sneak/smallwebwaf
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Land the initial README and SPEC per the owner's design rulings #1

New Issue
Closed
opened 2026-09-21 09:40:32 +02:00 by clawbot · 1 comment
clawbot commented 2026-09-21 09:40:32 +02:00
Collaborator
Copy Link
Copy Source

Owner directive (sneak, 2026-09-21, chat, verbatim): "repo is sneak/smallwebwaf - readme in addition to the proposed feature list and simple spec should have an intro that explains the what (simple performant logging WAF for self-hosters) and the why (protection against misbehaving scrapers and bias against countries/ASNs that are common abuse sources). it should of course support reading from a directory of WAF rules that can be easily edited, like regex to detect common scanning/penetration/etc."

Prior rulings from the same session, all already applied to the draft spec: env-var configuration; sits between traefik and one docker service; per-minute/hour/day request and byte limits per client; netblock whitelist bypassing limits; webhook/slack/ntfy alerting on attacks and anomaly thresholds; temporary blocks and permanent bans for repeat offenders; RBL/IP-reputation integration; AS number lookups; threshold bias against listed ASNs and countries; NO SQLite — all state in memory, persisted as formatted hand-editable JSON written atomically, loaded once at startup, never read per-request; structured JSONL request logging to stdout with timings and all standard web log fields; env var to additionally ship logs to remote syslog or RELP; Prometheus metrics endpoint.

Definition of done:

  • README.md with an intro stating the what (simple performant logging WAF for self-hosters) and the why (protection against misbehaving scrapers; bias against countries and ASNs that are common abuse sources), the proposed feature list, and the simple spec (or a link to SPEC.md carrying it).
  • SPEC.md covering every ruling above, including a directory of easily-editable WAF rule files (e.g. regex to detect common scanning/penetration probes) read at startup, with its env var.
  • EVALUATION.md (the survey of existing tools and why none fit) committed for the record.
  • Open design questions stated in SPEC.md for the owner: overlapping ASN/country percentages lowest-wins vs multiplied; country percentage per-client vs whole-country cap; bans shared across the fleet or per-instance; which lookup database; banned clients get 403 vs dropped connection.
  • Committed and pushed to this repo.

model: claude-fable-5

Owner directive (sneak, 2026-09-21, chat, verbatim): "repo is sneak/smallwebwaf - readme in addition to the proposed feature list and simple spec should have an intro that explains the what (simple performant logging WAF for self-hosters) and the why (protection against misbehaving scrapers and bias against countries/ASNs that are common abuse sources). it should of course support reading from a directory of WAF rules that can be easily edited, like regex to detect common scanning/penetration/etc." Prior rulings from the same session, all already applied to the draft spec: env-var configuration; sits between traefik and one docker service; per-minute/hour/day request and byte limits per client; netblock whitelist bypassing limits; webhook/slack/ntfy alerting on attacks and anomaly thresholds; temporary blocks and permanent bans for repeat offenders; RBL/IP-reputation integration; AS number lookups; threshold bias against listed ASNs and countries; NO SQLite — all state in memory, persisted as formatted hand-editable JSON written atomically, loaded once at startup, never read per-request; structured JSONL request logging to stdout with timings and all standard web log fields; env var to additionally ship logs to remote syslog or RELP; Prometheus metrics endpoint. Definition of done: - README.md with an intro stating the what (simple performant logging WAF for self-hosters) and the why (protection against misbehaving scrapers; bias against countries and ASNs that are common abuse sources), the proposed feature list, and the simple spec (or a link to SPEC.md carrying it). - SPEC.md covering every ruling above, including a directory of easily-editable WAF rule files (e.g. regex to detect common scanning/penetration probes) read at startup, with its env var. - EVALUATION.md (the survey of existing tools and why none fit) committed for the record. - Open design questions stated in SPEC.md for the owner: overlapping ASN/country percentages lowest-wins vs multiplied; country percentage per-client vs whole-country cap; bans shared across the fleet or per-instance; which lookup database; banned clients get 403 vs dropped connection. - Committed and pushed to this repo. model: claude-fable-5
clawbot commented 2026-09-21 09:42:58 +02:00
Author
Collaborator
Copy Link
Copy Source

Docs landed on main in a0d2c21346

Open questions for the owner are kept at the end of SPEC.md: combining percentages, per-client versus whole-country meaning of a country percentage, per-sidecar versus fleet-wide bans, lookup database source, upaas second-container support, remote log library, ban response code.

Disclosures:

  • Markdown is hand-wrapped; the repo has no make fmt yet.
  • Commit is authored with the git identity configured on the host.

Model: fable-5-1

Docs landed on `main` in https://git.eeqj.de/sneak/smallwebwaf/commit/a0d2c21346d9e0bf1ee93eaa43cddd3bbd7e641d - https://git.eeqj.de/sneak/smallwebwaf/src/branch/main/README.md : what and why, proposed feature list, short spec summary linking to `SPEC.md` - https://git.eeqj.de/sneak/smallwebwaf/src/branch/main/SPEC.md : full design with the rulings applied (in-memory state with atomic JSON files, JSONL request log, remote syslog/RELP, Prometheus endpoint) and the new rule file directory (`RULES_DIR`, one regex rule per line, examples included) - https://git.eeqj.de/sneak/smallwebwaf/src/branch/main/EVALUATION.md : survey of existing tools and gaps Open questions for the owner are kept at the end of `SPEC.md`: combining percentages, per-client versus whole-country meaning of a country percentage, per-sidecar versus fleet-wide bans, lookup database source, upaas second-container support, remote log library, ban response code. Disclosures: - Markdown is hand-wrapped; the repo has no `make fmt` yet. - Commit is authored with the git identity configured on the host. Model: fable-5-1
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#1