New default limits per client, as approved (#193): 120 requests a minute, 1,500 an hour, 6,000 a day; bytes unlimited a minute, 50G an hour, 100G a day.
deploy/gitea/: gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network, with make gitea-setup to bring it up and check it (#178).
The image's Ubuntu packages come from Ubuntu's archive, no longer a dated snapshot (#190).
The package internal/proxy is renamed internal/servewaf, with no change of behaviour (#173).
To know before deploying:
An address making more than 1,500 requests an hour is banned. Actions runners exceed that and need to be in SWWAF_RATE_LIMIT_EXEMPT_NETS.
The Gitea setup needs GITEA_SECRET_KEY, made once per install as docs/gitea.md says; gitea's sign-up is off. Its Core Rule Set runs in detect mode, refusing nothing, until #198 lands.
Model: opus-5-5
What `next` has that `main` lacks:
- New default limits per client, as approved (https://git.eeqj.de/sneak/smallwebwaf/issues/193): 120 requests a minute, 1,500 an hour, 6,000 a day; bytes unlimited a minute, 50G an hour, 100G a day.
- `deploy/gitea/`: gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network, with `make gitea-setup` to bring it up and check it (https://git.eeqj.de/sneak/smallwebwaf/issues/178).
- The image's Ubuntu packages come from Ubuntu's archive, no longer a dated snapshot (https://git.eeqj.de/sneak/smallwebwaf/issues/190).
- The package `internal/proxy` is renamed `internal/servewaf`, with no change of behaviour (https://git.eeqj.de/sneak/smallwebwaf/issues/173).
To know before deploying:
- An address making more than 1,500 requests an hour is banned. Actions runners exceed that and need to be in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
- The Gitea setup needs `GITEA_SECRET_KEY`, made once per install as `docs/gitea.md` says; gitea's sign-up is off. Its Core Rule Set runs in `detect` mode, refusing nothing, until https://git.eeqj.de/sneak/smallwebwaf/issues/198 lands.
Model: opus-5-5
A compose setup that runs gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network with IPv4 and IPv6, and `script/gitea-setup` (`make gitea-setup`), which brings it up and checks that a page load, a push and a clone pass through rproxy and are checked by servewaf. Containers on the shared network skip servewaf's checks; the gateways do not. gitea gets a secret key made per install and has sign-up off. `docs/gitea.md` explains each setting.
Judgement call: the Core Rule Set runs in `detect` mode here until #198 lands.
Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
sneak
was assigned by clawbot2026-11-06 19:47:18 +01:00
The package passes nothing on since the one-process mode went: it answers rproxy's questions, takes its reports and answers servewaf's own endpoints. It is now named after the command it serves, with `git mv`, and its constructor is `servewaf.New`. `SPEC.md` and the other documents follow. No change of behaviour.
Model: opus-5-5
The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone.
Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index.
Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
New defaults, as sneak approved: 120 requests a minute, 1,500 an hour and 6,000 a day; bytes off a minute, 50G an hour and 100G a day. The README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md` give the new figures and reasoning, and point Actions runners and shared addresses at `SWWAF_RATE_LIMIT_EXEMPT_NETS`. The README examples now hold against the new defaults.
An Actions runner that is not exempted makes more requests an hour than the new limit and will be banned.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
nexthas thatmainlacks:deploy/gitea/: gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network, withmake gitea-setupto bring it up and check it (#178).internal/proxyis renamedinternal/servewaf, with no change of behaviour (#173).To know before deploying:
SWWAF_RATE_LIMIT_EXEMPT_NETS.GITEA_SECRET_KEY, made once per install asdocs/gitea.mdsays; gitea's sign-up is off. Its Core Rule Set runs indetectmode, refusing nothing, until #198 lands.Model: opus-5-5