rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

Dockerfile

@@ -133,11 +133,32 @@ RUN mkdir /etc/sysusers.d \
     && echo 'u  _runit-log  -  "runit svlogd user"  /nonexistent  /sbin/nologin' \
         > /etc/sysusers.d/runit.conf
 
-# ca-certificates, nix-bin and runit, from Ubuntu's normal mirrors: the
-# live archive the image's own sources name, over plain HTTP, so no CA
-# certificate is needed and none is borrowed from the Go image.
-RUN apt-get update \
+# ca-certificates, nix-bin and runit, from Ubuntu's archive as it was at
+# the snapshot moment, which is never earlier than the Ubuntu image above.
+# apt checks every package against the snapshot's InRelease files, and
+# this step checks those against the hashes named here, which are those
+# of the amd64 archive: other architectures use Ubuntu's ports archive.
+# apt also fetches the live archive's InRelease files, which change daily
+# and which the install does not use. The snapshot service is HTTPS only
+# and this image has no CA certificates yet, so this step uses the Go
+# image's. The snapshot service answers 503 at times; apt retries a
+# failed download, waiting twice as long before each retry, and this
+# step gives it five retries, about half a minute in all, where its
+# default of three gives up after seven seconds.
+RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,target=/tmp/go-image-ca.crt \
+    apt-get update --snapshot 20261001T000000Z \
+        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
+        -o Acquire::Retries=5 \
+    && printf '%s\n' \
+        '45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute_InRelease' \
+        '802e675dd9de4c7f3916434a95e7c1d8eec0e82886622d7805ab19a2c6fe0365  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-updates_InRelease' \
+        '64b3353f0bd4970b4f7271962245bcea9ff24d4cc7bea16b433f8a60e42ca3dd  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-backports_InRelease' \
+        '1d5041572116a8b23aabf79ac7439ad8af83d57ad3fb0f9aa0d4523ec10c5908  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-security_InRelease' \
+        | (cd /var/lib/apt/lists && sha256sum --check --strict) \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
+        --snapshot 20261001T000000Z \
+        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
+        -o Acquire::Retries=5 \
         ca-certificates nix-bin runit \
     && rm -rf /var/lib/apt/lists/*
 

SPEC.md

@@ -1544,12 +1544,20 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 
 - The image is Ubuntu's newest long-term support release, pinned by digest, and
   moves to the next LTS release when that ships. Its packages come from Ubuntu's
-  normal mirrors, the live archive the image's own sources name, whose packages
-  change with every update.
+  snapshot service, the archive as it was at the moment the Dockerfile names,
+  rather than the live archive, whose packages change with every update. The
+  snapshot is never older than the pinned Ubuntu image, since older packages can
+  need older versions of packages the image holds, and it moves forward with the
+  image's digest. The Dockerfile names the hash of each of the snapshot's
+  `InRelease` files, which cover every package list and so every package, and
+  the build checks them before installing. The live archive's `InRelease` files,
+  which `apt-get update` also fetches and the install does not use, are left out
+  of the check. The hashes are the amd64 archive's, so the image is built for
+  amd64 only.
 - The Ubuntu image has no CA certificates. Without them Nix cannot download
   packages and `servewaf` cannot reach GeoJS, so `ca-certificates` is installed
-  by name. The archive is reached over plain HTTP, so the install needs no CA
-  certificate from the builder.
+  by name. The snapshot itself is fetched over HTTPS with the CA certificates of
+  the Go image that builds `smallwebwaf`, itself pinned by digest.
 - nixpkgs comes from a release file on `releases.nixos.org`, named with its
   hash, not from a GitHub archive, whose bytes can change. Root uses Nix
   directly; no Nix daemon runs. `nix-bin` creates no build users, so
@@ -1567,13 +1575,12 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
   writes. `runsvinit` starts runit's `runsvdir`, which runs the `run` script of
   each directory under `/etc/service`. Ubuntu's `sv` looks for services there
   too.
-- The image's `run` script is `/etc/service/smallwebwaf/run`. It starts
-  `servewaf` when `SMALLWEBWAF_COMMAND` is `servewaf`, and `rproxy` when it is
-  `rproxy`, unset or empty. It runs either as the `smallwebwaf` user (uid and
-  gid 65532), with runit's `chpst`. For `servewaf`, it first makes
-  `SWWAF_STATE_DIR` and every file in it belong to that user. For `rproxy` it
-  changes no owner. With any other value, it starts nothing, and stops with a
-  message naming `SMALLWEBWAF_COMMAND` and its value.
+- The image's `run` script, `/etc/service/smallwebwaf/run`, starts the command
+  `SMALLWEBWAF_COMMAND` names, `rproxy` when it is unset or empty, as the
+  `smallwebwaf` user (uid and gid 65532) with runit's `chpst`. For `servewaf`,
+  it first makes `SWWAF_STATE_DIR` and every file in it belong to that user. For
+  `rproxy` it changes no owner. With any other value, it starts nothing, and
+  stops with a message naming `SMALLWEBWAF_COMMAND` and its value.
 
 Every `run` script, the app's included, is a bash script. It starts with
 `#!/usr/bin/env bash` and `set -euo pipefail`, and puts its code in a `main`
@@ -1693,14 +1700,15 @@ ranges traefik is on.
 
 ### upaas
 
-upaas rebuilds and restarts an app's Docker container when its repository
-changes. An app it deploys takes the shape of "`rproxy` in the app's container"
-with no change to upaas. upaas builds the app's Dockerfile and runs the one
-container as it runs any app. The traefik labels route to port 8080, and the
-`SWRP_` settings go with the app's environment variables. `servewaf` runs in a
-container of its own, on a network the app's container can reach, with its state
-volume and the directory of any token file. `docs/gitea.md` records what the
-defaults do in front of gitea, and `script/gitea-requests` checks those notes.
+An app deployed by upaas, which rebuilds and restarts an app's Docker container
+when its repository changes, takes the shape of "`rproxy` in the app's
+container" with no change to upaas. upaas builds the app's Dockerfile and runs
+the one container as it runs any app. The traefik labels route to port 8080, and
+the `SWRP_` settings go with the app's environment variables. `servewaf` runs in
+a container of its own, on a network the app's container can reach, with its
+state volume and the directory of any token file. `docs/gitea.md` records what
+the defaults do in front of gitea, and `script/gitea-requests` checks those
+notes.
 
 ## Planned, not built
 

docs/image.md

@@ -8,8 +8,8 @@ is pinned that way.
 ## Contents
 
 - Ubuntu 26.04 LTS, pinned by digest.
-- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's normal mirrors, the
-  live archive, not a dated snapshot.
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
+  archive at `20261001T000000Z`.
 - Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
   `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
   Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
@@ -26,8 +26,10 @@ is pinned that way.
 
 ## Pins
 
-- Ubuntu's packages are not pinned: they come from the live archive, whose
-  packages change with every update.
+- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
+  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
+  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
+  `apt-get update`. The hashes are the amd64 archive's.
 - nixpkgs: the release file `nixexprs.tar.xz` of
   `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
   SHA-256 hash.