Part of #165, where one smallwebwaf servewaf decides for many sites, each with its own smallwebwaf rproxy.
Does one servewaf keep one table of clients and bans for every site behind it, or one table per site?
One table for all its sites (recommended). A client banned on one site is refused on all of them, and its requests and bytes on all of them count together toward one set of limits. The log lines, alerts and ban notes name the site by its host. For the sites behind one servewaf, this does what "Planned, not built" in SPEC.md plans to do with a CrowdSec engine: share bans between apps. The default limits, sized for one app, then cover a client's use of all of them together.
One table per site. Each site keeps its own counters and bans, as each app does today. A client banned on one site is still served by the others.
Either way a servewaf has one set of SWWAF_ settings and rule files for all its sites, since settings are environment variables and a configuration file is a non-goal. Sites that need different settings, such as a trap path that suits gitea but would ban a WordPress site's visitors, use a servewaf of their own.
Recommendation: one table for all its sites.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/165, where one `smallwebwaf servewaf` decides for many sites, each with its own `smallwebwaf rproxy`.
Does one `servewaf` keep one table of clients and bans for every site behind it, or one table per site?
- **One table for all its sites** (recommended). A client banned on one site is refused on all of them, and its requests and bytes on all of them count together toward one set of limits. The log lines, alerts and ban notes name the site by its host. For the sites behind one `servewaf`, this does what "Planned, not built" in `SPEC.md` plans to do with a CrowdSec engine: share bans between apps. The default limits, sized for one app, then cover a client's use of all of them together.
- **One table per site**. Each site keeps its own counters and bans, as each app does today. A client banned on one site is still served by the others.
Either way a `servewaf` has one set of `SWWAF_` settings and rule files for all its sites, since settings are environment variables and a configuration file is a non-goal. Sites that need different settings, such as a trap path that suits gitea but would ban a WordPress site's visitors, use a `servewaf` of their own.
Recommendation: one table for all its sites.
Model: opus-5-5
sneak
was assigned by clawbot2026-11-02 00:12:10 +01:00
Recorded (sneak, 4 November, in chat): yes. One servewaf keeps IP reputation centralized across every site behind it: the IP cache, the rate-limit counters and the rest are shared. That is the point of splitting rproxy from servewaf, so that one decision service serves several sites.
smallwebwaf is paused by sneak's order of 3 November (sneak/project-management#45); this goes into the design on #165 when it resumes.
Model: opus-5-5
Recorded (sneak, 4 November, in chat): yes. One servewaf keeps IP reputation centralized across every site behind it: the IP cache, the rate-limit counters and the rest are shared. That is the point of splitting rproxy from servewaf, so that one decision service serves several sites.
smallwebwaf is paused by sneak's order of 3 November (https://git.eeqj.de/sneak/project-management/issues/45); this goes into the design on https://git.eeqj.de/sneak/smallwebwaf/issues/165 when it resumes.
Model: opus-5-5
sneak
was unassigned by clawbot2026-11-04 19:01:59 +01:00
clawbot
self-assigned this 2026-11-04 19:01:59 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #165, where one
smallwebwaf servewafdecides for many sites, each with its ownsmallwebwaf rproxy.Does one
servewafkeep one table of clients and bans for every site behind it, or one table per site?servewaf, this does what "Planned, not built" inSPEC.mdplans to do with a CrowdSec engine: share bans between apps. The default limits, sized for one app, then cover a client's use of all of them together.Either way a
servewafhas one set ofSWWAF_settings and rule files for all its sites, since settings are environment variables and a configuration file is a non-goal. Sites that need different settings, such as a trap path that suits gitea but would ban a WordPress site's visitors, use aservewafof their own.Recommendation: one table for all its sites.
Model: opus-5-5
Recorded (sneak, 4 November, in chat): yes. One servewaf keeps IP reputation centralized across every site behind it: the IP cache, the rate-limit counters and the rest are shared. That is the point of splitting rproxy from servewaf, so that one decision service serves several sites.
smallwebwaf is paused by sneak's order of 3 November (sneak/project-management#45); this goes into the design on #165 when it resumes.
Model: opus-5-5