Run smallwebwaf the way the README tells an operator to, and file each place where it does not do what the README or SPEC.md promises. This unit opens no PR. Each defect becomes its own issue, and each fix is a later unit of its own.
What to do
Build the image with make docker. Build a small test backend on it, as deploy/example-app does. The backend needs a plain page, a slow answer, a large answer, an echo of the request headers, and a WebSocket. Run the container behind a local stand-in for traefik, or with curl sending X-Forwarded-For from a trusted address.
Use it as an operator would, first with no settings and then with the settings each README section names:
ordinary requests and the request log;
a broken rate limit, the ban that follows, and the ban lifted by editing bans.json and through the admin endpoints;
a rule file edited while it runs, a trap path, and a request the Core Rule Set refuses;
observe mode;
the metrics endpoint with and without its token, and the health check;
a restart, after which the state files still hold what they held;
a slow client, a slow app, a body over the limit, and a WebSocket passing through;
an alert sent to a local webhook receiver.
For each place where what happens differs from what the README or SPEC.md says, file one issue. Say what you ran, what happened, what the document promises, and a severity (critical, major or minor). Critical means a request is refused that should pass, or passes that should be refused, or the process crashes or loses its state. Before filing, check the tracker for an open issue that already covers it.
Leave nothing behind: remove every container, network and image you started or built.
Definition of done
Every README section above has been tried. One comment on this issue links each issue filed, one line each, or says that none was found.
Model: opus-5-5
Run `smallwebwaf` the way the README tells an operator to, and file each place where it does not do what the README or `SPEC.md` promises. This unit opens no PR. Each defect becomes its own issue, and each fix is a later unit of its own.
## What to do
- Build the image with `make docker`. Build a small test backend on it, as `deploy/example-app` does. The backend needs a plain page, a slow answer, a large answer, an echo of the request headers, and a WebSocket. Run the container behind a local stand-in for traefik, or with `curl` sending `X-Forwarded-For` from a trusted address.
- Use it as an operator would, first with no settings and then with the settings each README section names:
- ordinary requests and the request log;
- a broken rate limit, the ban that follows, and the ban lifted by editing `bans.json` and through the admin endpoints;
- a rule file edited while it runs, a trap path, and a request the Core Rule Set refuses;
- `observe` mode;
- the metrics endpoint with and without its token, and the health check;
- a restart, after which the state files still hold what they held;
- a slow client, a slow app, a body over the limit, and a WebSocket passing through;
- an alert sent to a local webhook receiver.
- For each place where what happens differs from what the README or `SPEC.md` says, file one issue. Say what you ran, what happened, what the document promises, and a severity (critical, major or minor). Critical means a request is refused that should pass, or passes that should be refused, or the process crashes or loses its state. Before filing, check the tracker for an open issue that already covers it.
- Leave nothing behind: remove every container, network and image you started or built.
## Definition of done
Every README section above has been tried. One comment on this issue links each issue filed, one line each, or says that none was found.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 17:26:42 +02:00
Every item of the list above was tried, in front of a test backend, with curl sending X-Forwarded-For from docker's gateway. Filed:
#137 (major): SWWAF_STATE_DIR given as a file is not given to the smallwebwaf user by the run script, and the start fails.
#138 (minor): a client too slow to send its request line is answered 400, where the documents say it gets no answer.
#139 (minor): on docker stop, requests in progress get 502 at once when the app exits on SIGTERM.
Deviation: the image build failed three times, twice with make docker, on Ubuntu's snapshot server answering 5xx (#132). The runs used the smallwebwaf image already on the host, built from 6fcbda6, the head of next.
Judgement call: every run had SWWAF_LOOKUP_SOURCE=off but the first, with no settings, which saw only private addresses, so no address went to GeoJS.
Model: opus-5-5
Every item of the list above was tried, in front of a test backend, with `curl` sending `X-Forwarded-For` from docker's gateway. Filed:
- https://git.eeqj.de/sneak/smallwebwaf/issues/137 (major): `SWWAF_STATE_DIR` given as a file is not given to the `smallwebwaf` user by the run script, and the start fails.
- https://git.eeqj.de/sneak/smallwebwaf/issues/138 (minor): a client too slow to send its request line is answered `400`, where the documents say it gets no answer.
- https://git.eeqj.de/sneak/smallwebwaf/issues/139 (minor): on `docker stop`, requests in progress get `502` at once when the app exits on SIGTERM.
Deviation: the image build failed three times, twice with `make docker`, on Ubuntu's snapshot server answering 5xx (https://git.eeqj.de/sneak/smallwebwaf/issues/132). The runs used the `smallwebwaf` image already on the host, built from `6fcbda6`, the head of `next`.
Judgement call: every run had `SWWAF_LOOKUP_SOURCE=off` but the first, with no settings, which saw only private addresses, so no address went to GeoJS.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Run
smallwebwafthe way the README tells an operator to, and file each place where it does not do what the README orSPEC.mdpromises. This unit opens no PR. Each defect becomes its own issue, and each fix is a later unit of its own.What to do
make docker. Build a small test backend on it, asdeploy/example-appdoes. The backend needs a plain page, a slow answer, a large answer, an echo of the request headers, and a WebSocket. Run the container behind a local stand-in for traefik, or withcurlsendingX-Forwarded-Forfrom a trusted address.bans.jsonand through the admin endpoints;observemode;SPEC.mdsays, file one issue. Say what you ran, what happened, what the document promises, and a severity (critical, major or minor). Critical means a request is refused that should pass, or passes that should be refused, or the process crashes or loses its state. Before filing, check the tracker for an open issue that already covers it.Definition of done
Every README section above has been tried. One comment on this issue links each issue filed, one line each, or says that none was found.
Model: opus-5-5
Every item of the list above was tried, in front of a test backend, with
curlsendingX-Forwarded-Forfrom docker's gateway. Filed:SWWAF_STATE_DIRgiven as a file is not given to thesmallwebwafuser by the run script, and the start fails.400, where the documents say it gets no answer.docker stop, requests in progress get502at once when the app exits on SIGTERM.Deviation: the image build failed three times, twice with
make docker, on Ubuntu's snapshot server answering 5xx (#132). The runs used thesmallwebwafimage already on the host, built from6fcbda6, the head ofnext.Judgement call: every run had
SWWAF_LOOKUP_SOURCE=offbut the first, with no settings, which saw only private addresses, so no address went to GeoJS.Model: opus-5-5