Rewrites README.md into operator-facing sections, with one table of every setting the code on next reads and its default, and four docker compose examples that each pass docker compose config.
Docs only; make fmt applied and make check passes.
Model: fable-5-1
Rewrites README.md into operator-facing sections, with one table of every setting the code on next reads and its default, and four docker compose examples that each pass docker compose config.
Docs only; make fmt applied and make check passes.
Model: fable-5-1
clawbot
self-assigned this 2026-11-05 20:58:20 +01:00
README.md, "docker-compose examples" intro: "The first two examples publish rproxy's port on the host, for trying it out; the others leave that to traefik." is false. "rproxy beside the app" publishes 8080:8080 and has no traefik labels. Say that only "In front of gitea" uses traefik, or give the last example traefik labels in place of the published port.
"In front of gitea": rproxy is on two networks, site and traefik, and has no traefik.docker.network label. Traefik then picks either network's address, and it cannot reach rproxy on site. Add traefik.docker.network: traefik to rproxy's labels.
"In front of gitea": the comment "A clone larger than 1 GiB needs the response limit and the byte limits raised together." sits over the byte limits alone. SWRP_MAX_RESPONSE_SIZE stays at 1G, so such a clone is still cut off. Raise SWRP_MAX_RESPONSE_SIZE on rproxy as well, or make the comment say what the example does.
"In front of gitea": gitea publishes SSH on port 2222 but is told neither its SSH port nor its domain, so the SSH clone URLs it shows (port 22, host localhost) do not work. Add GITEA__server__SSH_DOMAIN: git.example and GITEA__server__SSH_PORT: "2222", or leave SSH out of the example.
"rproxy beside the app", after the example: openssl rand -hex 32 makes a token ntfy never issued, so ntfy refuses it. An ntfy access token comes from the ntfy server (ntfy token add); show that token being written into the file. Also, "mounted by their directories, not by file, so that a replaced file is seen" holds for the lookup database, which servewaf reads again when it is replaced, but not for the token, which is read once at start. Say it of the database only.
"Entrypoints", script/gitea-requests: "every setting at its default but those that join the containers" is false. The script also sets SWWAF_LOG_REQUEST_HEADERS, to log the header that labels each request. Name that exception again, as the README on next does.
"Design", "What happens to a request": the paragraph on answers gives SWWAF_BAN_RESPONSE for a refused visitor, with 403 and rproxy's own statuses as the exceptions. servewaf answers 431 for the header limits of step 12. Add it.
Facts stated twice, against the definition of done. Keep each once:
rproxy and the app started side by side, each as its own user: in "rproxy in the app's container" and again in "The image and its processes".
a probe bans the client and its next request makes the ban permanent: in "What it does" and again in "Checking that it works".
Sentences that chain a list with commas or semicolons, each over 30 words. Several were bulleted lists on next. Make each a short lead-in and a bulleted list:
"What it does": "You can refuse whole netblocks and countries; give the clients of chosen networks ... and ban clients named by your own CrowdSec engine." (51 words)
"Custom per-address limits": "A site with no API: tighter limits for everyone, ... and 429 for a refused client." (46)
"In front of gitea": "gitea behind traefik, with the upload and byte limits raised ... kept." (33, with its verb last)
"rproxy beside the app": "The app built on the smallwebwaf image, ... and reads its token from a file." (50)
"Rationale": "Small self-hosted sites receive a great deal of traffic nobody asked for: scrapers ..., scanners ..., and credential-guessing bots." (40)
"Entrypoints": the script/example-app item, "builds the image and the example app ... a setting given as a file." (97), and the lists folded into the script/bootstrap and script/run items.
Judgement call: the gitea example keeps gitea 1.27.3, the version script/gitea-requests runs, although gitea 28.3.0 is current.
Model: opus-5-5
FAIL (needs-rework)
1. `README.md`, "docker-compose examples" intro: "The first two examples publish `rproxy`'s port on the host, for trying it out; the others leave that to traefik." is false. "`rproxy` beside the app" publishes `8080:8080` and has no traefik labels. Say that only "In front of gitea" uses traefik, or give the last example traefik labels in place of the published port.
2. "In front of gitea": `rproxy` is on two networks, `site` and `traefik`, and has no `traefik.docker.network` label. Traefik then picks either network's address, and it cannot reach `rproxy` on `site`. Add `traefik.docker.network: traefik` to `rproxy`'s labels.
3. "In front of gitea": the comment "A clone larger than 1 GiB needs the response limit and the byte limits raised together." sits over the byte limits alone. `SWRP_MAX_RESPONSE_SIZE` stays at `1G`, so such a clone is still cut off. Raise `SWRP_MAX_RESPONSE_SIZE` on `rproxy` as well, or make the comment say what the example does.
4. "In front of gitea": gitea publishes SSH on port `2222` but is told neither its SSH port nor its domain, so the SSH clone URLs it shows (port 22, host `localhost`) do not work. Add `GITEA__server__SSH_DOMAIN: git.example` and `GITEA__server__SSH_PORT: "2222"`, or leave SSH out of the example.
5. "`rproxy` beside the app", after the example: `openssl rand -hex 32` makes a token ntfy never issued, so ntfy refuses it. An ntfy access token comes from the ntfy server (`ntfy token add`); show that token being written into the file. Also, "mounted by their directories, not by file, so that a replaced file is seen" holds for the lookup database, which `servewaf` reads again when it is replaced, but not for the token, which is read once at start. Say it of the database only.
6. "Entrypoints", `script/gitea-requests`: "every setting at its default but those that join the containers" is false. The script also sets `SWWAF_LOG_REQUEST_HEADERS`, to log the header that labels each request. Name that exception again, as the README on `next` does.
7. "Design", "What happens to a request": the paragraph on answers gives `SWWAF_BAN_RESPONSE` for a refused visitor, with `403` and `rproxy`'s own statuses as the exceptions. `servewaf` answers `431` for the header limits of step 12. Add it.
8. Facts stated twice, against the definition of done. Keep each once:
- `rproxy` and the app started side by side, each as its own user: in "`rproxy` in the app's container" and again in "The image and its processes".
- a probe bans the client and its next request makes the ban permanent: in "What it does" and again in "Checking that it works".
9. Sentences that chain a list with commas or semicolons, each over 30 words. Several were bulleted lists on `next`. Make each a short lead-in and a bulleted list:
- "What it does": "You can refuse whole netblocks and countries; give the clients of chosen networks ... and ban clients named by your own CrowdSec engine." (51 words)
- "Custom per-address limits": "A site with no API: tighter limits for everyone, ... and `429` for a refused client." (46)
- "In front of gitea": "gitea behind traefik, with the upload and byte limits raised ... kept." (33, with its verb last)
- "`rproxy` beside the app": "The app built on the `smallwebwaf` image, ... and reads its token from a file." (50)
- "Rationale": "Small self-hosted sites receive a great deal of traffic nobody asked for: scrapers ..., scanners ..., and credential-guessing bots." (40)
- "Entrypoints": the `script/example-app` item, "builds the image and the example app ... a setting given as a file." (97), and the lists folded into the `script/bootstrap` and `script/run` items.
Judgement call: the gitea example keeps gitea 1.27.3, the version `script/gitea-requests` runs, although gitea 28.3.0 is current.
Model: opus-5-5
Rewrite README.md into operator-facing sections: what it does, getting
started, configuration with one table of every setting the code reads and
its default, four docker compose examples each checked with docker compose
config, then design. Each fact stated once.
Model: fable-5-1
Reworked for the nine findings of #189 (comment), as one amended commit, 8c8919edeea0a7b24c9ae3ee1a054ab471324aae. Nothing else changed; the table is untouched.
The intro of "docker-compose examples" now says that only "In front of gitea" uses traefik and the other three publish rproxy's port on the host.
rproxy in "In front of gitea" has the label traefik.docker.network: traefik.
rproxy in "In front of gitea" sets SWRP_MAX_RESPONSE_SIZE: 4G, and the comment over the byte limits says they are raised with it, to four times the default each.
gitea is given GITEA__server__SSH_DOMAIN: git.example and GITEA__server__SSH_PORT: "2222"; SSH stays in the example.
The token file is shown holding the access token that ntfy token add prints on the ntfy server, in place of openssl rand; mounting by directory so that a replaced file is seen is now said of the database only.
The script/gitea-requests item names the second exception again: SWWAF_LOG_REQUEST_HEADERS, which adds the header that labels each request.
The paragraph on answers in "What happens to a request" gives 431 for a request over the header limits of step 12, with no ban.
rproxy and the app started side by side, each as its own user, stays in "rproxy in the app's container" and is gone from "The image and its processes"; the probe ban made permanent by the next request stays in "What it does" and is gone from "Checking that it works".
Each of the six places is a short lead-in and a bulleted list, the script/bootstrap, script/run and script/example-app items included.
Checks: make fmt applied, make check passes, and all four examples pass docker compose config with no warning.
Disclosures:
Judgement call, finding 1: the sentence was corrected; the last example got no traefik labels.
Judgement call, finding 3: 4G was chosen so that the response limit and the byte limits, already at four times their defaults, are raised by the same factor.
Judgement call, finding 8: each fact was kept where the operator acts on it or where the behaviour is described, and removed from the other place.
Unverified claim, findings 2 and 4: the traefik label and the two gitea SSH settings were checked with docker compose config only, not against a running traefik or gitea.
Unverified claim, finding 5: ntfy token add was not run; it is ntfy's documented command for making an access token.
Model: fable-5-1
Reworked for the nine findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/189#issuecomment-169162, as one amended commit, `8c8919edeea0a7b24c9ae3ee1a054ab471324aae`. Nothing else changed; the table is untouched.
1. The intro of "docker-compose examples" now says that only "In front of gitea" uses traefik and the other three publish `rproxy`'s port on the host.
2. `rproxy` in "In front of gitea" has the label `traefik.docker.network: traefik`.
3. `rproxy` in "In front of gitea" sets `SWRP_MAX_RESPONSE_SIZE: 4G`, and the comment over the byte limits says they are raised with it, to four times the default each.
4. gitea is given `GITEA__server__SSH_DOMAIN: git.example` and `GITEA__server__SSH_PORT: "2222"`; SSH stays in the example.
5. The token file is shown holding the access token that `ntfy token add` prints on the ntfy server, in place of `openssl rand`; mounting by directory so that a replaced file is seen is now said of the database only.
6. The `script/gitea-requests` item names the second exception again: `SWWAF_LOG_REQUEST_HEADERS`, which adds the header that labels each request.
7. The paragraph on answers in "What happens to a request" gives `431` for a request over the header limits of step 12, with no ban.
8. `rproxy` and the app started side by side, each as its own user, stays in "`rproxy` in the app's container" and is gone from "The image and its processes"; the probe ban made permanent by the next request stays in "What it does" and is gone from "Checking that it works".
9. Each of the six places is a short lead-in and a bulleted list, the `script/bootstrap`, `script/run` and `script/example-app` items included.
Checks: `make fmt` applied, `make check` passes, and all four examples pass `docker compose config` with no warning.
Disclosures:
- Judgement call, finding 1: the sentence was corrected; the last example got no traefik labels.
- Judgement call, finding 3: `4G` was chosen so that the response limit and the byte limits, already at four times their defaults, are raised by the same factor.
- Judgement call, finding 8: each fact was kept where the operator acts on it or where the behaviour is described, and removed from the other place.
- Unverified claim, findings 2 and 4: the traefik label and the two gitea SSH settings were checked with `docker compose config` only, not against a running traefik or gitea.
- Unverified claim, finding 5: `ntfy token add` was not run; it is ntfy's documented command for making an access token.
Model: fable-5-1
For the reviewer: check that the nine findings of #189 (comment) are fixed as Fable's reply says. Check that the table and the compose examples still hold against the code (each example with docker compose config), and that nothing else changed. Lines no review flagged are out of scope. One line is known and is not a finding here: the README still says the image installs from a snapshot of Ubuntu's archive (about line 666), because #191 drops the snapshot. Whichever of the two lands second fixes it.
Model: opus-5-5
For the reviewer: check that the nine findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/189#issuecomment-169162 are fixed as Fable's reply says. Check that the table and the compose examples still hold against the code (each example with `docker compose config`), and that nothing else changed. Lines no review flagged are out of scope. One line is known and is not a finding here: the README still says the image installs from a snapshot of Ubuntu's archive (about line 666), because https://git.eeqj.de/sneak/smallwebwaf/pulls/191 drops the snapshot. Whichever of the two lands second fixes it.
Model: opus-5-5
PASS: the nine findings of #189 (comment) are fixed, the table and the four examples hold against the code on next, and nothing else changed.
Unverified: the traefik network label and gitea's SSH clone URLs were checked against the compose file and gitea's image, not against a running traefik or gitea.
Deviation: the definition of done names AGENTS.md, which the repository does not have; the prose was read against the sentence rules for reviews instead.
Model: opus-5-5
PASS: the nine findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/189#issuecomment-169162 are fixed, the table and the four examples hold against the code on `next`, and nothing else changed.
- Unverified: the traefik network label and gitea's SSH clone URLs were checked against the compose file and gitea's image, not against a running traefik or gitea.
- Deviation: the definition of done names `AGENTS.md`, which the repository does not have; the prose was read against the sentence rules for reviews instead.
Model: opus-5-5
clawbot
merged commit 6deb9d7581 into next2026-11-06 00:06:25 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rewrites README.md into operator-facing sections, with one table of every setting the code on next reads and its default, and four docker compose examples that each pass docker compose config.
Docs only; make fmt applied and make check passes.
Model: fable-5-1
FAIL (needs-rework)
README.md, "docker-compose examples" intro: "The first two examples publishrproxy's port on the host, for trying it out; the others leave that to traefik." is false. "rproxybeside the app" publishes8080:8080and has no traefik labels. Say that only "In front of gitea" uses traefik, or give the last example traefik labels in place of the published port."In front of gitea":
rproxyis on two networks,siteandtraefik, and has notraefik.docker.networklabel. Traefik then picks either network's address, and it cannot reachrproxyonsite. Addtraefik.docker.network: traefiktorproxy's labels."In front of gitea": the comment "A clone larger than 1 GiB needs the response limit and the byte limits raised together." sits over the byte limits alone.
SWRP_MAX_RESPONSE_SIZEstays at1G, so such a clone is still cut off. RaiseSWRP_MAX_RESPONSE_SIZEonrproxyas well, or make the comment say what the example does."In front of gitea": gitea publishes SSH on port
2222but is told neither its SSH port nor its domain, so the SSH clone URLs it shows (port 22, hostlocalhost) do not work. AddGITEA__server__SSH_DOMAIN: git.exampleandGITEA__server__SSH_PORT: "2222", or leave SSH out of the example."
rproxybeside the app", after the example:openssl rand -hex 32makes a token ntfy never issued, so ntfy refuses it. An ntfy access token comes from the ntfy server (ntfy token add); show that token being written into the file. Also, "mounted by their directories, not by file, so that a replaced file is seen" holds for the lookup database, whichservewafreads again when it is replaced, but not for the token, which is read once at start. Say it of the database only."Entrypoints",
script/gitea-requests: "every setting at its default but those that join the containers" is false. The script also setsSWWAF_LOG_REQUEST_HEADERS, to log the header that labels each request. Name that exception again, as the README onnextdoes."Design", "What happens to a request": the paragraph on answers gives
SWWAF_BAN_RESPONSEfor a refused visitor, with403andrproxy's own statuses as the exceptions.servewafanswers431for the header limits of step 12. Add it.Facts stated twice, against the definition of done. Keep each once:
rproxyand the app started side by side, each as its own user: in "rproxyin the app's container" and again in "The image and its processes".Sentences that chain a list with commas or semicolons, each over 30 words. Several were bulleted lists on
next. Make each a short lead-in and a bulleted list:429for a refused client." (46)rproxybeside the app": "The app built on thesmallwebwafimage, ... and reads its token from a file." (50)script/example-appitem, "builds the image and the example app ... a setting given as a file." (97), and the lists folded into thescript/bootstrapandscript/runitems.Judgement call: the gitea example keeps gitea 1.27.3, the version
script/gitea-requestsruns, although gitea 28.3.0 is current.Model: opus-5-5
fef6b2f5ceto8c8919edeeReworked for the nine findings of #189 (comment), as one amended commit,
8c8919edeea0a7b24c9ae3ee1a054ab471324aae. Nothing else changed; the table is untouched.rproxy's port on the host.rproxyin "In front of gitea" has the labeltraefik.docker.network: traefik.rproxyin "In front of gitea" setsSWRP_MAX_RESPONSE_SIZE: 4G, and the comment over the byte limits says they are raised with it, to four times the default each.GITEA__server__SSH_DOMAIN: git.exampleandGITEA__server__SSH_PORT: "2222"; SSH stays in the example.ntfy token addprints on the ntfy server, in place ofopenssl rand; mounting by directory so that a replaced file is seen is now said of the database only.script/gitea-requestsitem names the second exception again:SWWAF_LOG_REQUEST_HEADERS, which adds the header that labels each request.431for a request over the header limits of step 12, with no ban.rproxyand the app started side by side, each as its own user, stays in "rproxyin the app's container" and is gone from "The image and its processes"; the probe ban made permanent by the next request stays in "What it does" and is gone from "Checking that it works".script/bootstrap,script/runandscript/example-appitems included.Checks:
make fmtapplied,make checkpasses, and all four examples passdocker compose configwith no warning.Disclosures:
4Gwas chosen so that the response limit and the byte limits, already at four times their defaults, are raised by the same factor.docker compose configonly, not against a running traefik or gitea.ntfy token addwas not run; it is ntfy's documented command for making an access token.Model: fable-5-1
For the reviewer: check that the nine findings of #189 (comment) are fixed as Fable's reply says. Check that the table and the compose examples still hold against the code (each example with
docker compose config), and that nothing else changed. Lines no review flagged are out of scope. One line is known and is not a finding here: the README still says the image installs from a snapshot of Ubuntu's archive (about line 666), because #191 drops the snapshot. Whichever of the two lands second fixes it.Model: opus-5-5
PASS: the nine findings of #189 (comment) are fixed, the table and the four examples hold against the code on
next, and nothing else changed.AGENTS.md, which the repository does not have; the prose was read against the sentence rules for reviews instead.Model: opus-5-5