sneak, 25 September: milestone 2's GeoJS client keeps its answers in memory, and writing that cache to disk at shutdown and reading it back at start is milestone 3 or later (#14 (comment)). Milestone 2 keeps its rate counters in memory only as well. This writes both to JSON files in the state directory at an orderly stop and reads them back at start, as the "Persistent state" section of SPEC.md (#9) describes: atomic writes, and a file that does not parse stops the start.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
sneak, 25 September: milestone 2's GeoJS client keeps its answers in memory, and writing that cache to disk at shutdown and reading it back at start is milestone 3 or later (https://git.eeqj.de/sneak/smallwebwaf/issues/14#issuecomment-103016). Milestone 2 keeps its rate counters in memory only as well. This writes both to JSON files in the state directory at an orderly stop and reads them back at start, as the "Persistent state" section of `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describes: atomic writes, and a file that does not parse stops the start.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts the JSON state files in the first stage after milestone 2, so they are built next, after the bans of #18, as "Persistent state" and "Counting method" describe. Taking in an admin's edits while running follows as #68; reputation.json and alerts.json come with those features.
SWWAF_STATE_DIR (default /var/lib/smallwebwaf), SWWAF_STATE_WRITE_DELAY (10s) and SWWAF_STATE_COUNTER_INTERVAL (15m); a value set but invalid stops the start, and a state directory that is not writable at start stops the process.
Three files, in the format "Persistent state" gives (indented JSON with a top-level version, entries sorted by client address, clients.json and lookups.json one entry per line):
bans.json: every ban with its notes;
clients.json: each client's minute, hour and day counters and its history (first and last seen, the AS number, AS name and country last looked up and when, requests and bytes each way, forwarded and refused, responses by status class, offences by kind), up to SWWAF_MAX_TRACKED_CLIENTS. The ban notes gain the netblock's total requests since it was first seen;
lookups.json: the GeoJS answers.
Written from a snapshot taken under the lock, through a temporary file in the same directory, synced, renamed over the real name, with the directory synced: bans.jsonSWWAF_STATE_WRITE_DELAY after a ban is made or made permanent, every file every SWWAF_STATE_COUNTER_INTERVAL, and all of them at an orderly stop (SIGTERM).
Read at start: a missing file is empty state; buckets and answers whose time has passed are dropped; a file that does not parse, or has an unknown version, stops the start with a message naming the file and position.
The image gets /var/lib/smallwebwaf, which the run script gives to the smallwebwaf user, as "Deployment" describes; README.md says to mount a volume there.
Definition of done: tests show each file written and read back, the counters surviving a restart so a client gets no fresh allowance, the write after a ban, the write at SIGTERM, expired entries dropped on load, a missing file, a broken file and an unknown version stopping the start, and an unwritable directory; make example-app shows state kept across a container restart with a volume; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts the JSON state files in the first stage after milestone 2, so they are built next, after the bans of https://git.eeqj.de/sneak/smallwebwaf/issues/18, as "Persistent state" and "Counting method" describe. Taking in an admin's edits while running follows as https://git.eeqj.de/sneak/smallwebwaf/issues/68; `reputation.json` and `alerts.json` come with those features.
- `SWWAF_STATE_DIR` (default `/var/lib/smallwebwaf`), `SWWAF_STATE_WRITE_DELAY` (`10s`) and `SWWAF_STATE_COUNTER_INTERVAL` (`15m`); a value set but invalid stops the start, and a state directory that is not writable at start stops the process.
- Three files, in the format "Persistent state" gives (indented JSON with a top-level `version`, entries sorted by client address, `clients.json` and `lookups.json` one entry per line):
- `bans.json`: every ban with its notes;
- `clients.json`: each client's minute, hour and day counters and its history (first and last seen, the AS number, AS name and country last looked up and when, requests and bytes each way, forwarded and refused, responses by status class, offences by kind), up to `SWWAF_MAX_TRACKED_CLIENTS`. The ban notes gain the netblock's total requests since it was first seen;
- `lookups.json`: the GeoJS answers.
- Written from a snapshot taken under the lock, through a temporary file in the same directory, synced, renamed over the real name, with the directory synced: `bans.json` `SWWAF_STATE_WRITE_DELAY` after a ban is made or made permanent, every file every `SWWAF_STATE_COUNTER_INTERVAL`, and all of them at an orderly stop (SIGTERM).
- Read at start: a missing file is empty state; buckets and answers whose time has passed are dropped; a file that does not parse, or has an unknown `version`, stops the start with a message naming the file and position.
- The image gets `/var/lib/smallwebwaf`, which the `run` script gives to the `smallwebwaf` user, as "Deployment" describes; `README.md` says to mount a volume there.
Definition of done: tests show each file written and read back, the counters surviving a restart so a client gets no fresh allowance, the write after a ban, the write at SIGTERM, expired entries dropped on load, a missing file, a broken file and an unknown `version` stopping the start, and an unwritable directory; `make example-app` shows state kept across a container restart with a volume; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
self-assigned this 2026-10-06 02:47:57 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, 25 September: milestone 2's GeoJS client keeps its answers in memory, and writing that cache to disk at shutdown and reading it back at start is milestone 3 or later (#14 (comment)). Milestone 2 keeps its rate counters in memory only as well. This writes both to JSON files in the state directory at an orderly stop and reads them back at start, as the "Persistent state" section of
SPEC.md(#9) describes: atomic writes, and a file that does not parse stops the start.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs the JSON state files in the first stage after milestone 2, so they are built next, after the bans of #18, as "Persistent state" and "Counting method" describe. Taking in an admin's edits while running follows as #68;reputation.jsonandalerts.jsoncome with those features.SWWAF_STATE_DIR(default/var/lib/smallwebwaf),SWWAF_STATE_WRITE_DELAY(10s) andSWWAF_STATE_COUNTER_INTERVAL(15m); a value set but invalid stops the start, and a state directory that is not writable at start stops the process.version, entries sorted by client address,clients.jsonandlookups.jsonone entry per line):bans.json: every ban with its notes;clients.json: each client's minute, hour and day counters and its history (first and last seen, the AS number, AS name and country last looked up and when, requests and bytes each way, forwarded and refused, responses by status class, offences by kind), up toSWWAF_MAX_TRACKED_CLIENTS. The ban notes gain the netblock's total requests since it was first seen;lookups.json: the GeoJS answers.bans.jsonSWWAF_STATE_WRITE_DELAYafter a ban is made or made permanent, every file everySWWAF_STATE_COUNTER_INTERVAL, and all of them at an orderly stop (SIGTERM).version, stops the start with a message naming the file and position./var/lib/smallwebwaf, which therunscript gives to thesmallwebwafuser, as "Deployment" describes;README.mdsays to mount a volume there.Definition of done: tests show each file written and read back, the counters surviving a restart so a client gets no fresh allowance, the write after a ban, the write at SIGTERM, expired entries dropped on load, a missing file, a broken file and an unknown
versionstopping the start, and an unwritable directory;make example-appshows state kept across a container restart with a volume;make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Built in #72, waiting for review.
Model: opus-5-5
clawbot referenced this issue2026-10-06 08:34:04 +02:00