no. this program needs to support common selfhosted things out of the box. explicitly supported (no false positives allowed):
wordpress
drupal
mediawiki
gitea
mastodon
vaultwarden
nextcloud
etc
Definition of done, one unit per app, each its own issue and PR (Gitea's is #198):
With smallwebwaf's defaults and the web attack rules refusing attacks, the app's ordinary traffic is never refused. That covers:
its pages, signed in and out;
sign-in;
its admin pages;
its API and the clients that use it, such as Nextcloud's sync client, Bitwarden's apps against Vaultwarden, and Mastodon's apps and federation;
uploads.
Each rule that misfires on such traffic is switched off as narrowly as it can be: that rule only, on the paths or fields where it misfires. A one-line comment names the app and the request.
A test in make check sends recorded ordinary requests for the app, and none is refused. Classic attacks are still refused.
The README lists the apps supported out of the box, each added when its unit lands.
"etc": more common self-hosted apps follow the same way. The manager proposes the next ones here.
Model: opus-5-5
sneak, on https://git.eeqj.de/sneak/smallwebwaf/pulls/210#issuecomment-170208, 7 November:
> no. this program needs to support common selfhosted things out of the box. explicitly supported (no false positives allowed):
>
> - wordpress
> - drupal
> - mediawiki
> - gitea
> - mastodon
> - vaultwarden
> - nextcloud
>
> etc
**Definition of done**, one unit per app, each its own issue and PR (Gitea's is https://git.eeqj.de/sneak/smallwebwaf/issues/198):
- With smallwebwaf's defaults and the web attack rules refusing attacks, the app's ordinary traffic is never refused. That covers:
- its pages, signed in and out;
- sign-in;
- its admin pages;
- its API and the clients that use it, such as Nextcloud's sync client, Bitwarden's apps against Vaultwarden, and Mastodon's apps and federation;
- uploads.
- Each rule that misfires on such traffic is switched off as narrowly as it can be: that rule only, on the paths or fields where it misfires. A one-line comment names the app and the request.
- A test in `make check` sends recorded ordinary requests for the app, and none is refused. Classic attacks are still refused.
- The README lists the apps supported out of the box, each added when its unit lands.
- "etc": more common self-hosted apps follow the same way. The manager proposes the next ones here.
Model: opus-5-5
clawbot
self-assigned this 2026-11-07 03:20:53 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, on #210 (comment), 7 November:
Definition of done, one unit per app, each its own issue and PR (Gitea's is #198):
make checksends recorded ordinary requests for the app, and none is refused. Classic attacks are still refused.Model: opus-5-5