Admin listener #27

New Issue

2026-09-25T11:01:48+02:00

clawbot commented

2026-09-25 11:01:48 +02:00

The admin listener for health checks, listing, adding and lifting bans, and asking why an address was refused, as the "Admin listener" section of SPEC.md (#9) describes. sneak's pick among the easier-administration proposals in #10 bears on it.

Not scheduled: it waits for sneak to put it in a milestone.

Model: opus-5-5

The admin listener for health checks, listing, adding and lifting bans, and asking why an address was refused, as the "Admin listener" section of `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describes. sneak's pick among the easier-administration proposals in https://git.eeqj.de/sneak/smallwebwaf/issues/10 bears on it. Not scheduled: it waits for sneak to put it in a milestone. Model: opus-5-5

clawbot referenced this issue

2026-09-28 11:27:09 +02:00

Easier administration: five proposals to pick from #10

clawbot commented

2026-09-28 11:27:09 +02:00

sneak's ruling on issue 10: one listener only, and all admin commands come in through it like everything else. This issue therefore becomes "admin endpoints on the single listener", with no separate admin listener or port. The spec in PR 9 changes to match.

Model: opus-5-5

sneak's ruling on [issue 10](https://git.eeqj.de/sneak/smallwebwaf/issues/10#issuecomment-103275): one listener only, and all admin commands come in through it like everything else. This issue therefore becomes "admin endpoints on the single listener", with no separate admin listener or port. The spec in [PR 9](https://git.eeqj.de/sneak/smallwebwaf/pulls/9) changes to match. Model: opus-5-5

clawbot referenced this issue

2026-10-06 20:40:39 +02:00

Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept #86

clawbot referenced this issue

2026-10-06 20:40:53 +02:00

Settings given as files: the _FILE form of every setting #87

clawbot commented

2026-10-06 20:41:04 +02:00

Plan. The build order in SPEC.md puts the other admin endpoints in the second stage after milestone 2, beside rule files, alerting and remote log sending. Built after #86 (the admin cause, reason, lifted bans) and #87 (settings given as files), as "Admin endpoints" describes. One PR to next.

SWWAF_ADMIN_TOKEN (and its _FILE form): shorter than 32 characters stops the start; unset, the endpoints below answer 404 like any other path under /_smallwebwaf/. Sent as Authorization: Bearer <token>, compared in constant time; missing or wrong answers 401, in observe mode too.
GET /_smallwebwaf/bans: the bans as bans.json holds them, JSON.
POST /_smallwebwaf/bans: a client or netblock, a duration (or permanent) and a reason; makes an admin ban, written to bans.json like any other.
DELETE /_smallwebwaf/bans/<client>: lifts the ban covering that client (kept, marked lifted).
GET /_smallwebwaf/clients/<ip>: the client's current counters, history, lookup result, offences and bans with their notes, from what is built; reputation comes with its sources.
These requests go through every check other requests do and are answered where another would be forwarded; they count toward the client's limits; a client in SWWAF_ALLOW_NETS skips the checks but needs the token. The request log's action is admin.
README.md shows each endpoint with curl.

Not in this unit: a 401 counting toward the error burst comes with error bursts.

Definition of done: tests show each endpoint with a right, wrong and missing token, 404 while the token is unset, a short token stopping the start, a ban added and lifted through the endpoints and seen in bans.json, a banned client refused at an endpoint even with the token, and the counts; each test failing with its rule broken; make check green; one PR to next, passed by a reviewer who did not write it.

Model: opus-5-5

Plan. The build order in `SPEC.md` puts the other admin endpoints in the second stage after milestone 2, beside rule files, alerting and remote log sending. Built after https://git.eeqj.de/sneak/smallwebwaf/issues/86 (the `admin` cause, `reason`, lifted bans) and https://git.eeqj.de/sneak/smallwebwaf/issues/87 (settings given as files), as "Admin endpoints" describes. One PR to `next`. - `SWWAF_ADMIN_TOKEN` (and its `_FILE` form): shorter than 32 characters stops the start; unset, the endpoints below answer `404` like any other path under `/_smallwebwaf/`. Sent as `Authorization: Bearer <token>`, compared in constant time; missing or wrong answers `401`, in `observe` mode too. - `GET /_smallwebwaf/bans`: the bans as `bans.json` holds them, JSON. - `POST /_smallwebwaf/bans`: a client or netblock, a duration (or permanent) and a reason; makes an `admin` ban, written to `bans.json` like any other. - `DELETE /_smallwebwaf/bans/<client>`: lifts the ban covering that client (kept, marked lifted). - `GET /_smallwebwaf/clients/<ip>`: the client's current counters, history, lookup result, offences and bans with their notes, from what is built; reputation comes with its sources. - These requests go through every check other requests do and are answered where another would be forwarded; they count toward the client's limits; a client in `SWWAF_ALLOW_NETS` skips the checks but needs the token. The request log's `action` is `admin`. - `README.md` shows each endpoint with `curl`. Not in this unit: a `401` counting toward the error burst comes with error bursts. Definition of done: tests show each endpoint with a right, wrong and missing token, `404` while the token is unset, a short token stopping the start, a ban added and lifted through the endpoints and seen in `bans.json`, a banned client refused at an endpoint even with the token, and the counts; each test failing with its rule broken; `make check` green; one PR to `next`, passed by a reviewer who did not write it. Model: opus-5-5

clawbot referenced this issue

2026-10-06 23:20:13 +02:00

Settings given as files: the _FILE form of every setting #89

clawbot referenced this issue from a commit

2026-10-07 00:32:23 +02:00

Admin endpoints for bans and clients on the single listener (closes #27)

clawbot referenced this issue

2026-10-07 00:32:58 +02:00

Admin endpoints for bans and clients on the single listener #92

clawbot commented

2026-10-07 00:33:18 +02:00