status: http.StatusRequestTimeout,
 			action: requestlog.ActionTimedOut,
 			limit:  "SWWAF_CLIENT_REQUEST_TIMEOUT",
 		})
 		return
 	}
 	var (
 		netblock netip.Prefix
@@ -150,9 +177,12 @@ func (rq *request) addBan() {
 // readBanToAdd reads the body of POST BansPath: a JSON object with
 // nothing but whitespace after it, in at most banBodyMaxBytes.
 func (rq *request) readBanToAdd() (banToAdd, error) {
-	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	var body io.ReadCloser = http.NoBody
-	rq.requestBytes = int64(len(data))
+	if rq.body != nil {
 		body = rq.body
 	}
 	data, err := io.ReadAll(http.MaxBytesReader(nil, body, banBodyMaxBytes))
 	if err != nil {
 		return banToAdd{}, fmt.Errorf("%w: %w", errNotBanToAdd, err)
 	}
@@ -250,9 +280,9 @@ type clientAnswer struct {
 	Bans   []state.BanEntry  `json:"bans"`
 }
-// showClient answers GET ClientsPath<ip> with what servewaf knows of the client:
+// showClient answers GET ClientsPath<ip> with what smallwebwaf knows of
-// its counters, its history, which holds its country as last looked up and its
+// the client: its counters, its history, which holds its country as last
-// offences, and its bans with their notes.
+// looked up and its offences, and its bans with their notes.
 func (rq *request) showClient() {
 	addr, err := pathAddress(rq.in.URL.Path, ClientsPath)
 	if err != nil {
@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/netip"
 	"reflect"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -22,6 +23,8 @@ const (
 	// how a request carries it.
 	adminSecret = "fedcba9876543210fedcba9876543210"
 	adminBearer = "Bearer " + adminSecret
 	// adminClient is the client the tests' admin sends its requests from.
 	adminClient = "192.0.2.10"
 	// banOtherClient is the body of a request to ban otherClient for an
 	// hour.
 	banOtherClient = `{"netblock": "` + otherClient + `", "duration": "1h", ` +
@@ -40,7 +43,8 @@ func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
 		for _, e := range adminEndpoints() {
-			s.adminRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
+			s.adminRequest(adminClient, authorization, e.method, e.path, e.body,
 				http.StatusNotFound, requestlog.ActionAdmin)
 		}
 	}
@@ -67,8 +71,8 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		for _, authorization := range []string{
 			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
 		} {
-			got := s.adminRequest(authorization, e.method, e.path, e.body,
+			got := s.adminRequest(adminClient, authorization, e.method, e.path, e.body,
-				http.StatusUnauthorized)
+				http.StatusUnauthorized, requestlog.ActionAdmin)
 			if got.header.Get("WWW-Authenticate") != "Bearer" {
 				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
 					e.method, e.path, authorization)
@@ -261,12 +265,64 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 	}
 }
 func TestBanToAddOverTheRequestSizeLimitIsRefused(t *testing.T) {
 	t.Parallel()
 	s, _, server := startWithClock(t, "", map[string]string{
 		adminToken:      adminSecret,
 		requestMaxBytes: "16",
 	})
 	// Sent in a chunk, its length is not announced, so that it is found
 	// over SWWAF_REQUEST_MAX_BYTES only as it is read.
 	chunk := `{"netblock": "203.0.113.9", "duration": "1h"}`
 	s.adminRequest(adminClient, adminBearer+"\r\nTransfer-Encoding: chunked",
 		http.MethodPost, proxy.BansPath,
 		strconv.FormatInt(int64(len(chunk)), 16)+"\r\n"+chunk+"\r\n0\r\n\r\n",
 		http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
 		t.Errorf("the ledger holds %+v, want no ban", held)
 	}
 }
 func TestBanToAddSlowerThanTheClientRequestTimeoutIsRefused(t *testing.T) {
 	t.Parallel()
 	s, _, server := startWithClock(t, "", map[string]string{
 		adminToken:           adminSecret,
 		metricsToken:         token,
 		clientRequestTimeout: shortTimeoutSetting,
 	})
 	// The chunk announces 256 bytes and the rest of it never comes, so only
 	// the timeout ends the wait. A hold-up of the test process can only
 	// make the answer later, so the time is checked only for not being
 	// shorter than the timeout.
 	start := time.Now()
 	s.adminRequest(adminClient, adminBearer+"\r\nTransfer-Encoding: chunked",
 		http.MethodPost, proxy.BansPath, "100\r\n"+`{"netblock": "203.0.113.9", `,
 		http.StatusRequestTimeout, requestlog.ActionTimedOut)
 	if took := time.Since(start); took < shortTimeout {
 		t.Errorf("answered after %s, before the timeout of %s ran out", took, shortTimeout)
 	}
 	wantLimitHits(t, s.addr, clientRequestTimeout, 1)
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
 		t.Errorf("the ledger holds %+v, want no ban", held)
 	}
 }
 func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	t.Parallel()
 	s, clk, _ := startWithClock(t, "", map[string]string{
-		adminToken:         adminSecret,
+		adminToken:          adminSecret,
-		rateLimitPerMinute: "2",
+		rateLimitPerMinute:  "2",
 		rateLimitExemptNets: adminClient,
 	})
 	start := clk.Now()
@@ -315,6 +371,61 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 		http.StatusBadRequest)
 }
 func TestBannedClientIsRefusedAtTheEndpointsEvenWithTheToken(t *testing.T) {
 	t.Parallel()
 	s, _, _ := startWithClock(t, "", map[string]string{adminToken: adminSecret})
 	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
 	// otherClient cannot lift its own ban either.
 	for _, e := range adminEndpoints() {
 		s.adminRequest(otherClient, adminBearer, e.method, e.path, e.body,
 			http.StatusForbidden, requestlog.ActionBanned)
 	}
 }
 func TestAdminRequestsCountTowardTheLimits(t *testing.T) {
 	t.Parallel()
 	s, _, _ := startWithClock(t, "", map[string]string{
 		adminToken:         adminSecret,
 		rateLimitPerMinute: "2",
 	})
 	// A request refused for a missing token and one answered count toward
 	// the limit of two a minute, so the next breaks it.
 	s.adminRequest(client, "", http.MethodGet, proxy.BansPath, "",
 		http.StatusUnauthorized, requestlog.ActionAdmin)
 	s.adminRequest(client, adminBearer, http.MethodGet, proxy.BansPath, "",
 		http.StatusOK, requestlog.ActionAdmin)
 	s.adminRequest(client, adminBearer, http.MethodGet, proxy.BansPath, "",
 		http.StatusForbidden, requestlog.ActionRateLimited)
 }
 func TestClientInAllowNetsSkipsTheChecksButNeedsTheToken(t *testing.T) {
 	t.Parallel()
 	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
 	s, clk, server := startWithClock(t, "", map[string]string{
 		adminToken:         adminSecret,
 		allowNets:          allowed,
 		rateLimitPerMinute: "1",
 	})
 	// A ban on it refuses nothing, and its requests are not counted.
 	server.Ledger.BanForAdmin(netip.MustParsePrefix(allowed+"/32"), clk.Now(),
 		time.Time{}, "")
 	for range 2 {
 		s.adminRequest(allowed, "", http.MethodGet, proxy.BansPath, "",
 			http.StatusUnauthorized, requestlog.ActionAdmin)
 		s.adminRequest(allowed, adminBearer, http.MethodGet, proxy.BansPath, "",
 			http.StatusOK, requestlog.ActionAdmin)
 	}
 }
 func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	t.Parallel()
@@ -324,7 +435,8 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	})
 	for _, e := range adminEndpoints() {
-		s.adminRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
+		s.adminRequest(adminClient, "", e.method, e.path, e.body,
 			http.StatusUnauthorized, requestlog.ActionAdmin)
 	}
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
@@ -349,33 +461,39 @@ func adminEndpoints() []adminEndpoint {
 	}
 }
-// admin sends a request with method for path, with body, to servewaf's own
+// admin sends a request with method for path, with body, from
-// address, with the admin token, and checks that it is answered with status, its
+// adminClient, with the admin token, and checks that it is answered with
-// log line's action admin. It returns the answer.
+// status, its log line's action admin. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
 	s.t.Helper()
-	return s.adminRequest(adminBearer, method, path, body, status)
+	return s.adminRequest(adminClient, adminBearer, method, path, body, status,
 		requestlog.ActionAdmin)
 }
-// adminRequest is admin with authorization as the request's Authorization header
+// adminRequest sends a request with method for path, with body, from the
-// unless it is "".
+// client at from, with authorization as its Authorization header unless
 // it is "", and checks its answer's status and its log line's action, as
 // request does. authorization may end in more header lines. A body that
 // is not "" has its length announced, unless authorization names
 // Transfer-Encoding. It returns the answer.
 func (s *sender) adminRequest(
-	authorization, method, path, body string, status int,
+	from, authorization, method, path, body string, status int, action string,
 ) answer {
 	s.t.Helper()
-	req := newRequest(s.t, method, s.serveWAFAddr, path, strings.NewReader(body))
+	var header []string
 	if authorization != "" {
-		req.Header.Set("Authorization", authorization)
+		header = append(header, "Authorization: "+authorization)
 	}
-	got := do(s.t, req)
+	if body != "" && !strings.Contains(authorization, "Transfer-Encoding") {
-	wantStatus(s.t, got, status)
+		header = append(header, "Content-Length: "+strconv.Itoa(len(body)))
 	}
-	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	_, got := s.requestWithBody(method, from, path, strings.Join(header, "\r\n"),
-	s.sent++
+		body, status, action)
 	wantLine(s.t, line, status, requestlog.ActionAdmin)
 	return got
 }
@@ -224,9 +224,7 @@ func startAppWithAlerts(
 	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
-	s := &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}
+	return &sender{t: t, addr: addr, out: out}, clk, server, queue
 	return s, clk, server, queue
 }
 // banAlert returns the alert for event, raised by a request from client at
@@ -239,7 +237,6 @@ func banAlert(
 		Instance: alertInstance,
 		Time:     raised,
 		Event:    event,
 		Host:     appHost,
 		Client:   netip.MustParseAddr(client),
 		Netblock: ban.Netblock,
 		Reason:   ban.Reason,
@@ -117,7 +117,6 @@ func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
 					Instance: alertInstance,
 					Time:     start,
 					Event:    alerts.EventAnomaly,
 					Host:     appHost,
 					Client:   netip.MustParseAddr(client),
 					Netblock: scope.netblock,
 					ASN:      asnDE,
@@ -1,564 +0,0 @@
 package proxy_test
 import (
 	"fmt"
 	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
 	"slices"
 	"strconv"
 	"strings"
 	"testing"
 	"testing/synctest"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 const (
 	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
 	// servewaf has to answer.
 	answerTimeLimit = 2 * time.Second
 	// defaultLookupWait is the default of SWWAF_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
 	headerFieldLimit = 100
 	// cookieHeader is the header the cookie limit counts.
 	cookieHeader = "Cookie"
 	// tooLarge is how servewaf refuses a request over the header limits.
 	tooLarge = http.StatusRequestHeaderFieldsTooLarge
 	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
 	// that unansweredGeoJSURL names too.
 	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
 	// wholeLimit is the percentage of a rate limit that lowers it not at all.
 	wholeLimit = 100
 	// clientsDecision is the CrowdSec decision list holding client alone.
 	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
 		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
 )
 // cookies returns a Cookie header's value with count cookies.
 func cookies(count int) string {
 	parts := make([]string, 0, count)
 	for i := range count {
 		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
 	}
 	return strings.Join(parts, "; ")
 }
 // fillHeaders adds headers to a question until the checks see total header
 // fields: all but ClientHeader and PeerHeader, which servewaf removes. Go's
 // client sends nothing else but Host, which the limit does not count, once
 // User-Agent is set.
 func fillHeaders(req *http.Request, total int) {
 	req.Header.Set("User-Agent", "test")
 	for i := len(req.Header) - 2; i < total; i++ {
 		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
 	}
 }
 func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 	began := time.Now()
 	got := do(t, req)
 	if took := time.Since(began); took >= answerTimeLimit/2 {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 	wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 	if line.DurationWAF != nil {
 		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
 	}
 }
 func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 	t.Parallel()
 	repeated := make([]string, headerFieldLimit)
 	for i := range repeated {
 		repeated[i] = "1"
 	}
 	for _, tc := range []struct {
 		name string
 		make func(*http.Request)
 		// refused is true for a request over a limit, and false for one at it.
 		refused bool
 	}{
 		{"cookies at the limit", func(req *http.Request) {
 			req.Header.Set(cookieHeader, cookies(cookieLimit))
 		}, false},
 		{"cookies over the limit", func(req *http.Request) {
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 		}, true},
 		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
 			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
 		}, false},
 		{"parts of no-break spaces count", func(req *http.Request) {
 			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
 		}, true},
 		{"cookies over the limit across two headers", func(req *http.Request) {
 			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
 		}, true},
 		{"cookies without a value count", func(req *http.Request) {
 			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
 		}, true},
 		{"header fields at the limit", func(req *http.Request) {
 			fillHeaders(req, headerFieldLimit)
 		}, false},
 		{"header fields over the limit", func(req *http.Request) {
 			fillHeaders(req, headerFieldLimit+1)
 		}, true},
 		{"a header sent many times counts each time", func(req *http.Request) {
 			req.Header["X-Filler"] = repeated
 		}, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			s := startServeWAF(t, "", map[string]string{wafMode: block})
 			req := s.question(siteA, client, "/")
 			tc.make(req)
 			got := do(t, req)
 			line := s.out.requestLine(t)
 			if tc.refused {
 				wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
 				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 				return
 			}
 			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 			if line.DurationWAF == nil {
 				t.Error("the Core Rule Set did not read a request within the limits")
 			}
 		})
 	}
 }
 func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 	t.Parallel()
 	for _, env := range []map[string]string{
 		{wafMode: off},
 		{wafMode: "detect"},
 		{wafMode: block, "SWWAF_WAF_EXEMPT_PATHS": "/"},
 	} {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
 			s := startServeWAF(t, "", env)
 			req := s.question(siteA, client, "/")
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 			wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 		})
 	}
 }
 func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{wafMode: block, allowNets: client})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 }
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{mode: observe, wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 	began := time.Now()
 	got := do(t, req)
 	if took := time.Since(began); took >= answerTimeLimit/2 {
 		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
 	}
 	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
 		t.Errorf("would_action %q and duration_waf %v, want %q and none",
 			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
 	}
 }
 func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
 	ask := func() answer {
 		req := s.question(siteA, client, "/")
 		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 		return do(t, req)
 	}
 	wantDisposition(t, ask(), tooLarge, proxy.DispositionDeny)
 	wantDisposition(t, ask(), http.StatusForbidden, proxy.DispositionDeny)
 	lines := s.out.requestLines(t, 2)
 	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
 }
 func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, path, action string
 	}{
 		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
 		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			s := startServeWAF(t, "", map[string]string{
 				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
 			})
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 			wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
 		})
 	}
 }
 func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	t.Parallel()
 	geojsURL, _ := startGeoJS(t)
 	s := startServeWAF(t, geojsURL, map[string]string{
 		unknownLimitPercent: "0", lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 	if line.LimitPercent != nil {
 		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
 	}
 	// The client is under no ban, and GeoJS places it in a country.
 	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, proxy.DispositionAllow)
 }
 func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
 	t.Parallel()
 	geojsURL, _ := startGeoJS(t)
 	s := startServeWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
 	s.server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
 		Answered: s.clock.Now(), Used: s.clock.Now(),
 	}})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
 }
 func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 	geojsURL, _ := startGeoJS(t)
 	s := startServeWAF(t, geojsURL, map[string]string{
 		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 	got := do(t, req)
 	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 	if asn != asnDE || country != "DE" {
 		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
 			asn, country, asnDE)
 	}
 }
 // newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
 // answers, a setting needs its answer, and everything is at its default but
 // for env. No request to it may use the network.
 func newServeWAFInBubble(t *testing.T, env map[string]string) (*proxy.Server, *output) {
 	t.Helper()
 	settings := map[string]string{deniedCountries: "KP"}
 	maps.Copy(settings, env)
 	server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now, settings)
 	return server, out
 }
 // askDirectly hands a question about a request from client straight to server,
 // as change leaves it, and returns the answer's status and how long it took.
 func askDirectly(
 	t *testing.T, server *proxy.Server, change func(*http.Request),
 ) (int, time.Duration) {
 	t.Helper()
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
 	req.Header.Set(proxy.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
 	change(req)
 	recorder := httptest.NewRecorder()
 	began := time.Now()
 	server.Handler.ServeHTTP(recorder, req)
 	return recorder.Code, time.Since(began)
 }
 // banClient bans client at now.
 func banClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
 }
 // countClient counts one request from client at now for the rate limits.
 func countClient(_ *testing.T, server *proxy.Server, now time.Time) {
 	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
 }
 // listClient puts client on the blocklist at dropURL.
 func listClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 	err := server.Lists.Load([]reputation.List{{
 		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
 	}})
 	if err != nil {
 		t.Fatalf("load the blocklist: %v", err)
 	}
 }
 // decideOnClient puts client on the CrowdSec decision list.
 func decideOnClient(t *testing.T, server *proxy.Server, now time.Time) {
 	t.Helper()
 	loadDecisions(t, server, now, clientsDecision)
 }
 // leaveAsItIs prepares nothing.
 func leaveAsItIs(*testing.T, *proxy.Server, time.Time) {}
 func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	t.Parallel()
 	const forbidden = http.StatusForbidden
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
 		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		// cookie is the request's Cookie header.
 		cookie string
 		status int
 		action string
 	}{
 		{
 			name: "SWWAF_DENY_NETS", env: map[string]string{denyNets: client},
 			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{
 			name:    "a ban",
 			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
 		},
 		{
 			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
 			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
 		},
 		{
 			name:    "the rate limits, with a biased threshold",
 			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
 			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
 		},
 		{
 			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
 			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{
 			name:    "the CrowdSec decision list",
 			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
 			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
 		},
 		{
 			name: "the header limits", cookie: cookies(cookieLimit + 1),
 			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, so that a request that does not wait takes no time at all.
 			synctest.Test(t, func(t *testing.T) {
 				server, out := newServeWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 				status, took := askDirectly(t, server, func(req *http.Request) {
 					req.Header.Set(cookieHeader, tc.cookie)
 				})
 				if status != tc.status || took != 0 {
 					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
 						status, took, tc.status, out.text())
 				}
 				wantLine(t, out.requestLine(t), tc.status, tc.action)
 				// GeoJS's request is abandoned before the bubble ends.
 				time.Sleep(defaultLookupWait)
 			})
 		})
 	}
 }
 func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
 		prepare func(t *testing.T, server *proxy.Server, now time.Time)
 		status  int
 		action  string
 	}{
 		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
 		{
 			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
 			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
 		},
 		{
 			"a blocklist that only logs",
 			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
 			listClient, http.StatusOK, requestlog.ActionForward,
 		},
 		{
 			"a blocklist that only limits",
 			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
 			listClient, http.StatusOK, requestlog.ActionForward,
 		},
 		{
 			"over a rate limit on an exempt path",
 			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
 			countClient, http.StatusOK, requestlog.ActionForward,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			synctest.Test(t, func(t *testing.T) {
 				server, out := newServeWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 				status, took := askDirectly(t, server, func(*http.Request) {})
 				if status != tc.status || took != defaultLookupWait {
 					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
 						status, took, tc.status, defaultLookupWait, out.text())
 				}
 				wantLine(t, out.requestLine(t), tc.status, tc.action)
 			})
 		})
 	}
 }
 func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testing.T) {
 	t.Parallel()
 	held, askedGeoJS, _ := startHeldGeoJS(t)
 	// A resolver that takes every query and answers none.
 	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	t.Cleanup(func() { _ = resolver.Close() })
 	server, out, _ := newServeWAFWith(t, func(params proxy.Params) *proxy.Server {
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 		return proxy.NewServeWAF(params)
 	}, held, time.Now, map[string]string{
 		deniedCountries: "KP", wafMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
 		abuseIPDBKey:  accountKey,
 		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
 		crowdSecURL: held, crowdSecKey: bouncerKey,
 	})
 	// AbuseIPDB is asked only about a client with an offence.
 	group := netip.MustParsePrefix(client + "/32")
 	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
 	go server.Lists.Run(t.Context())
 	status, took := askDirectly(t, server, func(req *http.Request) {
 		req.Header.Set("User-Agent", "test")
 		req.Header.Set("Accept", "*/*")
 		req.Host = siteA
 	})
 	if status != http.StatusOK || took >= answerTimeLimit {
 		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
 			status, took, http.StatusOK, answerTimeLimit, out.text())
 	}
 	// Each outside source was asked, and none has answered. The stand-in for
 	// GeoJS is the lists' too, which name no address.
 	if !slices.Contains(askedGeoJS(), client) {
 		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
 	}
 	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
 		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
 	}
 	if checked := server.AbuseIPDB.Checked(); checked != 1 {
 		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
 	}
 }
@@ -58,12 +58,13 @@ func (rq *request) limitBroken(now time.Time) bool {
 }
 // countBytes counts the request's bytes, as countedBytes gives them, for
-// the byte limits, once its report has come, and notes the client's byte totals
+// the byte limits, once its response has ended, and notes the client's
-// for the log line; its requests stay there as the rate limits counted them.
+// byte totals for the log line; its requests stay there as the rate limits
-// Only an allowed request has them counted, and only one the rate limits
+// counted them. Only a request passed to the app has them counted, and
-// counted; in observe mode, not one that enforce mode would have refused. Bytes
+// only one the rate limits counted; in observe mode, not one that enforce
-// that take the client over a byte limit, as its limit percentage for the byte
+// mode would have refused. Bytes that take the client over a byte limit,
-// limits lowers it, break it; the response was passed on whole.
+// as its limit percentage for the byte limits lowers it, break it; the
 // response was passed on whole.
 func (rq *request) countBytes() {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return
@@ -83,8 +84,9 @@ func (rq *request) countBytes() {
 }
 // countRefusal counts the request for the error burst once it has been
-// answered, if servewaf refused it after a rule file match, a trap path or a
+// answered, if smallwebwaf refused it after a rule file match, a trap path
-// Core Rule Set match, and in observe mode if enforce mode would have: more than
+// or a Core Rule Set match, or for a missing or wrong token, and in
 // observe mode if enforce mode would have: more than
 // SWWAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
 // break a limit. A client in SWWAF_ALLOW_NETS, which the checks skip, is
 // not counted, and nothing is while the threshold is off.
@@ -94,7 +96,11 @@ func (rq *request) countRefusal() {
 		return
 	}
-	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
+	// In observe mode, a request that enforce mode would have refused
 	// before it reached the endpoint has had no token refused there.
 	tokenRefused := rq.tokenRefused && rq.line.WouldAction == "" &&
 		!isInside(rq.client, cfg.AllowNets)
 	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked && !tokenRefused {
 		return
 	}
@@ -121,9 +127,16 @@ func (rq *request) countRefusal() {
 // countedBytes returns the request's bytes, once it has ended, as the
 // byte limits and the anomaly thresholds count them: the response's body
-// bytes, the request's, or both, as SWWAF_BYTES_COUNT says.
+// bytes, the request's, or both, as SWWAF_BYTES_COUNT says. For an
 // upgraded connection, such as a WebSocket, which has closed by then, what
 // it carried from the app counts with the response's and what it carried
 // from the client with the request's.
 func (rq *request) countedBytes() int64 {
-	response, request := rq.out.bytes, rq.requestBytes
+	response, request := rq.out.bytes, rq.requestBytes()
 	if rq.upgraded != nil {
 		response += rq.upgraded.fromApp.Load()
 		request += rq.upgraded.toApp.Load()
 	}
 	switch rq.h.config.BytesCount {
 	case "response":
@@ -138,7 +151,7 @@ func (rq *request) countedBytes() int64 {
 // banForLimit bans the client's netblock at now for a broken limit, the
 // one hit names, notes the offence for the log line and counts the hit in
 // the metrics. status is what the client was sent, or is sent:
-// SWWAF_BAN_RESPONSE for a request over a rate limit, what the report says for
+// SWWAF_BAN_RESPONSE for a request over a rate limit, the app's answer for
 // one whose bytes broke a byte limit, the refusal for one that broke the
 // error burst. The ban's notes give the client's limit percentage for a
 // rate limit or a byte limit; the error burst is not lowered. The ban sets
@@ -9,7 +9,6 @@ import (
 	"net/netip"
 	"reflect"
 	"slices"
 	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -375,7 +374,7 @@ func (c *clock) advance(d time.Duration) {
 	c.now = c.now.Add(d)
 }
-// startWithClock starts servewaf, and rproxy in front of an app that answers 200,
+// startWithClock starts smallwebwaf in front of an app that answers 200,
 // with the settings in env on top of trusting localhost's
 // X-Forwarded-For, clients' AS numbers and countries looked up at
 // geojsURL, and a clock set to midnight, the start of a bucket in every
@@ -392,19 +391,18 @@ func startWithClock(
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
-	return &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}, clk, server
+	return &sender{t: t, addr: addr, out: out}, clk, server
 }
-// sender sends requests to rproxy one after another, each on a connection of its
+// sender sends requests to smallwebwaf one after another, each on a
-// own, and checks each one's answer and log line. serveWAFAddr is where servewaf's
+// connection of its own, and checks each one's answer and log line. They
-// own endpoints are, which adminRequest asks. Every request servewaf gets must
+// must be the only requests smallwebwaf is sent, since the log lines are
-// come through the sender, since the log lines are matched to them in order.
+// matched to them in order.
 type sender struct {
-	t            *testing.T
+	t    *testing.T
-	addr         string
+	addr string
-	serveWAFAddr string
+	out  *output
-	out          *output
+	sent int
 	sent         int
 }
 // get sends a GET request for / from the client at from.
@@ -421,19 +419,22 @@ func (s *sender) get(from string, status int, action string) logLine {
 func (s *sender) request(from, path string, status int, action string) logLine {
 	s.t.Helper()
-	return s.requestWithHeader(from, path, "", status, action)
+	line, _ := s.requestWithHeader(from, path, "", status, action)
 	return line
 }
 // requestWithHeader is request with header, such as "Authorization:
-// Bearer x", added to the request unless it is "".
+// Bearer x", added to the request unless it is "". It returns the body of
 // the answer too.
 func (s *sender) requestWithHeader(
 	from, path, header string, status int, action string,
-) logLine {
+) (logLine, string) {
 	s.t.Helper()
-	line, _ := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
+	line, got := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
-	return line
+	return line, string(got.body)
 }
 // requestWithBody is requestWithHeader for a request with method, whose
@@ -449,14 +450,10 @@ func (s *sender) requestWithBody(
 		header += "\r\n"
 	}
 	// rproxy refuses a request with more than one.
 	if !strings.Contains(header, "User-Agent:") {
 		header += "User-Agent: " + userAgent + "\r\n"
 	}
 	conn := dial(s.t, s.addr)
-	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+"\r\n"+
+	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+
-		forwardedFor+": "+from+"\r\n"+header+"\r\n"+body)
+		"\r\nUser-Agent: "+userAgent+"\r\n"+forwardedFor+": "+from+"\r\n"+
 		header+"\r\n"+body)
 	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
 	if err != nil {
@@ -481,7 +478,7 @@ func (s *sender) requestWithBody(
 			got.status, status)
 	}
-	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	line := s.out.requestLines(s.t, s.sent+1)[s.sent]
 	s.sent++
 	wantLine(s.t, line, status, action)
@@ -34,19 +34,19 @@ func biasedThresholdsSet(cfg *config.Config) bool {
 // percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
 // SWWAF_ASN_LIMIT_PERCENT_URL names gives it, the one
 // SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
-// country, unless its request skipped the wait for GeoJS,
+// country, SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists,
-// SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// the percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a
-// percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a client
+// client a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit,
-// a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
+// the percentage of SWWAF_REPUTATION_ACTION while it is limit. For the
-// percentage of SWWAF_REPUTATION_ACTION while it is limit. For the byte
+// byte limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT
-// limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the
+// take the place of the first three for an AS number or a country they
-// place of the first three for an AS number or a country they list.
+// list.
 func (rq *request) limitPercentages() (percentage, percentage) {
 	cfg := rq.h.config
 	asn, country := rq.line.ASN, rq.line.Country
 	unknown := percentage{percent: whole}
-	if country == "" && !rq.skippedLookupWait {
+	if country == "" {
 		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
 	}
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -280,12 +281,12 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-			map[string]string{unknownLimitPercent: "0"})
+			time.Now, map[string]string{unknownLimitPercent: "0"})
-		// Once the time the request waits for its answer is up, the client
+		// Once the second the request waits for its answer is up, the client
 		// counts as without a country, and its zero allowance refuses the
-		// request.
+		// request before it reaches the app.
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
 		line := out.requestLine(t)
@@ -319,8 +320,13 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
-				server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+				// The request's body is over SWWAF_REQUEST_MAX_BYTES, so that it
-					map[string]string{lookupTimeout: timeout.String(), tc.setting: tc.value})
+				// is refused after the checks, and never reaches the app.
 				server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
 					time.Now, map[string]string{
 						lookupTimeout: timeout.String(), requestMaxBytes: "1",
 						tc.setting: tc.value,
 					})
 				began := time.Now()
 				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
@@ -334,7 +340,8 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 					t.Errorf("the request waited %s for its answer, want %s", waited, want)
 				}
-				wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
+				wantLine(t, out.requestLine(t), http.StatusRequestEntityTooLarge,
 					requestlog.ActionTooLarge)
 				// The bubble's clock stops once this function returns, so the
 				// request to GeoJS, which a request that did not wait leaves
@@ -460,15 +467,13 @@ func (s *sender) uploadFrom(from string) logLine {
 	return line
 }
-// serveFromDE hands a question about a request from fromDE with method and body
+// serveFromDE hands a request from fromDE with method and body straight to
-// straight to server's handler, without the network, and returns once it is
+// server's handler, without the network, and returns once it is answered.
 // answered.
 func serveFromDE(t *testing.T, server *proxy.Server, method string, body io.Reader) {
 	t.Helper()
 	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.Header.Set(proxy.ClientHeader, fromDE)
+	req.RemoteAddr = net.JoinHostPort(fromDE, "1234")
 	req.Header.Set(requestIDHeader, "the-id")
 	server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 }
@@ -0,0 +1,239 @@
 package proxy
 import (
 	"bufio"
 	"errors"
 	"io"
 	"net"
 	"net/http"
 	"sync/atomic"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 // errResponseTooLarge ends an app's response body that is longer than
 // SWWAF_RESPONSE_MAX_BYTES.
 var errResponseTooLarge = errors.New(
 	"the response body is over SWWAF_RESPONSE_MAX_BYTES")
 // requestBody is the client's request body on its way to the app. The
 // transport reads it on a goroutine of its own.
 type requestBody struct {
 	// body is the client's body, ending in an *http.MaxBytesError past
 	// SWWAF_REQUEST_MAX_BYTES.
 	body io.ReadCloser
 	rq   *request
 	// readByCoreRuleSet is what the Core Rule Set read of the body before
 	// the request went to the app, and Read gives first.
 	readByCoreRuleSet []byte
 	// waiting is true while a Read waits for the client to send more.
 	waiting atomic.Bool
 	// received is true once the client has sent the whole body.
 	received atomic.Bool
 	// bytes is how much of the body has been read.
 	bytes atomic.Int64
 }
 // Read reads from the client's body, after what the Core Rule Set read of
 // it, which has been counted already.
 func (b *requestBody) Read(p []byte) (int, error) {
 	if len(b.readByCoreRuleSet) > 0 {
 		n := copy(p, b.readByCoreRuleSet)
 		b.readByCoreRuleSet = b.readByCoreRuleSet[n:]
 		return n, nil
 	}
 	b.waiting.Store(true)
 	n, err := b.body.Read(p)
 	b.waiting.Store(false)
 	b.bytes.Add(int64(n))
 	var tooLarge *http.MaxBytesError
 	switch {
 	case errors.Is(err, io.EOF):
 		b.received.Store(true)
 		b.rq.bodyReceived()
 	case errors.As(err, &tooLarge):
 		b.rq.refuse(refusal{
 			status: http.StatusRequestEntityTooLarge,
 			action: requestlog.ActionTooLarge,
 			limit:  "SWWAF_REQUEST_MAX_BYTES",
 		})
 	}
 	return n, err
 }
 // Close closes the client's body.
 func (b *requestBody) Close() error {
 	return b.body.Close()
 }
 // responseBody is the app's response body on its way to the client.
 type responseBody struct {
 	// body is the app's body, ending in an *http.MaxBytesError past
 	// SWWAF_RESPONSE_MAX_BYTES.
 	body io.ReadCloser
 	rq   *request
 }
 // Read reads from the app's body.
 func (b *responseBody) Read(p []byte) (int, error) {
 	n, err := b.body.Read(p)
 	if err == nil {
 		return n, nil
 	}
 	var tooLarge *http.MaxBytesError
 	switch {
 	case errors.Is(err, io.EOF):
 		b.rq.responseReceived()
 	case errors.As(err, &tooLarge):
 		b.rq.refuse(refusal{
 			status: http.StatusBadGateway,
 			action: requestlog.ActionTooLarge,
 			limit:  "SWWAF_RESPONSE_MAX_BYTES",
 		})
 		return n, errResponseTooLarge
 	case b.rq.in.Context().Err() == nil:
 		// The answer broke off, not because the client went away. If a
 		// timeout cut it, that refusal came first and is the one kept.
 		b.rq.refuse(refusal{
 			status: http.StatusBadGateway,
 			action: requestlog.ActionUpstreamError,
 		})
 	}
 	return n, err
 }
 // Close closes the app's body.
 func (b *responseBody) Close() error {
 	return b.body.Close()
 }
 // upgradedConn is the connection to the app once the app has switched
 // protocols, as for a WebSocket. ReverseProxy writes to it what the client
 // sends and reads from it what the app sends, on goroutines of its own,
 // until the connection closes; it counts the bytes each way, for the byte
 // limits.
 type upgradedConn struct {
 	io.ReadWriteCloser
 	// fromApp is how many bytes the app has sent, and toApp how many the
 	// client has.
 	fromApp atomic.Int64
 	toApp   atomic.Int64
 }
 // Read reads what the app sends.
 func (c *upgradedConn) Read(p []byte) (int, error) {
 	n, err := c.ReadWriteCloser.Read(p)
 	c.fromApp.Add(int64(n))
 	return n, err
 }
 // Write sends the app what the client sent.
 func (c *upgradedConn) Write(p []byte) (int, error) {
 	n, err := c.ReadWriteCloser.Write(p)
 	c.toApp.Add(int64(n))
 	return n, err
 }
 // CloseWrite tells the app that the client sends no more, while what the
 // app sends still passes. ReverseProxy calls it once the client has
 // stopped sending, and closes the connection there if it is not supported.
 func (c *upgradedConn) CloseWrite() error {
 	conn, ok := c.ReadWriteCloser.(interface{ CloseWrite() error })
 	if !ok {
 		return http.ErrNotSupported
 	}
 	return conn.CloseWrite()
 }
 // limitBody returns body, cut off with an *http.MaxBytesError after
 // maxBytes, or unchanged if maxBytes is zero, which is off.
 func limitBody(body io.ReadCloser, maxBytes int64) io.ReadCloser {
 	if maxBytes == 0 {
 		return body
 	}
 	// Without a ResponseWriter, MaxBytesReader only counts and cuts off.
 	return http.MaxBytesReader(nil, body, maxBytes)
 }
 // responseWriter is the response to the client. It notes the status and
 // size for the log line, and the first error writing to the client.
 type responseWriter struct {
 	http.ResponseWriter
 	// status is the final status sent, or zero before one is.
 	status int
 	bytes  int64
 	err    error
 }
 // WriteHeader sends the status and headers. An informational 1xx status
 // is passed on and the final status still comes later.
 func (w *responseWriter) WriteHeader(status int) {
 	if status >= http.StatusOK && w.status == 0 {
 		w.status = status
 	}
 	w.ResponseWriter.WriteHeader(status)
 }
 // Write sends part of the body.
 func (w *responseWriter) Write(p []byte) (int, error) {
 	if w.status == 0 {
 		w.status = http.StatusOK
 	}
 	n, err := w.ResponseWriter.Write(p)
 	w.bytes += int64(n)
 	w.noteError(err)
 	return n, err
 }
 // FlushError sends what has been written so far.
 // http.ResponseController calls it, as ReverseProxy does after each
 // write.
 func (w *responseWriter) FlushError() error {
 	err := http.NewResponseController(w.ResponseWriter).Flush()
 	w.noteError(err)
 	return err
 }
 // Hijack takes over the connection to the client, which ReverseProxy does
 // only to pass on the app's 101 Switching Protocols: that is then the
 // status sent.
 func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
 	if err == nil {
 		w.status = http.StatusSwitchingProtocols
 	}
 	return conn, buffered, err
 }
 // Unwrap lets http.ResponseController reach net/http's own
 // ResponseWriter for what responseWriter does not do itself.
 func (w *responseWriter) Unwrap() http.ResponseWriter {
 	return w.ResponseWriter
 }
 // noteError keeps the first error writing to the client.
 func (w *responseWriter) noteError(err error) {
 	if w.err == nil {
 		w.err = err
 	}
 }
@@ -47,6 +47,8 @@ const (
 func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	for _, tc := range []struct {
 		setting, window string
 		// apart is the time between the two requests, which the window
@@ -92,7 +94,7 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
-			wantMetric(t, s.scrape(), `smallwebwaf_rate_limit_hits_total{`+
+			wantMetric(t, s.scrape(scraper), `smallwebwaf_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
 		})
 	}
@@ -124,7 +126,7 @@ func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
 	// The 70 bytes passed on before the app broke off are over the limit of
 	// 50, and ban the client for an hour.
 	line, got := s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
-		requestlog.ActionForward)
+		requestlog.ActionUpstreamError)
 	if len(got.body) != answerBytes || line.LimitHit != minuteBytes ||
 		line.BanExpires != expires {
 		t.Errorf("got %d bytes, and the log line has limit_hit %q and ban_expires %q, "+
@@ -166,6 +168,39 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 	}
 }
 func TestWebSocketPassesTheAnswerAfterTheClientStopsSending(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, echoOnceTheClientStops)
 	addr, out := startProxy(t, app.URL,
 		map[string]string{trustedProxies: trustLocalhost})
 	s := &sender{t: t, addr: addr, out: out}
 	conn, reader := s.openWebSocket()
 	send(t, conn, uploadBody)
 	// The client closes its sending side and waits for the answer, which the
 	// app sends only once it has seen the client stop. smallwebwaf passes the
 	// close on to the app through CloseWrite on upgradedConn; without that,
 	// it closes both connections, and the answer is lost.
 	tcp, ok := conn.(*net.TCPConn)
 	if !ok {
 		t.Fatalf("connection is a %T, want a *net.TCPConn", conn)
 	}
 	err := tcp.CloseWrite()
 	if err != nil {
 		t.Fatalf("close the sending side: %v", err)
 	}
 	got, err := io.ReadAll(reader)
 	if err != nil || string(got) != uploadBody {
 		t.Errorf("got %q (%v), want %q", got, err, uploadBody)
 	}
 	s.closeWebSocket(conn)
 }
 func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 	t.Parallel()
@@ -430,6 +465,28 @@ func answerAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
 	}
 }
 // echoOnceTheClientStops is an app that switches protocols, as for a
 // WebSocket, reads what the client sends until the client stops sending,
 // and then sends it all back.
 func echoOnceTheClientStops(w http.ResponseWriter, _ *http.Request) {
 	conn, buffered, err := http.NewResponseController(w).Hijack()
 	if err != nil {
 		return
 	}
 	defer func() {
 		_ = conn.Close()
 	}()
 	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
 		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
 	_ = buffered.Flush()
 	received, _ := io.ReadAll(buffered)
 	_, _ = buffered.Write(received)
 	_ = buffered.Flush()
 }
 // webSocket opens a WebSocket from client to answerAfterUpgrade, sends a
 // line of bodyBytes on it, reads the answer, and closes it. It checks the
 // answer, and the log line as request does, and returns the log line.
@@ -486,7 +543,7 @@ func (s *sender) closeWebSocket(conn net.Conn) logLine {
 	_ = conn.Close()
-	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	line := s.out.requestLines(s.t, s.sent+1)[s.sent]
 	s.sent++
 	wantLine(s.t, line, http.StatusSwitchingProtocols, requestlog.ActionForward)
@@ -5,9 +5,10 @@ import (
 	"net/http"
 	"net/netip"
 	"slices"
 	"strings"
 )
-// peerAddress is the address of the request's TCP peer.
+// peerAddress is the address of the request's TCP peer, normally traefik.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
@@ -17,24 +18,58 @@ func peerAddress(r *http.Request) netip.Addr {
 	return addrPort.Addr().Unmap()
 }
-// requestIDHeader carries the request's id, from rproxy.
+// clientAddress works out who the client is. A peer outside the trusted
-const requestIDHeader = "X-Request-ID"
+// proxies is the client, and what it says in X-Forwarded-For is ignored.
-
+// For a peer inside them, X-Forwarded-For is read from the right, and the
-// requestID is the request's id: the one a question gives, or for any other
+// first address outside them is the client; if every address in it is
-// request a new random one.
+// inside, the leftmost is, and with no header, the peer. An entry that is
-func requestID(r *http.Request, isQuestion bool) string {
+// not an address ends the reading, since nothing to its left can be
-	if isQuestion {
+// believed.
-		return r.Header.Get(requestIDHeader)
+func clientAddress(
 	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
 ) netip.Addr {
 	client := peer
 	if !isInside(peer, trusted) {
 		return client
 	}
-	return rand.Text()
+	entries := strings.Split(strings.Join(forwardedFor, ","), ",")
 	for _, entry := range slices.Backward(entries) {
 		addr, err := netip.ParseAddr(strings.TrimSpace(entry))
 		if err != nil {
 			break
 		}
 		client = addr.Unmap()
 		if !isInside(client, trusted) {
 			break
 		}
 	}
 	return client
 }
-// scheme is how the visitor reached rproxy, or the trusted proxy in front of
+// requestIDHeader carries the request's id, from traefik and to the app.
-// it, as a question says in X-Forwarded-Proto, or otherwise http.
+const requestIDHeader = "X-Request-ID"
-func scheme(r *http.Request, isQuestion bool) string {
+
 // requestID is the request's id: the one a trusted proxy sent, or a new
 // random one. A peer outside the trusted proxies did not come through
 // traefik, so the id it sends is its own claim, and is replaced.
 func requestID(r *http.Request, peerTrusted bool) string {
 	id := r.Header.Get(requestIDHeader)
 	if !peerTrusted || id == "" {
 		id = rand.Text()
 	}
 	return id
 }
 // scheme is how the client reached traefik, as a trusted proxy says in
 // X-Forwarded-Proto, or otherwise http, the only scheme smallwebwaf
 // serves.
 func scheme(r *http.Request, peerTrusted bool) string {
 	proto := r.Header.Get("X-Forwarded-Proto")
-	if !isQuestion || proto == "" {
+	if !peerTrusted || proto == "" {
 		return "http"
 	}
@@ -60,3 +95,48 @@ func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 		return netblock.Contains(addr)
 	})
 }
 // setForwardedHeaders sets the headers in which the app learns about the
 // client, so that it sees what it would see from traefik directly. A
 // trusted proxy's forwarded headers pass on, with the proxy's own address
 // added to X-Forwarded-For. Those of any other peer are its own claims and
 // are replaced: X-Forwarded-For names the peer, X-Forwarded-Host the host
 // it asked for, and X-Forwarded-Proto plain http, which is how it reached
 // smallwebwaf.
 func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 	forwardedFor := peer.String()
 	if trusted {
 		// ReverseProxy removes these from out before Rewrite.
 		for _, name := range []string{"Forwarded", "X-Forwarded-Host", "X-Forwarded-Proto"} {
 			values, ok := in.Header[name]
 			if ok {
 				out.Header[name] = values
 			}
 		}
 		prior := in.Header.Values("X-Forwarded-For")
 		if len(prior) > 0 {
 			forwardedFor = strings.Join(prior, ", ") + ", " + forwardedFor
 		}
 		out.Header.Set("X-Forwarded-For", forwardedFor)
 		return
 	}
 	// ReverseProxy has removed Forwarded and the three set below; these
 	// are the other headers in which traefik tells the app about the
 	// client and its request.
 	for _, name := range []string{
 		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
 		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	} {
 		out.Header.Del(name)
 	}
 	out.Header.Set("X-Forwarded-For", forwardedFor)
 	out.Header.Set("X-Forwarded-Host", in.Host)
 	out.Header.Set("X-Forwarded-Proto", "http")
 }
@@ -0,0 +1,165 @@
 package proxy_test
 import (
 	"encoding/json"
 	"net/http"
 	"testing"
 )
 const (
 	// trustLocalhost trusts the address every test connects from, and a
 	// network for proxies in front of it.
 	trustLocalhost = localhost + "/32,10.0.0.0/8"
 	// appHost is the host every test asks for.
 	appHost = "app.example"
 	// client is the client's address, as a proxy names it.
 	client = "203.0.113.9"
 	// forwardedFor is the header that lists the client and its proxies,
 	// and forwardedProto the one that gives the scheme the client used.
 	forwardedFor   = "X-Forwarded-For"
 	forwardedProto = "X-Forwarded-Proto"
 	// secure is the scheme a client reached traefik with, and plain the
 	// one smallwebwaf serves.
 	secure = "https"
 	plain  = "http"
 )
 // appHeaders is what the app tells about the headers it received.
 type appHeaders struct {
 	Host           string `json:"host"`
 	ForwardedFor   string `json:"forwardedFor"`
 	ForwardedHost  string `json:"forwardedHost"`
 	ForwardedProto string `json:"forwardedProto"`
 	RealIP         string `json:"realIp"`
 }
 // clientAddressCase is a request and what smallwebwaf makes of it.
 type clientAddressCase struct {
 	name       string
 	env        map[string]string
 	header     http.Header
 	wantClient string
 	wantApp    appHeaders
 }
 func TestClientAddressAndForwardedHeaders(t *testing.T) {
 	t.Parallel()
 	for _, tc := range clientAddressCases() {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			got, line := requestWithHeaders(t, tc.env, tc.header)
 			tc.wantApp.Host = appHost
 			if got != tc.wantApp {
 				t.Errorf("app received %+v, want %+v", got, tc.wantApp)
 			}
 			if line.ClientIP != tc.wantClient || line.PeerIP != localhost {
 				t.Errorf("log line has client_ip %q and peer_ip %q, want %q and %q",
 					line.ClientIP, line.PeerIP, tc.wantClient, localhost)
 			}
 		})
 	}
 }
 // clientAddressCases are the requests TestClientAddressAndForwardedHeaders
 // sends, from 127.0.0.1, which the default trusted proxies leave out.
 func clientAddressCases() []clientAddressCase {
 	trusted := map[string]string{trustedProxies: trustLocalhost}
 	forged := http.Header{
 		forwardedFor:       {client},
 		"X-Forwarded-Host": {"forged.example"},
 		forwardedProto:     {secure},
 		"X-Real-Ip":        {client},
 	}
 	replaced := appHeaders{
 		ForwardedFor: localhost, ForwardedHost: appHost, ForwardedProto: plain,
 	}
 	return []clientAddressCase{{
 		name: "a peer outside the trusted proxies is the client, " +
 			"and its forwarded headers are replaced",
 		header: forged, wantClient: localhost, wantApp: replaced,
 	}, {
 		name:   "set but empty, the trusted proxies trust nothing",
 		env:    map[string]string{trustedProxies: ""},
 		header: forged, wantClient: localhost, wantApp: replaced,
 	}, {
 		name: "behind a trusted peer, the client is the first address " +
 			"outside the trusted proxies from the right",
 		env: trusted,
 		header: http.Header{
 			forwardedFor:       {"198.51.100.7, " + client + ", 10.0.0.2"},
 			"X-Forwarded-Host": {appHost},
 			forwardedProto:     {secure},
 			"X-Real-Ip":        {client},
 		},
 		wantClient: client,
 		wantApp: appHeaders{
 			ForwardedFor:  "198.51.100.7, " + client + ", 10.0.0.2, " + localhost,
 			ForwardedHost: appHost, ForwardedProto: secure, RealIP: client,
 		},
 	}, {
 		name:       "when every address is a trusted proxy, the leftmost is the client",
 		env:        trusted,
 		header:     http.Header{forwardedFor: {"10.0.0.5, 10.0.0.2"}},
 		wantClient: "10.0.0.5",
 		wantApp:    appHeaders{ForwardedFor: "10.0.0.5, 10.0.0.2, " + localhost},
 	}, {
 		name:       "with no header, a trusted peer is the client",
 		env:        trusted,
 		wantClient: localhost,
 		wantApp:    appHeaders{ForwardedFor: localhost},
 	}, {
 		name:       "an entry that is not an address ends the reading",
 		env:        trusted,
 		header:     http.Header{forwardedFor: {client + ", unknown, 10.0.0.2"}},
 		wantClient: "10.0.0.2",
 		wantApp: appHeaders{
 			ForwardedFor: client + ", unknown, 10.0.0.2, " + localhost,
 		},
 	}, {
 		name:       "several header lines are read as one list",
 		env:        trusted,
 		header:     http.Header{forwardedFor: {"2001:db8::7", "10.0.0.2"}},
 		wantClient: "2001:db8::7",
 		wantApp:    appHeaders{ForwardedFor: "2001:db8::7, 10.0.0.2, " + localhost},
 	}}
 }
 // requestWithHeaders sends a request for appHost with header through
 // smallwebwaf, with the settings in env, and returns the headers the app
 // received and the request's log line.
 func requestWithHeaders(
 	t *testing.T, env map[string]string, header http.Header,
 ) (appHeaders, logLine) {
 	t.Helper()
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_ = json.NewEncoder(w).Encode(appHeaders{
 			Host:           r.Host,
 			ForwardedFor:   r.Header.Get(forwardedFor),
 			ForwardedHost:  r.Header.Get("X-Forwarded-Host"),
 			ForwardedProto: r.Header.Get(forwardedProto),
 			RealIP:         r.Header.Get("X-Real-IP"),
 		})
 	})
 	addr, out := startProxy(t, app.URL, env)
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Host = appHost
 	req.Header = header.Clone()
 	answered := do(t, req)
 	var got appHeaders
 	err := json.Unmarshal(answered.body, &got)
 	if err != nil {
 		t.Fatalf("decode the app's answer %q: %v", answered.body, err)
 	}
 	return got, out.requestLine(t)
 }
@@ -1,6 +1,9 @@
 package proxy
 import (
 	"errors"
 	"net/http"
 	"os"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
@@ -16,7 +19,8 @@ import (
 // SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
 // and in block mode refuses the request, which is an offence its client's
 // history counts, and so returns ActionWAFBlocked. It returns "" for a
-// request it does not refuse.
+// request it does not refuse, and for one whose body meets a size or time
 // limit while the Core Rule Set reads it, which it notes nothing of.
 func (rq *request) checkCoreRuleSet() string {
 	cfg := rq.h.config
 	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
@@ -25,10 +29,10 @@ func (rq *request) checkCoreRuleSet() string {
 	start := time.Now()
-	// A question's body has been read into memory, so that reading it here
+	result := rq.inspect()
-	// cannot fail.
+	if rq.refused.Load() != nil {
-	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
+		return "" // the refusal for that limit, which check returns
-	rq.requestBytes = int64(len(read))
+	}
 	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
 	rq.line.WAFRuleIDs = result.RuleIDs
@@ -54,6 +58,39 @@ func (rq *request) checkCoreRuleSet() string {
 	return requestlog.ActionWAFBlocked
 }
 // inspect runs the Core Rule Set on the request, which reads the part of
 // its body it inspects within SWWAF_CLIENT_REQUEST_TIMEOUT, and keeps that
 // part for the app. A client that runs out of time is refused with 408
 // here, and a body over SWWAF_REQUEST_MAX_BYTES with 413 as it is read;
 // check returns the refusal. A body that breaks off for any other reason
 // is passed on as far as it came, and the request to the app fails there,
 // as it would have without the Core Rule Set.
 func (rq *request) inspect() waf.Result {
 	if rq.body == nil {
 		// Nothing is read of no body, so nothing can go wrong reading it.
 		result, _, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, http.NoBody)
 		return result
 	}
 	_ = rq.rc.SetReadDeadline(rq.clientRequestDeadline())
 	result, read, err := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.body)
 	// The timeouts that run while the request goes to the app take over.
 	_ = rq.rc.SetReadDeadline(time.Time{})
 	rq.body.readByCoreRuleSet = read
 	if errors.Is(err, os.ErrDeadlineExceeded) {
 		rq.refuse(refusal{
 			status: http.StatusRequestTimeout,
 			action: requestlog.ActionTimedOut,
 			limit:  "SWWAF_CLIENT_REQUEST_TIMEOUT",
 		})
 	}
 	return result
 }
 // alertWAFBlock raises the waf_block alert for the request, which the Core
 // Rule Set scored at result, at or over SWWAF_WAF_ANOMALY_THRESHOLD. Its
 // detail gives the rule ids, the score, the method and the path with the
@@ -8,6 +8,7 @@ import (
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
@@ -28,13 +29,6 @@ const (
 // formData is the type of a form's body.
 const formData = "application/x-www-form-urlencoded"
 // sizeLimit is SWWAF_WAF_BODY_LIMIT in the tests that read bodies, 1K as a
 // setting.
 const (
 	sizeLimit        = 1 << 10
 	sizeLimitSetting = "1K"
 )
 // sqlInjection asks for / with an SQL injection in its query, which only
 // the Core Rule Set's rule 942100 matches, with a score of 5, the default
 // SWWAF_WAF_ANOMALY_THRESHOLD.
@@ -102,7 +96,7 @@ func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *test
 			} {
 				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
-				line := s.requestWithHeader(client, attack.path, attack.header,
+				line, _ := s.requestWithHeader(client, attack.path, attack.header,
 					tc.status, tc.action)
 				wantWAF(t, line, &attack.score, attack.ruleIDs...)
 			}
@@ -305,7 +299,7 @@ func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
 				tc.name, len(got.body), got.status, len(tc.body))
 		}
-		line := out.endedLines(t, i+1)[i]
+		line := out.requestLines(t, i+1)[i]
 		wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 		if line.RequestBytes != int64(len(tc.body)) {
@@ -315,6 +309,119 @@ func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
 	}
 }
 func TestFormBodyLongerThanTheLimitStreamsOnToTheApp(t *testing.T) {
 	t.Parallel()
 	const (
 		first = "a=" // and twice the limit of b's, then the rest
 		rest  = 64 * sizeLimit
 	)
 	// past is closed once the app has received twice what the Core Rule
 	// Set reads, and got is the length of the whole body it received.
 	past := make(chan struct{})
 	got := make(chan int64, 1)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		n, _ := io.CopyN(io.Discard, r.Body, 2*sizeLimit)
 		close(past)
 		m, _ := io.Copy(io.Discard, r.Body)
 		got <- n + m
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		wafMode: block, wafBodyLimit: sizeLimitSetting,
 	})
 	// The client sends the rest only once the app has received the first
 	// part: were smallwebwaf to hold the body until the end, it would
 	// never come.
 	body, sender := io.Pipe()
 	go func() {
 		_, _ = io.WriteString(sender, first+strings.Repeat("b", 2*sizeLimit))
 		select {
 		case <-past:
 		case <-time.After(waitLimit):
 			t.Error("the app got no more than the Core Rule Set reads " +
 				"before the whole body was sent")
 			_ = sender.CloseWithError(io.ErrUnexpectedEOF)
 			return
 		}
 		_, _ = io.WriteString(sender, strings.Repeat("b", rest))
 		_ = sender.Close()
 	}()
 	req := newRequest(t, http.MethodPost, addr, "/", body)
 	req.Header.Set("Content-Type", formData)
 	wantStatus(t, do(t, req), http.StatusOK)
 	want := int64(len(first) + 2*sizeLimit + rest)
 	if n := <-got; n != want {
 		t.Errorf("the app got %d bytes, want %d", n, want)
 	}
 	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
 }
 func TestClientTooSlowToSendWhatTheCoreRuleSetReads(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		wafMode: block, wafBodyLimit: sizeLimitSetting,
 		clientRequestTimeout: shortTimeoutSetting, metricsToken: token,
 	})
 	conn := dial(t, addr)
 	send(t, conn, "POST /comment HTTP/1.1\r\nHost: app\r\nContent-Type: "+formData+
 		"\r\nContent-Length: 100\r\n\r\ncontent=the first bytes")
 	wantStatus(t, readResponse(t, conn), http.StatusRequestTimeout)
 	line := out.requestLine(t)
 	wantLine(t, line, http.StatusRequestTimeout, requestlog.ActionTimedOut)
 	wantNotSentToTheApp(t, line)
 	wantLimitHits(t, addr, clientRequestTimeout, 1)
 }
 func TestBodyOverTheSizeLimitWhileTheCoreRuleSetReadsIt(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		wafMode: block, wafBodyLimit: "4K",
 		requestMaxBytes: sizeLimitSetting, metricsToken: token,
 	})
 	// Sent in chunks, its length is not announced, and is found to be over
 	// the limit as the Core Rule Set reads it.
 	body := io.MultiReader(strings.NewReader("a=" + strings.Repeat("b", 2*sizeLimit)))
 	req := newRequest(t, http.MethodPost, addr, "/", body)
 	req.Header.Set("Content-Type", formData)
 	wantStatus(t, do(t, req), http.StatusRequestEntityTooLarge)
 	line := out.requestLine(t)
 	wantLine(t, line, http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
 	wantNotSentToTheApp(t, line)
 	wantLimitHits(t, addr, requestMaxBytes, 1)
 }
 // wantNotSentToTheApp checks that the request of line was not sent to the
 // app at all.
 func wantNotSentToTheApp(t *testing.T, line logLine) {
 	t.Helper()
 	_, sent := line.fields["duration_upstream_total"]
 	if sent {
 		t.Error("log line has duration_upstream_total, for a request sent to the app")
 	}
 }
 func TestResponsesAreNotInspected(t *testing.T) {
 	t.Parallel()
@@ -334,12 +441,14 @@ func TestResponsesAreNotInspected(t *testing.T) {
 		t.Errorf("answered %d with %q, want 200 with the app's page", got.status, got.body)
 	}
-	wantLine(t, out.endedLine(t), http.StatusOK, requestlog.ActionForward)
+	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
 }
 func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	s, _, server := startWithClock(t, "", map[string]string{
 		wafMode: block, errorBurstThreshold: "2", metricsToken: token,
 	})
@@ -365,7 +474,7 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 		t.Errorf("history counts the offences %+v, want %+v", offences, want)
 	}
-	metrics := s.scrape()
+	metrics := s.scrape(scraper)
 	wantMetric(t, metrics,
 		`smallwebwaf_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
 	wantMetric(t, metrics,
@@ -377,6 +486,8 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	s, _, server := startWithClock(t, "", map[string]string{
 		wafMode: detect, errorBurstThreshold: "2", metricsToken: token,
 	})
@@ -392,7 +503,7 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 		t.Errorf("history counts the offences %+v, want none", offences)
 	}
-	metrics := s.scrape()
+	metrics := s.scrape(scraper)
 	wantMetric(t, metrics,
 		`smallwebwaf_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
 	wantNoSeries(t, metrics,
@@ -465,7 +576,6 @@ func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 				Instance: alertInstance,
 				Time:     clk.Now(),
 				Event:    alerts.EventWAFBlock,
 				Host:     appHost,
 				Client:   netip.MustParseAddr(client),
 				Netblock: netip.MustParsePrefix(client + "/32"),
 				Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
@@ -65,7 +65,7 @@ func TestCountryLists(t *testing.T) {
 				req.Header.Set(forwardedFor, sent.client)
 				got := do(t, req)
-				line := out.endedLines(t, i+1)[i]
+				line := out.requestLines(t, i+1)[i]
 				if line.ASN != sent.asn || line.ASName != sent.asName ||
 					line.Country != sent.country {
 					t.Errorf("log line has %q, %q and %q, want %q, %q and %q",
@@ -90,7 +90,7 @@ func TestCountryLists(t *testing.T) {
 	}
 }
-func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
+func TestCountryRefusalComesBeforeTheBody(t *testing.T) {
 	t.Parallel()
 	var calls atomic.Int32
@@ -109,9 +109,13 @@ func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
 	req.Header.Set(forwardedFor, fromKP)
 	wantStatus(t, do(t, req), http.StatusForbidden)
-	line := out.endedLine(t)
+	line := out.requestLine(t)
 	wantLine(t, line, http.StatusForbidden, requestlog.ActionCountryDenied)
 	if line.RequestBytes != 0 {
 		t.Errorf("log line has request_bytes %d, want 0", line.RequestBytes)
 	}
 	if calls.Load() != 0 {
 		t.Errorf("the app was called %d times, want none", calls.Load())
 	}
@@ -207,7 +211,7 @@ func TestPrivateAddressIsNeverLookedUp(t *testing.T) {
 				wantStatus(t, do(t, req), http.StatusOK)
-				line := out.endedLines(t, i+1)[i]
+				line := out.requestLines(t, i+1)[i]
 				wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 				for _, field := range []string{"asn", "as_name", "country"} {
@@ -280,9 +284,9 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 // each in an AS of its own, and no other address. It returns its URL, and
 // what returns the addresses it has been asked about. A test that needs
 // the stand-in to be asked or to answer sets SWWAF_LOOKUP_TIMEOUT to an
-// hour, whether or not a request waits for the answer: on the default, a
+// hour, whether or not a request waits for the answer: on the default
-// hold-up of the test process can abandon the request to the stand-in, and
+// second, a hold-up of the test process can abandon the request to the
-// leave the client unknown.
+// stand-in, and leave the client unknown.
 func startGeoJS(t *testing.T) (string, func() []string) {
 	t.Helper()
@@ -84,7 +84,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	// The ban and the hit are counted, and the list has the metrics of any
 	// list fetched from a URL.
-	metrics := s.scrape()
+	metrics := s.scrape(unplaced)
 	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="crowdsec",`+
@@ -17,8 +17,8 @@ import (
 const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
-// refused is a request the tests here send, which servewaf refuses after a rule
+// refused is a request the tests here send, which smallwebwaf refuses
-// file match.
+// after a rule file match, or for a missing or wrong token.
 type refused int
 const (
@@ -27,6 +27,11 @@ const (
 	// banRule is one its ban rule refuses with 403, and bans the client
 	// for.
 	banRule
 	// noMetricsToken is one for the metrics without a token, and
 	// wrongAdminToken one for the bans with the metrics token, each
 	// refused with 401.
 	noMetricsToken
 	wrongAdminToken
 )
 // send sends r from the client at from, checks its answer and log line as
@@ -40,6 +45,14 @@ func (r refused) send(s *sender, from string) logLine {
 			requestlog.ActionRuleBlocked)
 	case banRule:
 		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
 	case noMetricsToken:
 		return s.request(from, proxy.MetricsPath, http.StatusUnauthorized,
 			requestlog.ActionAdmin)
 	case wrongAdminToken:
 		line, _ := s.requestWithHeader(from, proxy.BansPath, "Authorization: "+bearer,
 			http.StatusUnauthorized, requestlog.ActionAdmin)
 		return line
 	}
 	s.t.Fatalf("no request for the refusal %d", r)
@@ -47,7 +60,7 @@ func (r refused) send(s *sender, from string) logLine {
 	return logLine{}
 }
-// startForErrorBurst is startWithClock with testRules, the metrics token and
+// startForErrorBurst is startWithClock with testRules, both tokens and
 // SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
@@ -57,6 +70,7 @@ func startForErrorBurst(
 	settings := map[string]string{
 		errorBurstThreshold: threshold,
 		rulesDir:            writeRules(t, testRules),
 		adminToken:          adminSecret,
 		metricsToken:        token,
 	}
 	maps.Copy(settings, env)
@@ -73,7 +87,14 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 		refusals []refused
 	}{
 		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
-		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
+		{
 			"missing or wrong token",
 			[]refused{noMetricsToken, wrongAdminToken, noMetricsToken, wrongAdminToken},
 		},
 		{
 			"a mix ending in a ban rule",
 			[]refused{blockRule, noMetricsToken, blockRule, banRule},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -109,11 +130,13 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	s, clk, server := startForErrorBurst(t, "2", nil)
 	start := clk.Now()
 	blockRule.send(s, client)
-	blockRule.send(s, client)
+	wrongAdminToken.send(s, client)
 	line := blockRule.send(s, client)
 	expires := start.Add(time.Hour)
@@ -150,17 +173,19 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
 	}
-	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
+	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 2, TokenRefused: 1}
 	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
 		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
 	}
-	metrics := s.scrape()
+	metrics := s.scrape(scraper)
 	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
 		`kind="refusals",window="minute"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 3)
+		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 2)
 	wantMetric(t, metrics,
 		`smallwebwaf_offences_total{instance="app",kind="token_refused"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
 }
@@ -266,15 +291,19 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 		allowNets: allowed, rateLimitExemptNets: exempt,
 	})
-	// A client in SWWAF_ALLOW_NETS is not refused, and so not counted.
+	// A client in SWWAF_ALLOW_NETS still needs the token, but is not
 	// counted.
 	for range 3 {
-		s.request(allowed, blockedPath, http.StatusOK, requestlog.ActionForward)
+		line := noMetricsToken.send(s, allowed)
 		if line.LimitHit != "" {
 			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
 		}
 	}
 	// One the rate limits do not apply to is.
-	blockRule.send(s, exempt)
+	noMetricsToken.send(s, exempt)
-	line := blockRule.send(s, exempt)
+	line := wrongAdminToken.send(s, exempt)
 	if line.LimitHit != requestlog.LimitHitErrorBurst {
 		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
 	}
@@ -307,6 +336,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 		mode:                observe,
 		errorBurstThreshold: "1",
 		rulesDir:            writeRules(t, testRules),
 		adminToken:          adminSecret,
 	})
 	start := clk.Now()
 	held := bans.Ban{
@@ -317,11 +347,10 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	}
 	server.Ledger.Load([]bans.Ban{held})
-	// Under a ban, enforce mode would have refused these before the rule, so
+	// Under a ban, enforce mode would have refused these before the
-	// they are not counted.
+	// endpoint, so their tokens are not counted.
 	for range 2 {
-		line := s.request(otherClient, blockedPath, http.StatusOK,
+		line := wrongAdminToken.send(s, otherClient)
 			requestlog.ActionForward)
 		wantWouldAction(t, line, requestlog.ActionBanned)
 		if line.LimitHit != "" {
@@ -331,7 +360,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	// The block rule's refusal, which enforce mode would have answered 403,
 	// is the second of the client's, and would have banned it.
-	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
+	wrongAdminToken.send(s, client)
 	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
 	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
@@ -2,18 +2,24 @@ package proxy_test
 import (
 	"net/http"
 	"sync/atomic"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
-func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
+func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
 	t.Parallel()
 	var calls atomic.Int32
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		calls.Add(1)
 	})
 	// With a limit of one request a minute, any request counted before
 	// the last one would have it refused.
-	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+	addr, out := startProxy(t, app.URL, map[string]string{rateLimitPerMinute: "1"})
 	const (
 		healthChecks = 3
@@ -21,7 +27,8 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	)
 	for range healthChecks {
-		got := s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
+		got := get(t, addr, proxy.HealthPath)
 		wantStatus(t, got, http.StatusOK)
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
@@ -29,12 +36,21 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 		}
 	}
-	s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantStatus(t, get(t, addr, "/"), http.StatusOK)
 	lines := out.requestLines(t, healthChecks+1)
 	for _, line := range lines[:healthChecks] {
 		wantLine(t, line, http.StatusOK, requestlog.ActionAdmin)
 	for _, line := range s.out.endedLines(t, healthChecks)[:healthChecks] {
 		if line.ResponseContentType != contentType {
 			t.Errorf("health check's log line has response_content_type %q, "+
 				"want %q", line.ResponseContentType, contentType)
 		}
 	}
 	wantLine(t, lines[healthChecks], http.StatusOK, requestlog.ActionForward)
 	if calls.Load() != 1 {
 		t.Errorf("the app was called %d times, want once", calls.Load())
 	}
 }
@@ -86,7 +86,7 @@ func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
 	wantStatus(t, got, http.StatusOK)
-	out.endedLine(t)
+	out.requestLine(t)
 	history := historyOf(t, server, localhost)
 	if history.RequestBytes != 3 || history.ResponseBytes != 5 {
@@ -95,33 +95,38 @@ func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 	}
 }
-func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
+func TestHealthEndpointIsNotInTheHistory(t *testing.T) {
 	t.Parallel()
-	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
-	s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
+	wantStatus(t, get(t, addr, proxy.HealthPath), http.StatusOK)
-	s.adminRequest("", http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized)
+	out.requestLine(t)
 	s.scrape()
 	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
 		t.Errorf("the table holds %+v, want no client", clients)
 	}
 }
-func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
+func TestRequestForSmallwebwafIsRefusedOnlyWithoutTheToken(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
 		map[string]string{metricsToken: token})
 	// The metrics and the 404 are neither forwarded nor refused; the 401
 	// is refused.
 	scrape(t, addr)
 	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
-	out.endedLine(t)
+	wantStatus(t, get(t, addr, proxy.MetricsPath), http.StatusUnauthorized)
 	out.requestLines(t, 3)
 	history := historyOf(t, server, localhost)
-	if history.Requests != 1 || history.Forwarded != 0 || history.Refused != 0 {
+	if history.Requests != 3 || history.Forwarded != 0 || history.Refused != 1 {
 		t.Errorf("history counts %d requests, %d forwarded and %d refused, "+
-			"want 1, 0 and 0", history.Requests, history.Forwarded, history.Refused)
+			"want 3, 0 and 1", history.Requests, history.Forwarded, history.Refused)
 	}
 }
@@ -0,0 +1,162 @@
 package proxy_test
 import (
 	"bytes"
 	"errors"
 	"io"
 	"net/http"
 	"strconv"
 	"sync/atomic"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 // sizeLimit is the size limit the tests set, 1K as a setting.
 const (
 	sizeLimit        = 1 << 10
 	sizeLimitSetting = "1K"
 )
 func TestRequestBodyLimit(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		size int
 		// announced sends the size in Content-Length; otherwise the body
 		// is sent in chunks with no length given.
 		announced bool
 		want      int
 		action    string
 		// refusedBeforeApp is a refusal before anything reaches the app.
 		// A body over the limit with no length given has already partly
 		// reached the app when it is refused.
 		refusedBeforeApp bool
 	}{
 		{"announced, over the limit", 2 * sizeLimit, true,
 			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, true},
 		{"announced, at the limit", sizeLimit, true,
 			http.StatusOK, requestlog.ActionForward, false},
 		{"not announced, over the limit", 4 * sizeLimit, false,
 			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, false},
 		{"not announced, at the limit", sizeLimit, false,
 			http.StatusOK, requestlog.ActionForward, false},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			var calls atomic.Int32
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				calls.Add(1)
 				_, _ = io.Copy(io.Discard, r.Body)
 			})
 			addr, out := startProxy(t, app.URL, map[string]string{
 				requestMaxBytes: sizeLimitSetting,
 				metricsToken:    token,
 			})
 			var body io.Reader = bytes.NewReader(make([]byte, tc.size))
 			if !tc.announced {
 				body = io.MultiReader(body) // hides the length
 			}
 			wantStatus(t, do(t, newRequest(t, http.MethodPost, addr, "/upload", body)),
 				tc.want)
 			wantLine(t, out.requestLine(t), tc.want, tc.action)
 			hits := 0
 			if tc.action == requestlog.ActionTooLarge {
 				hits = 1
 			}
 			wantLimitHits(t, addr, requestMaxBytes, hits)
 			if tc.refusedBeforeApp && calls.Load() != 0 {
 				t.Errorf("the app was called %d times, want never", calls.Load())
 			}
 		})
 	}
 }
 func TestResponseBodyLimit(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		size int
 		// announced sends the size in Content-Length; otherwise the body
 		// is sent in chunks with no length given.
 		announced bool
 		want      int
 		action    string
 		// received is how much of a body the client gets, and cutOff
 		// whether the connection is then cut.
 		received int
 		cutOff   bool
 	}{
 		{"announced, over the limit", 2 * sizeLimit, true, http.StatusBadGateway,
 			requestlog.ActionTooLarge, len("Bad Gateway\n"), false},
 		{"announced, at the limit", sizeLimit, true, http.StatusOK,
 			requestlog.ActionForward, sizeLimit, false},
 		{"not announced, over the limit", 4 * sizeLimit, false, http.StatusOK,
 			requestlog.ActionTooLarge, sizeLimit, true},
 		{"not announced, at the limit", sizeLimit, false, http.StatusOK,
 			requestlog.ActionForward, sizeLimit, false},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 				answerWithSize(w, tc.size, tc.announced)
 			})
 			addr, out := startProxy(t, app.URL, map[string]string{
 				responseMaxBytes: sizeLimitSetting,
 				metricsToken:     token,
 			})
 			got := get(t, addr, "/download")
 			wantStatus(t, got, tc.want)
 			if len(got.body) != tc.received ||
 				errors.Is(got.err, io.ErrUnexpectedEOF) != tc.cutOff {
 				t.Errorf("client got %d bytes (%v), want %d",
 					len(got.body), got.err, tc.received)
 			}
 			line := out.requestLine(t)
 			wantLine(t, line, tc.want, tc.action)
 			if line.UpstreamStatus != http.StatusOK {
 				t.Errorf("log line has upstream_status %d", line.UpstreamStatus)
 			}
 			hits := 0
 			if tc.action == requestlog.ActionTooLarge {
 				hits = 1
 			}
 			wantLimitHits(t, addr, responseMaxBytes, hits)
 		})
 	}
 }
 // answerWithSize answers with a body of size bytes, announced in
 // Content-Length or sent in chunks with no length given.
 func answerWithSize(w http.ResponseWriter, size int, announced bool) {
 	body := make([]byte, size)
 	if announced {
 		w.Header().Set("Content-Length", strconv.Itoa(size))
 		_, _ = w.Write(body)
 		return
 	}
 	// Sending part of it before the end keeps Go's server from working
 	// out the length.
 	_, _ = w.Write(body[:size/2])
 	_ = http.NewResponseController(w).Flush()
 	_, _ = w.Write(body[size/2:])
 }
@@ -4,15 +4,15 @@ import (
 	"context"
 	"net/http"
 	"net/netip"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 )
-// The headers in which an answer of allow gives rproxy the client's AS number
+// The headers in which the app is passed the client's AS number and
-// and country, for the app, while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes
+// country while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes every header
-// every header name in this form, as it sends it and as it receives it, so
+// name in this form, as it sends it and as it receives it, so X-Client-ASN
-// X-Client-ASN arrives as X-Client-Asn; header names are not case-sensitive.
+// arrives as X-Client-Asn, and Del removes a client's own whatever their
 // case; header names are not case-sensitive.
 const (
 	asnHeader     = "X-Client-Asn"
 	countryHeader = "X-Client-Country"
@@ -23,24 +23,17 @@ const (
 // SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
 // link-local address, which no lookup can place. The lookup database
 // answers at once. With GeoJS, while a setting needs the answer, such as a
-// country list or a biased threshold, a new client's request waits for it,
+// country list or a biased threshold, a new client's request waits for it.
-// unless refusedWhateverTheAnswer reports true. ctx is the request's own
+// ctx is the request's own context.
-// context.
+func (rq *request) lookUp(ctx context.Context) {
 func (rq *request) lookUp(ctx context.Context, now time.Time) {
 	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
 		return
 	}
-	client := rq.h.clientGroup(rq.client)
+	if rq.h.config.LookupSource == "file" {
-
+		rq.lookupAnswer = rq.h.lookupFile.LookUp(rq.h.clientGroup(rq.client))
-	switch {
+	} else {
-	case rq.h.config.LookupSource == "file":
+		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, rq.h.clientGroup(rq.client))
 		rq.lookupAnswer = rq.h.lookupFile.LookUp(client)
 	case rq.refusedWhateverTheAnswer(now):
 		rq.lookupAnswer = rq.h.geojs.LookUpWithoutWaiting(ctx, client)
 		rq.skippedLookupWait = rq.lookupAnswer.Answered.IsZero()
 	default:
 		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, client)
 	}
 	rq.lookedUp = true
@@ -59,8 +52,8 @@ func (h *handler) addLookup(answer lookup.Answer) {
 		answer.ASN, answer.ASName, answer.Country)
 }
-// setLookupHeaders sets the headers that give the client's AS number and
+// setLookupHeaders sets the headers in which the app is passed the
-// country, leaving out one that is unknown.
+// client's AS number and country, leaving out one that is unknown.
 func setLookupHeaders(header http.Header, asn, country string) {
 	if asn != "" {
 		header.Set(asnHeader, asn)
@@ -1,7 +1,9 @@
 package proxy_test
 import (
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
 	"path/filepath"
 	"slices"
@@ -140,7 +142,7 @@ func TestRequestThatWaitedForItsLookupIsCountedWhenItGoesOn(t *testing.T) {
 		t.Fatalf("first request: %v", err)
 	}
-	wantLine(t, out.endedLines(t, 2)[1], http.StatusOK, requestlog.ActionForward)
+	wantLine(t, out.requestLines(t, 2)[1], http.StatusOK, requestlog.ActionForward)
 	// The third request's count holds all three: the first was counted
 	// when it went on, in the minute under way, and the second's count
@@ -148,7 +150,7 @@ func TestRequestThatWaitedForItsLookupIsCountedWhenItGoesOn(t *testing.T) {
 	clk.advance(500 * time.Millisecond)
 	wantStatus(t, do(t, requestFromDE()), http.StatusOK)
-	if got := out.endedLines(t, 3)[2].Counts.Minute; got != 3 {
+	if got := out.requestLines(t, 3)[2].Counts.Minute; got != 3 {
 		t.Errorf("the third request's count in the minute is %v, want 3", got)
 	}
 }
@@ -317,7 +319,7 @@ func TestLookupHeadersArePassedToTheAppAndTheClientsOwnRemoved(t *testing.T) {
 	addr, out, _ := startProxyWithClock(t, app.URL, geojsURL, time.Now, map[string]string{
 		trustedProxies:   trustLocalhost,
 		lookupTimeout:    "1h",
-		addLookupHeaders: on,
+		addLookupHeaders: "true",
 	})
 	s := &sender{t: t, addr: addr, out: out}
@@ -381,19 +383,22 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	// network, which would keep that clock from moving on: the request is
 	// handed to the proxy's handler, and GeoJS is one that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		// Not the default. The exclusive list needs the answer, and the app
+		// Not the default second. The exclusive list needs the answer, and
-		// is never reached.
+		// the app is never reached.
 		const timeout = 3 * time.Second
-		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-			map[string]string{
+			time.Now, map[string]string{
 				lookupTimeout:    timeout.String(),
 				allowedCountries: "DE",
 			})
 		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
 			http.NoBody)
 		req.RemoteAddr = net.JoinHostPort(fromDE, "1234")
 		began := time.Now()
-		serveFromDE(t, server, http.MethodGet, http.NoBody)
+		server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 		if waited := time.Since(began); waited != timeout {
 			t.Errorf("the request waited %s for its answer, want %s", waited, timeout)
@@ -7,6 +7,8 @@ import (
 	"net/netip"
 	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -28,21 +30,41 @@ const (
 func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	t.Parallel()
-	s, _, _ := startWithClock(t, "", nil)
+	var calls atomic.Int32
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		calls.Add(1)
 	})
 	addr, out := startProxy(t, app.URL, nil)
 	// An empty token does not match the unset one either.
-	for _, authorization := range []string{bearer, "Bearer ", ""} {
+	for i, authorization := range []string{bearer, "Bearer ", ""} {
-		s.adminRequest(authorization, http.MethodGet, proxy.MetricsPath, "",
+		req := newRequest(t, http.MethodGet, addr, proxy.MetricsPath, http.NoBody)
-			http.StatusNotFound)
+		if authorization != "" {
 			req.Header.Set("Authorization", authorization)
 		}
 		wantStatus(t, do(t, req), http.StatusNotFound)
 		wantLine(t, out.requestLines(t, i+1)[i], http.StatusNotFound,
 			requestlog.ActionAdmin)
 	}
 	if calls.Load() != 0 {
 		t.Errorf("the app was called %d times, want never", calls.Load())
 	}
 }
 func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 	t.Parallel()
-	s, _, _ := startWithClock(t, "", map[string]string{metricsToken: token})
+	var calls atomic.Int32
-	for _, tc := range []struct {
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		calls.Add(1)
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{metricsToken: token})
 	for i, tc := range []struct {
 		method, path, authorization string
 		status                      int
 	}{
@@ -59,7 +81,14 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
 		{http.MethodPost, proxy.HealthPath, "", http.StatusNotFound},
 	} {
-		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
+		req := newRequest(t, tc.method, addr, tc.path, http.NoBody)
 		if tc.authorization != "" {
 			req.Header.Set("Authorization", tc.authorization)
 		}
 		got := do(t, req)
 		wantStatus(t, got, tc.status)
 		wantLine(t, out.requestLines(t, i+1)[i], tc.status, requestlog.ActionAdmin)
 		if tc.status == http.StatusUnauthorized &&
 			got.header.Get("WWW-Authenticate") != "Bearer" {
@@ -72,28 +101,58 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 			t.Errorf("the metrics are\n%s", got.body)
 		}
 	}
 	if calls.Load() != 0 {
 		t.Errorf("the app was called %d times, want never", calls.Load())
 	}
 }
 func TestMetricsAreAskedForThroughTheChecks(t *testing.T) {
 	t.Parallel()
 	s, _, _ := startWithClock(t, "", map[string]string{
 		metricsToken:       token,
 		rateLimitPerMinute: "1",
 	})
 	// Asking for the metrics counts toward the client's limit of one
 	// request a minute, so its next request breaks it, and bans it. A
 	// banned client is refused the metrics too.
 	s.scrape(client)
 	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 	s.requestWithHeader(client, proxy.MetricsPath, "Authorization: "+bearer,
 		http.StatusForbidden, requestlog.ActionBanned)
 }
 func TestMetricsCountTheTraffic(t *testing.T) {
 	t.Parallel()
 	arrived, release := make(chan struct{}), make(chan struct{})
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		if r.URL.Path == "/held" {
 			close(arrived)
 			<-release
 		}
 		_, _ = io.WriteString(w, "hello")
 	})
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
+	releaseApp := sync.OnceFunc(func() { close(release) })
-		map[string]string{metricsToken: token})
+	t.Cleanup(releaseApp)
 	addr, out := startProxy(t, app.URL, map[string]string{metricsToken: token})
 	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
 	wantStatus(t, got, http.StatusOK)
 	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
-	out.endedLines(t, 2)
+	out.requestLines(t, 2)
 	forward := `{action="forward",instance="app",status_class="2xx"}`
 	notFound := `{action="admin",instance="app",status_class="4xx"}`
 	// The request for the metrics is itself under way.
-	metrics := scrape(t, server.Addr)
+	metrics := scrape(t, addr)
 	wantMetric(t, metrics, "smallwebwaf_requests_total"+forward, 1)
 	wantMetric(t, metrics, "smallwebwaf_requests_total"+notFound, 1)
 	wantMetric(t, metrics, "smallwebwaf_request_bytes_total"+forward, 3)
@@ -107,20 +166,50 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 	wantMetric(t, metrics, `smallwebwaf_requests_in_flight{instance="app"}`, 1)
 	metric(t, metrics, `go_goroutines{instance="app"}`)
 	metric(t, metrics, `process_start_time_seconds{instance="app"}`)
 	// A request the app holds is under way until it ends.
 	httpClient := newClient(t)
 	held := newRequest(t, http.MethodGet, addr, "/held", http.NoBody)
 	ended := make(chan error, 1)
 	go func() {
 		res, err := httpClient.Do(held)
 		if err == nil {
 			err = readAnswer(res).err
 		}
 		ended <- err
 	}()
 	<-arrived
 	wantMetric(t, scrape(t, addr), `smallwebwaf_requests_in_flight{instance="app"}`, 2)
 	releaseApp()
 	err := <-ended
 	if err != nil {
 		t.Fatalf("held request: %v", err)
 	}
 	out.requestLines(t, 5)
 	wantMetric(t, scrape(t, addr), `smallwebwaf_requests_in_flight{instance="app"}`, 1)
 }
 func TestMetricsCountLimitsAndBans(t *testing.T) {
 	t.Parallel()
-	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
+	const (
 		scraper = "192.0.2.200" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
 		denied  = "192.0.2.50"  // in SWWAF_DENY_NETS
 	)
 	s, clk, _ := startWithClock(t, "", map[string]string{
-		metricsToken:       token,
+		metricsToken:        token,
-		rateLimitPerMinute: "1",
+		rateLimitPerMinute:  "1",
-		denyNets:           denied,
+		rateLimitExemptNets: scraper,
-		banResponse:        banResponseClose,
+		denyNets:            denied,
-		limitBanDuration:   "1h",
+		banResponse:         banResponseClose,
-		maxBanDuration:     "2h",
+		limitBanDuration:    "1h",
 		maxBanDuration:      "2h",
 	})
 	// SWWAF_BAN_RESPONSE=close sends no status at all.
@@ -130,7 +219,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionRateLimited)
-	metrics := s.scrape()
+	metrics := s.scrape(scraper)
 	wantMetric(t, metrics,
 		`smallwebwaf_requests_total{action="denied",instance="app",status_class="none"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
@@ -141,35 +230,38 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 0)
 	clk.advance(time.Hour)
-	wantMetric(t, s.scrape(), `smallwebwaf_active_bans{instance="app"}`, 0)
+	wantMetric(t, s.scrape(scraper), `smallwebwaf_active_bans{instance="app"}`, 0)
 	// A limit broken again right after would ban for three hours, longer
 	// than SWWAF_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionRateLimited)
-	metrics = s.scrape()
+	metrics = s.scrape(scraper)
 	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
 		`kind="requests",window="minute"}`, 2)
 	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 2)
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 2)
 	wantMetric(t, metrics, `smallwebwaf_active_bans{instance="app"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 1)
-	// denied and client.
+	// denied, client, and the scraper as of its earlier requests.
-	wantMetric(t, metrics, `smallwebwaf_tracked_clients{instance="app"}`, 2)
+	wantMetric(t, metrics, `smallwebwaf_tracked_clients{instance="app"}`, 3)
 }
 func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
 	s, clk, server := startWithClock(t, "", map[string]string{
-		metricsToken: token,
+		metricsToken:        token,
-		adminToken:   adminSecret,
+		adminToken:          adminSecret,
 		rateLimitExemptNets: scraper,
 	})
 	const admins = `smallwebwaf_bans_made_total{cause="admin",instance="app"}`
-	wantMetric(t, s.scrape(), admins, 0)
+	wantMetric(t, s.scrape(scraper), admins, 0)
 	// As an admin's edit of bans.json that adds a ban is taken in.
 	server.Ledger.LoadEdit([]bans.Ban{{
@@ -177,11 +269,11 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 		Start:    clk.Now(),
 	}})
-	wantMetric(t, s.scrape(), admins, 1)
+	wantMetric(t, s.scrape(scraper), admins, 1)
 	// And a ban made through the endpoint.
 	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
-	wantMetric(t, s.scrape(), admins, 2)
+	wantMetric(t, s.scrape(scraper), admins, 2)
 }
 func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
@@ -220,7 +312,7 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 			// Each is counted before the next is sent, so that the
 			// countries are ranked in the order sent.
 			lines++
-			out.endedLines(t, lines)
+			out.requestLines(t, lines)
 		}
 	}
@@ -229,7 +321,7 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 	send(fromDE, 2, http.StatusOK)
 	send(fromFR, 1, http.StatusOK)
-	metrics := scrape(t, server.Addr)
+	metrics := scrape(t, addr)
 	lines++
 	wantMetric(t, metrics,
@@ -257,7 +349,7 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 	// from then on, and DE's is gone.
 	send(fromFR, 3, http.StatusOK)
-	metrics = scrape(t, server.Addr)
+	metrics = scrape(t, addr)
 	wantMetric(t, metrics,
 		`smallwebwaf_country_requests_total{country="KP",instance="app"}`, 3)
 	wantMetric(t, metrics,
@@ -291,12 +383,13 @@ func TestMetricsByASNumberKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 		answer(fromDE, "AS64501"), answer(fromKP, "AS64502"),
 	})
-	// With one AS number of its own, the other is counted as other.
+	// With one AS number of its own, the other is counted as other. The
 	// metrics are asked for from a private address, which has no AS number.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.get(fromKP, http.StatusOK, requestlog.ActionForward)
-	metrics := s.scrape()
+	metrics := s.scrape("10.0.0.9")
 	wantMetric(t, metrics,
 		`smallwebwaf_asn_requests_total{asn="AS64501",instance="app"}`, 2)
 	wantMetric(t, metrics,
@@ -319,12 +412,11 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	t.Cleanup(geojs.Close)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, _, server := startProxyWithClock(t, app.URL, geojs.URL, time.Now,
+	addr, _ := startProxyWithGeoJS(t, app.URL, geojs.URL, map[string]string{
-		map[string]string{
+		trustedProxies:  trustLocalhost,
-			trustedProxies:  trustLocalhost,
+		metricsToken:    token,
-			metricsToken:    token,
+		deniedCountries: "kp",
-			deniedCountries: "kp",
+	})
 		})
 	// GeoJS fails, so the client counts as coming from an unknown country,
 	// which SWWAF_DENIED_COUNTRIES does not refuse.
@@ -332,16 +424,16 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
-	// The client stops waiting for GeoJS once SWWAF_LOOKUP_TIMEOUT is up, so
+	// The client stops waiting for GeoJS after a second, so GeoJS's
-	// GeoJS's failure can come after its request has ended.
+	// failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
-	metrics := scrape(t, server.Addr)
+	metrics := scrape(t, addr)
 	for metric(t, metrics, `smallwebwaf_geojs_failures_total{instance="app"}`) == 0 &&
 		time.Now().Before(deadline) {
 		time.Sleep(pollInterval)
-		metrics = scrape(t, server.Addr)
+		metrics = scrape(t, addr)
 	}
 	wantMetric(t, metrics, `smallwebwaf_geojs_requests_total{instance="app"}`, 1)
@@ -360,8 +452,8 @@ func keptAnswer(addr, country string) lookup.Answer {
 	}
 }
-// scrape asks servewaf at addr for the metrics, with the token, and returns
+// scrape asks smallwebwaf at addr for the metrics, with the token, and
-// them.
+// returns them.
 func scrape(t *testing.T, addr string) string {
 	t.Helper()
@@ -376,12 +468,15 @@ func scrape(t *testing.T, addr string) string {
 	return string(got.body)
 }
-// scrape asks for the metrics, with the token, and returns them.
+// scrape asks for the metrics, with the token, from the client at from,
-func (s *sender) scrape() string {
+// and returns them.
 func (s *sender) scrape(from string) string {
 	s.t.Helper()
-	return string(s.adminRequest(bearer, http.MethodGet, proxy.MetricsPath, "",
+	_, metrics := s.requestWithHeader(from, proxy.MetricsPath, "Authorization: "+bearer,
-		http.StatusOK).body)
+		http.StatusOK, requestlog.ActionAdmin)
 	return metrics
 }
 // metric returns the value of series in metrics, which are in the
@@ -429,3 +524,22 @@ func wantNoSeries(t *testing.T, metrics, series string) {
 		t.Errorf("there is a series %s", series)
 	}
 }
 // wantLimitHits checks that the metrics of smallwebwaf at addr count hits
 // requests that passed the size or time limit of the setting limit, with
 // no series for it when hits is 0.
 func wantLimitHits(t *testing.T, addr, limit string, hits int) {
 	t.Helper()
 	series := `smallwebwaf_size_and_time_limit_hits_total{instance="app",limit="` +
 		limit + `"}`
 	metrics := scrape(t, addr)
 	if hits == 0 {
 		wantNoSeries(t, metrics, series)
 		return
 	}
 	wantMetric(t, metrics, series, float64(hits))
 }
@@ -1,13 +1,17 @@
 package proxy_test
 import (
 	"bytes"
 	"io"
 	"net/http"
 	"net/netip"
 	"reflect"
 	"sync/atomic"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
@@ -72,6 +76,11 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 				// Passed to the app, which answered it.
 				line := s.get(sent.from, http.StatusOK, requestlog.ActionForward)
 				wantWouldAction(t, line, sent.refusal)
 				if line.UpstreamStatus != http.StatusOK {
 					t.Errorf("log line has upstream_status %d, want 200",
 						line.UpstreamStatus)
 				}
 			}
 		})
 	}
@@ -124,6 +133,62 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 	}
 }
 func TestObserveModeKeepsTheSizeLimitsAndTheToken(t *testing.T) {
 	t.Parallel()
 	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
 	var calls atomic.Int32
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		calls.Add(1)
 		answerWithSize(w, 2*sizeLimit, true)
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		mode:             observe,
 		trustedProxies:   trustLocalhost,
 		denyNets:         denied,
 		requestMaxBytes:  sizeLimitSetting,
 		responseMaxBytes: sizeLimitSetting,
 		metricsToken:     token,
 	})
 	// SWWAF_DENY_NETS would refuse each request; instead a size limit or
 	// the missing token does.
 	for i, tc := range []struct {
 		method, path string
 		body         io.Reader
 		status       int
 		action       string
 	}{
 		{
 			http.MethodPost, "/upload", bytes.NewReader(make([]byte, 2*sizeLimit)),
 			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge,
 		},
 		{
 			http.MethodGet, "/download", http.NoBody,
 			http.StatusBadGateway, requestlog.ActionTooLarge,
 		},
 		{
 			http.MethodGet, proxy.MetricsPath, http.NoBody,
 			http.StatusUnauthorized, requestlog.ActionAdmin,
 		},
 	} {
 		req := newRequest(t, tc.method, addr, tc.path, tc.body)
 		req.Header.Set(forwardedFor, denied)
 		wantStatus(t, do(t, req), tc.status)
 		line := out.requestLines(t, i+1)[i]
 		wantLine(t, line, tc.status, tc.action)
 		wantWouldAction(t, line, requestlog.ActionDenied)
 	}
 	// The upload was refused before it reached the app.
 	if calls.Load() != 1 {
 		t.Errorf("the app was called %d times, want once", calls.Load())
 	}
 }
 // wantWouldAction checks the request log line's would_action, and that a
 // line that should have none has no such field.
 func wantWouldAction(t *testing.T, line logLine, want string) {
@@ -0,0 +1,556 @@
 package proxy_test
 import (
 	"bufio"
 	"bytes"
 	"errors"
 	"io"
 	"net/http"
 	"reflect"
 	"slices"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 // A request target with an escaped slash and space in its path, and a
 // query with a parameter ReverseProxy cannot parse.
 const (
 	rawPath  = "/some%2Fpath/with%20space"
 	rawQuery = "b=2&a=1&bad=%zz;x"
 )
 // chunkSize is the size of each part of a body a test sends in parts.
 const chunkSize = 1 << 10
 var errNotStreamed = errors.New("the first part never reached the app")
 // appSaw is what the app received.
 type appSaw struct {
 	method string
 	target string
 	header http.Header
 	body   []byte
 }
 func TestPassesRequestAndAnswerUnchanged(t *testing.T) {
 	t.Parallel()
 	requestBody := bytes.Repeat([]byte("request body "), 8000)
 	answerBody := bytes.Repeat([]byte("answer body "), 8000)
 	saw := make(chan appSaw, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		body, _ := io.ReadAll(r.Body)
 		saw <- appSaw{r.Method, r.RequestURI, r.Header.Clone(), body}
 		w.Header().Set("X-App", "yes")
 		w.Header().Add("Set-Cookie", "a=1")
 		w.Header().Add("Set-Cookie", "b=2")
 		w.WriteHeader(http.StatusTeapot)
 		_, _ = w.Write(answerBody)
 	})
 	addr, out := startProxy(t, app.URL, nil)
 	req := newRequest(t, http.MethodPatch, addr, rawPath+"?"+rawQuery,
 		bytes.NewReader(requestBody))
 	req.Header.Add("X-Test", "one")
 	req.Header.Add("X-Test", "two")
 	req.Header.Set("User-Agent", "test-agent")
 	got := do(t, req)
 	wantAppSaw(t, <-saw, requestBody)
 	wantAnswer(t, got, answerBody)
 	line := out.requestLine(t)
 	wantLine(t, line, http.StatusTeapot, requestlog.ActionForward)
 	wantRequestFields(t, line, addr, len(requestBody), len(answerBody))
 }
 func TestPassesThePathAsSent(t *testing.T) {
 	t.Parallel()
 	for _, path := range []string{
 		// An encoded slash and a character Go escapes: |, ^, and é sent
 		// as its UTF-8 bytes.
 		"/a%2Fb|c", "/feat%2Fx/file^1", "/x%2Fy/café",
 		// A path starting with //, which Go would send as a scheme and
 		// host if it were put in URL.Opaque.
 		"//a%2Fb",
 	} {
 		t.Run(path, func(t *testing.T) {
 			t.Parallel()
 			saw := make(chan string, 1)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				saw <- r.RequestURI
 			})
 			addr, out := startProxy(t, app.URL, nil)
 			conn := dial(t, addr)
 			send(t, conn, "GET "+path+"?q=1 HTTP/1.1\r\nHost: "+appHost+"\r\n\r\n")
 			got := readResponse(t, conn)
 			if got.status != http.StatusOK {
 				t.Fatalf("status %d, want %d", got.status, http.StatusOK)
 			}
 			target := <-saw
 			if target != path+"?q=1" {
 				t.Errorf("app saw %s, want %s", target, path+"?q=1")
 			}
 			line := out.requestLine(t)
 			if line.Path != path {
 				t.Errorf("log line has path %s, want %s", line.Path, path)
 			}
 		})
 	}
 }
 // wantAppSaw checks that the app received the test's request unchanged.
 func wantAppSaw(t *testing.T, saw appSaw, body []byte) {
 	t.Helper()
 	if saw.method != http.MethodPatch || saw.target != rawPath+"?"+rawQuery {
 		t.Errorf("app saw %s %s, want %s %s", saw.method, saw.target,
 			http.MethodPatch, rawPath+"?"+rawQuery)
 	}
 	if !slices.Equal(saw.header.Values("X-Test"), []string{"one", "two"}) {
 		t.Errorf("app saw X-Test %q", saw.header.Values("X-Test"))
 	}
 	if saw.header.Get("User-Agent") != "test-agent" {
 		t.Errorf("app saw User-Agent %q", saw.header.Get("User-Agent"))
 	}
 	if !bytes.Equal(saw.body, body) {
 		t.Errorf("app saw a body of %d bytes, want the %d sent",
 			len(saw.body), len(body))
 	}
 }
 // wantAnswer checks that the client received the app's answer unchanged.
 func wantAnswer(t *testing.T, got answer, body []byte) {
 	t.Helper()
 	wantStatus(t, got, http.StatusTeapot)
 	if got.header.Get("X-App") != "yes" {
 		t.Errorf("client got X-App %q", got.header.Get("X-App"))
 	}
 	if !slices.Equal(got.header.Values("Set-Cookie"), []string{"a=1", "b=2"}) {
 		t.Errorf("client got Set-Cookie %q", got.header.Values("Set-Cookie"))
 	}
 	if got.err != nil || !bytes.Equal(got.body, body) {
 		t.Errorf("client got %d bytes (%v), want the %d the app sent",
 			len(got.body), got.err, len(body))
 	}
 }
 // wantRequestFields checks the log line's fields about the request. Its
 // time, its id and its timings are checked only for being there.
 func wantRequestFields(t *testing.T, line logLine, host string, sent, received int) {
 	t.Helper()
 	bytes := float64(sent + received)
 	want := withTimings(line, requestlog.Line{
 		Type: requestType, Time: line.Time, Instance: "app",
 		ClientIP: localhost, Method: http.MethodPatch, Scheme: plain, Host: host,
 		Path: rawPath, Query: rawQuery, Protocol: protocol,
 		Status: http.StatusTeapot, RequestBytes: int64(sent),
 		ResponseBytes: int64(received), UserAgent: "test-agent",
 		RequestID: line.RequestID, PeerIP: localhost, ClientGroup: localhost + "/32",
 		ContentLength: int64(sent), ResponseContentType: "text/plain; charset=utf-8",
 		UpstreamStatus: http.StatusTeapot, Action: requestlog.ActionForward,
 		Counts: ratelimit.Counts{
 			Minute: 1, Hour: 1, Day: 1,
 			MinuteBytes: bytes, HourBytes: bytes, DayBytes: bytes,
 		},
 	})
 	if !reflect.DeepEqual(line.Line, want) {
 		t.Errorf("log line\n%+v\nwant\n%+v", line.Line, want)
 	}
 	_, err := time.Parse(time.RFC3339, line.Time)
 	if err != nil || line.RequestID == "" || line.DurationTotal <= 0 ||
 		line.DurationUpstreamTotal == nil || *line.DurationUpstreamTotal <= 0 {
 		t.Errorf("log line has time %q, request_id %q and durations %v and %v",
 			line.Time, line.RequestID, line.DurationTotal,
 			line.fields["duration_upstream_total"])
 	}
 }
 func TestAddsNoContentTypeTheAppDidNotSend(t *testing.T) {
 	t.Parallel()
 	const typed = "text/plain"
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/typed" {
 			w.Header().Set("Content-Type", typed)
 		} else {
 			// The key with no value keeps Go's server from adding one.
 			w.Header()["Content-Type"] = nil
 		}
 		_, _ = io.WriteString(w, "<!doctype html><title>page</title>")
 	})
 	addr, _ := startProxy(t, app.URL, nil)
 	got := get(t, addr, "/")
 	if got.header.Values("Content-Type") != nil {
 		t.Errorf("client got Content-Type %q, want none",
 			got.header.Get("Content-Type"))
 	}
 	got = get(t, addr, "/typed")
 	if got.header.Get("Content-Type") != typed {
 		t.Errorf("client got Content-Type %q, want %q",
 			got.header.Get("Content-Type"), typed)
 	}
 }
 func TestStreamsTheRequestBody(t *testing.T) {
 	t.Parallel()
 	chunk := bytes.Repeat([]byte("x"), chunkSize)
 	firstArrived := make(chan struct{})
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		first := make([]byte, len(chunk))
 		_, err := io.ReadFull(r.Body, first)
 		if err != nil {
 			return
 		}
 		close(firstArrived)
 		rest, _ := io.ReadAll(r.Body)
 		_, _ = w.Write(rest)
 	})
 	addr, _ := startProxy(t, app.URL, nil)
 	body, writer := io.Pipe()
 	go func() {
 		_, _ = writer.Write(chunk)
 		select {
 		case <-firstArrived:
 			_, _ = writer.Write(chunk)
 			_ = writer.Close()
 		case <-time.After(waitLimit):
 			_ = writer.CloseWithError(errNotStreamed)
 		}
 	}()
 	got := do(t, newRequest(t, http.MethodPost, addr, "/upload", body))
 	if got.err != nil || !bytes.Equal(got.body, chunk) {
 		t.Errorf("app read %d bytes after the first part (%v), want %d",
 			len(got.body), got.err, len(chunk))
 	}
 }
 func TestStreamsTheAnswerBody(t *testing.T) {
 	t.Parallel()
 	chunk := bytes.Repeat([]byte("y"), chunkSize)
 	firstArrived := make(chan struct{})
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = w.Write(chunk)
 		_ = http.NewResponseController(w).Flush()
 		select {
 		case <-firstArrived:
 			_, _ = w.Write(chunk)
 		case <-time.After(waitLimit):
 		}
 	})
 	addr, _ := startProxy(t, app.URL, nil)
 	req := newRequest(t, http.MethodGet, addr, "/download", http.NoBody)
 	res, err := newClient(t).Do(req)
 	if err != nil {
 		t.Fatalf("request: %v", err)
 	}
 	first := make([]byte, len(chunk))
 	_, err = io.ReadFull(res.Body, first)
 	close(firstArrived)
 	got := readAnswer(res)
 	if err != nil || got.err != nil || !bytes.Equal(got.body, chunk) {
 		t.Errorf("client read %d bytes after the first part (%v, %v), want %d",
 			len(got.body), err, got.err, len(chunk))
 	}
 }
 func TestUpgradedConnectionOutlastsTheTimeouts(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, echoAfterUpgrade)
 	addr, out := startProxy(t, app.URL, map[string]string{
 		clientRequestTimeout:    shortTimeoutSetting,
 		clientResponseTimeout:   shortTimeoutSetting,
 		upstreamRequestTimeout:  shortTimeoutSetting,
 		upstreamResponseTimeout: shortTimeoutSetting,
 	})
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
 		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
 	reader := bufio.NewReader(conn)
 	res, err := http.ReadResponse(reader, nil)
 	if err != nil {
 		t.Fatalf("read the answer to the upgrade: %v", err)
 	}
 	answered := time.Now()
 	_ = res.Body.Close()
 	if res.StatusCode != http.StatusSwitchingProtocols {
 		t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
 	}
 	// Every timeout started before the upgrade was answered, the response
 	// timeouts last, at the end of the request: wait until just past
 	// shortTimeout after the answer was read, then use the connection.
 	time.Sleep(time.Until(answered.Add(shortTimeout + 100*time.Millisecond)))
 	send(t, conn, "still here\n")
 	echoed, err := reader.ReadString('\n')
 	if err != nil || echoed != "still here\n" {
 		t.Errorf("echo %q (%v), want %q", echoed, err, "still here\n")
 	}
 	_ = conn.Close()
 	wantLine(t, out.requestLine(t), http.StatusSwitchingProtocols,
 		requestlog.ActionForward)
 }
 // echoAfterUpgrade is an app that switches protocols on request, and then
 // sends back each line it receives.
 func echoAfterUpgrade(w http.ResponseWriter, r *http.Request) {
 	if r.Header.Get("Upgrade") != "websocket" {
 		http.Error(w, "not an upgrade", http.StatusBadRequest)
 		return
 	}
 	conn, buffered, err := http.NewResponseController(w).Hijack()
 	if err != nil {
 		return
 	}
 	defer func() {
 		_ = conn.Close()
 	}()
 	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
 		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
 	_ = buffered.Flush()
 	for {
 		line, err := buffered.ReadString('\n')
 		if err != nil {
 			return
 		}
 		_, _ = buffered.WriteString(line)
 		_ = buffered.Flush()
 	}
 }
 func TestAnswers502WhenTheAppSwitchesToAnotherProtocol(t *testing.T) {
 	t.Parallel()
 	// answerAfterUpgrade switches to websocket whatever the client asked
 	// for, and ReverseProxy passes on a switch only to the protocol the
 	// client asked for, here "websocket, foo".
 	app := startApp(t, answerAfterUpgrade)
 	addr, out := startProxy(t, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET /ws HTTP/1.1\r\nHost: app\r\n"+
 		"Connection: Upgrade\r\nUpgrade: websocket, foo\r\n\r\n")
 	wantStatus(t, readResponse(t, conn), http.StatusBadGateway)
 	wantLine(t, out.requestLine(t), http.StatusBadGateway, requestlog.ActionUpstreamError)
 }
 func TestServerHasTheDefaultLimits(t *testing.T) {
 	t.Parallel()
 	cfg, err := config.FromEnvironment(func(string) (string, bool) { return "", false })
 	if err != nil {
 		t.Fatalf("default settings: %v", err)
 	}
 	server := proxy.New(proxy.Params{
 		Config:     cfg,
 		RequestLog: io.Discard,
 		ProcessLog: requestlog.NewProcessLogger(io.Discard, cfg.InstanceName, cfg.LogLevel),
 	})
 	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
 		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
 		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
 			"header timeout %s", server.Addr, server.MaxHeaderBytes,
 			server.IdleTimeout, server.ReadHeaderTimeout)
 	}
 }
 func TestRefusesHeadersOverTheLimit(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name  string
 		env   map[string]string
 		limit int
 	}{
 		{"by default", nil, 32 << 10},
 		{"as set", map[string]string{clientHeaderMaxBytes: "8K"}, 8 << 10},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			var calls atomic.Int32
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				calls.Add(1)
 			})
 			addr, _ := startProxy(t, app.URL, tc.env)
 			// size counts every byte of the request: the request line,
 			// the headers and the blank line that ends them.
 			const (
 				start = "GET / HTTP/1.1\r\nHost: app\r\nX-Large: "
 				end   = "\r\n\r\n"
 			)
 			for _, sent := range []struct{ size, want int }{
 				{tc.limit, http.StatusOK},
 				{tc.limit + 1, http.StatusRequestHeaderFieldsTooLarge},
 			} {
 				conn := dial(t, addr)
 				send(t, conn,
 					start+strings.Repeat("a", sent.size-len(start)-len(end))+end)
 				wantStatus(t, readResponse(t, conn), sent.want)
 			}
 			if calls.Load() != 1 {
 				t.Errorf("the app was called %d times, want once", calls.Load())
 			}
 		})
 	}
 }
 func TestAnswers502WhenTheAppCannotBeReached(t *testing.T) {
 	t.Parallel()
 	// No test can listen on port 1: listening on port 0 gets one from 32768 up.
 	addr, out := startProxy(t, "http://"+localhost+":1", nil)
 	wantStatus(t, get(t, addr, "/"), http.StatusBadGateway)
 	line := out.requestLine(t)
 	wantLine(t, line, http.StatusBadGateway, requestlog.ActionUpstreamError)
 	// There never was a connection to the app, nor an answer from it.
 	wantTimings(t, line, "duration_total", "duration_checks",
 		"duration_upstream_total")
 	logged := slices.ContainsFunc(out.lines(t), func(line map[string]any) bool {
 		return line["type"] == "process" && line["msg"] == "request to the app failed"
 	})
 	if !logged {
 		t.Errorf("no process line says the request to the app failed")
 	}
 }
 func TestLogLevelHoldsBackNoRequestLine(t *testing.T) {
 	t.Parallel()
 	// At error the warning that the request to the app failed is held back,
 	// and is written before the answer is.
 	addr, out := startProxy(t, "http://"+localhost+":1", map[string]string{
 		"SWWAF_LOG_LEVEL": "error",
 	})
 	wantStatus(t, get(t, addr, "/"), http.StatusBadGateway)
 	wantLine(t, out.requestLine(t), http.StatusBadGateway, requestlog.ActionUpstreamError)
 	for _, line := range out.lines(t) {
 		if line["type"] == "process" {
 			t.Errorf("process line %v, want none at error", line)
 		}
 	}
 }
 func TestLogsAnAnswerThatBrokeOff(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, "the first part")
 		_ = http.NewResponseController(w).Flush()
 		panic(http.ErrAbortHandler) // drops the connection mid-answer
 	})
 	addr, out := startProxy(t, app.URL, nil)
 	got := get(t, addr, "/")
 	if string(got.body) != "the first part" || !errors.Is(got.err, io.ErrUnexpectedEOF) {
 		t.Errorf("client read %q (%v), want the first part cut off", got.body, got.err)
 	}
 	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionUpstreamError)
 }
 func TestLogsAClientThatWentAway(t *testing.T) {
 	t.Parallel()
 	arrived := make(chan struct{})
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(arrived)
 		<-r.Context().Done()
 	})
 	addr, out := startProxy(t, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET /slow HTTP/1.1\r\nHost: app\r\n\r\n")
 	select {
 	case <-arrived:
 	case <-time.After(waitLimit):
 		t.Fatal("the request never reached the app")
 	}
 	_ = conn.Close()
 	line := out.requestLine(t)
 	if !line.Aborted || line.Status != 0 || line.Action != requestlog.ActionForward {
 		t.Errorf("log line has aborted %v, status %d and action %q, "+
 			"want true, 0 and %q",
 			line.Aborted, line.Status, line.Action, requestlog.ActionForward)
 	}
 }
@@ -1,15 +1,16 @@
-// Package proxy is servewaf's server. It runs the checks on the request each of
+// Package proxy runs the checks on each request and writes its request log
-// rproxy's questions carries, and answers rproxy what to do with that request. It
+// line. New passes each request it lets through to the app and the app's
-// takes rproxy's report once the visitor's answer has ended, which counts the
+// answer back, unchanged, within the size and time limits. NewServeWAF instead
-// request's bytes and writes its last log line. It answers servewaf's own
+// answers rproxy's question about each request, and takes rproxy's report once
-// endpoints: the health check, the metrics, the bans and the clients. It passes
+// the visitor's answer has ended, which writes the request a second log line.
 // nothing to an app: internal/rproxy does that.
 package proxy
 import (
 	"io"
 	"log"
 	"log/slog"
 	"net/http"
 	"strings"
 	"time"
 	lru "github.com/hashicorp/golang-lru/v2"
@@ -26,12 +27,18 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
-// adminPrefix starts the path of each of servewaf's own endpoints. The app never
+// How smallwebwaf keeps connections to the app open between requests.
-// sees a path under it.
+const (
 	appIdleConns       = 100
 	appIdleConnTimeout = 90 * time.Second
 )
 // adminPrefix starts the path of every request for smallwebwaf itself,
 // which never reaches the app.
 const adminPrefix = "/_smallwebwaf/"
-// HealthPath is the health endpoint of servewaf and of rproxy, which the
+// HealthPath is smallwebwaf's health endpoint, which the container's
-// container's health check asks.
+// health check asks.
 const HealthPath = "/_smallwebwaf/healthz"
 // MetricsPath is where the metrics are, for a request that carries
@@ -42,15 +49,15 @@ const MetricsPath = "/_smallwebwaf/metrics"
 // a client's address, lifts them, with SWWAF_ADMIN_TOKEN.
 const BansPath = "/_smallwebwaf/bans"
-// ClientsPath is where an admin asks what servewaf knows of a client, by the
+// ClientsPath is where an admin asks what smallwebwaf knows of a client,
-// client's address after it, with SWWAF_ADMIN_TOKEN.
+// by the client's address after it, with SWWAF_ADMIN_TOKEN.
 const ClientsPath = "/_smallwebwaf/clients/"
-// Params are what NewServeWAF needs.
+// Params are what New needs.
 type Params struct {
 	Config *config.Config
-	// RequestLog receives two JSON lines per question, one at its decision and
+	// RequestLog receives one JSON line per request, and from servewaf a second
-	// one when its report comes, and one per request to servewaf's own endpoints.
+	// when the request's report comes.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
@@ -70,7 +77,7 @@ type Params struct {
 	// Rules are the rule files' rules, which each request is checked
 	// against.
 	Rules *rules.Files
-	// Alerts receive the alert for each ban servewaf makes or makes
+	// Alerts receive the alert for each ban the proxy makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
 	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
 	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
@@ -80,10 +87,11 @@ type Params struct {
 	Alerts *alerts.Queue
 }
-// Server is the server servewaf runs, with the parts whose state the state
+// Server is the server smallwebwaf runs, with the parts of the proxy
-// files keep, the lookup database, nil unless SWWAF_LOOKUP_SOURCE is file, the
+// whose state the state files keep, the lookup database, nil unless
-// lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
+// SWWAF_LOOKUP_SOURCE is file, the lists fetched from URLs, which its Run
-// AbuseIPDB's scores and checks spent, and the metrics.
+// fetches, the DNSBL zones' verdicts, AbuseIPDB's scores and checks
 // spent, and the metrics.
 type Server struct {
 	*http.Server
@@ -98,24 +106,41 @@ type Server struct {
 	Metrics    *metrics.Metrics
 }
 // New returns the server smallwebwaf runs: each request it reads passes
 // through the proxy. Go's server itself refuses a request line and
 // headers over SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES, with 431, closes a
 // connection idle for SWWAF_CLIENT_IDLE_TIMEOUT, and applies
 // SWWAF_CLIENT_REQUEST_TIMEOUT while the headers arrive; the proxy
 // applies the timeouts and size limits from then on.
 func New(params Params) *Server {
 	h := newHandler(params)
 	return h.server(&http.Server{
 		Handler:           h,
 		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
 		// Off is an IdleTimeout of 0, which Go's server replaces with
 		// ReadTimeout: no limit, as long as ReadTimeout stays unset.
 		IdleTimeout: params.Config.ClientIdleTimeout,
 		// Go's server reads 4 KiB past MaxHeaderBytes before it
 		// refuses, so the limit a client meets is the setting.
 		MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
 	})
 }
 // newHandler returns the handler with what every request shares, as the
 // settings in params make it.
 func newHandler(params Params) *handler {
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	m := metrics.New(params.Config.MetricsTopN, params.Config.InstanceName)
 	lists, dnsbl, abuseIPDB := newReputation(params, m)
 	awaitingReport, err := lru.New[string, *decision](maxAwaitingReport)
 	if err != nil {
 		panic(err) // New fails only for a size below one
 	}
 	h := &handler{
-		config:         params.Config,
+		config:     params.Config,
-		requestLog:     params.RequestLog,
+		requestLog: params.RequestLog,
-		processLog:     params.ProcessLog,
+		processLog: params.ProcessLog,
-		now:            params.Now,
+		errorLog:   errorLog,
-		metrics:        m,
+		transport:  newTransport(),
-		awaitingReport: awaitingReport,
+		now:        params.Now,
 		metrics:    m,
 		limiter: ratelimit.New(ratelimit.Limits{
 			PerMinute:      params.Config.RateLimitPerMinute,
 			PerHour:        params.Config.RateLimitPerHour,
@@ -207,10 +232,7 @@ func newReputation(
 // newCoreRuleSet returns the Core Rule Set at SWWAF_WAF_PARANOIA_LEVEL,
 // without the rules SWWAF_WAF_DISABLED_RULES switches off, reading bodies
-// up to SWWAF_WAF_BODY_LIMIT, or nil while SWWAF_WAF_MODE is off. It reads at
+// up to SWWAF_WAF_BODY_LIMIT, or nil while SWWAF_WAF_MODE is off.
 // most QuestionBodyMaxBytes less one byte: a question's body of
 // QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
 // JSON or XML body over its limit.
 func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
 	if cfg.WAFMode == config.WAFModeOff {
 		return nil
@@ -218,24 +240,26 @@ func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
 	coreRuleSet, err := waf.New(waf.Params{
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
-		BodyLimit: min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
+		BodyLimit: cfg.WAFBodyLimit,
 	})
 	if err != nil {
 		// The Core Rule Set is built in, and the settings cannot break it:
-		// the paranoia level is from 1 to 4, and the id of no rule switches
+		// the paranoia level is from 1 to 4, the body limit at most 1G, and
-		// nothing off.
+		// the id of no rule switches nothing off.
 		panic(err)
 	}
 	return coreRuleSet
 }
-// handler is servewaf's handler. It holds what every request shares; what
+// handler is the proxy. It holds what every request shares; what belongs
-// belongs to one request is in a request.
+// to one request is in a request.
 type handler struct {
 	config      *config.Config
 	requestLog  io.Writer
 	processLog  *slog.Logger
 	errorLog    *log.Logger
 	transport   http.RoundTripper
 	now         func() time.Time
 	metrics     *metrics.Metrics
 	limiter     *ratelimit.Limiter
@@ -249,7 +273,88 @@ type handler struct {
 	rules       *rules.Files
 	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue
-	// awaitingReport holds the decision on each answered question by its id
+	// awaitingReport holds, in servewaf, the decision on each answered
-	// until its report comes, and nil for a question still being handled.
+	// question by its id until its report comes, and nil for a question still
 	// being handled.
 	awaitingReport *lru.Cache[string, *decision]
 }
 // newTransport returns what carries requests to the app. It never goes
 // through a proxy named in the environment, and leaves the app's answers
 // compressed or not as the app sent them.
 func newTransport() *http.Transport {
 	return &http.Transport{
 		MaxIdleConns:        appIdleConns,
 		MaxIdleConnsPerHost: appIdleConns,
 		IdleConnTimeout:     appIdleConnTimeout,
 		DisableCompression:  true,
 	}
 }
 // ServeHTTP handles one request: it works out the client, runs the
 // checks, passes the request to the app and the answer back within the
 // limits, or answers it itself if it is for smallwebwaf, and writes the
 // request's log line.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish()
 	// The health endpoint is answered at once, before any check, so that
 	// a health checker is never refused. It does not ask the app.
 	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
 		rq.answerHealth()
 		return
 	}
 	// Once the request has ended, before its log line is written. The
 	// last deferred runs first: countRefusal before addToHistory, so that
 	// a broken error burst is in the client's history.
 	defer rq.addToHistory()
 	defer rq.countAnomalies()
 	defer rq.countRefusal()
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()
 	if refused != nil {
 		rq.answer(*refused)
 		return
 	}
 	// A request for smallwebwaf itself is answered where another would be
 	// passed to the app, so that it goes through every check first.
 	if strings.HasPrefix(r.URL.Path, adminPrefix) {
 		rq.answerAdmin()
 		return
 	}
 	// Once the response has ended, before the request is added to its
 	// client's history. Deferred, since ReverseProxy panics to end a
 	// response it cannot finish.
 	defer rq.countBytes()
 	rq.forward(r.Context())
 }
 // server returns the Server of h, which listens at SWWAF_LISTEN_ADDR and
 // logs through h, with what httpServer sets.
 func (h *handler) server(httpServer *http.Server) *Server {
 	httpServer.Addr = h.config.ListenAddr
 	httpServer.ErrorLog = h.errorLog
 	return &Server{
 		Server:     httpServer,
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
 		GeoJS:      h.geojs,
 		Anomalies:  h.anomalies,
 		LookupFile: h.lookupFile,
 		Lists:      h.lists,
 		DNSBL:      h.dnsbl,
 		AbuseIPDB:  h.abuseIPDB,
 		Metrics:    h.metrics,
 	}
 }
@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"io"
 	"log/slog"
 	"maps"
 	"net"
 	"net/http"
@@ -20,76 +19,78 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 const (
 	// shortTimeout is what a test sets a timeout to, to see it run out.
 	// It starts before the test has set up its case, such as an upgrade
 	// or the app's buffers filling, so it is as long as the hold-up of the
 	// test process that wantTimedOut allows: a shorter one can run out
 	// first on a busy host.
 	shortTimeout = waitLimit / 2
 	// longTimeoutSetting is a timeout that does not run out in a test.
 	longTimeoutSetting = "1m"
 	// waitLimit bounds how long a test waits for what should happen.
 	waitLimit = 10 * time.Second
 	// pollInterval is how often a test looks for a log line.
 	pollInterval = 10 * time.Millisecond
-	// localhost is where every test server listens, and so the address rproxy
+	// localhost is where every test server listens, and so the address
-	// sees each test's requests come from.
+	// smallwebwaf sees each test's requests come from.
 	localhost = "127.0.0.1"
 	// requestType is the type that marks a request log line.
 	requestType = "request"
-	// protocol is the protocol of every question.
+	// protocol is the protocol of every test's requests.
 	protocol = "HTTP/1.1"
 	// trustLocalhost trusts the address every test connects from, and a
 	// network for proxies in front of it.
 	trustLocalhost = localhost + "/32,10.0.0.0/8"
 	// appHost is the host every test asks for.
 	appHost = "app.example"
 	// client is the client's address, as a proxy names it.
 	client = "203.0.113.9"
 	// forwardedFor is the header that lists the client and its proxies,
 	// and forwardedProto the one that gives the scheme the client used.
 	forwardedFor   = "X-Forwarded-For"
 	forwardedProto = "X-Forwarded-Proto"
 	// secure is the scheme a client reached traefik with, and plain the one
 	// rproxy serves.
 	secure = "https"
 	plain  = "http"
 )
 // shortTimeoutSetting is shortTimeout as a setting's value.
 //
 //nolint:gochecknoglobals // a constant cannot call String
 var shortTimeoutSetting = shortTimeout.String()
 // The settings the tests set.
 const (
-	mode                 = "SWWAF_MODE"
+	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
-	trustedProxies       = "SWRP_TRUSTED_PROXIES"
+	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
-	ipv6GroupPrefix      = "SWWAF_IPV6_GROUP_PREFIX"
+	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
-	maxTrackedClients    = "SWWAF_MAX_TRACKED_CLIENTS"
+	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	allowNets            = "SWWAF_ALLOW_NETS"
+	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
-	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
+	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
-	denyNets             = "SWWAF_DENY_NETS"
+	mode                    = "SWWAF_MODE"
-	rateLimitPerMinute   = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
-	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
+	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
-	rateLimitExemptPaths = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
-	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	ipv6GroupPrefix         = "SWWAF_IPV6_GROUP_PREFIX"
-	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
+	maxTrackedClients       = "SWWAF_MAX_TRACKED_CLIENTS"
-	lookupTimeout        = "SWWAF_LOOKUP_TIMEOUT"
+	allowNets               = "SWWAF_ALLOW_NETS"
-	addLookupHeaders     = "SWWAF_ADD_LOOKUP_HEADERS"
+	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
-	deniedCountries      = "SWWAF_DENIED_COUNTRIES"
+	denyNets                = "SWWAF_DENY_NETS"
-	allowedCountries     = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
-	banResponse          = "SWWAF_BAN_RESPONSE"
+	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
-	limitBanDuration     = "SWWAF_LIMIT_BAN_DURATION"
+	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
-	limitBanRepeatWindow = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	lookupSource            = "SWWAF_LOOKUP_SOURCE"
-	maxBanDuration       = "SWWAF_MAX_BAN_DURATION"
+	lookupDBPath            = "SWWAF_LOOKUP_DB_PATH"
-	maxBans              = "SWWAF_MAX_BANS"
+	lookupTimeout           = "SWWAF_LOOKUP_TIMEOUT"
-	banScopeV4Prefix     = "SWWAF_BAN_SCOPE_V4_PREFIX"
+	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
-	instanceName         = "SWWAF_INSTANCE_NAME"
+	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
-	logRequestHeaders    = "SWWAF_LOG_REQUEST_HEADERS"
+	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	attackBanDuration    = "SWWAF_ATTACK_BAN_DURATION"
+	banResponse             = "SWWAF_BAN_RESPONSE"
-	rulesDir             = "SWWAF_RULES_DIR"
+	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
-	wafMode              = "SWWAF_WAF_MODE"
+	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
 	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
 	maxBans                 = "SWWAF_MAX_BANS"
 	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
 	instanceName            = "SWWAF_INSTANCE_NAME"
 	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
 	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
 	rulesDir                = "SWWAF_RULES_DIR"
 	wafMode                 = "SWWAF_WAF_MODE"
 )
 // off is the value that switches a setting off.
 const off = "off"
 // on is the value that switches a setting that takes true or false on.
 const on = "true"
 // output collects what smallwebwaf writes on stdout.
 type output struct {
 	mu  sync.Mutex
@@ -175,73 +176,6 @@ func (o *output) requestLine(t *testing.T) logLine {
 	return o.requestLines(t, 1)[0]
 }
 // endedLines waits for count requests that went through rproxy, or to servewaf's
 // own endpoints, to have ended, and returns the last log line of each, in the
 // order servewaf took them. A question's last line is the one its report writes.
 func (o *output) endedLines(t *testing.T, count int) []logLine {
 	t.Helper()
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
 		found := o.lastLines(t)
 		ended := len(found) >= count
 		for _, line := range found[:min(count, len(found))] {
 			if line.ServeWAFLine == requestlog.ServeWAFLineDecision {
 				ended = false
 			}
 		}
 		if ended {
 			return found
 		}
 		time.Sleep(pollInterval)
 	}
 	t.Fatalf("fewer than %d requests have ended after %s", count, waitLimit)
 	return nil
 }
 // lastLines returns the last request log line written so far of each request,
 // in the order servewaf took them.
 func (o *output) lastLines(t *testing.T) []logLine {
 	t.Helper()
 	var found []logLine
 	places := map[string]int{}
 	for _, fields := range o.lines(t) {
 		if fields["type"] != requestType {
 			continue
 		}
 		line := decodeLine(t, fields)
 		place, seen := places[line.RequestID]
 		if seen {
 			found[place] = line
 			continue
 		}
 		places[line.RequestID] = len(found)
 		found = append(found, line)
 	}
 	return found
 }
 // endedLine waits for a test's one request to have ended, and returns its last
 // log line.
 func (o *output) endedLine(t *testing.T) logLine {
 	t.Helper()
 	return o.endedLines(t, 1)[0]
 }
 // decodeLine reads a request log line's fields into a logLine.
 func decodeLine(t *testing.T, fields map[string]any) logLine {
 	t.Helper()
@@ -261,7 +195,7 @@ func decodeLine(t *testing.T, fields map[string]any) logLine {
 	return line
 }
-// startApp starts app as the app rproxy passes requests to.
+// startApp starts app as the app smallwebwaf passes requests to.
 func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 	t.Helper()
@@ -271,9 +205,9 @@ func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 	return server
 }
-// startProxy starts servewaf, and rproxy in front of the app at appURL, each with
+// startProxy starts smallwebwaf in front of the app at appURL, with the
-// the settings in env on top of the defaults, and returns where rproxy listens
+// settings in env on top of the defaults, and returns where it listens and
-// and what servewaf writes.
+// what it writes.
 func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
 	t.Helper()
@@ -293,10 +227,10 @@ func startProxyWithGeoJS(
 }
 // startProxyWithClock is startProxyWithGeoJS with requests counted and
-// bans made by the time now tells, and returns servewaf's server as well, whose
+// bans made by the time now tells, and returns the server as well. Unless
-// Addr is where servewaf listens. Unless env sets SWWAF_RULES_DIR, it is an empty
+// env sets SWWAF_RULES_DIR, it is an empty directory, of no rules, and
-// directory, of no rules, and unless it sets SWWAF_INSTANCE_NAME, that is app,
+// unless it sets SWWAF_INSTANCE_NAME, that is app, the label instance of
-// the label instance of every metric.
+// every metric.
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
@@ -309,70 +243,14 @@ func startProxyWithClock(
 }
 // startProxyWithAlerts is startProxyWithClock, and returns the queue of
-// the alerts servewaf raises as well, as newServeWAF makes them.
+// the alerts the proxy raises as well, as newProxy makes them.
 func startProxyWithAlerts(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
 ) (string, *output, *proxy.Server, *alerts.Queue) {
 	t.Helper()
-	server, out, alertQueue := newServeWAF(t, geojsURL, now, env)
+	server, out, alertQueue := newProxy(t, appURL, geojsURL, now, env)
 	serve(t, server)
 	return startRProxy(t, server.Addr, appURL, env), out, server, alertQueue
 }
 // serve serves server on a port of its own until the test ends, and sets its
 // Addr to where it listens.
 func serve(t *testing.T, server *proxy.Server) {
 	t.Helper()
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	server.Addr = listener.Addr().String()
 	go func() {
 		_ = server.Serve(listener)
 	}()
 	t.Cleanup(func() {
 		_ = server.Close()
 	})
 }
 // startRProxy starts rproxy in front of the app at appURL, asking the servewaf
 // at serveWAFAddr, with the settings in env on top of the defaults, and returns
 // where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless
 // env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide.
 func startRProxy(
 	t *testing.T, serveWAFAddr, appURL string, env map[string]string,
 ) string {
 	t.Helper()
 	settings := map[string]string{
 		"SWRP_WAF_BACKEND":  "http://" + serveWAFAddr,
 		"SWRP_UPSTREAM_URL": appURL,
 		"SWRP_TIMEOUT_MS":   "60000",
 	}
 	maps.Copy(settings, env)
 	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
 		value, ok := settings[name]
 		return value, ok
 	})
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: io.Discard,
 		ProcessLog: requestlog.NewProcessLogger(io.Discard, "rproxy", slog.LevelInfo),
 	})
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
@@ -387,35 +265,38 @@ func startRProxy(
 		_ = server.Close()
 	})
-	return listener.Addr().String()
+	return listener.Addr().String(), out, server, alertQueue
 }
-// newServeWAF makes servewaf's server, without starting it, and returns it, what
+// newProxy makes the server startProxyWithClock starts, without starting
-// it writes, and the queue of the alerts it raises, as the settings in env make
+// it, and returns it, what it writes, and the queue of the alerts the
-// it. No alert is sent from the queue: they wait in it, for the test to look at.
+// proxy raises, as the settings in env make it. No alert is sent from the
-// With no geojsURL, there is no stand-in for GeoJS to look clients up at, and
+// queue: they wait in it, for the test to look at. With no geojsURL, there
-// SWWAF_LOOKUP_SOURCE is off unless env sets it. While it is file, the lookup
+// is no stand-in for GeoJS to look clients up at, and SWWAF_LOOKUP_SOURCE
-// database SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
+// is off unless env sets it. While it is file, the lookup database
-// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off unless
+// SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
-// env sets it, so that only the tests of the Core Rule Set have their requests
+// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off
-// inspected by it.
+// unless env sets it, so that only the tests of the Core Rule Set have
-func newServeWAF(
+// their requests inspected by it.
-	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
+func newProxy(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
 ) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
-	return newServeWAFWith(t, proxy.NewServeWAF, geojsURL, now, env)
+	return newServerWith(t, proxy.New, appURL, geojsURL, now, env)
 }
-// newServeWAFWith is newServeWAF for the server build makes.
+// newServerWith is newProxy for the server build makes.
-func newServeWAFWith(
+func newServerWith(
 	t *testing.T, build func(proxy.Params) *proxy.Server,
-	geojsURL string, now func() time.Time, env map[string]string,
+	appURL, geojsURL string, now func() time.Time, env map[string]string,
 ) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 	settings := map[string]string{
-		rulesDir: t.TempDir(), instanceName: "app", wafMode: off,
+		"SWWAF_UPSTREAM_URL": appURL, rulesDir: t.TempDir(), instanceName: "app",
 		wafMode: off,
 	}
 	if geojsURL == "" {
 		settings[lookupSource] = off
@@ -507,7 +388,7 @@ func readAnswer(res *http.Response) answer {
 	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
 }
-// newRequest makes a request for path to addr, where rproxy or servewaf listens.
+// newRequest makes a request for path to smallwebwaf at addr.
 func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
 	t.Helper()
@@ -531,15 +412,15 @@ func do(t *testing.T, req *http.Request) answer {
 	return readAnswer(res)
 }
-// get sends a GET request for path to addr.
+// get sends a GET request for path to smallwebwaf at addr.
 func get(t *testing.T, addr, path string) answer {
 	t.Helper()
 	return do(t, newRequest(t, http.MethodGet, addr, path, http.NoBody))
 }
-// dial opens a connection to addr, for requests the HTTP client cannot make,
+// dial opens a connection to smallwebwaf at addr, for requests the HTTP
-// such as one that stops sending halfway.
+// client cannot make, such as one that stops sending halfway.
 func dial(t *testing.T, addr string) net.Conn {
 	t.Helper()
@@ -600,3 +481,14 @@ func wantStatus(t *testing.T, got answer, status int) {
 		t.Errorf("status %d, want %d", got.status, status)
 	}
 }
 // wantTimedOut checks that what began at start ended once shortTimeout
 // had run out, and not much later.
 func wantTimedOut(t *testing.T, start time.Time) {
 	t.Helper()
 	took := time.Since(start)
 	if took < shortTimeout || took > shortTimeout+waitLimit/2 {
 		t.Errorf("took %s, want %s", took, shortTimeout)
 	}
 }
@@ -51,7 +51,7 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 		req.Header.Set(forwardedFor, sent.client)
 		wantStatus(t, do(t, req), sent.want)
-		line := out.endedLines(t, i+1)[i]
+		line := out.requestLines(t, i+1)[i]
 		if line.ClientIP != sent.logged {
 			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
 		}
@@ -272,7 +272,6 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 			Instance: alertInstance,
 			Time:     clk.Now(),
 			Event:    alerts.EventReputationHit,
 			Host:     appHost,
 			Client:   netip.MustParseAddr(fromDE),
 			Netblock: netip.MustParsePrefix(fromDE + "/32"),
 			ASN:      asnDE,
@@ -290,7 +289,7 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 	// Each list's hits, none of its fetches failed, and when its copy was
 	// fetched, 0 for the one without.
-	metrics := s.scrape()
+	metrics := s.scrape(unplaced)
 	fetched := float64(listsFetched().Unix())
 	for listURL, want := range map[string]struct{ hits, fetched float64 }{
@@ -514,7 +513,6 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 			Instance: alertInstance,
 			Time:     clk.Now(),
 			Event:    alerts.EventReputationHit,
 			Host:     appHost,
 			Client:   netip.MustParseAddr(fromDE),
 			Netblock: netip.MustParsePrefix(fromDE + "/32"),
 			ASN:      asnDE,
@@ -532,7 +530,7 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 	// Each zone's hits, and its queries and their failures, none, since
 	// every client had its verdicts.
-	metrics := s.scrape()
+	metrics := s.scrape(unplaced)
 	for _, zone := range []string{dnsblZone, otherZone} {
 		labels := `{instance="` + alertInstance + `",source="` + zone + `"}`
@@ -566,7 +564,7 @@ func TestZoneKeyIsMaskedInTheLogTheAlertAndTheMetrics(t *testing.T) {
 			masked)
 	}
-	metrics := s.scrape()
+	metrics := s.scrape(unplaced)
 	wantMetric(t, metrics, `smallwebwaf_reputation_hits_total{instance="`+
 		alertInstance+`",source="`+masked+`"}`, 1)
@@ -739,6 +737,10 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			"a trap path", "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned,
 			ratelimit.Offences{Attack: 1},
 		},
 		{
 			"a missing token", proxy.MetricsPath, http.StatusUnauthorized,
 			requestlog.ActionAdmin, ratelimit.Offences{TokenRefused: 1},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -746,7 +748,7 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			s, clk, server := startWithClock(t, "", map[string]string{
 				abuseIPDBKey: accountKey, reputationAction: actionLog,
 				rulesDir: writeRules(t, testRules), attackBanDuration: "1h",
-				trapPaths: trapPathList, wafMode: block,
+				trapPaths: trapPathList, metricsToken: token, wafMode: block,
 			})
 			s.request(client, tc.path, tc.status, tc.action)
@@ -860,7 +862,7 @@ func TestAbuseIPDBHitRaisesAnAlertWithTheScoreOncePerCooldownAndIsCounted(
 	// The hits, and the checks, none, since no client committed an
 	// offence, so that the whole budget is left.
-	metrics := s.scrape()
+	metrics := s.scrape(unplaced)
 	labels := `{instance="` + alertInstance + `",source="` + abuseipdb + `"}`
 	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
@@ -887,7 +889,7 @@ func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 0)
-	wantNoSeries(t, s.scrape(), `smallwebwaf_reputation_daily_budget_remaining{`+
+	wantNoSeries(t, s.scrape(unplaced), `smallwebwaf_reputation_daily_budget_remaining{`+
 		`instance="`+alertInstance+`",source="`+abuseipdb+`"}`)
 }
@@ -2,10 +2,17 @@ package proxy
 import (
 	"context"
 	"errors"
 	"io"
 	"net/http"
 	"net/http/httptrace"
 	"net/http/httputil"
 	"net/netip"
 	"os"
 	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
@@ -17,11 +24,19 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
-// refusal is servewaf refusing a request: the status the visitor is to get, 0
+// flushAfterEachWrite has ReverseProxy pass on each part of the app's
-// to close its connection without an answer, and the action the log line names.
+// answer as soon as it arrives.
 const flushAfterEachWrite time.Duration = -1
 // refusal is smallwebwaf refusing a request, or refusing to go on with it:
 // the status the client is answered if the response has not started yet,
 // 0 to close the connection without an answer, the action the log line
 // names, and the setting whose size or time limit the request passed, if
 // that is why.
 type refusal struct {
 	status int
 	action string
 	limit  string
 }
 // decision is what the checks note of a request: its log line, and what
@@ -33,8 +48,8 @@ type decision struct {
 	client netip.Addr
 	// requestURI is the path with the query, as a ban's notes keep it.
 	requestURI string
-	// site is, for a question, the host the visitor asked for, which the
+	// site is, in servewaf, the host the visitor asked for, which the
-	// alerts name, since one servewaf serves many sites.
+	// alerts name, since one servewaf serves many sites. It is "" otherwise.
 	site string
 	// allowed is true for a question answered with DispositionAllow.
 	allowed bool
@@ -43,10 +58,6 @@ type decision struct {
 	// what the lookup gave then, the zero Answer while GeoJS had given none.
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// skippedLookupWait is true for a request that did not wait for GeoJS and
 	// found no answer kept. SWWAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
 	// the byte limits count once it has ended. limitPercent and
 	// bytesPercent are then its client's limit percentages for the rate
@@ -63,34 +74,75 @@ type decision struct {
 	reputation []bans.ReputationHit
 }
-// request is one request to servewaf, from the moment its headers have been
+// request is one request on its way through smallwebwaf, from the moment
-// read to its log line.
+// its headers have been read to its log line.
 type request struct {
 	decision
-	h   *handler
+	h  *handler
-	in  *http.Request
+	in *http.Request
-	out *responseWriter
+	// rc sets the deadlines of the connection to the client.
 	rc   *http.ResponseController
 	out  *responseWriter
 	body *requestBody // nil for a request without a body
 	peer        netip.Addr
 	peerTrusted bool
 	// tokenRefused is true for a request refused for a missing or wrong
 	// token, an offence its client's history counts.
 	tokenRefused bool
 	// blocklisted is true once a blocklist is found to list the client,
 	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
 	// AbuseIPDB's score of it is a hit.
 	blocklisted, dnsblListed, abuseIPDBHit bool
 	start                                  time.Time
-	// checked is when the checks were done.
+	// checked is when the checks were done, and upstreamStart when the
-	checked time.Time
+	// request was handed to the app.
-	// refused is what the request was refused with, nil if it was not.
+	checked       time.Time
-	refused *refusal
+	upstreamStart time.Time
-	// requestBytes is how many bytes of the request's body have been read.
+	// cancel ends the request to the app.
-	requestBytes int64
+	cancel context.CancelFunc
 	// refused is the first refusal, from whichever goroutine meets it.
 	refused atomic.Pointer[refusal]
 	// complete is true once the app's whole answer has been passed on.
 	complete bool
 	// upgraded is the connection to the app once the app has switched
 	// protocols, as for a WebSocket, and nil otherwise.
 	upgraded *upgradedConn
 	// mu guards what follows. The timeouts run on goroutines of their
 	// own, and the transport starts and stops them, and notes the times
 	// below, from its own; once timersStopped is set, none of the timeouts
 	// acts any more.
 	mu                    sync.Mutex
 	timersStopped         bool
 	clientRequestTimer    *time.Timer
 	upstreamRequestTimer  *time.Timer
 	upstreamResponseTimer *time.Timer
 	// connected is when there was a connection to the app, requestSent
 	// when the app had been sent the whole request, and answerStarted
 	// when the first byte of its answer arrived.
 	connected     time.Time
 	requestSent   time.Time
 	answerStarted time.Time
 }
 // newRequest starts handling r: it works out the client from the TCP peer
 // and X-Forwarded-For, and goes on as startRequest does.
 func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 	peer := peerAddress(r)
 	trusted := h.config.TrustedProxies
 	client := clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted)
 	return h.startRequest(w, r, client, peer, isInside(peer, trusted))
 }
 // startRequest starts handling r from client, which came through peer: it
 // notes the time, counts the request as under way, and starts the log line
-// with what is known of the request. isQuestion says whether r is a question,
+// with what is known of the request. peerTrusted says whether to believe
-// whose headers give the request's id and scheme.
+// the request's id and scheme, which r's headers give.
 func (h *handler) startRequest(
-	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, isQuestion bool,
+	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, peerTrusted bool,
 ) *request {
 	h.metrics.RequestStarted()
@@ -106,14 +158,14 @@ func (h *handler) startRequest(
 				Instance:         h.config.InstanceName,
 				ClientIP:         client.String(),
 				Method:           r.Method,
-				Scheme:           scheme(r, isQuestion),
+				Scheme:           scheme(r, peerTrusted),
 				Host:             r.Host,
 				Path:             rules.Path(r),
 				Query:            r.URL.RawQuery,
 				Protocol:         r.Proto,
 				Referer:          r.Referer(),
 				UserAgent:        r.UserAgent(),
-				RequestID:        requestID(r, isQuestion),
+				RequestID:        requestID(r, peerTrusted),
 				PeerIP:           peer.String(),
 				ForwardedFor:     strings.Join(forwardedFor, ", "),
 				ClientGroup:      h.clientGroup(client).String(),
@@ -124,10 +176,13 @@ func (h *handler) startRequest(
 				Action:           requestlog.ActionForward,
 			},
 		},
-		h:     h,
+		h:           h,
-		in:    r,
+		in:          r,
-		out:   &responseWriter{ResponseWriter: w},
+		rc:          http.NewResponseController(w),
-		start: start,
+		out:         &responseWriter{ResponseWriter: w},
 		peer:        peer,
 		peerTrusted: peerTrusted,
 		start:       start,
 	}
 	// A length of -1 is a body whose length was not announced.
@@ -135,6 +190,10 @@ func (h *handler) startRequest(
 		rq.line.ContentLength = r.ContentLength
 	}
 	if r.Body != http.NoBody {
 		rq.body = &requestBody{body: limitBody(r.Body, h.config.RequestMaxBytes), rq: rq}
 	}
 	return rq
 }
@@ -159,28 +218,45 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 	return headers
 }
-// check is the one place where a request can be refused. It returns nil to let
+// check is the one place where a request can be refused once its client
-// the request through. The checks of checkClient decide: a request they refuse
+// is known, before anything reaches the app, and before its body is read,
-// is answered with SWWAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
+// but for the part the Core Rule Set reads. It returns nil to let the
-// or 431 for the header limits. In observe mode nothing is refused, and the log
+// request through. The checks of checkClient come first, answered with
-// line names what enforce mode would have done. ctx is the request's own context.
+// SWWAF_BAN_RESPONSE, or 403 for a block rule or the Core Rule Set, and
 // then the size limit, so that a request the rate limits count is counted
 // even when it is refused for its size. In observe mode a request
 // checkClient refuses goes on to the size limit like any other. A size or
 // time limit the Core Rule Set's reading of the body meets ends the
 // request in either mode. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
 	action := rq.checkClient(ctx)
 	refused := rq.refused.Load()
 	if refused != nil {
 		return refused
 	}
 	switch {
 	case action == "":
 		return nil
 	case rq.h.config.Observe:
 		// The log line names what enforce mode would have done.
 		rq.line.WouldAction = action
 		return nil
 	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
 		return &refusal{status: http.StatusForbidden, action: action}
 	case action == requestlog.ActionTooLarge:
 		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
 	default:
 		return rq.banResponse(action)
 	}
 	maxBytes := rq.h.config.RequestMaxBytes
 	if maxBytes > 0 && rq.in.ContentLength > maxBytes {
 		return &refusal{
 			status: http.StatusRequestEntityTooLarge,
 			action: requestlog.ActionTooLarge,
 			limit:  "SWWAF_REQUEST_MAX_BYTES",
 		}
 	}
 	return nil
 }
 // checkClient runs the checks on the request's client, and returns the
@@ -195,9 +271,9 @@ func (rq *request) check(ctx context.Context) *refusal {
 // rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, then SWWAF_TRAP_PATHS, then the rule files, then the header
+// percentages, then SWWAF_TRAP_PATHS, then the rule files, and last the
-// limits, and last the Core Rule Set. A request exempt from the rate limits
+// Core Rule Set. A request exempt from the rate limits is exempt from the
-// is exempt from the byte limits too. ctx is the request's own context.
+// byte limits too. ctx is the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -214,7 +290,7 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionBanned
 	}
-	rq.lookUp(ctx, now)
+	rq.lookUp(ctx)
 	// The lookup can wait for GeoJS, so the checks after it read the time
 	// again: a request counted at the time it arrived could be counted
@@ -238,7 +314,8 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionDenied
 	}
-	rq.counted = rq.countedByRateLimits()
+	rq.counted = !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
 	if rq.counted {
 		rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
 		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
@@ -258,23 +335,9 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return action
 	}
 	if rq.overHeaderLimits() {
 		return requestlog.ActionTooLarge
 	}
 	return rq.checkCoreRuleSet()
 }
 // countedByRateLimits reports whether the rate limits count the request: its
 // client is not in SWWAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
 // under SWWAF_RATE_LIMIT_EXEMPT_PATHS.
 func (rq *request) countedByRateLimits() bool {
 	cfg := rq.h.config
 	return !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
 }
 // pathExempt reports whether r is exempt under prefixes,
 // SWWAF_RATE_LIMIT_EXEMPT_PATHS or SWWAF_WAF_EXEMPT_PATHS: whether its
 // path as sent, the path the app receives, not percent-decoded, starts
@@ -298,32 +361,251 @@ func pathExempt(r *http.Request, prefixes []string) bool {
 	})
 }
-// finish counts the request in the metrics and writes its log line.
+// forward passes the request to the app and the app's answer back. ctx
 // is the request's own context.
 func (rq *request) forward(ctx context.Context) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	rq.cancel = cancel
 	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
 		GotConn:              rq.gotConn,
 		WroteRequest:         rq.wroteRequest,
 		GotFirstResponseByte: rq.gotFirstResponseByte,
 	})
 	out := rq.in.WithContext(ctx)
 	if rq.body != nil {
 		out.Body = rq.body
 	}
 	reverseProxy := &httputil.ReverseProxy{
 		Rewrite:        rq.rewrite,
 		Transport:      rq.h.transport,
 		FlushInterval:  flushAfterEachWrite,
 		ErrorLog:       rq.h.errorLog,
 		ModifyResponse: rq.modifyResponse,
 		ErrorHandler:   rq.answerError,
 	}
 	rq.startRequestTimers()
 	rq.upstreamStart = time.Now()
 	reverseProxy.ServeHTTP(rq.out, out)
 }
 // rewrite makes the request the app receives: the client's request,
 // unchanged, sent to SWWAF_UPSTREAM_URL, with the forwarded headers and
 // the request's id set, without any X-Client-ASN or X-Client-Country the
 // client sent, whatever SWWAF_ADD_LOOKUP_HEADERS says, and, while it is
 // set, with the client's AS number and country in them.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	upstream := rq.h.config.UpstreamURL
 	pr.Out.URL.Scheme = upstream.Scheme
 	pr.Out.URL.Host = upstream.Host
 	// ReverseProxy drops query parameters it cannot parse; the app gets
 	// the query as the client sent it.
 	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
 	// ReverseProxy sends the path URL.EscapedPath gives, which, for a path
 	// holding a character Go escapes, such as |, is the whole path decoded
 	// and escaped again, %2F turned into /. Opaque is sent as it is, so the
 	// app gets the path as the client sent it. Left out are a target that
 	// is no path, such as *, and a path starting with //, which Go would
 	// send in Opaque as a scheme and host.
 	path := rules.Path(pr.In)
 	if strings.HasPrefix(path, "/") && !strings.HasPrefix(path, "//") {
 		pr.Out.URL.Opaque = path
 	}
 	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
 	pr.Out.Header.Set(requestIDHeader, rq.line.RequestID)
 	pr.Out.Header.Del(asnHeader)
 	pr.Out.Header.Del(countryHeader)
 	if rq.h.config.AddLookupHeaders {
 		setLookupHeaders(pr.Out.Header, rq.line.ASN, rq.line.Country)
 	}
 }
 // modifyResponse looks at the app's answer before ReverseProxy passes it
 // on.
 func (rq *request) modifyResponse(res *http.Response) error {
 	rq.line.UpstreamStatus = res.StatusCode
 	if res.StatusCode == http.StatusSwitchingProtocols {
 		// An upgraded connection, such as a WebSocket, is not cut by the
 		// timeouts. ReverseProxy writes this answer straight to the
 		// connection it takes over, not through rq.out, and then copies
 		// what passes each way through res.Body, the connection to the app.
 		// It may still refuse the switch, as when the app's Upgrade is not
 		// the client's, so the status is noted only once it has taken over
 		// the connection, by rq.out's Hijack.
 		rq.stopTimers()
 		rq.line.Websocket = true
 		conn, ok := res.Body.(io.ReadWriteCloser)
 		if ok {
 			rq.upgraded = &upgradedConn{ReadWriteCloser: conn}
 			res.Body = rq.upgraded
 		}
 		return nil
 	}
 	maxBytes := rq.h.config.ResponseMaxBytes
 	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
 		rq.refuse(refusal{
 			status: http.StatusBadGateway,
 			action: requestlog.ActionTooLarge,
 			limit:  "SWWAF_RESPONSE_MAX_BYTES",
 		})
 		return errResponseTooLarge
 	}
 	// Go's server adds a Content-Type it guesses from the body to a
 	// response whose headers have no Content-Type key. The key with no
 	// value sends none, as the app sent none.
 	if res.Header.Get("Content-Type") == "" {
 		rq.out.Header()["Content-Type"] = nil
 	}
 	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
 	rq.startClientResponseTimeout()
 	return nil
 }
 // answerError is ReverseProxy's ErrorHandler: the request could not be
 // passed to the app, or the app's answer cannot be passed on.
 func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
 	if rq.upgraded != nil {
 		// The app switched protocols, but the switch was not passed on,
 		// and ReverseProxy leaves the app's connection open when it
 		// refuses it.
 		_ = rq.upgraded.Close()
 	}
 	refused := rq.refused.Load()
 	if refused == nil {
 		if rq.in.Context().Err() != nil {
 			return // the client has gone, and there is no one to answer
 		}
 		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
 		refused = &refusal{
 			status: http.StatusBadGateway,
 			action: requestlog.ActionUpstreamError,
 		}
 	}
 	rq.answer(*refused)
 }
 // answer sends smallwebwaf's own answer, unless the response has already
 // started, and records the refusal for the log line.
 func (rq *request) answer(r refusal) {
 	rq.refused.CompareAndSwap(nil, &r)
 	if rq.out.status != 0 {
 		return // too late to answer: the connection can only be cut
 	}
 	if r.status == 0 {
 		// SWWAF_BAN_RESPONSE is close. This panic has Go's server close
 		// the connection without an answer, and log nothing; the log line
 		// is still written as the handler returns.
 		panic(http.ErrAbortHandler)
 	}
 	// A client found too slow is read no more; any other may go on
 	// sending until its time is up, so that Go's server can read the
 	// rest of the body and end the request cleanly.
 	deadline := rq.clientRequestDeadline()
 	if r.status == http.StatusRequestTimeout {
 		deadline = time.Now()
 	}
 	rq.stopReadingBody(deadline)
 	timeout := rq.h.config.ClientResponseTimeout
 	if timeout > 0 {
 		_ = rq.rc.SetWriteDeadline(time.Now().Add(timeout))
 	}
 	http.Error(rq.out, http.StatusText(r.status), r.status)
 }
 // refuse records r, unless an earlier refusal was, and ends the request
 // to the app, if one was made: smallwebwaf reads the body of a request
 // it answers itself too.
 func (rq *request) refuse(r refusal) {
 	rq.refused.CompareAndSwap(nil, &r)
 	if rq.cancel != nil {
 		rq.cancel()
 	}
 }
 // finish ends the request's timeouts, counts it in the metrics and writes
 // its log line.
 func (rq *request) finish() {
 	rq.stopTimers()
 	refused := rq.refused.Load()
 	if refused == nil {
 		rq.stopReadingBody(rq.clientRequestDeadline())
 	}
 	line := &rq.line
 	line.Status = rq.out.status
 	line.ResponseBytes = rq.out.bytes
-	line.ResponseContentType = rq.out.Header().Get("Content-Type")
+	header := rq.out.Header()
-	line.RequestBytes = rq.requestBytes
+	line.ResponseContentType = header.Get("Content-Type")
 	line.CacheControl = header.Get("Cache-Control")
 	line.Location = header.Get("Location")
 	line.RequestBytes = rq.requestBytes()
 	// limit is the setting whose size or time limit the request passed.
 	var limit string
 	switch {
-	case rq.refused != nil:
+	case refused != nil:
-		line.Action = rq.refused.action
+		line.Action = refused.action
-	case rq.out.err != nil || rq.in.Context().Err() != nil:
+		limit = refused.limit
 	case errors.Is(rq.out.err, os.ErrDeadlineExceeded):
 		// The client took longer than SWWAF_CLIENT_RESPONSE_TIMEOUT to
 		// take the response.
 		line.Action = requestlog.ActionTimedOut
 		limit = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
 	case !rq.complete && (rq.out.err != nil || rq.in.Context().Err() != nil):
 		line.Aborted = true
 	}
-	duration := time.Since(rq.start)
+	now := time.Now()
 	duration := now.Sub(rq.start)
 	line.DurationTotal = requestlog.Milliseconds(duration)
 	line.DurationChecks = timing(rq.start, rq.checked)
 	var upstreamDuration time.Duration
 	if !rq.upstreamStart.IsZero() {
 		upstreamDuration = now.Sub(rq.upstreamStart)
 		line.DurationUpstreamTotal = new(requestlog.Milliseconds(upstreamDuration))
 		rq.mu.Lock()
 		line.DurationUpstreamConnect = timing(rq.upstreamStart, rq.connected)
 		line.DurationUpstreamFirstByte = timing(rq.upstreamStart, rq.answerStarted)
 		rq.mu.Unlock()
 	}
 	// Counted before the log line is written, so that the metrics count
 	// every request whose line is out. An allowed request is the exception:
 	// its report gives the status, bytes and times the metrics count.
 	if rq.allowed {
 		rq.h.metrics.RequestAllowed()
 	} else {
-		rq.h.metrics.RequestEnded(line, duration)
+		rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
 	}
 	rq.writeLine()
@@ -355,16 +637,18 @@ func timing(start, end time.Time) *float64 {
 // before either was there, and one from GeoJS that comes later is added
 // when it comes.
 func (rq *request) addToHistory() {
 	forwarded := !rq.upstreamStart.IsZero()
 	request := ratelimit.Request{
-		Forwarded:     rq.allowed,
+		Forwarded:     forwarded,
-		Refused:       rq.refused != nil,
+		Refused:       !forwarded && rq.refused.Load() != nil,
 		Status:        rq.out.status,
-		RequestBytes:  rq.requestBytes,
+		RequestBytes:  rq.requestBytes(),
 		ResponseBytes: rq.out.bytes,
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
 		Attack:        rq.attack,
 		RuleBlocked:   rq.ruleBlocked,
 		WAFBlocked:    rq.wafBlocked,
 		TokenRefused:  rq.tokenRefused,
 	}
 	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)
@@ -425,38 +709,228 @@ func (rq *request) answerAtTheEnd() (lookup.Answer, bool) {
 	return rq.h.geojs.Kept(rq.h.clientGroup(rq.client))
 }
-// responseWriter is servewaf's answer to a request. It notes the status and
+// requestBytes is how many bytes of the request's body have been read.
-// size for the log line, and the first error writing the answer.
+func (rq *request) requestBytes() int64 {
-type responseWriter struct {
+	if rq.body == nil {
-	http.ResponseWriter
+		return 0
 	// status is the status sent, or zero before one is.
 	status int
 	bytes  int64
 	err    error
 }
 // WriteHeader sends the status and headers.
 func (w *responseWriter) WriteHeader(status int) {
 	if w.status == 0 {
 		w.status = status
 	}
-	w.ResponseWriter.WriteHeader(status)
+	return rq.body.bytes.Load()
 }
-// Write sends part of the body.
+// clientRequestDeadline is when the client must have sent its whole
-func (w *responseWriter) Write(p []byte) (int, error) {
+// request, or zero when SWWAF_CLIENT_REQUEST_TIMEOUT is off.
-	if w.status == 0 {
+func (rq *request) clientRequestDeadline() time.Time {
-		w.status = http.StatusOK
+	timeout := rq.h.config.ClientRequestTimeout
 	if timeout == 0 {
 		return time.Time{}
 	}
-	n, err := w.ResponseWriter.Write(p)
+	return rq.start.Add(timeout)
-	w.bytes += int64(n)
+}
-	if w.err == nil {
+// stopReadingBody ends, at deadline, the reading of a client body that has
-		w.err = err
+// not arrived whole: Go's server then reads no more of it, and closes the
 // connection after the answer.
 func (rq *request) stopReadingBody(deadline time.Time) {
 	if rq.body == nil || rq.body.received.Load() {
 		return
 	}
-	return n, err
+	_ = rq.rc.SetReadDeadline(deadline)
 }
 // startRequestTimers starts the timeouts that run while the request goes
 // to the app: SWWAF_CLIENT_REQUEST_TIMEOUT until the client has sent its
 // whole body, and SWWAF_UPSTREAM_REQUEST_TIMEOUT until the app has been
 // sent the whole request.
 func (rq *request) startRequestTimers() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if rq.body != nil && rq.h.config.ClientRequestTimeout > 0 {
 		rq.clientRequestTimer = time.AfterFunc(
 			time.Until(rq.clientRequestDeadline()), func() {
 				rq.requestTimedOut("SWWAF_CLIENT_REQUEST_TIMEOUT")
 			})
 	}
 	timeout := rq.h.config.UpstreamRequestTimeout
 	if timeout > 0 {
 		rq.upstreamRequestTimer = time.AfterFunc(timeout, func() {
 			rq.requestTimedOut("SWWAF_UPSTREAM_REQUEST_TIMEOUT")
 		})
 	}
 }
 // requestTimedOut is called when limit, SWWAF_CLIENT_REQUEST_TIMEOUT or
 // SWWAF_UPSTREAM_REQUEST_TIMEOUT, runs out while the request is still on
 // its way to the app. The answer names the side smallwebwaf was waiting
 // on at that moment: 408 when it was waiting for the client to send more
 // of its body, 504 when it was waiting for the app to be reached or to
 // take what it had.
 func (rq *request) requestTimedOut(limit string) {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if rq.timersStopped {
 		return
 	}
 	if rq.body == nil || !rq.body.waiting.Load() {
 		// Once the app has answered, the transport, ReverseProxy and Go's
 		// server each close the client's body, and closing it reads what
 		// is left of a body under 256 KiB without requestBody.Read, so
 		// waiting is false while that read waits for the client. That
 		// read ends now, before refuse: should smallwebwaf still answer
 		// itself, answer then sets the deadline it gives its own answers.
 		if !rq.answerStarted.IsZero() {
 			rq.stopReadingBody(time.Now())
 		}
 		rq.refuse(refusal{
 			status: http.StatusGatewayTimeout,
 			action: requestlog.ActionTimedOut,
 			limit:  limit,
 		})
 		return
 	}
 	rq.refuse(refusal{
 		status: http.StatusRequestTimeout,
 		action: requestlog.ActionTimedOut,
 		limit:  limit,
 	})
 	// The transport gives up on the app only once its Read of the
 	// client's body returns, so that Read is ended now. The lock keeps
 	// this from reaching the connection after the request is handled.
 	_ = rq.rc.SetReadDeadline(time.Now())
 }
 // bodyReceived is called once the client has sent its whole body.
 func (rq *request) bodyReceived() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	stopTimer(rq.clientRequestTimer)
 }
 // gotConn is called once there is a connection to the app, a new one or
 // one kept open from an earlier request.
 func (rq *request) gotConn(httptrace.GotConnInfo) {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	rq.connected = time.Now()
 }
 // gotFirstResponseByte is called once the first byte of the app's answer
 // has arrived.
 func (rq *request) gotFirstResponseByte() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	rq.answerStarted = time.Now()
 }
 // wroteRequest is called once the app has been sent the whole request:
 // the request timeouts end and SWWAF_UPSTREAM_RESPONSE_TIMEOUT starts.
 func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
 	if info.Err != nil {
 		return // the transport gives up, or tries again
 	}
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if rq.timersStopped {
 		return
 	}
 	stopTimer(rq.clientRequestTimer)
 	stopTimer(rq.upstreamRequestTimer)
 	rq.requestSent = time.Now()
 	timeout := rq.h.config.UpstreamResponseTimeout
 	if timeout > 0 {
 		rq.upstreamResponseTimer = time.AfterFunc(timeout, rq.responseTimedOut)
 	}
 }
 // responseTimedOut is called when SWWAF_UPSTREAM_RESPONSE_TIMEOUT runs out
 // before the app has sent its whole answer.
 func (rq *request) responseTimedOut() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	if !rq.timersStopped {
 		rq.refuse(refusal{
 			status: http.StatusGatewayTimeout,
 			action: requestlog.ActionTimedOut,
 			limit:  "SWWAF_UPSTREAM_RESPONSE_TIMEOUT",
 		})
 	}
 }
 // responseReceived is called once the app has sent its whole answer. An
 // app may answer before the client has sent its whole body, as with a 404
 // it sends without reading it. The timeouts then run on: until the
 // transport's read of the body returns, Go's server cannot send the
 // answer, and SWWAF_CLIENT_REQUEST_TIMEOUT is what ends that read for a
 // client that stops sending.
 func (rq *request) responseReceived() {
 	rq.complete = true
 	if rq.body != nil && !rq.body.received.Load() {
 		return
 	}
 	rq.stopTimers()
 }
 // startClientResponseTimeout sets SWWAF_CLIENT_RESPONSE_TIMEOUT on the
 // connection to the client: the response must reach the client within it
 // of the end of the request, or of now if the app answers before it has
 // the whole request.
 func (rq *request) startClientResponseTimeout() {
 	timeout := rq.h.config.ClientResponseTimeout
 	if timeout == 0 {
 		return
 	}
 	from := rq.sentAt()
 	if from.IsZero() {
 		from = time.Now()
 	}
 	_ = rq.rc.SetWriteDeadline(from.Add(timeout))
 }
 // sentAt is when the app had been sent the whole request, or zero.
 func (rq *request) sentAt() time.Time {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	return rq.requestSent
 }
 // stopTimers stops the request's timeouts and keeps any from starting
 // later: the app's answer is complete, the connection upgraded, or the
 // request handled.
 func (rq *request) stopTimers() {
 	rq.mu.Lock()
 	defer rq.mu.Unlock()
 	rq.timersStopped = true
 	stopTimer(rq.clientRequestTimer)
 	stopTimer(rq.upstreamRequestTimer)
 	stopTimer(rq.upstreamResponseTimer)
 }
 // stopTimer stops t, which is nil when its timeout is off.
 func stopTimer(t *time.Timer) {
 	if t != nil {
 		t.Stop()
 	}
 }
@@ -0,0 +1,55 @@
 package proxy
 import (
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			rq := &request{
 				h:   &handler{config: &config.Config{}},
 				out: &responseWriter{ResponseWriter: w},
 			}
 			app := &http.Response{
 				StatusCode: http.StatusOK,
 				Header:     http.Header{},
 				Body:       http.NoBody,
 			}
 			err := rq.modifyResponse(app)
 			if err != nil {
 				t.Errorf("modifyResponse: %v", err)
 			}
 			// The headers go out with this, the first part of the body,
 			// which Go's server would guess a Content-Type from.
 			_, _ = io.WriteString(w, "<!doctype html><title>page</title>")
 		}))
 	t.Cleanup(srv.Close)
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, srv.URL,
 		http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
 	res, err := srv.Client().Do(req)
 	if err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	_ = res.Body.Close()
 	if res.Header.Values("Content-Type") != nil {
 		t.Errorf("client got Content-Type %q, want none",
 			res.Header.Get("Content-Type"))
 	}
 }
@@ -2,6 +2,7 @@ package proxy_test
 import (
 	"io"
 	"maps"
 	"math"
 	"net/http"
 	"reflect"
@@ -41,6 +42,9 @@ func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
 			return
 		}
 		w.Header().Set("Content-Type", "text/html")
 		w.Header().Set("Cache-Control", "no-store")
 		w.Header().Set("Location", "/elsewhere")
 		w.WriteHeader(http.StatusFound)
 		_, _ = io.WriteString(w, "moved")
 	})
@@ -66,7 +70,7 @@ func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
 	// A request's log line can come after its answer: each is waited for
 	// before the next request, so that the lines are in order.
-	full := out.endedLines(t, 1)[0]
+	full := out.requestLines(t, 1)[0]
 	// This one comes from 127.0.0.1, which the rate limits do not count,
 	// with a body of 4 bytes whose length it does not announce, so that its
@@ -77,7 +81,7 @@ func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
 		"Transfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n")
 	wantStatus(t, readResponse(t, conn), http.StatusNoContent)
-	bare := out.endedLines(t, 2)[1]
+	bare := out.requestLines(t, 2)[1]
 	wantFullLine(t, full)
 	wantBareLine(t, bare)
@@ -104,23 +108,24 @@ func wantFullLine(t *testing.T, line logLine) {
 	headers := map[string]string{"accept": "text/html", "x-custom": "one, two"}
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Type: requestType, Time: line.Time, Instance: instance,
 		Time: line.Time, Instance: instance,
 		ClientIP: ipv6Client, Method: http.MethodPost, Scheme: secure,
 		Host: appHost, Path: "/full", Protocol: protocol,
 		Status: http.StatusFound, RequestBytes: 3, ResponseBytes: 5,
-		RequestID: line.RequestID, PeerIP: localhost,
+		RequestID: "from-traefik", PeerIP: localhost,
 		ForwardedFor: "198.51.100.7, " + ipv6Client, ClientGroup: ipv6Group,
 		ContentType: "application/x-www-form-urlencoded", ContentLength: 3,
 		RequestHeaders: headers, HasAuthorization: true, HasCookie: true,
 		ResponseContentType: "text/html", UpstreamStatus: http.StatusFound,
 		CacheControl: "no-store", Location: "/elsewhere",
 		Action: requestlog.ActionForward,
 		// Its 3 bytes in and 5 out, each way counted by default.
 		Counts: ratelimit.Counts{
 			Minute: 1, Hour: 1, Day: 1, MinuteBytes: 8, HourBytes: 8, DayBytes: 8,
 		},
 	})
-	if !reflect.DeepEqual(line.Line, want) || line.RequestID == "from-traefik" {
+	if !reflect.DeepEqual(line.Line, want) {
-		t.Errorf("log line\n%+v\nwant\n%+v, with a new request id", line.Line, want)
+		t.Errorf("log line\n%+v\nwant\n%+v", line.Line, want)
 	}
 }
@@ -130,13 +135,12 @@ func wantBareLine(t *testing.T, line logLine) {
 	t.Helper()
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Type: requestType, Time: line.Time, Instance: instance,
 		Time: line.Time, Instance: instance,
 		ClientIP: localhost, Method: http.MethodPost, Scheme: plain,
 		Host: appHost, Path: "/bare", Protocol: protocol,
 		Status: http.StatusNoContent, RequestBytes: 4, RequestID: line.RequestID,
 		PeerIP: localhost, ClientGroup: localhost + "/32",
-		Action: requestlog.ActionForward,
+		UpstreamStatus: http.StatusNoContent, Action: requestlog.ActionForward,
 	})
 	if !reflect.DeepEqual(line.Line, want) || line.RequestID == "" {
 		t.Errorf("log line\n%+v\nwant\n%+v, with a request id", line.Line, want)
@@ -144,7 +148,8 @@ func wantBareLine(t *testing.T, line logLine) {
 	for _, name := range []string{
 		"forwarded_for", "content_type", "content_length", "request_headers",
-		"has_authorization", "has_cookie", "response_content_type", "counts",
+		"has_authorization", "has_cookie", "websocket", "response_content_type",
 		"cache_control", "location", "counts",
 	} {
 		_, present := line.fields[name]
 		if present {
@@ -157,6 +162,8 @@ func wantBareLine(t *testing.T, line logLine) {
 func withTimings(line logLine, want requestlog.Line) requestlog.Line {
 	want.DurationTotal = line.DurationTotal
 	want.DurationChecks = line.DurationChecks
 	want.DurationUpstreamConnect = line.DurationUpstreamConnect
 	want.DurationUpstreamFirstByte = line.DurationUpstreamFirstByte
 	want.DurationUpstreamTotal = line.DurationUpstreamTotal
 	return want
@@ -181,7 +188,7 @@ func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
 			req.Header.Set(tc.header, "secret")
 			wantStatus(t, do(t, req), http.StatusOK)
-			line := out.endedLine(t)
+			line := out.requestLine(t)
 			_, otherPresent := line.fields[tc.other]
 			if line.fields[tc.field] != true || otherPresent {
@@ -192,20 +199,81 @@ func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
 	}
 }
 func TestRequestIDAndSchemeComeOnlyFromATrustedProxy(t *testing.T) {
 	t.Parallel()
 	const sentID = "from-traefik"
 	sent := http.Header{requestIDHeader: {sentID}, forwardedProto: {secure}}
 	trusted := map[string]string{trustedProxies: trustLocalhost}
 	for _, tc := range []struct {
 		name   string
 		env    map[string]string
 		header http.Header
 		// wantID is the request id logged, "" for a new one.
 		wantID, wantScheme string
 	}{
 		{"a trusted proxy's are kept", trusted, sent, sentID, secure},
 		{"without them, the id is new and the scheme http", trusted, nil, "", plain},
 		{"another peer's are replaced", nil, sent, "", plain},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			received := make(chan string, 2)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				received <- r.Header.Get(requestIDHeader)
 			})
 			addr, out := startProxy(t, app.URL, tc.env)
 			// Two requests, so that two new ids can be told apart.
 			ids := make([]string, 0, 2)
 			for i := range 2 {
 				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 				maps.Copy(req.Header, tc.header)
 				wantStatus(t, do(t, req), http.StatusOK)
 				line := out.requestLines(t, i+1)[i]
 				ids = append(ids, line.RequestID)
 				got := <-received
 				if line.RequestID != got || line.Scheme != tc.wantScheme {
 					t.Errorf("log line has request_id %q and scheme %q, and the "+
 						"app received id %q; want the same id and scheme %q",
 						line.RequestID, line.Scheme, got, tc.wantScheme)
 				}
 			}
 			switch {
 			case tc.wantID != "" && (ids[0] != tc.wantID || ids[1] != tc.wantID):
 				t.Errorf("request ids %q, want %q", ids, tc.wantID)
 			case tc.wantID == "" && (slices.Contains(ids, sentID) ||
 				slices.Contains(ids, "") || ids[0] == ids[1]):
 				t.Errorf("request ids %q, want two new ones", ids)
 			}
 		})
 	}
 }
 func TestTimingsAreInOrder(t *testing.T) {
 	t.Parallel()
 	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		// The pause sets the times apart; a hold-up of the test only lengthens
+		// The pauses set the times apart; a hold-up of the test only
-		// it.
+		// lengthens them.
 		time.Sleep(time.Millisecond)
 		w.WriteHeader(http.StatusOK)
 		_ = http.NewResponseController(w).Flush()
 		time.Sleep(time.Millisecond)
 		_, _ = io.WriteString(w, "done")
 	})
-
+	addr, out := startProxy(t, app.URL, map[string]string{
 	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, map[string]string{
 		trustedProxies: trustLocalhost,
 		denyNets:       denied,
 	})
@@ -213,19 +281,20 @@ func TestTimingsAreInOrder(t *testing.T) {
 	// Each log line is waited for before the next request, so that the
 	// lines are in order.
 	wantStatus(t, get(t, addr, "/"), http.StatusOK)
-	forwarded := out.endedLines(t, 1)[0]
+	forwarded := out.requestLines(t, 1)[0]
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(forwardedFor, denied)
 	wantStatus(t, do(t, req), http.StatusForbidden)
-	refused := out.endedLines(t, 2)[1]
+	refused := out.requestLines(t, 2)[1]
-	wantStatus(t, get(t, server.Addr, proxy.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, addr, proxy.HealthPath), http.StatusOK)
-	health := out.endedLines(t, 3)[2]
+	health := out.requestLines(t, 3)[2]
 	// A request passed to the app has every timing; one refused, none of
 	// the app's; the health check, which runs no check, only the total.
 	wantTimings(t, forwarded, "duration_total", "duration_checks",
 		"duration_upstream_connect", "duration_upstream_first_byte",
 		"duration_upstream_total")
 	wantTimings(t, refused, "duration_total", "duration_checks")
 	wantTimings(t, health, "duration_total")
@@ -238,12 +307,17 @@ func TestTimingsAreInOrder(t *testing.T) {
 	// exact.
 	total := microseconds(forwarded.DurationTotal)
 	checks := microseconds(*forwarded.DurationChecks)
 	connect := microseconds(*forwarded.DurationUpstreamConnect)
 	firstByte := microseconds(*forwarded.DurationUpstreamFirstByte)
 	upstream := microseconds(*forwarded.DurationUpstreamTotal)
-	// The checks end before the request is handed to the app.
+	// The checks end before the request is handed to the app, and the
-	if checks+upstream > total {
+	// connection comes before the answer, which the app ends after a
-		t.Errorf("timings in microseconds: total %d, checks %d, upstream total %d",
+	// pause.
-			total, checks, upstream)
+	if checks+upstream > total || connect >= firstByte || firstByte >= upstream {
 		t.Errorf("timings in microseconds: total %d, checks %d, connect %d, "+
 			"first byte %d, upstream total %d", total, checks, connect, firstByte,
 			upstream)
 	}
 	if *refused.DurationChecks > refused.DurationTotal {
@@ -276,3 +350,22 @@ func wantTimings(t *testing.T, line logLine, want ...string) {
 func microseconds(milliseconds float64) int64 {
 	return int64(math.Round(milliseconds * 1000))
 }
 func TestLogsAnUpgradedConnection(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, echoAfterUpgrade)
 	addr, out := startProxy(t, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
 		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
 	wantStatus(t, readResponse(t, conn), http.StatusSwitchingProtocols)
 	_ = conn.Close()
 	line := out.requestLine(t)
 	if line.fields["websocket"] != true {
 		t.Errorf("log line has websocket %v, want true", line.fields["websocket"])
 	}
 }
@@ -185,6 +185,8 @@ func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
 func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	s, _, _ := startWithClock(t, "", map[string]string{
 		rulesDir:     writeRules(t, testRules),
 		metricsToken: token,
@@ -194,7 +196,7 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
-	metrics := s.scrape()
+	metrics := s.scrape(scraper)
 	wantMetric(t, metrics,
 		`smallwebwaf_rule_matches_total{action="block",instance="app",rule_id="blocked"}`, 1)
 	wantMetric(t, metrics,
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
 	"net/netip"
 	"strconv"
@@ -14,6 +13,8 @@ import (
 	"time"
 	"unicode/utf8"
 	lru "github.com/hashicorp/golang-lru/v2"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
@@ -52,13 +53,6 @@ const ReportPath = "/_smallwebwaf/report"
 // QuestionBodyMaxBytes is the most of a visitor's body a question carries.
 const QuestionBodyMaxBytes = 64 << 10
 // The header limits: the most cookies and header fields a request may have
 // when the checks reach the Core Rule Set. Real clients never reach them.
 const (
 	maxCookies      = 50
 	maxHeaderFields = 100
 )
 const (
 	// maxAwaitingReport is the most answered requests held until their
 	// reports come. Past it, the request answered longest ago is dropped.
@@ -104,38 +98,45 @@ type Report struct {
 }
 // NewServeWAF returns the server `smallwebwaf servewaf` runs. It answers
-// rproxy's questions, takes rproxy's reports and answers its own endpoints. It
+// rproxy's questions with the checks New runs, takes rproxy's reports and
-// passes nothing to an app. rproxy applies the size and time limits to the
+// answers its own endpoints. It passes nothing to an app. rproxy applies
-// visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
+// the size and time limits to the visitor, so their settings do not apply
-// is far above rproxy's, and a question refused for its size would have rproxy
+// here. Go's default limit on a request's line and headers, 1 MiB, stays:
-// let the request through.
+// it is far above rproxy's, and a question refused for its size would have
 // rproxy let the request through.
 func NewServeWAF(params Params) *Server {
 	cfg := *params.Config
 	cfg.RequestMaxBytes = 0
 	cfg.ClientRequestTimeout = serveWAFTimeout
 	// The server's WriteTimeout does this. It sets a new deadline for each
 	// request, where a deadline a handler sets stays on a kept-open
 	// connection, and would run out under a later request's answer.
 	cfg.ClientResponseTimeout = 0
 	// A question's body of QuestionBodyMaxBytes may be cut short, and the
 	// Core Rule Set does not read a JSON or XML body over its limit.
 	cfg.WAFBodyLimit = min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1)
 	params.Config = &cfg
 	h := newHandler(params)
-	return &Server{
+	awaitingReport, err := lru.New[string, *decision](maxAwaitingReport)
-		Server: &http.Server{
+	if err != nil {
-			Addr:         params.Config.ListenAddr,
+		panic(err) // New fails only for a size below one
 			Handler:      h,
 			ErrorLog:     slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn),
 			ReadTimeout:  serveWAFTimeout,
 			WriteTimeout: serveWAFTimeout,
 			IdleTimeout:  serveWAFIdleTimeout,
 		},
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
 		GeoJS:      h.geojs,
 		Anomalies:  h.anomalies,
 		LookupFile: h.lookupFile,
 		Lists:      h.lists,
 		DNSBL:      h.dnsbl,
 		AbuseIPDB:  h.abuseIPDB,
 		Metrics:    h.metrics,
 	}
 	h.awaitingReport = awaitingReport
 	return h.server(&http.Server{
 		Handler:      http.HandlerFunc(h.serveWAF),
 		ReadTimeout:  serveWAFTimeout,
 		WriteTimeout: serveWAFTimeout,
 		IdleTimeout:  serveWAFIdleTimeout,
 	})
 }
-// ServeHTTP handles one request to servewaf: a request carrying ClientHeader is
+// serveWAF handles one request to servewaf: a request carrying
-// rproxy's question, and any other is for servewaf itself.
+// ClientHeader is rproxy's question, and any other is for servewaf itself.
-func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+func (h *handler) serveWAF(w http.ResponseWriter, r *http.Request) {
 	if len(r.Header.Values(ClientHeader)) > 0 {
 		h.answerQuestion(w, r)
@@ -145,52 +146,6 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	h.answerOwnEndpoint(w, r)
 }
 // refusedWhateverTheAnswer reports whether the request is one that does not wait
 // for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
 // its client: it is over the header limits, a blocklist lists its client while
 // SWWAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
 // over a whole rate limit. In observe mode, which refuses nothing, none is.
 // rproxy lets a request through when servewaf answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 	if rq.h.config.Observe {
 		return false
 	}
 	lists := rq.h.lists
 	_, decided := lists.CrowdSecDecision(rq.client, now)
 	return decided || rq.overHeaderLimits() ||
 		(rq.h.config.BlocklistAction == deny && len(lists.ListedBy(rq.client)) > 0) ||
 		(rq.countedByRateLimits() &&
 			rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now))
 }
 // overHeaderLimits reports whether servewaf refuses the request for its
 // headers: it has more than maxHeaderFields fields, each value of a header sent
 // twice being one, or more than maxCookies cookies, each part of a Cookie header
 // between semicolons being one unless it is empty or only spaces and tabs. The
 // Core Rule Set runs each of its rules on each cookie, so that thousands of small
 // cookies keep it busy for over a second. It trims only spaces and control
 // characters, of which a header value can hold only tabs, so a part of Unicode
 // spaces is a cookie to it.
 func (rq *request) overHeaderLimits() bool {
 	fields, cookies := 0, 0
 	for _, values := range rq.in.Header {
 		fields += len(values)
 	}
 	for _, value := range rq.in.Header.Values("Cookie") {
 		for part := range strings.SplitSeq(value, ";") {
 			if strings.Trim(part, " \t") != "" {
 				cookies++
 			}
 		}
 	}
 	return fields > maxHeaderFields || cookies > maxCookies
 }
 // answerQuestion runs the checks on the visitor's request a question
 // carries, and answers rproxy what to do with it. A denied request's counting
 // is finished here, and an allowed one's by its report.
@@ -226,8 +181,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 		return
 	}
-	// The last deferred runs first: countRefusal before addToHistory, so that a
+	// The last deferred runs first, as in ServeHTTP.
 	// broken error burst is in the client's history.
 	defer rq.addToHistory()
 	defer rq.countAnomalies()
 	defer rq.countRefusal()
@@ -357,11 +311,10 @@ func (rq *request) holdForReport() {
 // deny answers a question with what the visitor is to get for r.
 func (rq *request) deny(r refusal) {
 	rq.refused = &r
 	if r.status == 0 {
 		// SWWAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
 		// status stays 0: the visitor is sent nothing.
 		rq.refused.CompareAndSwap(nil, &r)
 		rq.out.Header().Set(DispositionHeader, DispositionClose)
 		rq.out.ResponseWriter.WriteHeader(http.StatusOK)
@@ -369,7 +322,7 @@ func (rq *request) deny(r refusal) {
 	}
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
-	http.Error(rq.out, http.StatusText(r.status), r.status)
+	rq.answer(r)
 }
 // answerOwnEndpoint answers a request to servewaf's own address. No check
@@ -409,8 +362,7 @@ func (h *handler) takeReport(w http.ResponseWriter, r *http.Request) {
 	}
 	held, found := h.awaitingReport.Peek(report.RequestID)
-	// Remove reports true to one report only, of several that name the id. A
+	// Remove reports true to one report only, of several that name the id.
 	// question still being handled is held as nil.
 	if found && held != nil && h.awaitingReport.Remove(report.RequestID) {
 		h.finishWith(held, report)
 	}
@@ -475,17 +427,18 @@ func (report *Report) checkRanges() error {
 // finishWith finishes a request with what its report says, and writes the
 // request's last log line, which holds its decision's fields and the report's.
-// For an allowed request it first counts the request's bytes, and adds it to its
+// For an allowed request it first takes the steps ServeHTTP takes once a
-// client's history, the anomaly counters and the metrics, with the status and
+// request passed to the app has ended, with the status and bytes of the report
-// bytes the report gives. A denied request's counting was finished at its
+// in place of those it would have seen. A denied request's counting was
-// decision.
+// finished at its decision.
 func (h *handler) finishWith(held *decision, report Report) {
 	rq := &request{
-		decision:     *held,
+		decision: *held,
-		h:            h,
+		h:        h,
-		out:          &responseWriter{status: report.Status, bytes: report.ResponseBytes},
+		out:      &responseWriter{status: report.Status, bytes: report.ResponseBytes},
-		requestBytes: report.RequestBytes,
+		body:     &requestBody{},
 	}
 	rq.body.bytes.Store(report.RequestBytes)
 	rq.line.ServeWAFLine = requestlog.ServeWAFLineReport
 	rq.line.Status = report.Status
@@ -495,6 +448,8 @@ func (h *handler) finishWith(held *decision, report Report) {
 	if rq.allowed {
 		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
 		// addToHistory goes by this for whether the request reached the app.
 		rq.upstreamStart = time.Now()
 		rq.countBytes()
 		rq.countAnomalies()
@@ -84,12 +84,26 @@ func startServeWAFWith(
 	}
 	maps.Copy(settings, env)
-	server, out, queue := newServeWAF(t, geojsURL, clk.Now, settings)
+	server, out, queue := newServerWith(t, proxy.NewServeWAF,
 		"http://127.0.0.1:8081", geojsURL, clk.Now, settings)
 	change(server)
-	serve(t, server)
+
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	go func() {
 		_ = server.Serve(listener)
 	}()
 	t.Cleanup(func() {
 		_ = server.Close()
 	})
 	return &serveWAF{
-		t: t, addr: server.Addr, out: out, server: server, clock: clk, queue: queue,
+		t: t, addr: listener.Addr().String(), out: out, server: server,
 		clock: clk, queue: queue,
 	}
 }
@@ -612,10 +626,13 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) {
 			wantProcessMessages(t, s, "a question's body stopped arriving", 1)
 			wantNoRequestLines(t, s)
-			// The id was not taken.
+			// The id was not taken, and the metrics count nothing for it.
 			again := s.question(siteA, client, "/")
 			again.Header.Set(requestIDHeader, "an-id")
 			wantDisposition(t, do(t, again), http.StatusOK, proxy.DispositionAllow)
 			wantNoSeries(t, s.metrics(),
 				`smallwebwaf_size_and_time_limit_hits_total{instance="`+alertInstance+
 					`",limit="SWWAF_CLIENT_REQUEST_TIMEOUT"}`)
 		})
 	}
 }
@@ -750,7 +767,7 @@ func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) {
 		setting              string
 		wantASN, wantCountry string
 	}{
-		{on, "AS64496", "DE"},
+		{"true", "AS64496", "DE"},
 		{"false", "", ""},
 	} {
 		t.Run(tc.setting, func(t *testing.T) {
@@ -1449,10 +1466,16 @@ func TestOwnEndpointsLinesDoNotSayWhichOfTheTwoTheyAre(t *testing.T) {
 	}
 }
-func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) {
+func TestSettingsOfTheLimitsAndTheProxiesAreIgnored(t *testing.T) {
 	t.Parallel()
-	s := startServeWAF(t, "", nil)
+	s := startServeWAF(t, "", map[string]string{
 		requestMaxBytes:       "1",
 		clientHeaderMaxBytes:  "5K",
 		clientRequestTimeout:  off,
 		clientResponseTimeout: off,
 		trustedProxies:        localhost,
 	})
 	req := s.questionWith(http.MethodPost, siteA, client, "/",
 		strings.NewReader("a body"))
@@ -1470,23 +1493,33 @@ func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) {
 	}
 }
-func TestLogLevelHoldsBackNoRequestLine(t *testing.T) {
+func TestShortClientResponseTimeoutIsIgnored(t *testing.T) {
 	t.Parallel()
-	s := startServeWAF(t, "", map[string]string{"SWWAF_LOG_LEVEL": "error"})
+	// The setting would leave no time to send any answer.
 	s := startServeWAF(t, "", map[string]string{
 		clientResponseTimeout: time.Nanosecond.String(), denyNets: client,
 	})
-	// A refused question would write a process warning, held back at error.
+	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, proxy.DispositionDeny)
-	req := s.question(siteA, client, "/")
+	wantStatus(t, get(t, s.addr, proxy.HealthPath), http.StatusOK)
-	req.Header.Del(requestIDHeader)
+}
 	wantStatus(t, do(t, req), http.StatusBadRequest)
-	s.allowed(client)
+func TestShortClientRequestTimeoutIsIgnored(t *testing.T) {
-	wantLine(t, s.out.requestLine(t), http.StatusOK, requestlog.ActionForward)
+	t.Parallel()
-	for _, line := range s.out.lines(t) {
+	// The setting would have run out while the Core Rule Set read the body. Go's
-		if line["type"] == "process" {
+	// server would then take the connection for gone, and the line say aborted.
-			t.Errorf("process line %v, want none at error", line)
+	s := startServeWAF(t, "", map[string]string{
-		}
+		clientRequestTimeout: time.Nanosecond.String(), wafMode: block, wafBodyLimit: "1M",
 	})
 	req := s.questionWith(http.MethodPost, siteA, client, "/", strings.NewReader("a=1"))
 	req.Header.Set("Content-Type", formData)
 	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
 	if line := s.out.requestLine(t); line.Aborted {
 		t.Errorf("log line says aborted: %+v", line.Line)
 	}
 }
@@ -1540,7 +1573,7 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) {
 	t.Parallel()
 	s := startServeWAF(t, "", map[string]string{
-		wafMode: block, wafBodyLimit: "64K",
+		wafMode: block, wafBodyLimit: "1M",
 	})
 	ask := func(contentType, body string) answer {
@@ -17,7 +17,7 @@ const (
 	unlistedAddr = "2001:db8::2"
 )
-func TestAllowNetsSkipEveryCheck(t *testing.T) {
+func TestAllowNetsSkipEveryCheckButTheSizeLimit(t *testing.T) {
 	t.Parallel()
 	var calls atomic.Int32
@@ -34,6 +34,7 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		denyNets:           fromKP,
 		deniedCountries:    "kp",
 		rateLimitPerMinute: "1",
 		requestMaxBytes:    "1K",
 	})
 	// Neither SWWAF_DENY_NETS, the country lists nor the limit of one
@@ -48,6 +49,14 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
 	}
 	// The size limit still applies.
 	body := strings.NewReader(strings.Repeat("a", 2<<10))
 	req := newRequest(t, http.MethodPost, addr, "/", body)
 	req.Header.Set(forwardedFor, fromKP)
 	wantStatus(t, do(t, req), http.StatusRequestEntityTooLarge)
 	wantLine(t, out.requestLines(t, 3)[2],
 		http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
 	if calls.Load() != 2 {
 		t.Errorf("the app was called %d times, want 2", calls.Load())
 	}
@@ -73,7 +82,7 @@ func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
 	})
 }
-func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
+func TestDenyNetsRefuseBeforeTheLookupAndTheBody(t *testing.T) {
 	t.Parallel()
 	var calls atomic.Int32
@@ -92,9 +101,13 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusForbidden)
-	line := out.endedLine(t)
+	line := out.requestLine(t)
 	wantLine(t, line, http.StatusForbidden, requestlog.ActionDenied)
 	if line.RequestBytes != 0 {
 		t.Errorf("log line has request_bytes %d, want 0", line.RequestBytes)
 	}
 	if len(asked()) != 0 {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
 	}
@@ -167,6 +180,6 @@ func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest)
 		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 		req.Header.Set(forwardedFor, sent.client)
 		wantStatus(t, do(t, req), sent.status)
-		wantLine(t, out.endedLines(t, i+1)[i], sent.status, sent.action)
+		wantLine(t, out.requestLines(t, i+1)[i], sent.status, sent.action)
 	}
 }
@@ -0,0 +1,453 @@
 package proxy_test
 import (
 	"errors"
 	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 // largeBodySize is more than the connections between the client,
 // smallwebwaf and the app can hold while nobody reads, so that a sender
 // soon waits.
 const largeBodySize = 64 << 20
 // writeSize is how much a test sender writes at a time.
 const writeSize = 32 << 10
 func TestRequestTimeouts(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		// limit is the setting set to shortTimeout, which runs out; long
 		// is one set to longTimeoutSetting, which does not, or "".
 		limit, long string
 		// appTakesNothing has the app never read, while the client sends
 		// as fast as it can; otherwise the app reads, and the client
 		// stops sending halfway.
 		appTakesNothing bool
 		want            int
 	}{
 		{
 			name:  "client request timeout, waiting on the client",
 			limit: clientRequestTimeout,
 			want:  http.StatusRequestTimeout,
 		},
 		{
 			name:  "upstream request timeout, waiting on the client",
 			limit: upstreamRequestTimeout,
 			long:  clientRequestTimeout,
 			want:  http.StatusRequestTimeout,
 		},
 		{
 			name:            "upstream request timeout, waiting on the app",
 			limit:           upstreamRequestTimeout,
 			appTakesNothing: true,
 			want:            http.StatusGatewayTimeout,
 		},
 		{
 			name:            "client request timeout, waiting on the app",
 			limit:           clientRequestTimeout,
 			long:            upstreamRequestTimeout,
 			appTakesNothing: true,
 			want:            http.StatusGatewayTimeout,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			var (
 				app         *httptest.Server
 				appURL      string
 				sendRequest func(*testing.T, string) net.Conn
 				appGotBody  atomic.Bool
 			)
 			if tc.appTakesNothing {
 				appURL, sendRequest = startAppThatTakesNothing(t), sendLargeBody
 			} else {
 				app = startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 					n, _ := io.Copy(io.Discard, r.Body)
 					appGotBody.Store(n > 0)
 				})
 				appURL, sendRequest = app.URL, sendPartOfBody
 			}
 			env := map[string]string{tc.limit: shortTimeoutSetting, metricsToken: token}
 			if tc.long != "" {
 				env[tc.long] = longTimeoutSetting
 			}
 			addr, out := startProxy(t, appURL, env)
 			start := time.Now()
 			got := readResponse(t, sendRequest(t, addr))
 			wantTimedOut(t, start)
 			want := tc.want
 			if app != nil {
 				// Close returns once the app has finished with the request.
 				app.Close()
 				// Until some of the body has reached the app, smallwebwaf
 				// waits on the app, and SPEC.md asks for 504; the timeout
 				// runs out then only if the test process is held up.
 				if !appGotBody.Load() {
 					want = http.StatusGatewayTimeout
 				}
 			}
 			wantStatus(t, got, want)
 			wantLine(t, out.requestLine(t), want, requestlog.ActionTimedOut)
 			wantLimitHits(t, addr, tc.limit, 1)
 		})
 	}
 }
 // startAppThatTakesNothing starts an app that accepts connections and
 // never reads from them, and returns its URL.
 func startAppThatTakesNothing(t *testing.T) string {
 	t.Helper()
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	var (
 		mu   sync.Mutex
 		held []net.Conn
 	)
 	hold := func(conn net.Conn) {
 		mu.Lock()
 		defer mu.Unlock()
 		held = append(held, conn)
 	}
 	go func() {
 		for {
 			conn, err := listener.Accept()
 			if err != nil {
 				return
 			}
 			hold(conn)
 		}
 	}()
 	t.Cleanup(func() {
 		_ = listener.Close()
 		mu.Lock()
 		defer mu.Unlock()
 		for _, conn := range held {
 			_ = conn.Close()
 		}
 	})
 	return "http://" + listener.Addr().String()
 }
 // sendPartOfBody sends a request that announces a large body, and only
 // the first bytes of it.
 func sendPartOfBody(t *testing.T, addr string) net.Conn {
 	t.Helper()
 	conn := dial(t, addr)
 	send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: "+
 		strconv.Itoa(largeBodySize)+"\r\n\r\nthe first bytes")
 	return conn
 }
 // sendLargeBody sends a request with a large body, as fast as smallwebwaf
 // takes it, from a goroutine of its own.
 func sendLargeBody(t *testing.T, addr string) net.Conn {
 	t.Helper()
 	conn := dial(t, addr)
 	send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: "+
 		strconv.Itoa(largeBodySize)+"\r\n\r\n")
 	go func() {
 		chunk := make([]byte, writeSize)
 		for range largeBodySize / writeSize {
 			_, err := conn.Write(chunk)
 			if err != nil {
 				return
 			}
 		}
 	}()
 	return conn
 }
 func TestClientStopsSendingAfterTheAppHasAnswered(t *testing.T) {
 	t.Parallel()
 	// answeredAt is when the app answered, or nil if the bytes the client
 	// sent never reached it.
 	var answeredAt atomic.Pointer[time.Time]
 	// The app answers without reading the whole body, as an app does for
 	// a path it does not serve, and only once smallwebwaf waits for the
 	// rest of it: the app takes the bytes the client sent, and then waits
 	// half the timeout, far longer than smallwebwaf takes to go on to
 	// wait.
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, err := io.ReadFull(r.Body, make([]byte, len("the first bytes")))
 		if err != nil {
 			return
 		}
 		time.Sleep(shortTimeout / 2)
 		answeredAt.Store(new(time.Now()))
 		http.NotFound(w, r)
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		clientRequestTimeout: shortTimeoutSetting,
 		metricsToken:         token,
 	})
 	start := time.Now()
 	got := readResponse(t, sendPartOfBody(t, addr))
 	wantTimedOut(t, start)
 	// Close returns once the app has finished with the request.
 	app.Close()
 	// The app's answer came before the time ran out, so the client is
 	// sent that answer, not smallwebwaf's 408. Only a hold-up of the test
 	// process can make it come later, and SPEC.md then asks for 408, as
 	// smallwebwaf was waiting for the client, or for 504 if the bytes the
 	// client sent had not reached the app.
 	at := answeredAt.Load()
 	want := http.StatusNotFound
 	switch {
 	case at == nil:
 		want = http.StatusGatewayTimeout
 	case at.Sub(start) >= shortTimeout:
 		want = http.StatusRequestTimeout
 	}
 	wantStatus(t, got, want)
 	wantLine(t, out.requestLine(t), want, requestlog.ActionTimedOut)
 	wantLimitHits(t, addr, clientRequestTimeout, 1)
 }
 func TestClientStopsSendingWithLittleOfItsBodyLeft(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		// limit is the setting set to shortTimeout, which runs out, and
 		// clientTimeout what SWWAF_CLIENT_REQUEST_TIMEOUT is set to when it
 		// is not limit.
 		limit, clientTimeout string
 	}{
 		{
 			name:  "client request timeout",
 			limit: clientRequestTimeout,
 		},
 		{
 			name:          "upstream request timeout, client request timeout off",
 			limit:         upstreamRequestTimeout,
 			clientTimeout: off,
 		},
 		{
 			name:          "upstream request timeout, client request timeout longer",
 			limit:         upstreamRequestTimeout,
 			clientTimeout: longTimeoutSetting,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			// appClosed is closed once smallwebwaf has closed its
 			// connection to the app, which it does once it has the app's
 			// answer.
 			appClosed := make(chan struct{})
 			// The app answers without reading the rest of the body, and
 			// says it closes the connection, only once smallwebwaf waits
 			// for the client to send more: it takes the bytes the client
 			// sent, and then waits half the timeout, far longer than
 			// smallwebwaf takes to go on to wait.
 			app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 				conn, buf, err := http.NewResponseController(w).Hijack()
 				if err != nil {
 					return
 				}
 				_, _ = io.ReadFull(buf.Reader, make([]byte, len("the first bytes")))
 				time.Sleep(shortTimeout / 2)
 				_, _ = buf.WriteString("HTTP/1.1 404 Not Found\r\n" +
 					"Content-Length: 0\r\nConnection: close\r\n\r\n")
 				_ = buf.Flush()
 				_, _ = io.Copy(io.Discard, buf.Reader)
 				_ = conn.Close()
 				close(appClosed)
 			})
 			env := map[string]string{tc.limit: shortTimeoutSetting, metricsToken: token}
 			if tc.clientTimeout != "" {
 				env[clientRequestTimeout] = tc.clientTimeout
 			}
 			addr, out := startProxy(t, app.URL, env)
 			// Less than 256 KiB of the body is left after the first bytes,
 			// little enough for Go's server in smallwebwaf to read the rest
 			// itself before it sends the app's answer.
 			start := time.Now()
 			conn := dial(t, addr)
 			send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: 200000\r\n\r\n"+
 				"the first bytes")
 			select {
 			case <-appClosed:
 			case <-time.After(waitLimit):
 				t.Fatal("smallwebwaf did not close its connection to the app")
 			}
 			// More of the body, which can no longer go to the app, and then
 			// nothing.
 			send(t, conn, strings.Repeat("x", 8<<10))
 			got := readResponse(t, conn)
 			wantTimedOut(t, start)
 			wantStatus(t, got, http.StatusNotFound)
 			wantLine(t, out.requestLine(t), http.StatusNotFound, requestlog.ActionTimedOut)
 			wantLimitHits(t, addr, tc.limit, 1)
 		})
 	}
 }
 func TestAppTooSlowToAnswer(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		upstreamResponseTimeout: shortTimeoutSetting,
 		metricsToken:            token,
 	})
 	start := time.Now()
 	wantStatus(t, get(t, addr, "/slow"), http.StatusGatewayTimeout)
 	wantTimedOut(t, start)
 	line := out.requestLine(t)
 	wantLine(t, line, http.StatusGatewayTimeout, requestlog.ActionTimedOut)
 	_, answered := line.fields["upstream_status"]
 	if answered {
 		t.Errorf("log line has upstream_status %v for an app that never answered",
 			line.fields["upstream_status"])
 	}
 	wantLimitHits(t, addr, upstreamResponseTimeout, 1)
 }
 func TestAppTooSlowToFinishItsAnswer(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.WriteString(w, "the first part")
 		_ = http.NewResponseController(w).Flush()
 		<-r.Context().Done()
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		upstreamResponseTimeout: shortTimeoutSetting,
 	})
 	start := time.Now()
 	got := get(t, addr, "/slow")
 	wantStatus(t, got, http.StatusOK)
 	if string(got.body) != "the first part" || !errors.Is(got.err, io.ErrUnexpectedEOF) {
 		t.Errorf("client read %q (%v), want the first part cut off", got.body, got.err)
 	}
 	wantTimedOut(t, start)
 	line := out.requestLine(t)
 	wantLine(t, line, http.StatusOK, requestlog.ActionTimedOut)
 	if line.UpstreamStatus != http.StatusOK {
 		t.Errorf("log line has upstream_status %d, want %d",
 			line.UpstreamStatus, http.StatusOK)
 	}
 }
 func TestClientTooSlowToTakeTheAnswer(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		chunk := make([]byte, writeSize)
 		for range largeBodySize / writeSize {
 			_, err := w.Write(chunk)
 			if err != nil {
 				return
 			}
 		}
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{
 		clientResponseTimeout: shortTimeoutSetting,
 		metricsToken:          token,
 	})
 	start := time.Now()
 	// The client asks, and never reads the answer.
 	conn := dial(t, addr)
 	send(t, conn, "GET /large HTTP/1.1\r\nHost: app\r\n\r\n")
 	line := out.requestLine(t)
 	wantTimedOut(t, start)
 	wantLine(t, line, http.StatusOK, requestlog.ActionTimedOut)
 	wantLimitHits(t, addr, clientResponseTimeout, 1)
 }
 func TestClosesAnIdleConnection(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, _ := startProxy(t, app.URL, map[string]string{
 		clientIdleTimeout: shortTimeoutSetting,
 	})
 	// The idle time starts once the answer is sent, so after start.
 	start := time.Now()
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: app\r\n\r\n")
 	wantStatus(t, readResponse(t, conn), http.StatusOK)
 	// The read deadline readResponse set still bounds this read.
 	_, err := conn.Read(make([]byte, 1))
 	if !errors.Is(err, io.EOF) {
 		t.Fatalf("read on the idle connection: %v, want it closed", err)
 	}
 	wantTimedOut(t, start)
 }
@@ -23,8 +23,8 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 		{Forwarded: true, Status: 502, ResponseBytes: 12},
 		// Closed without an answer: refused, and no response.
 		{Refused: true, Status: 0},
-		// Answered 404 for a path under /_smallwebwaf/: neither forwarded nor
+		// Answered 404 at smallwebwaf's own endpoints: neither forwarded
-		// refused.
+		// nor refused.
 		{Status: 404},
 	} {
 		limiter.AddToHistory(client, start.Add(time.Duration(i)*time.Minute), r)
@@ -92,9 +92,10 @@ type History struct {
 	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those servewaf allowed,
+	// Requests are all the client's requests: Forwarded those passed to
-	// Refused those it refused, and neither those for a path under
+	// the app, Refused those refused before anything reached it, a 401 at
-	// /_smallwebwaf/.
+	// smallwebwaf's own endpoints included, and neither the others
 	// smallwebwaf answered there.
 	Requests  int64 `json:"requests"`
 	Forwarded int64 `json:"forwarded"`
 	Refused   int64 `json:"refused"`
@@ -123,20 +124,21 @@ type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
 	// of a ban rule or a request for a trap path, RuleBlocked those a block
-	// rule refused, and WAFBlocked those the Core Rule Set refused.
+	// rule refused, WAFBlocked those the Core Rule Set refused, and
-	Limit       int64 `json:"limit"`
+	// TokenRefused those refused for a missing or wrong token.
-	Attack      int64 `json:"attack"`
+	Limit        int64 `json:"limit"`
-	RuleBlocked int64 `json:"rule_blocked"`
+	Attack       int64 `json:"attack"`
-	WAFBlocked  int64 `json:"waf_blocked"`
+	RuleBlocked  int64 `json:"rule_blocked"`
-	// TokenRefused is what a clients.json written by an earlier version gives,
+	WAFBlocked   int64 `json:"waf_blocked"`
-	// which must still load. Nothing adds to it.
+	TokenRefused int64 `json:"token_refused"`
 	TokenRefused int64 `json:"token_refused,omitempty"`
 }
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Forwarded is true for a request servewaf allowed, and Refused for one it
+	// Forwarded is true for a request passed to the app, Refused for one
-	// refused. Both are false for a request for a path under /_smallwebwaf/.
+	// refused before anything reached it, a 401 at smallwebwaf's own
 	// endpoints included. Both are false for any other request smallwebwaf
 	// answered there.
 	Forwarded bool
 	Refused   bool
 	// Status is what the client was sent, 0 if nothing was.
@@ -147,12 +149,14 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, RuleBlocked for one a block rule refused, and
+	// asked for a trap path, RuleBlocked for one a block rule refused,
-	// WAFBlocked for one the Core Rule Set refused.
+	// WAFBlocked for one the Core Rule Set refused, and TokenRefused for
-	BrokeLimit  bool
+	// one refused for a missing or wrong token.
-	Attack      bool
+	BrokeLimit   bool
-	RuleBlocked bool
+	Attack       bool
-	WAFBlocked  bool
+	RuleBlocked  bool
 	WAFBlocked   bool
 	TokenRefused bool
 }
 // New returns a Limiter for limits, with no client counted yet, whose
@@ -224,30 +228,6 @@ func (l *Limiter) Count(
 	return l.count(client, now, 1, 0, percent)
 }
 // OverARateLimit reports whether one more request from client at now would
 // take it over a whole rate limit. A client's percentage can only lower a
 // limit, so that request is over the limit at any percentage. It counts
 // nothing, and does not make the client the most recently seen.
 func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	c, seen := l.clients.Peek(client)
 	if !seen {
 		return false
 	}
 	buckets := c.buckets()
 	for i, w := range l.windows {
 		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
 			return true
 		}
 	}
 	return false
 }
 // CountBytes counts bytes, those of a request from client that has ended,
 // at now, in every window, and returns the client's counts in each window.
 // It reports whether the bytes take the client over a byte limit, of which
@@ -330,6 +310,10 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 	if r.WAFBlocked {
 		h.Offences.WAFBlocked++
 	}
 	if r.TokenRefused {
 		h.Offences.TokenRefused++
 	}
 }
 // AddLookup gives client's history its AS number, AS name and country, as
@@ -26,50 +26,6 @@ const (
 	hour   = "hour"
 )
 func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.T) {
 	t.Parallel()
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
 	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
 		tableSize)
 	if limiter.OverARateLimit(client, now) {
 		t.Error("a client never seen is over a rate limit")
 	}
 	if limiter.Len() != 0 {
 		t.Error("asking about a client never seen added it to the table")
 	}
 	for range limit {
 		if limiter.OverARateLimit(client, now) {
 			t.Error("a client with room for another request is over a rate limit")
 		}
 		wantCount(t, limiter, client, now, "")
 	}
 	if !limiter.OverARateLimit(client, now) {
 		t.Error("a client at its limit is not over a rate limit")
 	}
 	held, _ := limiter.Client(client)
 	if held.Minute.Current != limit {
 		t.Errorf("the client's minute holds %d requests, want %d", held.Minute.Current, limit)
 	}
 	wantCount(t, limiter, client, now, minute)
 	// A limit that is off is never gone over.
 	off := ratelimit.New(ratelimit.Limits{}, tableSize)
 	off.Count(client, now, whole)
 	if off.OverARateLimit(client, now) {
 		t.Error("a client is over a rate limit that is off")
 	}
 }
 func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 	t.Parallel()
@@ -14,13 +14,18 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
-// The action a request line names: what servewaf did with the request.
+// The action a request line names: what smallwebwaf did with the
 // request.
 const (
-	// ActionForward is a request servewaf allowed, which rproxy passes to the
+	// ActionForward is a request passed to the app.
 	// app.
 	ActionForward = "forward"
-	// ActionTooLarge is a request over the header limits.
+	// ActionTooLarge is a request or response over its size limit.
 	ActionTooLarge = "too_large"
 	// ActionTimedOut is a request or response that ran out of time.
 	ActionTimedOut = "timed_out"
 	// ActionUpstreamError is a request the app could not be reached
 	// for, or whose answer could not be passed on.
 	ActionUpstreamError = "upstream_error"
 	// ActionRateLimited is a request refused because it took its client
 	// over a rate limit, which bans the client.
 	ActionRateLimited = "rate_limited"
@@ -42,8 +47,8 @@ const (
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
-	// ActionAdmin is a request servewaf answered at one of its own endpoints,
+	// ActionAdmin is a request smallwebwaf answered at one of its own
-	// or a question about a path under /_smallwebwaf/.
+	// endpoints, under /_smallwebwaf/.
 	ActionAdmin = "admin"
 )
@@ -80,8 +85,8 @@ type Line struct {
 	// two lines about a question.
 	ServeWAFLine string `json:"servewaf_line,omitempty"`
-	// The standard web log fields. Scheme is how the client reached rproxy, or
+	// The standard web log fields. Scheme is how the client reached
-	// the trusted proxy in front of it.
+	// smallwebwaf, or the trusted proxy in front of it.
 	Time          string `json:"time"`
 	Instance      string `json:"instance"`
 	ClientIP      string `json:"client_ip"`
@@ -97,8 +102,8 @@ type Line struct {
 	Referer       string `json:"referer"`
 	UserAgent     string `json:"user_agent"`
-	// Request detail. RequestID is the id rproxy made for the request, or for a
+	// Request detail. RequestID is the X-Request-ID a trusted proxy sent,
-	// request to servewaf's own endpoints a new one. ForwardedFor is the
+	// or a new one, and is sent on to the app. ForwardedFor is the
 	// X-Forwarded-For header as received. ClientGroup is the netblock the
 	// client is counted as. ASN, ASName and Country are the client's AS
 	// number, AS name and country, as looked up.
@@ -117,10 +122,17 @@ type Line struct {
 	RequestHeaders   map[string]string `json:"request_headers,omitempty"`
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
 	HasCookie        bool              `json:"has_cookie,omitempty"`
 	// Websocket is true when the connection was upgraded, as for a
 	// WebSocket.
 	Websocket bool `json:"websocket,omitempty"`
-	// Response detail, of servewaf's own answer. Aborted is true when rproxy, or
+	// Response detail, from the headers of the answer: the app's, as
-	// the admin's tool, went away before the answer.
+	// passed on, or those of smallwebwaf's own. Aborted is true when the
 	// client went away early.
 	ResponseContentType string `json:"response_content_type,omitempty"`
 	UpstreamStatus      int    `json:"upstream_status,omitempty"`
 	CacheControl        string `json:"cache_control,omitempty"`
 	Location            string `json:"location,omitempty"`
 	Aborted             bool   `json:"aborted,omitempty"`
 	// The decision.
@@ -128,8 +140,7 @@ type Line struct {
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
 	// ActionBanned, ActionCountryDenied, ActionRateLimited,
-	// ActionRuleBlocked, ActionWAFBlocked, or, in servewaf, ActionTooLarge
+	// ActionRuleBlocked or ActionWAFBlocked.
 	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
@@ -170,13 +181,17 @@ type Line struct {
 	// The timings, in milliseconds. DurationChecks is the time until the
 	// checks were done, and DurationWAF the part of it the Core Rule Set
-	// took. DurationUpstreamTotal is what the report of an allowed request gives,
+	// took. DurationUpstreamConnect, DurationUpstreamFirstByte and
-	// from the hand-over to the app until the end of its answer. Each but
+	// DurationUpstreamTotal run from when the request was handed to the
-	// DurationTotal is nil for a request that did not get that far.
+	// app: until there was a connection to it, until the first byte of its
-	DurationTotal         float64  `json:"duration_total"`
+	// answer arrived, and until the end. Each but DurationTotal is nil for
-	DurationChecks        *float64 `json:"duration_checks,omitempty"`
+	// a request that did not get that far.
-	DurationWAF           *float64 `json:"duration_waf,omitempty"`
+	DurationTotal             float64  `json:"duration_total"`
-	DurationUpstreamTotal *float64 `json:"duration_upstream_total,omitempty"`
+	DurationChecks            *float64 `json:"duration_checks,omitempty"`
 	DurationWAF               *float64 `json:"duration_waf,omitempty"`
 	DurationUpstreamConnect   *float64 `json:"duration_upstream_connect,omitempty"`
 	DurationUpstreamFirstByte *float64 `json:"duration_upstream_first_byte,omitempty"`
 	DurationUpstreamTotal     *float64 `json:"duration_upstream_total,omitempty"`
 }
 // RProxyLine is rproxy's short line in the request log about one request. The
@@ -201,9 +216,8 @@ type RProxyLine struct {
 	// if that is sooner. DurationResponse runs from then until the answer ends.
 	DurationRequest  float64 `json:"duration_request"`
 	DurationResponse float64 `json:"duration_response"`
-	// Disposition is the valid disposition servewaf answered or, while
+	// Disposition is servewaf's answer or, while DefaultDisposition is true, the
-	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
+	// value of SWRP_DEFAULT_DISPOSITION. It is "" when servewaf was not asked.
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`
 	DefaultDisposition bool   `json:"default_disposition,omitempty"`
 }
@@ -14,7 +14,6 @@ import (
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 )
@@ -210,52 +209,6 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	})
 }
 func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.T) {
 	t.Parallel()
 	const announced = "2048"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		maxResponseSize: "1K",
 	})
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusOK || got.header.Get(contentLengthHeader) != announced {
 		t.Errorf("answered %+v, want the app's 200 announcing %s bytes", got, announced)
 	}
 }
 func TestASettingOfOffSetsNoLimit(t *testing.T) {
 	t.Parallel()
 	for _, setting := range []string{
 		maxRequestSize, maxResponseSize, maxRequestTime, maxResponseTime,
 	} {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				setting: "off",
 			})
 			// A body and an answer that a limit of zero would cut off, as it would the
 			// next answer, which rproxy gives itself.
 			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 				strings.NewReader("a body"))))
 			if got := get(t, addr, proxy.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
 	}
 }
 func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 	t.Parallel()
@@ -369,22 +322,13 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	}
 }
-// deadlineRecorder notes the time limits rproxy sets on reading the visitor's body
+// deadlineRecorder notes the time limit rproxy sets on sending its answer.
 // and on sending its answer.
 type deadlineRecorder struct {
 	*httptest.ResponseRecorder
 	readDeadline  time.Time
 	writeDeadline time.Time
 }
 // SetReadDeadline notes deadline.
 func (w *deadlineRecorder) SetReadDeadline(deadline time.Time) error {
 	w.readDeadline = deadline
 	return nil
 }
 // SetWriteDeadline notes deadline.
 func (w *deadlineRecorder) SetWriteDeadline(deadline time.Time) error {
 	w.writeDeadline = deadline
@@ -392,51 +336,6 @@ func (w *deadlineRecorder) SetWriteDeadline(deadline time.Time) error {
 	return nil
 }
 func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 	t.Parallel()
 	const (
 		limit = 5 * time.Minute
 		// announced is over what Go's server reads of a body left unread, so that
 		// the app's own server answers without waiting for the rest.
 		announced = 100 * questionBodyMaxBytes
 	)
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
 	_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
 		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
 	})
 	// The visitor sends the first part and a little more, and then nothing.
 	stalled, stop := io.Pipe()
 	t.Cleanup(func() { _ = stop.Close() })
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
 		io.MultiReader(bytes.NewReader(make([]byte, questionBodyMaxBytes+1)), stalled))
 	req.ContentLength = announced
 	req.Header.Set(contentLengthHeader, strconv.Itoa(announced))
 	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 	before := time.Now()
 	server.Handler.ServeHTTP(w, req)
 	if w.Code != http.StatusNoContent {
 		t.Errorf("status %d, want the app's 204", w.Code)
 	}
 	if w.readDeadline.Before(before.Add(limit)) ||
 		w.readDeadline.After(time.Now().Add(limit)) {
 		t.Errorf("the reading of the body ends at %s, want %s from the request",
 			w.readDeadline, limit)
 	}
 }
 func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 	t.Parallel()
@@ -710,46 +609,6 @@ func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.
 	}
 }
 func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 	working := make(chan struct{})
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
 	})
 	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	select {
 	case <-working:
 	case <-time.After(waitLimit):
 		t.Fatal("the app was not asked")
 	}
 	tcpConn, ok := conn.(*net.TCPConn)
 	if !ok {
 		t.Fatalf("the connection is a %T", conn)
 	}
 	err := tcpConn.CloseWrite()
 	if err != nil {
 		t.Fatalf("stop sending: %v", err)
 	}
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
 		t.Errorf("read %q (%v), want the connection closed without an answer", text, err)
 	}
 	if line := out.requestLine(t); line["status"] != 0.0 {
 		t.Errorf("line %v, want status 0", line)
 	}
 }
 func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing.T) {
 	t.Parallel()
@@ -774,38 +633,22 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 	}
 }
-func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing.T) {
+func TestAVisitorThatStopsSendingAfterADenyGetsTheAnswerByTheDeadline(t *testing.T) {
 	t.Parallel()
-	for _, tc := range []struct {
+	servewaf := startServeWAF(t, deny)
-		name, start string
+	app := startApp(t, greet)
-		status      int
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
-	}{
+		maxRequestTime: "500",
-		{"a deny", post, http.StatusForbidden},
+	})
 		{
 			"the health check",
 			"GET " + proxy.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			servewaf := startServeWAF(t, deny)
+	// Go's server waits for a little of the body left before it sends an answer,
-			app := startApp(t, greet)
+	// and the time for sending the request ends that wait.
-			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+	conn := dial(t, addr)
-				maxRequestTime: "500",
+	send(t, conn, post+announcedLength(questionBodyMaxBytes+100)+
-			})
+		strings.Repeat("x", questionBodyMaxBytes))
-			// Go's server waits for a little of the body left before it sends an answer,
+	if status := readStatus(t, conn); status != http.StatusForbidden {
-			// and the time for sending the request ends that wait.
+		t.Errorf("status %d, want servewaf's 403", status)
 			conn := dial(t, addr)
 			send(t, conn, tc.start+announcedLength(questionBodyMaxBytes+100)+
 				strings.Repeat("x", questionBodyMaxBytes))
 			if status := readStatus(t, conn); status != tc.status {
 				t.Errorf("status %d, want %d", status, tc.status)
 			}
 		})
 	}
 }
@@ -128,52 +128,6 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 	}
 }
 func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name   string
 		header []string
 		client string
 	}{
 		{
 			"the first address outside the trusted proxies, from the right",
 			[]string{"198.51.100.7, 203.0.113.9, 10.0.0.2"}, "203.0.113.9",
 		},
 		{
 			"the leftmost, when every address is a trusted proxy",
 			[]string{"10.0.0.5, 10.0.0.2"}, "10.0.0.5",
 		},
 		{"the peer, with no header", nil, localhost},
 		{
 			"the last address read, before an entry that is not an address",
 			[]string{"203.0.113.9, unknown, 10.0.0.2"}, "10.0.0.2",
 		},
 		{
 			"read as one list, with several header lines",
 			[]string{"2001:db8::7", "10.0.0.2"}, "2001:db8::7",
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32,10.0.0.0/8",
 			})
 			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 			req.Header[forwardedForHeader] = tc.header
 			wantGreeting(t, visit(t, req))
 			if got := servewaf.question(t).header.Get(proxy.ClientHeader); got != tc.client {
 				t.Errorf("the question names %s, want %s", got, tc.client)
 			}
 		})
 	}
 }
 // randomBytes returns n random bytes.
 func randomBytes(n int) []byte {
 	body := make([]byte, n)
@@ -301,7 +255,7 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 		{"with its length", announcedLength(4) + "body", "body", nil},
 	} {
 		for _, method := range []string{
-			http.MethodGet, http.MethodDelete, http.MethodPost,
+			http.MethodConnect, http.MethodGet, http.MethodDelete, http.MethodPost,
 		} {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
@@ -327,73 +281,6 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 	}
 }
 func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 	t.Parallel()
 	for _, method := range []string{http.MethodTrace, "PROPFIND", "LOCK", "BREW"} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
 			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
 				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY" {
 				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
 			}
 			line := out.requestLine(t)
 			if line["status"] != float64(http.StatusMethodNotAllowed) ||
 				line["disposition"] != nil || line["default_disposition"] != nil {
 				t.Errorf("line %v, want status 405 and no disposition", line)
 			}
 			if len(servewaf.questions) != 0 {
 				t.Error("servewaf was asked")
 			}
 			servewaf.wantNoReport(t)
 		})
 	}
 }
 func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
 	t.Parallel()
 	for _, method := range []string{
 		http.MethodGet, http.MethodHead, http.MethodPost, http.MethodOptions,
 		http.MethodPut, http.MethodDelete, http.MethodPatch, "QUERY",
 	} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 			reached := make(chan string, 1)
 			servewaf := startServeWAF(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
 			addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusOK {
 				t.Errorf("answered %+v, want the app's 200", got)
 			}
 			if asked := servewaf.question(t); asked.method != method {
 				t.Errorf("servewaf was asked about %s", asked.method)
 			}
 			if atApp := <-reached; atApp != method {
 				t.Errorf("the app was asked %s", atApp)
 			}
 		})
 	}
 }
 func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 	t.Parallel()
@@ -403,15 +290,10 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 		"a target of a scheme":    "GET x:admin HTTP/1.1\r\n" + host,
 		"a target of a URL":       "GET http://site.example/ HTTP/1.1\r\n" + host,
 		"a host Go will not send": "GET http://a<b/ HTTP/1.1\r\n" + host,
-		"a target of a host":      "GET site.example:443 HTTP/1.1\r\n" + host,
+		"a target of a host":      "CONNECT site.example:443 HTTP/1.1\r\n" + host,
 		"a target of *":           "GET * HTTP/1.1\r\n" + host,
 		"a target of //":          "GET //x/y HTTP/1.1\r\n" + host,
 		"a target of // escaped":  "GET //x%2Fadmin| HTTP/1.1\r\n" + host,
 		"an empty Host":           "GET / HTTP/1.1\r\nHost:\r\n\r\n",
 		"HTTP/1.0 with no Host":   "GET / HTTP/1.0\r\n\r\n",
 		"a Host with a zone":      "GET / HTTP/1.1\r\nHost: [fe80::1%25eth0]:80\r\n\r\n",
 		"two User-Agents": "GET / HTTP/1.1\r\nUser-Agent: a\r\nUser-Agent: b\r\n" +
 			host,
 	} {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
@@ -442,46 +324,6 @@ func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
 	}
 }
 func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
 	t.Parallel()
 	const host = "a%b"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET / HTTP/1.1\r\nHost: "+host+"\r\n\r\n")
 	if status := readStatus(t, conn); status != http.StatusOK {
 		t.Errorf("status %d, want the app's 200", status)
 	}
 	if asked := servewaf.question(t); asked.host != host {
 		t.Errorf("asked about the host %q, want %q", asked.host, host)
 	}
 }
 func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 	t.Parallel()
 	const want = "http"
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 	wantGreeting(t, get(t, addr, "/"))
 	asked := servewaf.question(t)
 	if got := asked.header.Get(forwardedProtoHeader); got != want {
 		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
 	}
 }
 func TestAQuestionNamesNoZone(t *testing.T) {
 	t.Parallel()
@@ -11,7 +11,7 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
-	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -29,9 +29,6 @@ const flushAfterEachWrite time.Duration = -1
 // send a higher one, up to 999, and the visitor gets that as it is.
 const reportStatusMax = 599
 // plainText is the Content-Type of the answers rproxy gives itself.
 const plainText = "text/plain; charset=utf-8"
 // request is one request on its way through rproxy, from the moment its headers
 // have been read to its log line and report.
 type request struct {
@@ -49,8 +46,8 @@ type request struct {
 	peerTrusted bool
 	start       time.Time
-	// disposition is what is done with the request: servewaf's valid disposition,
+	// disposition is what is done with the request, "" until servewaf has been
-	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
+	// asked.
 	disposition string
 	// answered is true when servewaf gave disposition, which makes a report due,
 	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
@@ -112,9 +109,8 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 // answerHealth answers the health check.
 func (rq *request) answerHealth() {
-	rq.prepareOwnAnswer(rq.requestDeadline())
+	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
-	rq.out.Header().Set("Content-Type", plainText)
+	_, _ = io.WriteString(rq.out, "ok\n")
 	rq.send(http.StatusOK, []byte("ok\n"))
 }
 // readFirstPartOfBody reads up to the first 64 KiB of the body into memory,
@@ -153,9 +149,13 @@ func (rq *request) readFirstPartOfBody() bool {
 // setPathAsSent has out, the URL of a request made from in, send the path as the
 // visitor sent it. Go sends the path URL.EscapedPath gives, which, for a path
 // holding a character Go escapes, such as |, is the whole path decoded and
-// escaped again, %2F turned into /. Opaque is sent as it is.
+// escaped again, %2F turned into /. Opaque is sent as it is. Left out is a path
 // starting with //, which Go would send in Opaque as a scheme and host.
 func setPathAsSent(out *url.URL, in *http.Request) {
-	out.Opaque = rules.Path(in)
+	path := rules.Path(in)
 	if !strings.HasPrefix(path, "//") {
 		out.Opaque = path
 	}
 }
 // forward passes the request to the app, the part of the body held and then the
@@ -269,10 +269,7 @@ func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error
 	status := int(rq.refused.Load())
 	if status == 0 {
 		if rq.in.Context().Err() != nil {
-			// The visitor went away or stopped its sending side. This panic has Go's
+			return // the visitor has gone, and there is no one to answer
 			// server close the connection without an answer, and log nothing; the
 			// deferred finish still runs.
 			panic(http.ErrAbortHandler)
 		}
 		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
@@ -300,27 +297,7 @@ func (rq *request) answer(status int) {
 	}
 	rq.prepareOwnAnswer(deadline)
-
+	http.Error(rq.out, http.StatusText(status), status)
 	header := rq.out.Header()
 	header.Set("Content-Type", plainText)
 	header.Set("X-Content-Type-Options", "nosniff")
 	rq.send(status, []byte(http.StatusText(status)+"\n"))
 }
 // send gives the visitor an answer rproxy holds whole: status, the headers set so
 // far and body. Go's server would otherwise send so short an answer only once the
 // handler has returned, after finish has written the log line and sent the report.
 // Without Content-Length, the flush would send the body in chunks, the last of
 // which would still wait for the handler. A HEAD's answer has no body, so any
 // Content-Length it has stays as servewaf gave it.
 func (rq *request) send(status int, body []byte) {
 	if rq.in.Method != http.MethodHead {
 		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
 	}
 	rq.out.WriteHeader(status)
 	_, _ = rq.out.Write(body)
 	_ = rq.rc.Flush()
 }
 // prepareOwnAnswer readies the connection for an answer rproxy gives itself: the
@@ -356,8 +333,8 @@ func (rq *request) finish(ctx context.Context) {
 		rq.stopReadingBody(rq.requestDeadline())
 	}
 	requestEnd := rq.endRequest()
 	end := time.Now()
 	requestEnd := rq.endRequest()
 	requestBytes, responseBytes := rq.bytesEachWay()
 	err := requestlog.WriteRProxyLine(rq.h.requestLog, &requestlog.RProxyLine{
@@ -1,12 +1,9 @@
 // Package rproxy is the reverse proxy in front of one app that asks servewaf
 // about each request. It passes a request servewaf allows to the app and the
-// app's answer back, within the size and time limits. Any other answer from
+// app's answer back, within the size and time limits. When servewaf gives no
-// servewaf goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
+// answer, SWRP_DEFAULT_DISPOSITION decides. A request it cannot put to servewaf
-// decides only when servewaf cannot be connected to, does not answer at all, or
+// as the visitor sent it, it refuses itself. It keeps nothing between requests
-// does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
+// and never touches disk. "rproxy" in SPEC.md says what it does.
 // method it does not pass on, or one it cannot put to servewaf as the visitor
 // sent it. It keeps nothing between requests and never touches disk. "rproxy" in
 // SPEC.md says what it does.
 package rproxy
 import (
@@ -16,7 +13,6 @@ import (
 	"log/slog"
 	"net/http"
 	"net/url"
 	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -49,10 +45,6 @@ const (
 // never reaches the app.
 const adminPrefix = "/_smallwebwaf/"
 // allowedMethods lists the methods rproxy passes on, as an Allow header gives
 // them. It answers any other method 405 itself.
 const allowedMethods = "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY"
 // Params are what New needs.
 type Params struct {
 	Config *config.RProxy
@@ -158,10 +150,10 @@ func newServeWAFTransport() *http.Transport {
 }
 // ServeHTTP handles one request: it answers the health check itself, refuses a
-// request with a method it does not pass on or one it cannot put to servewaf as
+// request it cannot put to servewaf as the visitor sent it, and for any other
-// the visitor sent it, and for any other request reads the first part of the
+// request reads the first part of the body, asks servewaf, and does what the
-// body, asks servewaf, and does what the answer says. Once the answer has ended,
+// answer says. Once the answer has ended, it writes the request's log line and
-// it writes the request's log line and sends its report.
+// sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
@@ -172,14 +164,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
-	if !slices.Contains(strings.Split(allowedMethods, ", "), r.Method) {
+	// Go's client sends only a target that starts with / as it came. For an empty
-		rq.out.Header().Set("Allow", allowedMethods)
+	// Host, it sends servewaf's own address.
-		rq.answer(http.StatusMethodNotAllowed)
+	if r.Host == "" || !strings.HasPrefix(r.RequestURI, "/") {
 		return
 	}
 	if !canBeAsked(r) {
 		rq.answer(http.StatusBadRequest)
 		return
@@ -189,24 +176,23 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
-	answer, err := rq.ask(r.Context())
+	answer := rq.askServeWAF(r.Context())
 	if err != nil {
 		rq.handleNoUsableAnswer(r.Context(), err)
 		return
 	}
 	rq.noteAnswer(answer)
 	switch rq.disposition {
 	case proxy.DispositionAllow:
 		rq.passToApp(r.Context())
-	case proxy.DispositionClose:
+	case proxy.DispositionDeny:
 		if answer == nil {
 			rq.answer(http.StatusServiceUnavailable)
 			return
 		}
 		rq.answerWith(answer)
 	default: // proxy.DispositionClose, or none when the visitor has gone
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)
 	default: // a deny, an error, or an answer without a valid disposition
 		rq.answerWith(answer)
 	}
 }
@@ -4,7 +4,6 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/json"
 	"errors"
 	"io"
 	"log/slog"
 	"maps"
@@ -12,7 +11,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"slices"
 	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -63,9 +61,6 @@ const (
 	contentLengthHeader  = "Content-Length"
 	// fromServeWAFHeader is a header the stand-in for servewaf adds to a deny.
 	fromServeWAFHeader = "X-From-Servewaf"
 	// addedHeaderValue is the value of a header a test adds to an answer, to see it
 	// reach the visitor.
 	addedHeaderValue = "yes"
 )
 // What the stand-in for servewaf answers.
@@ -130,34 +125,6 @@ func (o *output) has(text string) bool {
 	return strings.Contains(o.buf.String(), text)
 }
 // waitFor waits until what rproxy has written holds text.
 func (o *output) waitFor(t *testing.T, text string) {
 	t.Helper()
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
 		if o.has(text) {
 			return
 		}
 		time.Sleep(pollInterval)
 	}
 	t.Fatalf("rproxy did not write %q", text)
 }
 // heldLog is a request log whose Write waits until release is closed.
 type heldLog struct {
 	release chan struct{}
 }
 // Write waits until release is closed.
 func (l heldLog) Write(p []byte) (int, error) {
 	<-l.release
 	return len(p), nil
 }
 // question is what the stand-in for servewaf received as a question.
 type question struct {
 	method, target, host string
@@ -264,28 +231,6 @@ func (s *serveWAF) question(t *testing.T) question {
 	}
 }
 // startServeWAFAnsweringReports starts a stand-in for servewaf that answers each
 // question as answer does and each report as report does, and returns its URL.
 func startServeWAFAnsweringReports(
 	t *testing.T, answer, report http.HandlerFunc,
 ) string {
 	t.Helper()
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
 			if r.Header.Get(proxy.ClientHeader) != "" {
 				answer(w, r)
 				return
 			}
 			report(w, r)
 		}))
 	t.Cleanup(backend.Close)
 	return backend.URL
 }
 // allow answers a question with allow.
 func allow(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set(dispositionHeader, dispositionAllow)
@@ -295,7 +240,7 @@ func allow(w http.ResponseWriter, _ *http.Request) {
 // deny answers a question with deny, status 403 and a body of its own.
 func deny(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set(dispositionHeader, dispositionDeny)
-	w.Header().Set(fromServeWAFHeader, addedHeaderValue)
+	w.Header().Set(fromServeWAFHeader, "yes")
 	w.WriteHeader(http.StatusForbidden)
 	_, _ = io.WriteString(w, deniedBody)
 }
@@ -335,20 +280,6 @@ func startServer(
 ) (string, *output, *rproxy.Server) {
 	t.Helper()
 	out := &output{}
 	addr, server := startServerLogging(t, backend, appURL, env, out, out)
 	return addr, out, server
 }
 // startServerLogging is startServer with rproxy's request lines going to
 // requestLog and its process lines to processLog.
 func startServerLogging(
 	t *testing.T, backend, appURL string, env map[string]string,
 	requestLog, processLog io.Writer,
 ) (string, *rproxy.Server) {
 	t.Helper()
 	settings := map[string]string{
 		"SWRP_WAF_BACKEND": backend, "SWRP_UPSTREAM_URL": appURL,
 	}
@@ -363,10 +294,11 @@ func startServerLogging(
 		t.Fatalf("settings %v: %v", settings, err)
 	}
 	out := &output{}
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
-		RequestLog: requestLog,
+		RequestLog: out,
-		ProcessLog: requestlog.NewProcessLogger(processLog, "test", slog.LevelInfo),
+		ProcessLog: requestlog.NewProcessLogger(out, "test", slog.LevelInfo),
 	})
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -384,7 +316,7 @@ func startServerLogging(
 		server.WaitForReports()
 	})
-	return listener.Addr().String(), server
+	return listener.Addr().String(), out, server
 }
 // answered is the visitor's answer.
@@ -508,7 +440,7 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Clone(t.Context())
-		w.Header().Set("X-App", addedHeaderValue)
+		w.Header().Set("X-App", "yes")
 		w.WriteHeader(http.StatusTeapot)
 		_, _ = io.WriteString(w, greeting)
 	})
@@ -525,7 +457,7 @@ func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	got := visit(t, req)
 	if got.status != http.StatusTeapot || got.body != greeting ||
-		got.header.Get("X-App") != addedHeaderValue {
+		got.header.Get("X-App") != "yes" {
 		t.Errorf("answered %+v, want the app's answer", got)
 	}
@@ -599,45 +531,6 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 	}
 }
 func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
 		greet(w, r)
 	})
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
 	})
 	sent := map[string]string{
 		"Forwarded":          "for=198.51.100.1",
 		"X-Forwarded-Host":   "public.example",
 		forwardedProtoHeader: "https",
 		"X-Real-Ip":          "198.51.100.1",
 	}
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Host = site
 	for name, value := range sent {
 		req.Header.Set(name, value)
 	}
 	wantGreeting(t, visit(t, req))
 	header := <-seen
 	for name, want := range sent {
 		if got := header.Values(name); !slices.Equal(got, []string{want}) {
 			t.Errorf("the app saw %s %q, want %q", name, got, want)
 		}
 	}
 }
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
@@ -712,7 +605,7 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 	got := get(t, addr, "/")
 	if got.status != http.StatusForbidden || got.body != deniedBody ||
-		got.header.Get(fromServeWAFHeader) != addedHeaderValue {
+		got.header.Get(fromServeWAFHeader) != "yes" {
 		t.Errorf("answered %+v, want servewaf's answer", got)
 	}
@@ -733,87 +626,6 @@ func TestDenyGivesTheVisitorServeWAFsAnswer(t *testing.T) {
 	}
 }
 func TestADeniedHeadKeepsServeWAFsContentLength(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
 		got.header.Get(contentLengthHeader) != strconv.Itoa(len(deniedBody)) {
 		t.Errorf("answered %+v, want servewaf's 403 and its length", got)
 	}
 }
 func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 	t.Parallel()
 	const host = " HTTP/1.1\r\nHost: site.example\r\n\r\n"
 	for _, tc := range []struct {
 		name, request, body string
 		status              int
 	}{
 		{"a deny", "GET /" + host, deniedBody, http.StatusForbidden},
 		{"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest},
 		{"the health check", "GET " + proxy.HealthPath + host, "ok\n", http.StatusOK},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			log := heldLog{release: make(chan struct{})}
 			servewaf := startServeWAF(t, deny)
 			app := startApp(t, greet)
 			addr, _ := startServerLogging(t, servewaf.URL, app.URL, nil, log, io.Discard)
 			t.Cleanup(func() { close(log.release) })
 			conn := dial(t, addr)
 			send(t, conn, tc.request)
 			res, err := http.ReadResponse(bufio.NewReader(conn), nil)
 			if err != nil {
 				t.Fatalf("read the answer: %v", err)
 			}
 			defer func() {
 				_ = res.Body.Close()
 			}()
 			body, err := io.ReadAll(res.Body)
 			if err != nil || res.StatusCode != tc.status || string(body) != tc.body {
 				t.Errorf("answered %d %q (%v), want %d %q", res.StatusCode, body, err,
 					tc.status, tc.body)
 			}
 		})
 	}
 }
 func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
 	if err != nil {
 		t.Fatalf("read the answer: %v", err)
 	}
 	_ = res.Body.Close()
 	if res.Header.Get("Content-Type") != "text/plain; charset=utf-8" ||
 		res.Header.Get("X-Content-Type-Options") != "nosniff" {
 		t.Errorf("the answer's headers are %v", res.Header)
 	}
 }
 func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
@@ -846,55 +658,22 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	}
 }
-func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
+// noAnswers are the ways servewaf can fail to give an answer that holds.
-	t.Parallel()
+func noAnswers() map[string]func(t *testing.T) string {
 	answeringWith := func(answer http.HandlerFunc) func(t *testing.T) string {
 		return func(t *testing.T) string {
 			t.Helper()
-	backend := startServeWAFAnsweringReports(t,
+			return startServeWAF(t, answer).URL
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(dispositionHeader, dispositionClose)
 		},
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusNoContent)
 		})
 	// A negative time would be about a microsecond, which one request would seldom
 	// show.
 	for range 100 {
 		addr, out := startRProxy(t, backend, nowhere, nil)
 		conn := dial(t, addr)
 		send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 		line := out.requestLine(t)
 		duration, ok := line["duration_response"].(float64)
 		if !ok || duration < 0 {
 			t.Errorf("line %v, want a duration_response that is not negative", line)
 		}
 	}
 }
 // answeringWith returns what starts a stand-in for servewaf that answers each
 // question as answer does, and returns its URL.
 func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
 	return func(t *testing.T) string {
 		t.Helper()
 		return startServeWAF(t, answer).URL
 	}
 }
 // noAnswers are the ways servewaf can leave the decision to the default.
 func noAnswers() map[string]func(t *testing.T) string {
 	return map[string]func(t *testing.T) string{
-		"no connection": func(*testing.T) string { return nowhere },
+		"down": func(*testing.T) string { return nowhere },
-		"no answer at all": answeringWith(func(http.ResponseWriter, *http.Request) {
+		"too slow": answeringWith(func(_ http.ResponseWriter, r *http.Request) {
 			panic(http.ErrAbortHandler)
 		}),
 		"a slow start": answeringWith(func(_ http.ResponseWriter, r *http.Request) {
 			<-r.Context().Done()
 		}),
-		"headers followed by a stalled body": answeringWith(
+		"too slow after its headers": answeringWith(
 			func(w http.ResponseWriter, r *http.Request) {
 				w.Header().Set(dispositionHeader, dispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
@@ -902,250 +681,34 @@ func noAnswers() map[string]func(t *testing.T) string {
 				<-r.Context().Done()
 			}),
 		"no disposition": answeringWith(func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusOK)
 		}),
 		"a question refused": answeringWith(func(w http.ResponseWriter, _ *http.Request) {
 			http.Error(w, "refused", http.StatusBadRequest)
 		}),
 		"an unknown disposition": answeringWith(
 			func(w http.ResponseWriter, _ *http.Request) {
 				w.Header().Set(dispositionHeader, "maybe")
 				w.WriteHeader(http.StatusOK)
 			}),
 		"an answer cut short": answeringWith(
 			func(w http.ResponseWriter, _ *http.Request) {
 				w.Header().Set(dispositionHeader, dispositionDeny)
 				w.Header().Set(contentLengthHeader, "100")
 				w.WriteHeader(http.StatusForbidden)
 				_, _ = io.WriteString(w, deniedBody)
 				// Go's server drops on this panic what it has not flushed.
 				_ = http.NewResponseController(w).Flush()
 				panic(http.ErrAbortHandler)
 			}),
 		"an answer too long": answeringWith(func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(dispositionHeader, dispositionDeny)
 			w.WriteHeader(http.StatusForbidden)
 			_, _ = w.Write(make([]byte, 1<<20+1))
 		}),
 	}
 }
 func TestAnAnswerOtherThanAllowGoesToTheVisitorAsServeWAFGaveIt(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name, disposition, body string
 		status                  int
 	}{
 		{"a refusal", dispositionDeny, deniedBody, http.StatusForbidden},
 		{"a refusal, 429", dispositionDeny, deniedBody, http.StatusTooManyRequests},
 		{"servewaf's 400", "", "refused\n", http.StatusBadRequest},
 		{"a 500", "", "broken\n", http.StatusInternalServerError},
 		{"a 503 denied", dispositionDeny, "busy\n", http.StatusServiceUnavailable},
 		{"no header", "", "who knows\n", http.StatusOK},
 		{"an unknown disposition", "maybe", "who knows\n", http.StatusOK},
 	} {
 		for _, setting := range []string{dispositionAllow, dispositionDeny} {
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 				servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 					if tc.disposition != "" {
 						w.Header().Set(dispositionHeader, tc.disposition)
 					}
 					w.Header().Set(fromServeWAFHeader, addedHeaderValue)
 					w.WriteHeader(tc.status)
 					_, _ = io.WriteString(w, tc.body)
 				})
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
 					t.Error("the app was asked")
 				})
 				addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
 					defaultDisposition: setting,
 				})
 				got := get(t, addr, "/")
 				if got.status != tc.status || got.body != tc.body ||
 					got.header.Get(fromServeWAFHeader) != addedHeaderValue {
 					t.Errorf("answered %+v, want servewaf's answer", got)
 				}
 				if len(got.header.Values(dispositionHeader)) != 0 {
 					t.Errorf("the visitor got %s", dispositionHeader)
 				}
 				line := out.requestLine(t)
 				if line["status"] != float64(tc.status) || line["default_disposition"] != nil {
 					t.Errorf("line %v, want status %d and no default", line, tc.status)
 				}
 				if out.has("servewaf gave no answer") {
 					t.Error("rproxy warned that servewaf gave no answer")
 				}
 			})
 		}
 	}
 }
 func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 	if got := get(t, addr, "/"); got.status != http.StatusBadRequest {
 		t.Errorf("answered %+v, want servewaf's 400", got)
 	}
 	if line := out.requestLine(t); line["disposition"] != nil {
 		t.Errorf("line %v, want no disposition", line)
 	}
 	servewaf.wantNoReport(t)
 }
 func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = io.WriteString(w, "<html>broken")
 	})
 	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 	got := get(t, addr, "/")
 	if contentType, sent := got.header["Content-Type"]; sent {
 		t.Errorf("the visitor got the Content-Type %v", contentType)
 	}
 }
 func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 	t.Parallel()
 	const size = 1 << 20
 	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
 	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
 	got := get(t, addr, "/")
 	if got.status != http.StatusInternalServerError || len(got.body) != size {
 		t.Errorf("answered %d with %d bytes, want servewaf's 500 with %d",
 			got.status, len(got.body), size)
 	}
 }
 // startServeWAFWriting starts a stand-in for servewaf that reads each question and
 // answers it with text, as it is, and returns its URL. It can send what Go's
 // server would not.
 func startServeWAFWriting(t *testing.T, text string) string {
 	t.Helper()
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
 	t.Cleanup(func() {
 		_ = listener.Close()
 	})
 	go func() {
 		for {
 			conn, err := listener.Accept()
 			if err != nil {
 				return
 			}
 			_ = conn.SetDeadline(time.Now().Add(waitLimit))
 			_, _ = http.ReadRequest(bufio.NewReader(conn))
 			_, _ = io.WriteString(conn, text)
 			_ = conn.Close()
 		}
 	}()
 	return "http://" + listener.Addr().String()
 }
 // overOneMiB answers a question with a body over the most rproxy reads, and with
 // disposition unless it is "".
 func overOneMiB(disposition string) http.HandlerFunc {
 	return func(w http.ResponseWriter, _ *http.Request) {
 		if disposition != "" {
 			w.Header().Set(dispositionHeader, disposition)
 		}
 		w.WriteHeader(http.StatusForbidden)
 		_, _ = w.Write(make([]byte, 1<<20+1))
 	}
 }
 // switchAndHold answers a 101 and holds the connection open until rproxy closes
 // it, or until long after any test has stopped waiting.
 func switchAndHold(w http.ResponseWriter, _ *http.Request) {
 	conn, _, err := http.NewResponseController(w).Hijack()
 	if err != nil {
 		return
 	}
 	defer func() {
 		_ = conn.Close()
 	}()
 	_ = conn.SetDeadline(time.Now().Add(2 * waitLimit))
 	_, _ = io.WriteString(conn, "HTTP/1.1 101 Switching Protocols\r\n"+
 		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
 	_, _ = io.Copy(io.Discard, conn)
 }
 func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 	t.Parallel()
 	for name, backend := range map[string]func(t *testing.T) string{
 		"a deny over 1 MiB":    answeringWith(overOneMiB(dispositionDeny)),
 		"an allow over 1 MiB":  answeringWith(overOneMiB(dispositionAllow)),
 		"no header over 1 MiB": answeringWith(overOneMiB("")),
 		"a status below 100": func(t *testing.T) string {
 			t.Helper()
 			return startServeWAFWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
 		},
 		"a 101 that holds its connection open": answeringWith(switchAndHold),
 	} {
 		for _, setting := range []string{dispositionAllow, dispositionDeny} {
 			t.Run(name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 				app := startApp(t, func(http.ResponseWriter, *http.Request) {
 					t.Error("the app was asked")
 				})
 				addr, out := startRProxy(t, backend(t), app.URL, map[string]string{
 					defaultDisposition: setting,
 				})
 				if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
 					t.Errorf("answered %+v, want 502", got)
 				}
 				line := out.requestLine(t)
 				if line["status"] != float64(http.StatusBadGateway) ||
 					line["disposition"] != nil || line["default_disposition"] != nil {
 					t.Errorf("line %v, want status 502 and no disposition", line)
 				}
 				out.waitFor(t, "servewaf's answer is dropped")
 			})
 		}
 	}
 }
 func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, overOneMiB(dispositionDeny))
 	addr, out := startRProxy(t, servewaf.URL, nowhere, nil)
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
 		t.Errorf("answered %+v, want 502", got)
 	}
 	out.requestLine(t)
 	servewaf.wantNoReport(t)
 }
 func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
 	t.Parallel()
@@ -1231,26 +794,14 @@ func TestAVisitorThatGoesAwayWhileServeWAFIsAskedGetsNoDefault(t *testing.T) {
 	}
 }
 func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
 	t.Parallel()
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 	wantGreeting(t, get(t, addr, "/"))
 	out.waitFor(t, "servewaf gave no answer")
 }
 func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
-	servewaf := startServeWAF(t, func(_ http.ResponseWriter, r *http.Request) {
+	servewaf := startServeWAF(t, func(w http.ResponseWriter, _ *http.Request) {
-		<-r.Context().Done()
+		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
-	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
 		timeoutSetting: "200",
 	})
 	wantGreeting(t, get(t, addr, "/"))
 	out.requestLine(t)
@@ -1301,110 +852,41 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 	t.Parallel()
 	release := make(chan struct{})
-	backend := startServeWAFAnsweringReports(t, deny,
+	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
 			if r.Header.Get(proxy.ClientHeader) != "" {
 				deny(w, r)
 				return
 			}
 			select {
 			case <-release:
 			case <-r.Context().Done():
 			}
 			w.WriteHeader(http.StatusNoContent)
-		})
+		}))
 	t.Cleanup(backend.Close)
 	app := startApp(t, greet)
-	addr, _ := startRProxy(t, backend, app.URL, map[string]string{
+	addr, _ := startRProxy(t, backend.URL, app.URL, map[string]string{
 		timeoutSetting: "60000",
 	})
 	t.Cleanup(func() { close(release) })
-	// Go's server reads the next request on a connection only once the handler has
+	// Go's server sends a deny's answer only once the handler has returned, so
-	// returned, so the second answer comes only if the handler does not wait for
+	// this answer comes only if the handler does not wait for the report, which
-	// the first report, which the stand-in leaves unanswered.
+	// the stand-in leaves unanswered.
 	conn := dial(t, addr)
-	reader := bufio.NewReader(conn)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
-	for range 2 {
+	if status := readStatus(t, conn); status != http.StatusForbidden {
-		send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+		t.Errorf("status %d, want servewaf's 403", status)
 		res, err := http.ReadResponse(reader, nil)
 		if err != nil {
 			t.Fatalf("read the answer: %v", err)
 		}
 		_, _ = io.Copy(io.Discard, res.Body)
 		_ = res.Body.Close()
 		if res.StatusCode != http.StatusForbidden {
 			t.Errorf("status %d, want servewaf's 403", res.StatusCode)
 		}
 	}
 }
 func TestAReportServeWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
 	t.Parallel()
 	release := make(chan struct{})
 	backend := startServeWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			<-release
 			w.WriteHeader(http.StatusNoContent)
 		})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
 		timeoutSetting: "1000",
 	})
 	t.Cleanup(func() { close(release) })
 	wantGreeting(t, get(t, addr, "/"))
 	out.waitFor(t, "a report is dropped")
 }
 func TestAReportServeWAFRefusesIsDroppedWithAWarning(t *testing.T) {
 	t.Parallel()
 	backend := startServeWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusBadRequest)
 		})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, nil)
 	wantGreeting(t, get(t, addr, "/"))
 	out.waitFor(t, "a report is dropped")
 }
 func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 	t.Parallel()
 	backend := startServeWAFAnsweringReports(t, allow, switchAndHold)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
 		timeoutSetting: "60000",
 	})
 	wantGreeting(t, get(t, addr, "/"))
 	out.waitFor(t, "a report is dropped")
 }
 func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) {
 	t.Parallel()
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out, server := startServer(t, servewaf.URL, app.URL, nil)
 	server.WaitForReports()
 	wantGreeting(t, get(t, addr, "/"))
 	out.requestLine(t)
 	servewaf.wantNoReport(t)
 }
 func TestReportGivesWhatHappened(t *testing.T) {
 	t.Parallel()
@@ -1601,52 +1083,6 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 	}
 }
 // This test does not run in parallel. Go closes a connection nothing refers to at
 // its next garbage collection, which other tests' allocations would soon start, and
 // that would hide a connection left open.
 //
 //nolint:paralleltest // see above
 func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 	closed := make(chan error, 1)
 	servewaf := startServeWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
 			closed <- err
 			return
 		}
 		defer func() {
 			_ = conn.Close()
 		}()
 		// Not the protocol the visitor asked for, so ReverseProxy refuses the switch.
 		_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
 			"Connection: Upgrade\r\nUpgrade: another\r\n\r\n")
 		_ = buffered.Flush()
 		_ = conn.SetReadDeadline(time.Now().Add(waitLimit))
 		_, err = buffered.ReadByte()
 		closed <- err
 	})
 	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
 	conn := dial(t, addr)
 	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
 		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
 	if status := readStatus(t, conn); status != http.StatusBadGateway {
 		t.Errorf("status %d, want 502", status)
 	}
 	err := <-closed
 	if !errors.Is(err, io.EOF) {
 		t.Errorf("the app's read gave %v, want its connection closed", err)
 	}
 }
 // echoAfterUpgrade is an app that switches protocols on request, and then sends
 // back each line it receives.
 func echoAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
@@ -9,7 +9,6 @@ import (
 	"io"
 	"maps"
 	"net/http"
 	"strings"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 )
@@ -23,7 +22,8 @@ const answerBodyMaxBytes = 1 << 20
 const reportAnswerMaxBytes = 4 << 10
 var (
-	errCannotPassOn  = errors.New("the answer cannot be passed to the visitor")
+	errNoDisposition = errors.New("the answer has no valid " + proxy.DispositionHeader)
 	errAnswerTooLong = errors.New("the answer's body is over 1 MiB")
 	errReportRefused = errors.New("the report was answered")
 )
@@ -34,57 +34,37 @@ type servewafAnswer struct {
 	body   []byte
 }
-// noteAnswer notes what servewaf answered. An answer without a valid disposition
+// askServeWAF asks servewaf about the request, and notes what is to be done
-// notes nothing, and no report is due for it: servewaf holds no decision to report
+// with it. It returns servewaf's answer, or nil when servewaf gave none, and
-// on.
+// SWRP_DEFAULT_DISPOSITION decides. When the visitor went away while servewaf
-func (rq *request) noteAnswer(answer *servewafAnswer) {
+// was being asked, servewaf has not failed, and nothing is noted. ctx is the
-	disposition := answer.header.Get(proxy.DispositionHeader)
+// request's own context.
 func (rq *request) askServeWAF(ctx context.Context) *servewafAnswer {
 	answer, err := rq.ask(ctx)
 	if err != nil {
 		if ctx.Err() != nil {
 			return nil
 		}
 	switch disposition {
 	case proxy.DispositionAllow, proxy.DispositionDeny, proxy.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
 		rq.country = answer.header.Get(countryHeader)
 	}
 }
 // handleNoUsableAnswer deals with a request whose question ended in err, which
 // leaves no answer to act on. ctx is the request's own context.
 func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	switch {
 	case ctx.Err() != nil:
 		// The visitor went away while servewaf was being asked. servewaf has not
 		// failed, and nothing is noted. This panic has Go's server close the
 		// connection without an answer, and log nothing; the deferred finish still
 		// runs.
 		panic(http.ErrAbortHandler)
 	case errors.Is(err, errCannotPassOn):
 		rq.h.processLog.Warn("servewaf's answer is dropped", "error", err.Error())
 		rq.answer(http.StatusBadGateway)
 	default:
 		// servewaf cannot be connected to, does not answer at all, or does not answer
 		// within SWRP_TIMEOUT_MS. A request that keeps servewaf busy past
 		// SWRP_TIMEOUT_MS, like any request while servewaf is overloaded, gets
 		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
 		// whenever servewaf is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
 		rq.h.processLog.Warn("servewaf gave no answer", "error", err.Error())
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
-		if rq.disposition == proxy.DispositionAllow {
+		return nil
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
 		}
 	}
 	rq.disposition = answer.header.Get(proxy.DispositionHeader)
 	rq.answered = true
 	rq.asn = answer.header.Get(asnHeader)
 	rq.country = answer.header.Get(countryHeader)
 	return answer
 }
 // ask sends servewaf the question, and returns its answer, which must have come
-// whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
+// whole within SWRP_TIMEOUT_MS, with a valid disposition. It ends when ctx does,
-// away.
+// as when the visitor goes away.
 func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
 	defer cancel()
@@ -103,39 +83,21 @@ func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
 		_ = res.Body.Close()
 	}()
 	// The body of a 101 is the connection itself, and the time limit does not end
 	// a read of that. Go's client also takes a status below 100, which Go's server
 	// panics when asked to send.
 	if res.StatusCode < http.StatusOK {
 		return nil, fmt.Errorf("%w: its status is %d", errCannotPassOn, res.StatusCode)
 	}
 	body, err := io.ReadAll(io.LimitReader(res.Body, answerBodyMaxBytes+1))
 	if err != nil {
 		return nil, fmt.Errorf("read the answer: %w", err)
 	}
 	if len(body) > answerBodyMaxBytes {
-		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
+		return nil, errAnswerTooLong
 	}
-	return &servewafAnswer{res.StatusCode, res.Header, body}, nil
+	switch res.Header.Get(proxy.DispositionHeader) {
-}
+	case proxy.DispositionAllow, proxy.DispositionDeny, proxy.DispositionClose:
-
+		return &servewafAnswer{res.StatusCode, res.Header, body}, nil
-// canBeAsked reports whether Go's client can send servewaf r as the visitor sent
+	default:
-// it. It cannot send these as they came:
+		return nil, fmt.Errorf("%w, and status %d", errNoDisposition, res.StatusCode)
-//   - a target that does not start with /, or that starts with //;
+	}
 //   - an empty Host, for which it sends servewaf's own address;
 //   - a Host holding an IPv6 zone, which it removes;
 //   - more than one User-Agent, of which it sends the first;
 //   - an empty User-Agent, which it leaves out, the one case that still goes to
 //     servewaf.
 func canBeAsked(r *http.Request) bool {
 	target, host := r.RequestURI, r.Host
 	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
 	return strings.HasPrefix(target, "/") && !strings.HasPrefix(target, "//") &&
 		host != "" && !hostHasZone && len(r.Header.Values("User-Agent")) <= 1
 }
 // newQuestion returns the question about the request, as "The question" in
@@ -163,9 +125,10 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	question.URL = &target
 	question.Host = in.Host
-	// The length NewRequestWithContext set is that of what is held. This line makes
+	// The length NewRequestWithContext set is that of what is held. A body whose
-	// a body whose length the visitor did not announce go chunked, as "The question"
+	// length the visitor did not announce goes chunked. Named here, since Go's
-	// in SPEC.md requires.
+	// client would otherwise send a CONNECT's body with neither length nor chunks,
 	// which servewaf would read as further requests.
 	question.TransferEncoding = in.TransferEncoding
 	question.Header = in.Header.Clone()
@@ -197,14 +160,8 @@ func (rq *request) answerWith(answer *servewafAnswer) {
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
 	header.Del(proxy.DispositionHeader)
-
+	rq.out.WriteHeader(answer.status)
-	// Go's server adds a Content-Type it guesses from the body to a response whose
+	_, _ = rq.out.Write(answer.body)
 	// headers have no Content-Type key. The key with no value sends none.
 	if header.Get("Content-Type") == "" {
 		header["Content-Type"] = nil
 	}
 	rq.send(answer.status, answer.body)
 }
 // sendReport sends servewaf report on a goroutine of its own, so that the
@@ -250,12 +207,7 @@ func (h *handler) postReport(ctx context.Context, report *proxy.Report) error {
 		return fmt.Errorf("send the report: %w", err)
 	}
-	// The body of a 101 is the connection itself, and the time limit does not end
+	_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
 	// a read of that.
 	if res.StatusCode >= http.StatusOK {
 		_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
 	}
 	_ = res.Body.Close()
 	if res.StatusCode != http.StatusNoContent {
@@ -17,16 +17,13 @@ import (
 // healthCheckTimeout bounds the whole health check.
 const healthCheckTimeout = 5 * time.Second
-var errHealthEndpoint = errors.New("the health endpoint answered")
+var errHealthEndpoint = errors.New("smallwebwaf's health endpoint answered")
-// HealthCheck is the container's health check. In servewaf's container, where
+// HealthCheck is the container's health check. It returns 0 while
-// SMALLWEBWAF_COMMAND is servewaf, it returns 0 while servewaf answers its health
+// smallwebwaf answers its health endpoint on 127.0.0.1, at the port in
-// endpoint on 127.0.0.1, at the port in SWWAF_LISTEN_ADDR. In rproxy's container,
+// SWWAF_LISTEN_ADDR, and the app accepts connections at the address in
-// where SMALLWEBWAF_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
+// SWWAF_UPSTREAM_URL. Otherwise it writes why to stderr and returns 1.
-// answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
+// It reads no other setting, nor a file that another names, so neither
 // the app accepts connections at the address in SWRP_UPSTREAM_URL. Otherwise,
 // any other value of SMALLWEBWAF_COMMAND included, it writes why to stderr and
 // returns 1. It reads no other setting, nor a file that another names, so neither
 // can fail it.
 // args are the arguments after `healthcheck`; it takes none, and given
 // one it names it on stderr and returns 1 without checking anything.
@@ -41,20 +38,7 @@ func HealthCheck(
 		return 1
 	}
-	ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
+	err := healthCheck(ctx, lookupEnv)
 	defer cancel()
 	command, err := config.Command(lookupEnv)
 	switch {
 	case err != nil:
 		err = fmt.Errorf("invalid setting: %w", err)
 	case command == "servewaf":
 		err = checkServeWAF(ctx, lookupEnv)
 	default:
 		err = checkRProxyAndApp(ctx, lookupEnv)
 	}
 	if err != nil {
 		_, _ = fmt.Fprintln(stderr, "unhealthy:", err)
@@ -64,48 +48,16 @@ func HealthCheck(
 	return 0
 }
-// checkServeWAF asks servewaf's health endpoint.
+func healthCheck(ctx context.Context, lookupEnv func(string) (string, bool)) error {
-func checkServeWAF(ctx context.Context, lookupEnv func(string) (string, bool)) error {
+	ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
-	listenAddr, err := config.ServeWAFListenAddr(lookupEnv)
+	defer cancel()
 	listenAddr, upstreamURL, err := config.ListenAddrAndUpstreamURL(lookupEnv)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
-	err = askHealthEndpoint(ctx, listenAddr)
+	// The settings have checked that the address has a port.
 	if err != nil {
 		return fmt.Errorf("ask servewaf: %w", err)
 	}
 	return nil
 }
 // checkRProxyAndApp asks rproxy's health endpoint, and connects to the app.
 func checkRProxyAndApp(
 	ctx context.Context, lookupEnv func(string) (string, bool),
 ) error {
 	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(lookupEnv)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
 	err = askHealthEndpoint(ctx, listenAddr)
 	if err != nil {
 		return fmt.Errorf("ask rproxy: %w", err)
 	}
 	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", appAddress(upstreamURL))
 	if err != nil {
 		return fmt.Errorf("connect to the app: %w", err)
 	}
 	_ = conn.Close()
 	return nil
 }
 // askHealthEndpoint asks the health endpoint on 127.0.0.1 at the port of
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
 	health := "http://" + net.JoinHostPort("127.0.0.1", port) + proxy.HealthPath
@@ -116,7 +68,7 @@ func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	res, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return fmt.Errorf("send the request: %w", err)
+		return fmt.Errorf("ask smallwebwaf: %w", err)
 	}
 	_ = res.Body.Close()
@@ -125,6 +77,13 @@ func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 		return fmt.Errorf("%w %s", errHealthEndpoint, res.Status)
 	}
 	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", appAddress(upstreamURL))
 	if err != nil {
 		return fmt.Errorf("connect to the app: %w", err)
 	}
 	_ = conn.Close()
 	return nil
 }
@@ -15,26 +15,22 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
-const (
+func TestHealthCheck(t *testing.T) {
 	// commandSetting says which command a container runs, and which the health
 	// check checks.
 	commandSetting = "SMALLWEBWAF_COMMAND"
 	// serveWAFCommand is the command that runs servewaf.
 	serveWAFCommand = "servewaf"
 )
 func TestHealthCheckInServeWAFsContainer(t *testing.T) {
 	t.Parallel()
 	app := httptest.NewServer(http.NotFoundHandler())
 	defer app.Close()
 	ctx, stop := context.WithCancel(t.Context())
 	defer stop()
 	out := &output{}
 	exited := make(chan int, 1)
 	settings := map[string]string{
-		listenAddr: localhost + ":0",
+		listenAddr:  localhost + ":0",
-		stateDir:   t.TempDir(),
+		upstreamURL: app.URL,
-		rulesDir:   t.TempDir(),
+		stateDir:    t.TempDir(),
 		rulesDir:    t.TempDir(),
 	}
 	go func() {
@@ -43,36 +39,40 @@ func TestHealthCheckInServeWAFsContainer(t *testing.T) {
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	_, port, _ := net.SplitHostPort(addr)
 	// The container's settings: an address to listen on with an empty
 	// host part, which the health check asks at 127.0.0.1.
-	wantHealthCheck(t, map[string]string{
+	env := map[string]string{listenAddr: ":" + port, upstreamURL: app.URL}
 		commandSetting: serveWAFCommand, listenAddr: ":" + port,
 	}, 0, "")
-	// The health check reads that setting alone, here given as a file: a removed
+	wantHealthCheck(t, env, 0, "")
-	// or invalid token file, or an invalid value of another setting, does not
+
-	// fail it.
+	// The health check reads those two settings alone, here given as
 	// files: a removed or invalid token file, or an invalid value of
 	// another setting, does not fail it.
 	for _, other := range []struct{ name, value string }{
 		{"SWWAF_METRICS_TOKEN_FILE", filepath.Join(t.TempDir(), "removed")},
 		{"SWWAF_METRICS_TOKEN_FILE", writeFile(t, "too short\n")},
 		{"SWWAF_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
-			commandSetting:       serveWAFCommand,
+			listenAddr + "_FILE":  writeFile(t, ":"+port+"\n"),
-			listenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
+			upstreamURL + "_FILE": writeFile(t, app.URL+"\n"),
-			other.name:           other.value,
+			other.name:            other.value,
 		}, 0, "")
 	}
 	// Another test can take a closed server's port at once, so the app's
 	// address here is a multicast address, to which TCP cannot connect.
 	wantHealthCheck(t, map[string]string{
 		listenAddr:  ":" + port,
 		upstreamURL: "http://224.0.0.1",
 	}, 1, "unhealthy: connect to the app: ")
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
-	wantHealthCheck(t, map[string]string{
+	wantHealthCheck(t, map[string]string{listenAddr: ":0"}, 1,
-		commandSetting: serveWAFCommand, listenAddr: ":0",
+		"unhealthy: ask smallwebwaf: ")
-	}, 1, "unhealthy: ask servewaf: ")
+	wantHealthCheck(t, map[string]string{listenAddr: "8080"}, 1,
-	wantHealthCheck(t, map[string]string{
+		"unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
 		commandSetting: serveWAFCommand, listenAddr: "8080",
 	}, 1, "unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
 	stop()
@@ -83,63 +83,6 @@ func TestHealthCheckInServeWAFsContainer(t *testing.T) {
 	}
 }
 func TestHealthCheckInRProxysContainer(t *testing.T) {
 	t.Parallel()
 	app := httptest.NewServer(http.NotFoundHandler())
 	defer app.Close()
 	// Nothing listens at the backend. The health check asks rproxy and the app,
 	// whether or not servewaf answers.
 	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
 	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
 	settings := func(more ...string) map[string]string {
 		env := map[string]string{rproxyListenAddr: ":" + port, rproxyUpstreamURL: app.URL}
 		for i := 0; i < len(more); i += 2 {
 			env[more[i]] = more[i+1]
 		}
 		return env
 	}
 	wantHealthCheck(t, settings(), 0, "")
 	wantHealthCheck(t, settings(commandSetting, ""), 0, "")
 	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
 	// SMALLWEBWAF_COMMAND cannot be given as a file.
 	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "servewaf\n")),
 		0, "")
 	// Another setting does not fail it, even an invalid one, and neither does
 	// SWRP_WAF_BACKEND being unset.
 	wantHealthCheck(t, settings("SWRP_TIMEOUT_MS", "soon"), 0, "")
 	// Another test can take a closed server's port at once, so the app's
 	// address here is a multicast address, to which TCP cannot connect.
 	wantHealthCheck(t, settings(rproxyUpstreamURL, "http://224.0.0.1"), 1,
 		"unhealthy: connect to the app: ")
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
 	wantHealthCheck(t, settings(rproxyListenAddr, ":0"), 1, "unhealthy: ask rproxy: ")
 	wantHealthCheck(t, settings(rproxyListenAddr, "8080"), 1,
 		"unhealthy: invalid setting: SWRP_LISTEN_ADDR: ")
 	// No setting of rproxy's has a form given as a file.
 	wantHealthCheck(t, map[string]string{
 		rproxyListenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 		rproxyUpstreamURL:          app.URL,
 	}, 1, "unhealthy: ask rproxy: ")
 }
 func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
 	t.Parallel()
 	wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1,
 		"unhealthy: invalid setting: SMALLWEBWAF_COMMAND: "+
 			"\"healthcheck\" is not rproxy or servewaf\n")
 }
 func TestHealthCheckRefusesAnArgument(t *testing.T) {
 	t.Parallel()
@@ -26,12 +26,6 @@ import (
 const (
 	// wafBackend is the setting that names servewaf to rproxy.
 	wafBackend = "SWRP_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
 	rproxyListenAddr = "SWRP_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
 	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
 	// rproxyTimeout is the setting that says how long rproxy waits for servewaf.
 	rproxyTimeout = "SWRP_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
 	// otherClient is a client the tests do not ban.
@@ -64,7 +58,7 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 	go func() {
 		exited <- runRProxy(ctx, map[string]string{
-			rproxyListenAddr:       localhost + ":0",
+			"SWRP_LISTEN_ADDR":     localhost + ":0",
 			"SWRP_UPSTREAM_URL":    appURL,
 			"SWRP_TRUSTED_PROXIES": localhost + "/32",
 			wafBackend:             backend,
@@ -102,7 +96,7 @@ func startServeWAF(t *testing.T, env map[string]string) (string, *output, func()
 	exited := make(chan int, 1)
 	go func() {
-		exited <- run(ctx, env, out)
+		exited <- runAs(ctx, true, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
@@ -306,7 +300,7 @@ func sendRaw(t *testing.T, site, request string) int {
 	return res.StatusCode
 }
-func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
+func TestAConnectBodyStaysABodyAtServeWAF(t *testing.T) {
 	t.Parallel()
 	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
@@ -321,11 +315,12 @@ func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
 		proxy.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
-	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
+	status := sendRaw(t, site, "CONNECT /tunnel HTTP/1.1\r\nHost: site.example\r\n"+
 		"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
 		strconv.FormatInt(int64(len(smuggled)), 16)+"\r\n"+smuggled+"\r\n0\r\n\r\n")
-	if status != http.StatusOK {
+	if status != http.StatusForbidden {
-		t.Errorf("status %d, want the app's 200", status)
+		t.Errorf("status %d, want the 403 of the Core Rule Set, which refuses CONNECT",
 			status)
 	}
 	// Read as a further request, it would act straight after the answer.
@@ -508,191 +503,6 @@ func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	}
 }
 func TestRProxyProcessLinesNameTheHostAndComeAtInfo(t *testing.T) {
 	t.Parallel()
 	hostname, err := os.Hostname()
 	if err != nil {
 		t.Fatalf("the host's name: %v", err)
 	}
 	// Nothing listens at the backend's address; no request asks it.
 	_, out := startRProxy(t, "http://127.0.0.1:9", startApp(t))
 	line := out.line(t, "msg", "starting")
 	if line["instance"] != hostname || line["level"] != "INFO" {
 		t.Errorf("rproxy's line is %v, want instance %s at INFO", line, hostname)
 	}
 }
 func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	t.Parallel()
 	reportGotThere := make(chan struct{})
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
 			if r.Header.Get(proxy.ClientHeader) != "" {
 				w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 				return
 			}
 			close(reportGotThere)
 			<-release
 			w.WriteHeader(http.StatusNoContent)
 		}))
 	t.Cleanup(backend.Close)
 	ctx, stop := context.WithCancel(t.Context())
 	defer stop()
 	env := map[string]string{
 		rproxyListenAddr:    localhost + ":0",
 		"SWRP_UPSTREAM_URL": startApp(t),
 		rproxyTimeout:       "60000",
 		wafBackend:          backend.URL,
 	}
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runRProxy(ctx, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	wantStatus(t, "http://"+addr+"/", placed, http.StatusOK)
 	select {
 	case <-reportGotThere:
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 	}
 	stop()
 	select {
 	case <-exited:
 		t.Error("rproxy stopped with a report on its way")
 		close(release)
 		return
 	case <-time.After(10 * pollInterval):
 	}
 	close(release)
 	select {
 	case status := <-exited:
 		if status != 0 {
 			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running, the report having been answered")
 	}
 }
 // sendAndKeepOpen sends request to rproxy at addr, and returns the connection. A
 // read from it ends with an error once waitLimit is up.
 func sendAndKeepOpen(t *testing.T, addr, request string) net.Conn {
 	t.Helper()
 	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp", addr)
 	if err != nil {
 		t.Fatalf("dial: %v", err)
 	}
 	t.Cleanup(func() {
 		_ = conn.Close()
 	})
 	err = conn.SetDeadline(time.Now().Add(waitLimit))
 	if err != nil {
 		t.Fatalf("set the deadline: %v", err)
 	}
 	_, err = io.WriteString(conn, request)
 	if err != nil {
 		t.Fatalf("send: %v", err)
 	}
 	return conn
 }
 func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 	t.Parallel()
 	const (
 		cutOffAfter     = 5 * time.Second
 		upstreamSetting = "SWRP_UPSTREAM_URL"
 	)
 	asked := make(chan struct{})
 	release := make(chan struct{})
 	app := httptest.NewServer(http.HandlerFunc(
 		func(http.ResponseWriter, *http.Request) {
 			close(asked)
 			<-release
 		}))
 	t.Cleanup(app.Close)
 	t.Cleanup(func() { close(release) })
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 	ctx, stop := context.WithCancel(t.Context())
 	defer stop()
 	env := map[string]string{
 		rproxyListenAddr: localhost + ":0",
 		upstreamSetting:  app.URL,
 		wafBackend:       backend.URL,
 	}
 	out := &output{}
 	exited := make(chan int, 1)
 	go func() {
 		exited <- runRProxy(ctx, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	conn := sendAndKeepOpen(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
 	select {
 	case <-asked:
 	case <-time.After(waitLimit):
 		t.Fatal("the app was not asked")
 	}
 	stopped := time.Now()
 	stop()
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
 		t.Errorf("read %q (%v), want the connection cut off", text, err)
 	}
 	if elapsed := time.Since(stopped); elapsed < cutOffAfter {
 		t.Errorf("cut off after %s, want %s", elapsed, cutOffAfter)
 	}
 	select {
 	case status := <-exited:
 		if status != 0 {
 			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
 		}
 	case <-time.After(waitLimit):
 		t.Error("rproxy still running after the cut-off")
 	}
 	out.line(t, "msg", "requests still in progress were cut off")
 }
 func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 	t.Parallel()
@@ -702,8 +512,8 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 	}{
 		{"no backend", wafBackend, nil},
 		{
-			"another invalid", rproxyTimeout,
+			"another invalid", "SWRP_TIMEOUT_MS",
-			map[string]string{wafBackend: "http://servewaf:8080", rproxyTimeout: "soon"},
+			map[string]string{wafBackend: "http://servewaf:8080", "SWRP_TIMEOUT_MS": "soon"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -740,8 +550,8 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	out := &output{}
 	status := runRProxy(t.Context(), map[string]string{
-		wafBackend:       "http://servewaf:8080",
+		wafBackend:         "http://servewaf:8080",
-		rproxyListenAddr: taken.Addr().String(),
+		"SWRP_LISTEN_ADDR": taken.Addr().String(),
 	}, out)
 	if status != 1 {
 		t.Errorf("exit status %d, want 1", status)
@@ -1,7 +1,6 @@
 package smallwebwaf_test
 import (
 	"bytes"
 	"context"
 	"crypto/rand"
 	"io"
@@ -34,88 +33,59 @@ func TestMain(m *testing.M) {
 	os.Exit(smallwebwaf.Main(testVersion))
 }
-func TestMainRunsServeWAF(t *testing.T) {
+func TestMainAnswersQuestionsOnlyAsServeWAF(t *testing.T) {
 	t.Parallel()
-	binary, err := os.Executable()
+	for _, tc := range []struct {
-	if err != nil {
+		command, disposition string
-		t.Fatalf("find the test binary: %v", err)
+	}{
-	}
+		{"servewaf", proxy.DispositionAllow},
-
+		{"", ""},
-	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
+	} {
-	defer cancel()
+		t.Run("command "+tc.command, func(t *testing.T) {
 	out := &output{}
 	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
 	cmd.Stdout = out
 	cmd.Env = append(os.Environ(),
 		commandForMain+"="+serveWAFCommand,
 		listenAddr+"="+localhost+":0",
 		stateDir+"="+t.TempDir(),
 		rulesDir+"="+t.TempDir(),
 		lookupSource+"=off")
 	err = cmd.Start()
 	if err != nil {
 		t.Fatalf("start: %v", err)
 	}
 	t.Cleanup(func() {
 		_ = cmd.Process.Kill()
 		_ = cmd.Wait()
 	})
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
 		t.Fatalf("signal: %v", err)
 	}
 	err = cmd.Wait()
 	if err != nil {
 		t.Errorf("exit: %v; output:\n%s", err, out.text())
 	}
 }
 func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
 	t.Parallel()
 	binary, err := os.Executable()
 	if err != nil {
 		t.Fatalf("find the test binary: %v", err)
 	}
 	for _, command := range []string{"", "serve"} {
 		t.Run("command "+command, func(t *testing.T) {
 			t.Parallel()
-			ctx, cancel := context.WithTimeout(t.Context(), waitLimit)
+			binary, err := os.Executable()
 			if err != nil {
 				t.Fatalf("find the test binary: %v", err)
 			}
 			ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
 			defer cancel()
-			var stdout, stderr bytes.Buffer
+			out := &output{}
 			cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
 			cmd.Stdout = out
-			cmd := exec.CommandContext(ctx, binary)
+			cmd.Env = append(os.Environ(),
-			cmd.Stdout, cmd.Stderr = &stdout, &stderr
+				commandForMain+"="+tc.command,
 				listenAddr+"="+localhost+":0",
 				upstreamURL+"="+startApp(t),
 				stateDir+"="+t.TempDir(),
 				rulesDir+"="+t.TempDir(),
 				lookupSource+"=off")
-			cmd.Env = append(os.Environ(), commandForMain+"="+command)
+			err = cmd.Start()
-
+			if err != nil {
-			err := cmd.Run()
+				t.Fatalf("start: %v", err)
 			if code := cmd.ProcessState.ExitCode(); code != 2 {
 				t.Errorf("exit status %d (%v), want 2", code, err)
 			}
-			for _, name := range []string{"rproxy", serveWAFCommand, "healthcheck"} {
+			t.Cleanup(func() {
-				if !strings.Contains(stderr.String(), name) {
+				_ = cmd.Process.Kill()
-					t.Errorf("stderr %q does not name %s", stderr.String(), name)
+				_ = cmd.Wait()
-				}
+			})
 			addr, _ := out.line(t, "msg", "starting")["address"].(string)
 			ask(t, addr, "/", http.StatusOK, tc.disposition)
 			err = cmd.Process.Signal(syscall.SIGTERM)
 			if err != nil {
 				t.Fatalf("signal: %v", err)
 			}
-			if stdout.Len() != 0 {
+			err = cmd.Wait()
-				t.Errorf("stdout %q, want nothing", stdout.String())
+			if err != nil {
 				t.Errorf("exit: %v; output:\n%s", err, out.text())
 			}
 		})
 	}
@@ -164,7 +134,7 @@ func runServeWAF(t *testing.T, env map[string]string, use func(addr string)) {
 	exited := make(chan int, 1)
 	go func() {
-		exited <- run(ctx, env, out)
+		exited <- runAs(ctx, true, env, out)
 	}()
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
@@ -202,3 +172,39 @@ func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 		ask(t, addr, "/", http.StatusForbidden, proxy.DispositionDeny)
 	})
 }
 func TestWithoutACommandTheClientHeaderIsNoQuestion(t *testing.T) {
 	t.Parallel()
 	runUntilStopped(t, map[string]string{
 		listenAddr:  localhost + ":0",
 		upstreamURL: startApp(t),
 		stateDir:    t.TempDir(),
 		rulesDir:    t.TempDir(),
 	}, func(url string) {
 		req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
 			http.NoBody)
 		if err != nil {
 			t.Fatalf("new request: %v", err)
 		}
 		req.Header.Set(proxy.ClientHeader, placed)
 		transport := &http.Transport{}
 		defer transport.CloseIdleConnections()
 		res, err := (&http.Client{Transport: transport}).Do(req)
 		if err != nil {
 			t.Fatalf("request: %v", err)
 		}
 		body, err := io.ReadAll(res.Body)
 		_ = res.Body.Close()
 		if err != nil || string(body) != greeting ||
 			res.Header.Get(proxy.DispositionHeader) != "" {
 			t.Errorf("answered %q (%v) with disposition %q, want the app's greeting",
 				body, err, res.Header.Get(proxy.DispositionHeader))
 		}
 	})
 }
@@ -1,16 +1,15 @@
-// Package smallwebwaf runs the smallwebwaf process, as the command it is given.
+// Package smallwebwaf runs the smallwebwaf process: it reads the settings,
-// `smallwebwaf servewaf` reads the settings, the rule files, the lookup database
+// the rule files, the lookup database and the state files, serves requests
-// and the state files, answers rproxy's questions until it is told to stop, and
+// until it is told to stop, and then stops in an orderly way, writing the
-// then stops in an orderly way, writing the state files. `smallwebwaf rproxy`
+// state files. It serves them in front of an app, or, as `smallwebwaf
-// reads rproxy's settings alone, and runs the reverse proxy in front of one app
+// servewaf`, by answering rproxy's questions about them. As `smallwebwaf
-// that asks servewaf about each request. `smallwebwaf healthcheck` is the
+// rproxy`, it instead reads rproxy's settings alone, and runs the reverse proxy
-// container's health check.
+// in front of one app that asks servewaf about each request.
 package smallwebwaf
 import (
 	"context"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net"
@@ -36,25 +35,12 @@ import (
 // runit and docker wait a little longer before they kill the process.
 const shutdownTimeout = 5 * time.Second
-// remoteLogStopTimeout is how long, as servewaf stops, the log lines still
+// remoteLogStopTimeout is how long, as smallwebwaf stops, the log lines
-// waiting are sent to SWWAF_LOG_REMOTE_URL before they are given up. stdout has
+// still waiting are sent to SWWAF_LOG_REMOTE_URL before they are given
-// carried them.
+// up. stdout has carried them.
 const remoteLogStopTimeout = 2 * time.Second
-// usageStatus is the exit status with no command, or one smallwebwaf does not
+// Params are what Run needs from the process.
 // know.
 const usageStatus = 2
 // usage is what smallwebwaf prints then.
 const usage = `usage: smallwebwaf <command>
 commands:
  rproxy       the reverse proxy in front of one app
  servewaf     decides for rproxy, and keeps bans, counters and history
  healthcheck  the container's health check
 `
 // Params are what RunServeWAF and RunRProxy need from the process.
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
@@ -62,47 +48,44 @@ type Params struct {
 	LookupEnv func(string) (string, bool)
 	// Stdout receives the request log and the process's own messages.
 	Stdout io.Writer
 	// ServeWAF makes it `smallwebwaf servewaf`, which answers rproxy's
 	// questions, rather than the proxy in front of an app.
 	ServeWAF bool
 }
-// Main runs the command os.Args names, and returns the process's exit status.
+// Main runs smallwebwaf until SIGTERM or SIGINT, and returns the
-// `smallwebwaf rproxy` and `smallwebwaf servewaf` run until SIGTERM or SIGINT.
+// process's exit status. Run as `smallwebwaf servewaf`, it answers
-// With no command, or one it does not know, it prints the commands and returns
+// rproxy's questions rather than pass requests to an app. Run as
-// usageStatus.
+// `smallwebwaf rproxy`, it is the reverse proxy that asks those questions.
 // Run as `smallwebwaf healthcheck`, it is the container's health check
 // instead.
 func Main(version string) int {
-	args := os.Args[1:]
+	if len(os.Args) > 1 && os.Args[1] == "healthcheck" {
-	if len(args) == 0 {
+		return HealthCheck(context.Background(), os.Args[2:], os.LookupEnv, os.Stderr)
 		return printUsage(os.Stderr)
 	}
 	ctx, stop := signal.NotifyContext(context.Background(),
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
-	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+	params := Params{
-
+		Version:   version,
-	switch args[0] {
+		LookupEnv: os.LookupEnv,
-	case "rproxy":
+		Stdout:    os.Stdout,
-		return RunRProxy(ctx, params)
+		ServeWAF:  len(os.Args) > 1 && os.Args[1] == "servewaf",
 	case "servewaf":
 		return RunServeWAF(ctx, params)
 	case "healthcheck":
 		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
 	default:
 		return printUsage(os.Stderr)
 	}
 	if len(os.Args) > 1 && os.Args[1] == "rproxy" {
 		return RunRProxy(ctx, params)
 	}
 	return Run(ctx, params)
 }
-// printUsage writes the commands to w, and returns usageStatus.
+// Run reads the settings, the rule files, the lookup database and the
-func printUsage(w io.Writer) int {
+// state files, then serves requests until ctx is done. It returns the
-	_, _ = fmt.Fprint(w, usage)
+// process's exit status, 1 when smallwebwaf cannot start.
-
+func Run(ctx context.Context, params Params) int {
 	return usageStatus
 }
 // RunServeWAF is `smallwebwaf servewaf`: it reads the settings, the rule files,
 // the lookup database and the state files, then serves requests until ctx is
 // done. It returns the process's exit status, 1 when servewaf cannot start.
 func RunServeWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWWAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
@@ -150,7 +133,12 @@ func RunServeWAF(ctx context.Context, params Params) int {
 		return 1
 	}
-	server, err := newServer(cfg, stdout, processLog, now, ruleFiles, alertQueue)
+	newProxy := proxy.New
 	if params.ServeWAF {
 		newProxy = proxy.NewServeWAF
 	}
 	server, err := newServer(newProxy, cfg, stdout, processLog, now, ruleFiles, alertQueue)
 	if err != nil {
 		processLog.Error("cannot use the lookup database", "error", err.Error())
@@ -184,10 +172,12 @@ func RunServeWAF(ctx context.Context, params Params) int {
 	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
 }
-// newServer returns the server servewaf runs, with the metrics of the alerts,
+// newServer returns the server smallwebwaf runs, which newProxy makes, with
-// after reading the lookup database while SWWAF_LOOKUP_SOURCE is file. A lookup
+// the metrics of the alerts, after reading the lookup database while
-// database that cannot be read is an error.
+// SWWAF_LOOKUP_SOURCE is file. A lookup database that cannot be read is an
 // error.
 func newServer(
 	newProxy func(proxy.Params) *proxy.Server,
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 ) (*proxy.Server, error) {
@@ -207,7 +197,7 @@ func newServer(
 		}
 	}
-	server := proxy.NewServeWAF(proxy.Params{
+	server := newProxy(proxy.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -371,10 +361,12 @@ func serve(
 	// Run and Watch have ended, so nothing else reads or writes the
 	// files, and no alert is being sent, so that alerts.json keeps every
-	// alert not yet sent. Every request has ended too, but for one cut off
+	// alert not yet sent. Every request has ended too, but for two kinds
-	// because Shutdown timed out, which adds to its client's history only as
+	// that Go's server does not wait for: one cut off because Shutdown
-	// it ends. That can be after this write, and then that request is missing
+	// timed out, and one whose connection switched protocols, such as a
-	// from clients.json.
+	// WebSocket. Such a request adds to its client's history only as it
 	// ends, which can be after this write, and then that request is
 	// missing from clients.json.
 	<-written
 	<-watched
 	<-rulesWatched
@@ -3,7 +3,6 @@ package smallwebwaf_test
 import (
 	"bytes"
 	"context"
 	"crypto/rand"
 	"encoding/json"
 	"io"
 	"net"
@@ -20,7 +19,6 @@ import (
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
@@ -34,6 +32,8 @@ const (
 	// localhost is where the tests listen.
 	localhost            = "127.0.0.1"
 	listenAddr           = "SWWAF_LISTEN_ADDR"
 	upstreamURL          = "SWWAF_UPSTREAM_URL"
 	trustedProxies       = "SWWAF_TRUSTED_PROXIES"
 	stateDir             = "SWWAF_STATE_DIR"
 	stateWriteDelay      = "SWWAF_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
@@ -122,11 +122,18 @@ func (o *output) text() string {
 	return o.buf.String()
 }
-// run runs `smallwebwaf servewaf` with the settings in env until ctx is done,
+// run runs smallwebwaf with the settings in env until ctx is done, and
-// and returns its exit status. SWWAF_LOOKUP_SOURCE is off unless env sets it,
+// returns its exit status. SWWAF_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
-	return smallwebwaf.RunServeWAF(ctx, smallwebwaf.Params{
+	return runAs(ctx, false, env, out)
 }
 // runAs is run as `smallwebwaf servewaf` while serveWAF is true.
 func runAs(
 	ctx context.Context, serveWAF bool, env map[string]string, out *output,
 ) int {
 	return smallwebwaf.Run(ctx, smallwebwaf.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -136,7 +143,8 @@ func run(ctx context.Context, env map[string]string, out *output) int {
 			return value, ok
 		},
-		Stdout: out,
+		Stdout:   out,
 		ServeWAF: serveWAF,
 	})
 }
@@ -146,8 +154,8 @@ func TestInvalidSettingStopsTheStart(t *testing.T) {
 	out := &output{}
 	status := run(t.Context(), map[string]string{
-		"SWWAF_BYTES_LIMIT_PER_MINUTE": "lots",
+		"SWWAF_REQUEST_MAX_BYTES": "lots",
-		instanceName:                   instance,
+		instanceName:              instance,
 	}, out)
 	if status != 1 {
 		t.Errorf("exit status %d, want 1", status)
@@ -158,7 +166,7 @@ func TestInvalidSettingStopsTheStart(t *testing.T) {
 	if line["type"] != "process" || line["instance"] != instance ||
 		line["level"] != "ERROR" ||
-		!strings.HasPrefix(message, "SWWAF_BYTES_LIMIT_PER_MINUTE: ") {
+		!strings.HasPrefix(message, "SWWAF_REQUEST_MAX_BYTES: ") {
 		t.Errorf("start refused with %v", line)
 	}
 }
@@ -220,6 +228,7 @@ func TestAddressInUseStopsTheStart(t *testing.T) {
 func TestServesUntilToldToStop(t *testing.T) {
 	t.Parallel()
 	appURL := startApp(t)
 	dir := t.TempDir()
 	ctx, stop := context.WithCancel(t.Context())
@@ -228,9 +237,10 @@ func TestServesUntilToldToStop(t *testing.T) {
 	go func() {
 		exited <- run(ctx, map[string]string{
-			listenAddr: localhost + ":0",
+			listenAddr:  localhost + ":0",
-			stateDir:   dir,
+			upstreamURL: appURL,
-			rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
+			stateDir:    dir,
 			rulesDir:    filepath.Join("..", "..", "share", "rules.d"),
 		}, out)
 	}()
@@ -240,10 +250,10 @@ func TestServesUntilToldToStop(t *testing.T) {
 	}
 	starting := out.line(t, "msg", "starting")
-	wantStartingLine(t, starting, dir)
+	wantStartingLine(t, starting, appURL, dir)
 	addr, _ := starting["address"].(string)
-	wantAllowed(t, "http://"+addr+"/")
+	wantGreeting(t, "http://"+addr+"/")
 	out.line(t, "type", "request")
 	stop()
@@ -315,6 +325,7 @@ func TestEveryLogLineAndMetricCarriesTheInstanceName(t *testing.T) {
 	env := map[string]string{
 		listenAddr:   localhost + ":0",
 		upstreamURL:  startApp(t),
 		stateDir:     t.TempDir(),
 		rulesDir:     t.TempDir(),
 		metricsToken: token,
@@ -352,6 +363,7 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
 		upstreamURL:     startApp(t),
 		stateDir:        t.TempDir(),
 		rulesDir:        t.TempDir(),
 		rateLimitPerDay: "2",
@@ -363,8 +375,8 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 	// The two requests a day allows, and a stop.
 	runUntilStopped(t, env, func(url string) {
-		wantAllowed(t, url)
+		wantGreeting(t, url)
-		wantAllowed(t, url)
+		wantGreeting(t, url)
 	})
 	// After a restart the client has no fresh allowance: its third
@@ -388,8 +400,10 @@ func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
 		upstreamURL:     startApp(t),
 		stateDir:        t.TempDir(),
 		rulesDir:        t.TempDir(),
 		trustedProxies:  localhost + "/32",
 		rateLimitPerDay: "1",
 		scope:           "24",
 	}
@@ -433,9 +447,11 @@ func TestBanAddedAndLiftedByEditingBansJSON(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr: localhost + ":0",
+		listenAddr:     localhost + ":0",
-		stateDir:   dir,
+		upstreamURL:    startApp(t),
-		rulesDir:   t.TempDir(),
+		stateDir:       dir,
 		rulesDir:       t.TempDir(),
 		trustedProxies: localhost + "/32",
 		// No write comes due in the test, so only the watch on the
 		// directory can take the edits in.
 		stateWriteDelay:      "1h",
@@ -456,10 +472,12 @@ func TestBanAddedAndLiftedThroughTheEndpointsKeptInBansJSON(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr: localhost + ":0",
+		listenAddr:     localhost + ":0",
-		stateDir:   dir,
+		upstreamURL:    startApp(t),
-		rulesDir:   t.TempDir(),
+		stateDir:       dir,
-		adminToken: adminSecret,
+		rulesDir:       t.TempDir(),
 		trustedProxies: localhost + "/32",
 		adminToken:     adminSecret,
 		// Neither comes due in the test: the files are written as
 		// smallwebwaf stops.
 		stateWriteDelay:      "1h",
@@ -499,16 +517,17 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr: localhost + ":0",
+		listenAddr:  localhost + ":0",
-		stateDir:   t.TempDir(),
+		upstreamURL: startApp(t),
-		rulesDir:   dir,
+		stateDir:    t.TempDir(),
 		rulesDir:    dir,
 		// The requests sent until the rule takes effect must not break a
 		// rate limit, whose ban would refuse them too.
 		"SWWAF_RATE_LIMIT_PER_MINUTE": "off",
 	}
 	out := runUntilStopped(t, env, func(url string) {
-		wantAllowed(t, url)
+		wantGreeting(t, url)
 		// Written once: each change would start the rule files' wait
 		// again. A file written before smallwebwaf watches the directory is
@@ -561,8 +580,10 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	env := map[string]string{
 		listenAddr:               localhost + ":0",
 		upstreamURL:              startApp(t),
 		stateDir:                 t.TempDir(),
 		rulesDir:                 t.TempDir(),
 		trustedProxies:           localhost + "/32",
 		metricsToken:             token,
 		instanceName:             instance,
 		lookupSource:             "file",
@@ -658,8 +679,10 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	dir := t.TempDir()
 	env := map[string]string{
 		listenAddr:             localhost + ":0",
 		upstreamURL:            startApp(t),
 		stateDir:               dir,
 		rulesDir:               t.TempDir(),
 		trustedProxies:         localhost + "/32",
 		metricsToken:           token,
 		instanceName:           instance,
 		"SWWAF_BLOCKLIST_URLS": torURL,
@@ -740,8 +763,10 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
 		listenAddr:                localhost + ":0",
 		upstreamURL:               startApp(t),
 		stateDir:                  dir,
 		rulesDir:                  t.TempDir(),
 		trustedProxies:            localhost + "/32",
 		"SWWAF_CROWDSEC_LAPI_URL": engine.URL,
 		"SWWAF_CROWDSEC_LAPI_KEY": bouncerKey,
 	}
@@ -839,13 +864,14 @@ func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 	env := map[string]string{
 		listenAddr:             localhost + ":0",
 		upstreamURL:            startApp(t),
 		stateDir:               t.TempDir(),
 		rulesDir:               t.TempDir(),
 		"SWWAF_LOG_REMOTE_URL": "syslog+tcp://" + endpoint.Addr().String(),
 	}
 	out := runUntilStopped(t, env, func(url string) {
-		wantAllowed(t, url)
+		wantGreeting(t, url)
 	})
 	out.line(t, "type", "request")
@@ -894,6 +920,7 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 	env := map[string]string{
 		listenAddr:                localhost + ":0",
 		upstreamURL:               startApp(t),
 		stateDir:                  t.TempDir(),
 		rulesDir:                  t.TempDir(),
 		"SWWAF_LOG_REMOTE_URL":    "syslog+tls://" + endpoint.Addr().String(),
@@ -903,7 +930,7 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 	}
 	out := runUntilStopped(t, env, func(url string) {
-		wantAllowed(t, url)
+		wantGreeting(t, url)
 		// More than one line has been written, and the buffer holds the
 		// last.
@@ -953,6 +980,7 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
 		listenAddr:                    localhost + ":0",
 		upstreamURL:                   startApp(t),
 		stateDir:                      dir,
 		rulesDir:                      rules,
 		"SWWAF_ALERT_WEBHOOK_URL":     webhook.url,
@@ -1037,8 +1065,10 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 	slack, ntfy := startDestination(t), startDestination(t)
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
 		upstreamURL:     startApp(t),
 		stateDir:        t.TempDir(),
 		rulesDir:        t.TempDir(),
 		trustedProxies:  localhost + "/32",
 		rateLimitPerDay: "1",
 		// The metrics are read from 127.0.0.1, which no limit counts.
 		"SWWAF_ALLOW_NETS":              localhost + "/32",
@@ -1178,8 +1208,8 @@ func startApp(t *testing.T) string {
 	return app.URL
 }
-// runUntilStopped runs `smallwebwaf servewaf` with the settings in env, has use
+// runUntilStopped runs smallwebwaf with the settings in env, has use send
-// send it requests at url, then stops it as SIGTERM does, checks that it
+// it requests at url, then stops it as SIGTERM does, checks that it
 // stopped in order, and returns its output.
 func runUntilStopped(
 	t *testing.T, env map[string]string, use func(url string),
@@ -1212,33 +1242,43 @@ func runUntilStopped(
 // wantStartingLine checks that the line at start gives the version and
 // every setting's value.
-func wantStartingLine(t *testing.T, line map[string]any, dir string) {
+func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 	t.Helper()
 	settings, _ := line["settings"].(map[string]any)
 	want := map[string]any{
-		listenAddr:                            localhost + ":0",
+		listenAddr:                              localhost + ":0",
-		stateDir:                              dir,
+		upstreamURL:                             appURL,
-		"SWWAF_MODE":                          "enforce",
+		stateDir:                                dir,
-		stateWriteDelay:                       "10s",
+		"SWWAF_MODE":                            "enforce",
-		stateCounterInterval:                  "15m",
+		stateWriteDelay:                         "10s",
-		"SWWAF_ALLOW_NETS":                    "",
+		stateCounterInterval:                    "15m",
-		rateLimitExemptNets:                   "",
+		trustedProxies:                          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
-		"SWWAF_DENY_NETS":                     "",
+		"SWWAF_CLIENT_REQUEST_TIMEOUT":          "60s",
-		"SWWAF_RATE_LIMIT_PER_MINUTE":         "500",
+		"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES": "32K",
-		"SWWAF_RATE_LIMIT_PER_HOUR":           "20000",
+		"SWWAF_CLIENT_IDLE_TIMEOUT":             "120s",
-		rateLimitPerDay:                       "300000",
+		"SWWAF_CLIENT_RESPONSE_TIMEOUT":         "30m",
-		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":       "",
+		"SWWAF_UPSTREAM_REQUEST_TIMEOUT":        "60s",
-		"SWWAF_DENIED_COUNTRIES":              "",
+		"SWWAF_UPSTREAM_RESPONSE_TIMEOUT":       "30m",
-		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES": "",
+		"SWWAF_REQUEST_MAX_BYTES":               "100M",
-		"SWWAF_BAN_RESPONSE":                  "403",
+		"SWWAF_RESPONSE_MAX_BYTES":              "1G",
-		"SWWAF_LIMIT_BAN_DURATION":            "1h",
+		"SWWAF_ALLOW_NETS":                      "",
-		"SWWAF_LIMIT_BAN_REPEAT_WINDOW":       "24h",
+		rateLimitExemptNets:                     "",
-		"SWWAF_MAX_BAN_DURATION":              "7d",
+		"SWWAF_DENY_NETS":                       "",
-		"SWWAF_ATTACK_BAN_DURATION":           "7d",
+		"SWWAF_RATE_LIMIT_PER_MINUTE":           "500",
-		"SWWAF_MAX_BANS":                      "5000",
+		"SWWAF_RATE_LIMIT_PER_HOUR":             "20000",
-		"SWWAF_BAN_SCOPE_V4_PREFIX":           "32",
+		rateLimitPerDay:                         "300000",
-		"SWWAF_RULES_ENABLED":                 "true",
+		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":         "",
 		"SWWAF_DENIED_COUNTRIES":                "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",
 		"SWWAF_BAN_RESPONSE":                    "403",
 		"SWWAF_LIMIT_BAN_DURATION":              "1h",
 		"SWWAF_LIMIT_BAN_REPEAT_WINDOW":         "24h",
 		"SWWAF_MAX_BAN_DURATION":                "7d",
 		"SWWAF_ATTACK_BAN_DURATION":             "7d",
 		"SWWAF_MAX_BANS":                        "5000",
 		"SWWAF_BAN_SCOPE_V4_PREFIX":             "32",
 		"SWWAF_RULES_ENABLED":                   "true",
 	}
 	for name, value := range want {
@@ -1252,11 +1292,30 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 	}
 }
-// wantAllowed checks that servewaf at url allows a request from localhost.
+// wantGreeting checks that a request to url gets the app's answer.
-func wantAllowed(t *testing.T, url string) {
+func wantGreeting(t *testing.T, url string) {
 	t.Helper()
-	wantStatus(t, url, localhost, http.StatusOK)
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
 		http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()
 	res, err := (&http.Client{Transport: transport}).Do(req)
 	if err != nil {
 		t.Fatalf("request: %v", err)
 	}
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 	if err != nil || string(body) != greeting {
 		t.Errorf("got %q (%v), want the app's answer", body, err)
 	}
 }
 // messages returns the message of each record in received, octet-counted
@@ -1437,16 +1496,34 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 	return file.Bans[0]
 }
-// wantRefused checks that servewaf at url refuses a request from localhost with
+// wantRefused checks that a request to url is refused with 403, the
-// 403, the default SWWAF_BAN_RESPONSE.
+// default SWWAF_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
-	wantStatus(t, url, localhost, http.StatusForbidden)
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
 		http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()
 	res, err := (&http.Client{Transport: transport}).Do(req)
 	if err != nil {
 		t.Fatalf("request: %v", err)
 	}
 	_ = res.Body.Close()
 	if res.StatusCode != http.StatusForbidden {
 		t.Errorf("status %d, want %d", res.StatusCode, http.StatusForbidden)
 	}
 }
-// wantStatus checks that a request to url from the client at from, as statusFrom
+// wantStatus checks that a request to url from the client at from, as
-// sends it, is answered with status.
+// X-Forwarded-For names it, is answered with status.
 func wantStatus(t *testing.T, url, from string, status int) {
 	t.Helper()
@@ -1613,10 +1690,8 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost
 	}
 }
-// statusFrom returns the status a request to url from the client at from is
+// statusFrom returns the status a request to url from the client at
-// answered with. The request serves rproxy and servewaf alike. rproxy reads the
+// from, as X-Forwarded-For names it, is answered with.
 // client from X-Forwarded-For, and replaces the other two headers. To servewaf,
 // they make it a question about that client.
 func statusFrom(t *testing.T, url, from string) int {
 	t.Helper()
@@ -1627,8 +1702,6 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 	req.Header.Set("X-Forwarded-For", from)
 	req.Header.Set(proxy.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()
@@ -648,27 +648,6 @@ func TestClientWithRefusalsInTheMinuteWithoutTheirStartStopsTheStart(t *testing.
 		`: entry 1 has no "minute_refusals.start"`)
 }
 func TestClientsJSONFromAnEarlierVersionWithTokenRefusalsLoads(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
 	err := os.WriteFile(filepath.Join(dir, clientsJSON),
 		[]byte(`{"version": 1, "clients": [{"client": "203.0.113.9/32", `+
 			`"history": {"offences": {"token_refused": 2}}}]}`), 0o600)
 	if err != nil {
 		t.Fatalf("write %s: %v", clientsJSON, err)
 	}
 	params := newParams(dir)
 	load(t, params)
 	clients := params.Limiter.Snapshot()
 	if len(clients) != 1 || clients[0].History.Offences.TokenRefused != 2 {
 		t.Errorf("clients %+v, want one with its two refusals kept", clients)
 	}
 }
 func TestReputationJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	t.Parallel()
@@ -212,7 +212,8 @@ type Result struct {
 // method, its URL with the query, and its headers, the Cookie header
 // without the cookies in cookiesNotRead, and on body, r's body as the
 // caller has it, as readBody reads it. It returns what it found, what it
-// read of body, and the error that ended the reading early, if one did.
+// read of body, which the app is still to be sent, and the error that
 // ended the reading early, if one did.
 func (c *CoreRuleSet) Inspect(
 	r *http.Request, client netip.Addr, body io.Reader,
 ) (Result, []byte, error) {
@@ -1,28 +1,19 @@
 #!/bin/sh
 # script/example-app: build the image, and on it the example app in
-# deploy/example-app, then run the app's container, with rproxy in it, and
+# deploy/example-app, then run the app's container with a volume for the
-# servewaf in a container of its own with a volume for the state files. It
+# state files and check that the health check passes, that a request is
-# checks:
+# served through smallwebwaf, that a second one in a minute bans the
-#   - that the health checks pass;
+# client, that a probe for /.env bans another client, which its next
-#   - that a request is served through rproxy, and a second one in a minute
+# request bans for good, that `sv stop` stops smallwebwaf in order, that
-#     bans the client;
+# `docker stop` stops the container without having to kill it, that a
-#   - that a probe for /.env bans another client, which its next request bans
+# new container on the same volume still refuses the banned client, that
-#     for good;
+# a container with its state files on a new volume mounted at the
-#   - that only servewaf's container changes the state directory's owner;
+# directory SWWAF_STATE_DIR_FILE names becomes healthy, and that one whose
-#   - that the app still answers through rproxy with servewaf stopped, and
+# SWWAF_STATE_DIR does not exist logs smallwebwaf's message about it. The
-#     that once servewaf has started again, bans apply again;
+# containers run with SWWAF_LOOKUP_SOURCE=off, so that no address is sent
-#   - that `sv stop` stops rproxy in order, and `docker stop` stops each
+# to GeoJS. The containers, the volumes and both images are removed
-#     container without having to kill it;
+# however the script ends. Building the app needs network access, for
-#   - that a new servewaf container on the same volume still refuses the banned
+# nixpkgs' binary cache. script/check does not run this.
 #     client;
 #   - that a servewaf container with its state files on a new volume mounted at
 #     the directory SWWAF_STATE_DIR_FILE names becomes healthy;
 #   - that one whose SWWAF_STATE_DIR does not exist logs servewaf's message
 #     about it.
 # servewaf runs with SWWAF_LOOKUP_SOURCE=off, so that no address is sent to
 # GeoJS. The containers, the network, the volumes and both images are removed
 # however the script ends. Building the app needs network access, for nixpkgs'
 # binary cache. script/check does not run this.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -33,9 +24,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 NAME="$("$SCRIPT_DIR/projectname")-example-$$"
 IMAGE="$NAME-base"
 APP_IMAGE="$NAME-app"
-NETWORK="$NAME"
+CONTAINER="$NAME"
 APP="$NAME-app-container"
 SERVEWAF="$NAME-servewaf"
 VOLUME="$NAME-state"
 # The volumes of the container whose state directory SWWAF_STATE_DIR_FILE
 # names: its state files, and the file that names their directory.
@@ -43,18 +32,15 @@ MOVED_VOLUME="$NAME-moved-state"
 SETTINGS_VOLUME="$NAME-settings"
 cleanup() {
-    docker rm --force "$APP" "$SERVEWAF" >/dev/null 2>&1 || true
+    docker rm --force "$CONTAINER" >/dev/null 2>&1 || true
    docker network rm "$NETWORK" >/dev/null 2>&1 || true
    docker volume rm --force "$VOLUME" "$MOVED_VOLUME" "$SETTINGS_VOLUME" \
        >/dev/null 2>&1 || true
    docker rmi --force "$APP_IMAGE" "$IMAGE" >/dev/null 2>&1 || true
 }
 fail() {
-    echo "example-app: $*; the app container's output:" >&2
+    echo "example-app: $*; the container's output:" >&2
-    docker logs "$APP" >&2 || true
+    docker logs "$CONTAINER" >&2 || true
    echo "example-app: servewaf's output:" >&2
    docker logs "$SERVEWAF" >&2 || true
    exit 1
 }
@@ -71,73 +57,52 @@ wait_for() {
    done
 }
 # healthy <container>: docker says the container's health check passes.
 healthy() {
-    status="$(docker inspect --format '{{.State.Health.Status}}' "$1")"
+    status="$(docker inspect --format '{{.State.Health.Status}}' "$CONTAINER")"
    [ "$status" = healthy ]
 }
-# logged <container> <text>...: a line of the container's output holds every
+# logged <text>...: a line of the container's output holds every text,
-# text, in any order.
+# in any order.
 logged() {
-    lines="$(docker logs "$1" 2>&1)"
+    lines="$(docker logs "$CONTAINER" 2>&1)"
    shift
    for text in "$@"; do
        lines="$(printf '%s\n' "$lines" | grep -F "$text")" || return 1
    done
 }
-# start_servewaf: run servewaf from the image, with the state files on the
+# start_container: run the app's container, with the state files on the
-# volume, a rate limit of one request a minute and no client looked up, and wait
+# volume, a rate limit of one request a minute and no client looked up,
-# until it is healthy.
+# and wait until it is healthy.
-start_servewaf() {
+start_container() {
-    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
+    docker run --detach --name "$CONTAINER" --publish 127.0.0.1::8080 \
        --volume "$VOLUME:/var/lib/smallwebwaf" \
        --env SMALLWEBWAF_COMMAND=servewaf \
        --env SWWAF_RATE_LIMIT_PER_MINUTE=1 \
        --env SWWAF_LOOKUP_SOURCE=off \
        "$IMAGE" >/dev/null
    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
 }
 # start_app: run the app's container, with rproxy in it, and wait until it is
 # healthy.
 start_app() {
    docker run --detach --name "$APP" --network "$NETWORK" --publish 127.0.0.1::8080 \
        --env SWRP_WAF_BACKEND="http://$SERVEWAF:8080" \
        "$APP_IMAGE" >/dev/null
-    wait_for "the app's health check did not pass" healthy "$APP"
+    wait_for "the health check did not pass" healthy
-    address="$(docker port "$APP" 8080/tcp)"
+    address="$(docker port "$CONTAINER" 8080/tcp)"
 }
-# start_moved_servewaf: run servewaf with the state files on a new volume at
+# start_moved_container: run the app's container with the state files on
-# /srv/state, which SWWAF_STATE_DIR_FILE names in a file only the smallwebwaf
+# a new volume at /srv/state, which SWWAF_STATE_DIR_FILE names in a file
-# user can read, as under "Settings given as files" in docs/settings.md, and
+# only the smallwebwaf user can read, as under "Settings given as files"
-# wait until it is healthy. servewaf can write the new volume only once the run
+# in docs/settings.md, and wait until it is healthy. smallwebwaf can write the
-# script has given it to that user.
+# new volume only once the run script has given it to that user.
-start_moved_servewaf() {
+start_moved_container() {
    docker volume create "$MOVED_VOLUME" >/dev/null
    docker volume create "$SETTINGS_VOLUME" >/dev/null
    docker run --rm --volume "$SETTINGS_VOLUME:/settings" \
        --entrypoint bash "$IMAGE" -c 'echo /srv/state > /settings/state-dir &&
            chown smallwebwaf:smallwebwaf /settings/state-dir &&
            chmod 0400 /settings/state-dir'
-    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
+    docker run --detach --name "$CONTAINER" \
        --volume "$MOVED_VOLUME:/srv/state" \
        --volume "$SETTINGS_VOLUME:/etc/smallwebwaf/settings:ro" \
        --env SMALLWEBWAF_COMMAND=servewaf \
        --env SWWAF_STATE_DIR_FILE=/etc/smallwebwaf/settings/state-dir \
        --env SWWAF_LOOKUP_SOURCE=off \
-        "$IMAGE" >/dev/null
+        "$APP_IMAGE" >/dev/null
-    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
+    wait_for "the health check did not pass" healthy
 }
 # status_from <client> <path>: print the status a request for path from client,
 # as X-Forwarded-For names it, gets. rproxy believes the header from docker's
 # gateway, a private address.
 status_from() {
    curl --silent --output /dev/null --write-out '%{http_code}' \
        --max-time 10 --header "X-Forwarded-For: $1" "http://$address$2" || true
 }
 # refused: a request to the container gets 403, SWWAF_BAN_RESPONSE's
@@ -148,14 +113,13 @@ refused() {
    [ "$code" = 403 ]
 }
-# refused_from <client> <path>: a request for path from client gets 403.
+# refused_from <client> <path>: a request for path from client, as
 # X-Forwarded-For names it, gets 403. smallwebwaf believes the header
 # from docker's gateway, a private address.
 refused_from() {
-    [ "$(status_from "$1" "$2")" = 403 ]
+    code="$(curl --silent --output /dev/null --write-out '%{http_code}' \
-}
+        --max-time 10 --header "X-Forwarded-For: $1" "http://$address$2")" || true
-
+    [ "$code" = 403 ]
 # owner_of_state_dir <container>: print who owns /var/lib/smallwebwaf there.
 owner_of_state_dir() {
    docker exec "$1" stat --format '%U' /var/lib/smallwebwaf
 }
 main() {
@@ -167,88 +131,58 @@ main() {
    docker build --no-cache --build-arg SMALLWEBWAF_IMAGE="$IMAGE" \
        -t "$APP_IMAGE" deploy/example-app
    docker network create "$NETWORK" >/dev/null
    docker volume create "$VOLUME" >/dev/null
-    start_servewaf
+    start_container
-    start_app
+    echo "example-app: the health check passes"
    echo "example-app: the health checks pass"
    [ "$(owner_of_state_dir "$SERVEWAF")" = smallwebwaf ] ||
        fail "servewaf's container did not give the state directory to smallwebwaf"
    [ "$(owner_of_state_dir "$APP")" = root ] ||
        fail "the app's container changed the state directory's owner"
    echo "example-app: only servewaf's container changes the state directory's owner"
    page="$(curl --fail --silent --show-error --max-time 10 "http://$address/")" ||
        fail "no answer on port 8080"
    [ "$page" = "hello from the example app" ] || fail "port 8080 answered $page"
-    wait_for "servewaf logged no request it allowed" \
+    wait_for "smallwebwaf logged no request it forwarded" logged '"action":"forward"'
-        logged "$SERVEWAF" '"action":"forward"' '"servewaf_line":"report"'
+    echo "example-app: smallwebwaf passes a request to the app and its answer back"
    echo "example-app: rproxy passes a request to the app and its answer back"
    refused || fail "a second request in a minute was not refused"
-    wait_for "servewaf logged no ban" logged "$SERVEWAF" '"action":"rate_limited"'
+    wait_for "smallwebwaf logged no ban" logged '"action":"rate_limited"'
    echo "example-app: a second request in a minute bans the client"
    refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
-    wait_for "servewaf logged no ban for the probe" \
+    wait_for "smallwebwaf logged no ban for the probe" \
-        logged "$SERVEWAF" '"action":"banned"' '"rule_ids":["env-file"]'
+        logged '"action":"banned"' '"rule_ids":["env-file"]'
    refused_from 203.0.113.9 / || fail "the client of the probe was let through"
    wait_for "the client's next request did not make its ban permanent" \
-        logged "$SERVEWAF" '"ban_expires":"permanent"'
+        logged '"ban_expires":"permanent"'
    echo "example-app: a probe for /.env bans the client, its next request for good"
-    docker exec "$SERVEWAF" sv stop smallwebwaf >/dev/null ||
+    docker exec "$CONTAINER" sv stop smallwebwaf >/dev/null ||
-        fail "sv stop smallwebwaf failed in servewaf's container"
+        fail "sv stop smallwebwaf failed"
-    wait_for "servewaf did not stop in order" logged "$SERVEWAF" '"msg":"stopped"'
+    wait_for "smallwebwaf did not stop in order" logged '"msg":"stopped"'
-    [ "$(status_from 203.0.113.9 /)" = 200 ] ||
+    echo "example-app: sv stop stops smallwebwaf in order"
        fail "with servewaf stopped, the app did not answer through rproxy"
    wait_for "rproxy logged no request SWRP_DEFAULT_DISPOSITION decided" \
        logged "$APP" '"default_disposition":true'
    docker exec "$APP" /usr/local/bin/smallwebwaf healthcheck ||
        fail "with servewaf stopped, the app's health check failed"
    echo "example-app: with servewaf stopped, the app answers through rproxy"
-    docker exec "$SERVEWAF" sv start smallwebwaf >/dev/null ||
+    docker stop "$CONTAINER" >/dev/null
-        fail "sv start smallwebwaf failed in servewaf's container"
+    status="$(docker inspect --format '{{.State.ExitCode}}' "$CONTAINER")"
-    wait_for "once servewaf had started again, the ban did not apply" \
+    [ "$status" = 0 ] || fail "docker stop left exit status $status"
-        refused_from 203.0.113.9 /
+    echo "example-app: docker stop stops the container in order"
    echo "example-app: once servewaf has started again, bans apply again"
-    docker exec "$APP" sv stop smallwebwaf >/dev/null ||
+    docker rm "$CONTAINER" >/dev/null
-        fail "sv stop smallwebwaf failed in the app's container"
+    start_container
-    wait_for "rproxy did not stop in order" logged "$APP" '"msg":"stopped"'
+    refused || fail "the new container let the banned client through"
-    echo "example-app: sv stop stops rproxy in order"
+    wait_for "smallwebwaf logged no request refused under the ban" \
        logged '"action":"banned"'
    echo "example-app: a new container on the same volume keeps the ban"
-    for container in "$APP" "$SERVEWAF"; do
+    docker rm --force "$CONTAINER" >/dev/null
-        docker stop "$container" >/dev/null
+    start_moved_container
        status="$(docker inspect --format '{{.State.ExitCode}}' "$container")"
        [ "$status" = 0 ] || fail "docker stop left exit status $status"
    done
    echo "example-app: docker stop stops each container in order"
    docker rm "$APP" "$SERVEWAF" >/dev/null
    start_servewaf
    start_app
    refused || fail "the new servewaf container let the banned client through"
    wait_for "servewaf logged no request refused under the ban" \
        logged "$SERVEWAF" '"action":"banned"'
    echo "example-app: a new servewaf container on the same volume keeps the ban"
    docker rm --force "$SERVEWAF" >/dev/null
    start_moved_servewaf
    echo "example-app: the run script gives the state files' directory named" \
        "by SWWAF_STATE_DIR_FILE to the smallwebwaf user"
-    docker rm --force "$SERVEWAF" >/dev/null
+    docker rm --force "$CONTAINER" >/dev/null
-    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
+    docker run --detach --name "$CONTAINER" \
        --env SMALLWEBWAF_COMMAND=servewaf \
        --env SWWAF_STATE_DIR=/srv/missing \
        --env SWWAF_LOOKUP_SOURCE=off \
-        "$IMAGE" >/dev/null
+        "$APP_IMAGE" >/dev/null
-    wait_for "servewaf did not report the missing state directory" \
+    wait_for "smallwebwaf did not report the missing state directory" \
-        logged "$SERVEWAF" "SWWAF_STATE_DIR cannot be written"
+        logged "SWWAF_STATE_DIR cannot be written"
-    echo "example-app: servewaf reports a state directory that does not exist"
+    echo "example-app: smallwebwaf reports a state directory that does not exist"
 }
 main "$@"
@@ -1,14 +1,13 @@
 #!/bin/sh
-# script/gitea-requests: build the image and run gitea 1.27.3 behind rproxy
+# script/gitea-requests: build the image and run gitea 1.27.3 behind it,
-# and servewaf, three containers on one network. Every setting is at its
+# with every setting of smallwebwaf at its default but SWWAF_UPSTREAM_URL,
-# default but these: SWRP_UPSTREAM_URL names gitea's container, SWRP_WAF_BACKEND
+# which names gitea's container. Then send through it the gitea requests
-# names servewaf's, and SWWAF_LOG_REQUEST_HEADERS adds the header that labels a
+# that reading gitea's source found the Core Rule Set refuses, which
-# request. Then send through rproxy the gitea requests that reading gitea's
+# docs/gitea.md records, and a short sample of gitea's ordinary use:
-# source found the Core Rule Set refuses, which docs/gitea.md records, and a
+# signing in, pages of files and commits, a diff, the API, a push, clone
-# short sample of gitea's ordinary use: signing in, pages of files and commits,
+# and fetch over HTTP, and two container image pushes. Last, print each
-# a diff, the API, a push, clone and fetch over HTTP, and two container image
+# request smallwebwaf logged, with what it did with it and the ids of the
-# pushes. Last, print each request servewaf logged, with what it did with it and
+# Core Rule Set's rules that matched it.
 # the ids of the Core Rule Set's rules that matched it.
 # Every request comes from one client, docker's gateway, so more than
 # SWWAF_ERROR_BURST_THRESHOLD, 30, refusals in a minute would ban it, and
 # the requests after would show as banned. The containers, the network,
@@ -30,8 +29,7 @@ GITEA_IMAGE="gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025
 NAME="$("$SCRIPT_DIR/projectname")-gitea-$$"
 IMAGE="$NAME-image"
 NETWORK="$NAME"
-RPROXY="$NAME-rproxy"
+SMALLWEBWAF="$NAME-smallwebwaf"
 SERVEWAF="$NAME-servewaf"
 GITEA="$NAME-gitea"
 # gitea's one user, who owns the repository and the container images.
@@ -39,23 +37,16 @@ PASSWORD="owner-password"
 BROWSER="Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0"
-# The header that labels a request in the report. rproxy makes every request's
+# The files the script makes, and smallwebwaf's address once it runs,
-# id itself, so a label cannot be the X-Request-ID.
+# localhost and the port docker publishes it on: a host name, since the
-LABEL_HEADER="X-Case"
+# Core Rule Set takes a Host that is an IP address for a warning (920350).
 # The default of SWWAF_LOG_REQUEST_HEADERS, and the header above.
 LOGGED_HEADERS="accept,accept-language,accept-encoding,content-type,origin,range,x-case"
 # The files the script makes, and rproxy's address once it runs, localhost and
 # the port docker publishes it on: a host name, since the Core Rule Set takes a
 # Host that is an IP address for a warning (920350).
 WORK=""
 address=""
 cleanup() {
    # So that a signal cannot stop it partway through.
    trap '' HUP INT TERM
-    docker rm --force --volumes "$RPROXY" "$SERVEWAF" "$GITEA" >/dev/null 2>&1 || true
+    docker rm --force --volumes "$SMALLWEBWAF" "$GITEA" >/dev/null 2>&1 || true
    docker network rm "$NETWORK" >/dev/null 2>&1 || true
    docker rmi --force "$IMAGE" >/dev/null 2>&1 || true
    if [ -n "$address" ]; then
@@ -84,30 +75,30 @@ wait_for() {
    done
 }
 # healthy <container>: docker says the container's health check passes.
 healthy() {
-    status="$(docker inspect --format '{{.State.Health.Status}}' "$1")"
+    status="$(docker inspect --format '{{.State.Health.Status}}' "$SMALLWEBWAF")"
    [ "$status" = healthy ]
 }
-# logged <text>...: a line of servewaf's output holds every text, in any order.
+# logged <text>...: a line of smallwebwaf's output holds every text, in
 # any order.
 logged() {
-    lines="$(docker logs "$SERVEWAF" 2>&1)"
+    lines="$(docker logs "$SMALLWEBWAF" 2>&1)"
    for text in "$@"; do
        lines="$(printf '%s\n' "$lines" | grep -F "$text")" || return 1
    done
 }
-# send <label> <path> <curl option>...: send a request for path to rproxy, with
+# send <label> <path> <curl option>...: send a request for path to
-# label in LABEL_HEADER, which the report gives, and keep the body of the answer
+# smallwebwaf, with label as its X-Request-ID, which the report gives,
-# in $WORK/answer. The Core Rule Set reads that header too, so a label names no
+# and keep the body of the answer in $WORK/answer. The Core Rule Set
-# file the cases name.
+# reads that header too, so a label names no file the cases name.
 send() {
    label="$1"
    path="$2"
    shift 2
    curl --silent --show-error --max-time 30 --output "$WORK/answer" \
-        --header "$LABEL_HEADER: $label" "$@" "http://$address$path"
+        --header "X-Request-ID: $label" "$@" "http://$address$path"
 }
 # page <label> <path> <curl option>...: send the request as a browser
@@ -182,7 +173,7 @@ make_repository() {
    echo "line 41" >>"$dir/src/java.base/share/classes/java/lang/Runtime.java"
    repo_git -C "$dir" commit --quiet --all --message "Add a line"
-    repo_git -C "$dir" -c "http.extraHeader=$LABEL_HEADER: git-push" push --quiet \
+    repo_git -C "$dir" -c "http.extraHeader=X-Request-ID: git-push" push --quiet \
        "http://owner:$PASSWORD@$address/owner/repo.git" main ||
        fail "the push of the repository failed"
 }
@@ -245,8 +236,9 @@ call_api() {
 # push_images: push a container image to owner/python3-app, then the same
 # image to owner/app. For the second, the case, docker asks gitea to take
 # its layer from owner/python3-app, naming it in the query parameter
-# from. docker sends no label, so the report gives its requests none. The image
+# from. docker sends no X-Request-ID, so its requests have the ids
-# is one small file, imported rather than built.
+# smallwebwaf gives them. The image is one small file, imported rather
 # than built.
 push_images() {
    echo "$NAME" >"$WORK/layer.txt"
    tar -cf - -C "$WORK" layer.txt |
@@ -266,10 +258,10 @@ push_images() {
 # clone_and_fetch: the clone and fetch over HTTP of the sample.
 clone_and_fetch() {
-    repo_git -c "http.extraHeader=$LABEL_HEADER: git-clone" clone --quiet \
+    repo_git -c "http.extraHeader=X-Request-ID: git-clone" clone --quiet \
        "http://owner:$PASSWORD@$address/owner/repo.git" "$WORK/clone" ||
        fail "the clone failed"
-    repo_git -C "$WORK/clone" -c "http.extraHeader=$LABEL_HEADER: git-fetch" fetch --quiet ||
+    repo_git -C "$WORK/clone" -c "http.extraHeader=X-Request-ID: git-fetch" fetch --quiet ||
        fail "the fetch failed"
 }
@@ -279,19 +271,19 @@ field() {
    printf '%s\n' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p"
 }
-# report: print a line for each request rproxy reported to servewaf: what
+# report: print a line for each request smallwebwaf logged, but its
-# servewaf did with the request, the ids of the Core Rule Set's rules that
+# health checks: what it did with the request, the ids of the Core Rule
-# matched it, its label, and the request. waf_blocked is a refusal by the Core
+# Set's rules that matched it, its X-Request-ID, and the request.
-# Rule Set, and forward a request passed on to gitea, whatever gitea answered.
+# waf_blocked is a refusal by the Core Rule Set, and forward a request
 # passed on to gitea, whatever gitea answered.
 report() {
-    docker logs "$SERVEWAF" 2>/dev/null | grep '"servewaf_line":"report"' |
+    docker logs "$SMALLWEBWAF" 2>/dev/null | grep '"type":"request"' |
-        sed 's/\\u0026/\&/g' >"$WORK/requests"
+        grep -v '"action":"admin"' | sed 's/\\u0026/\&/g' >"$WORK/requests"
    while IFS= read -r line; do
        ids="$(printf '%s\n' "$line" | sed -n 's/.*"waf_rule_ids":\[\([0-9,]*\)\].*/\1/p')"
        query="$(field query "$line")"
        label="$(field x-case "$line")"
        printf '%-11s %-13s %-17s %s %s%s\n' "$(field action "$line")" "${ids:--}" \
-            "${label:--}" "$(field method "$line")" \
+            "$(field request_id "$line")" "$(field method "$line")" \
            "$(field path "$line")" "${query:+?$query}"
    done <"$WORK/requests"
    echo "gitea-requests: $(grep -c . "$WORK/requests") requests," \
@@ -306,30 +298,24 @@ main() {
    docker build --no-cache -t "$IMAGE" .
-    # rproxy first, so that gitea can be given the address it is reached at,
+    # smallwebwaf first, so that gitea can be given the address it is
-    # and gitea's image pulled before, so that gitea starts within the minute
+    # reached at, and gitea's image pulled before, so that gitea starts
-    # rproxy's health check waits for it.
+    # within the minute smallwebwaf's health check waits for it.
    docker pull --quiet "$GITEA_IMAGE" >/dev/null
    docker network create "$NETWORK" >/dev/null
-    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
+    docker run --detach --name "$SMALLWEBWAF" --network "$NETWORK" \
        --env SMALLWEBWAF_COMMAND=servewaf \
        --env SWWAF_LOG_REQUEST_HEADERS="$LOGGED_HEADERS" \
        "$IMAGE" >/dev/null
    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
    docker run --detach --name "$RPROXY" --network "$NETWORK" \
        --publish 127.0.0.1::8080 \
-        --env SWRP_UPSTREAM_URL="http://$GITEA:3000" \
+        --env SWWAF_UPSTREAM_URL="http://$GITEA:3000" \
        --env SWRP_WAF_BACKEND="http://$SERVEWAF:8080" \
        "$IMAGE" >/dev/null
-    published="$(docker port "$RPROXY" 8080/tcp)"
+    published="$(docker port "$SMALLWEBWAF" 8080/tcp)"
    address="localhost:${published##*:}"
    docker run --detach --name "$GITEA" --network "$NETWORK" \
        --env GITEA__security__INSTALL_LOCK=true \
        --env GITEA__server__ROOT_URL="http://$address/" \
        "$GITEA_IMAGE" >/dev/null
-    # rproxy's health check passes once gitea takes connections.
+    # smallwebwaf's health check passes once gitea takes connections.
-    wait_for "rproxy's health check did not pass" healthy "$RPROXY"
+    wait_for "the health check did not pass" healthy
    docker exec --user git "$GITEA" gitea admin user create --admin \
        --username owner --password "$PASSWORD" --email owner@example.invalid \
        --must-change-password=false >/dev/null
@@ -342,8 +328,8 @@ main() {
    # The fetch's last request is the last of all; once it is logged, so
    # is every other.
-    wait_for "servewaf logged no report of the fetch" \
+    wait_for "smallwebwaf logged no line for the fetch" \
-        logged '"x-case":"git-fetch"' '"method":"POST"' '"servewaf_line":"report"'
+        logged '"request_id":"git-fetch"' '"method":"POST"'
    report
 }
@@ -1,29 +1,14 @@
 #!/bin/sh
-# script/run: build bin/smallwebwaf with script/build and run servewaf and
+# script/run: build bin/smallwebwaf with script/build and run it, with
-# rproxy on the host, with the settings in the environment, until rproxy
+# the settings in the environment. Unless SWWAF_STATE_DIR is set, the
-# exits or the script is told to stop. rproxy listens on port 8080 unless
+# state files go in bin/state, beside the binary, and unless
-# SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
+# SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
 # servewaf listens on port 8090 unless SWWAF_LISTEN_ADDR says otherwise, and
 # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
 # SWWAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
 # and unless SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
 # which the image ships.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 SERVEWAF=""
 RPROXY=""
 # stop_both: stop what runs, and wait for it, so that servewaf writes its state
 # files.
 stop_both() {
    trap '' HUP INT TERM
    kill $SERVEWAF $RPROXY 2>/dev/null || true
    wait || true
 }
 main() {
    "$SCRIPT_DIR/build"
    if [ -z "${SWWAF_STATE_DIR+set}" ]; then
@@ -35,18 +20,7 @@ main() {
        SWWAF_RULES_DIR="$ROOT/share/rules.d"
        export SWWAF_RULES_DIR
    fi
-    SWWAF_LISTEN_ADDR="${SWWAF_LISTEN_ADDR:-:8090}"
+    exec "$ROOT/bin/smallwebwaf"
    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWWAF_LISTEN_ADDR##*:}}"
    export SWWAF_LISTEN_ADDR SWRP_WAF_BACKEND
    trap stop_both EXIT
    trap 'exit 1' HUP INT TERM
    "$ROOT/bin/smallwebwaf" servewaf &
    SERVEWAF=$!
    "$ROOT/bin/smallwebwaf" rproxy &
    RPROXY=$!
    wait "$RPROXY"
 }
 main "$@"
@@ -2,38 +2,22 @@
 set -euo pipefail
 # runit's run script for smallwebwaf, run again whenever smallwebwaf
-# exits; the wait spaces out the restarts. SMALLWEBWAF_COMMAND names the
+# exits; the wait spaces out the restarts. The state directory and every
-# command to run: rproxy when it is unset or empty, or servewaf. With any
+# file in it are given to the smallwebwaf user, so that a volume mounted
-# other value the script starts nothing and stops with a message naming it.
+# there needs no change of owner; chown -R changes a symbolic link itself,
 # never what it points to. When SWWAF_STATE_DIR, in either form, cannot be
 # read or is not the absolute path of a directory, no owner is changed,
 # and smallwebwaf starts and stops with a message naming the setting. A
 # change of owner that fails, as on a volume mounted read-only, does not
 # end the script either: smallwebwaf reports a directory it cannot write.
 # exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
 main() {
    sleep 1
    local command="${SMALLWEBWAF_COMMAND:-rproxy}"
    case "$command" in
        rproxy) ;;
        servewaf) give_state_dir_to_smallwebwaf ;;
        *)
            printf 'SMALLWEBWAF_COMMAND: "%s" is not rproxy or servewaf\n' \
                "$command" >&2
            exit 1
            ;;
    esac
    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf "$command"
 }
 # give_state_dir_to_smallwebwaf gives the state directory and every file in
 # it to the smallwebwaf user, so that a volume mounted there needs no change
 # of owner; chown -R changes a symbolic link itself, never what it points
 # to. When SWWAF_STATE_DIR, in either form, cannot be read or is not the
 # absolute path of a directory, no owner is changed, and servewaf starts and
 # stops with a message naming the setting. A change of owner that fails, as
 # on a volume mounted read-only, does not end the script either: servewaf
 # reports a directory it cannot write.
 give_state_dir_to_smallwebwaf() {
    local dir
    if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
        chown -R smallwebwaf:smallwebwaf "$dir" || true
    fi
    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
 }
 # state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,