Alerts on attacks and bans, with a cooldown and an hourly cap, as the "Alerting" settings and the alert webhook schema in SPEC.md (#9) describe.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Alerts on attacks and bans, with a cooldown and an hourly cap, as the "Alerting" settings and the alert webhook schema in `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describe.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts alerting in the second stage after milestone 2, now that rule files and remote log sending are on next. This issue builds the alert queue and the JSON webhook; Slack and ntfy follow in #90. One PR to next.
SWWAF_ALERT_WEBHOOK_URL and SWWAF_ALERT_WEBHOOK_HEADERS: one JSON POST per alert, as "Alert webhook schema" gives it (instance, time, event, client, netblock, asn, as_name, country, reason, detail, suppressed_repeats).
The events built so far: ban and permanent_ban (with the ban's notes in detail), source_failure for GeoJS failing or refusing, and file_error for a rule file or state file edit that does not parse and a state file that cannot be written. waf_block, anomaly and reputation_hit come with their features. SWWAF_ALERT_EVENTS chooses which are sent.
SWWAF_ALERT_COOLDOWN: the same event for the same client or netblock is not repeated within it; the next one carries the count held back. SWWAF_ALERT_MAX_PER_HOUR: past it, alerts are rolled into one summary per hour.
Sending never holds up a request: a bounded queue, retried with backoff, oldest dropped first; sent, failed, suppressed and dropped counted by destination in the metrics.
alerts.json keeps the cooldown state, the alerts sent this hour and those waiting, as "Persistent state" gives it, written and edited like the other state files.
README.md shows the settings and a sample alert.
Definition of done: tests, against a local stand-in endpoint and on a clock the test controls, show each event's alert and its fields, the headers sent, SWWAF_ALERT_EVENTS choosing, the cooldown and its count, the hourly summary, a down endpoint retried and dropped from a full queue without holding up a request, and alerts.json kept across a restart; each test failing with its rule broken; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts alerting in the second stage after milestone 2, now that rule files and remote log sending are on `next`. This issue builds the alert queue and the JSON webhook; Slack and ntfy follow in https://git.eeqj.de/sneak/smallwebwaf/issues/90. One PR to `next`.
- `SWWAF_ALERT_WEBHOOK_URL` and `SWWAF_ALERT_WEBHOOK_HEADERS`: one JSON POST per alert, as "Alert webhook schema" gives it (`instance`, `time`, `event`, `client`, `netblock`, `asn`, `as_name`, `country`, `reason`, `detail`, `suppressed_repeats`).
- The events built so far: `ban` and `permanent_ban` (with the ban's notes in `detail`), `source_failure` for GeoJS failing or refusing, and `file_error` for a rule file or state file edit that does not parse and a state file that cannot be written. `waf_block`, `anomaly` and `reputation_hit` come with their features. `SWWAF_ALERT_EVENTS` chooses which are sent.
- `SWWAF_ALERT_COOLDOWN`: the same event for the same client or netblock is not repeated within it; the next one carries the count held back. `SWWAF_ALERT_MAX_PER_HOUR`: past it, alerts are rolled into one summary per hour.
- Sending never holds up a request: a bounded queue, retried with backoff, oldest dropped first; sent, failed, suppressed and dropped counted by destination in the metrics.
- `alerts.json` keeps the cooldown state, the alerts sent this hour and those waiting, as "Persistent state" gives it, written and edited like the other state files.
- `README.md` shows the settings and a sample alert.
Definition of done: tests, against a local stand-in endpoint and on a clock the test controls, show each event's alert and its fields, the headers sent, `SWWAF_ALERT_EVENTS` choosing, the cooldown and its count, the hourly summary, a down endpoint retried and dropped from a full queue without holding up a request, and `alerts.json` kept across a restart; each test failing with its rule broken; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
changed title from Alerts to a webhook, Slack or ntfy to Alerts: the queue and the JSON webhook2026-10-07 00:02:21 +02:00
clawbot
self-assigned this 2026-10-07 00:02:21 +02:00
Built in #93: alerts to the JSON webhook, with the cooldown, the hourly summary and alerts.json.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/93: alerts to the JSON webhook, with the cooldown, the hourly summary and `alerts.json`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Alerts on attacks and bans, with a cooldown and an hourly cap, as the "Alerting" settings and the alert webhook schema in
SPEC.md(#9) describe.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs alerting in the second stage after milestone 2, now that rule files and remote log sending are onnext. This issue builds the alert queue and the JSON webhook; Slack and ntfy follow in #90. One PR tonext.SWWAF_ALERT_WEBHOOK_URLandSWWAF_ALERT_WEBHOOK_HEADERS: one JSON POST per alert, as "Alert webhook schema" gives it (instance,time,event,client,netblock,asn,as_name,country,reason,detail,suppressed_repeats).banandpermanent_ban(with the ban's notes indetail),source_failurefor GeoJS failing or refusing, andfile_errorfor a rule file or state file edit that does not parse and a state file that cannot be written.waf_block,anomalyandreputation_hitcome with their features.SWWAF_ALERT_EVENTSchooses which are sent.SWWAF_ALERT_COOLDOWN: the same event for the same client or netblock is not repeated within it; the next one carries the count held back.SWWAF_ALERT_MAX_PER_HOUR: past it, alerts are rolled into one summary per hour.alerts.jsonkeeps the cooldown state, the alerts sent this hour and those waiting, as "Persistent state" gives it, written and edited like the other state files.README.mdshows the settings and a sample alert.Definition of done: tests, against a local stand-in endpoint and on a clock the test controls, show each event's alert and its fields, the headers sent,
SWWAF_ALERT_EVENTSchoosing, the cooldown and its count, the hourly summary, a down endpoint retried and dropped from a full queue without holding up a request, andalerts.jsonkept across a restart; each test failing with its rule broken;make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Alerts to a webhook, Slack or ntfyto Alerts: the queue and the JSON webhookBuilt in #93: alerts to the JSON webhook, with the cooldown, the hourly summary and
alerts.json.Model: opus-5-5