You wrote on #217 (comment) that the CrowdSec part can be left unimplemented or postponed, since you don't use it and are not sure where it came from.
What exists: it is already built. When SWW_CROWDSEC_LAPI_URL and SWW_CROWDSEC_LAPI_KEY are set, smallwebwaf fetches the decision list of a CrowdSec engine and refuses the addresses on it. It lives in internal/bans (about 30 places in the code), with its own tests (internal/bans/crowdsec_test.go) and sections in README.md, SPEC.md, docs/settings.md, docs/alerts.md and docs/request-log.md. With those settings unset, which is the default, it does nothing. It came from the original design comparison in EVALUATION.md, which listed a CrowdSec decision feed as an option.
Options:
Remove it: the code, its two settings, its tests and every mention in the documents go. One less outside system to keep working, and nothing to explain for 1.0. Bringing it back later means rebuilding it.
Keep it, off by default: nothing changes. It stays unused unless someone sets the two settings, and it keeps needing tests and upkeep.
Recommendation: remove it. You don't use it, it is off by default, and fewer moving parts is the simpler 1.0.
Model: opus-5-5
You wrote on https://git.eeqj.de/sneak/smallwebwaf/issues/217#issuecomment-175940 that the CrowdSec part can be left unimplemented or postponed, since you don't use it and are not sure where it came from.
**What exists:** it is already built. When `SWW_CROWDSEC_LAPI_URL` and `SWW_CROWDSEC_LAPI_KEY` are set, smallwebwaf fetches the decision list of a CrowdSec engine and refuses the addresses on it. It lives in `internal/bans` (about 30 places in the code), with its own tests (`internal/bans/crowdsec_test.go`) and sections in `README.md`, `SPEC.md`, `docs/settings.md`, `docs/alerts.md` and `docs/request-log.md`. With those settings unset, which is the default, it does nothing. It came from the original design comparison in `EVALUATION.md`, which listed a CrowdSec decision feed as an option.
**Options:**
- **Remove it:** the code, its two settings, its tests and every mention in the documents go. One less outside system to keep working, and nothing to explain for 1.0. Bringing it back later means rebuilding it.
- **Keep it, off by default:** nothing changes. It stays unused unless someone sets the two settings, and it keeps needing tests and upkeep.
**Recommendation: remove it.** You don't use it, it is off by default, and fewer moving parts is the simpler 1.0.
Model: opus-5-5
sneak
was assigned by clawbot2026-11-11 00:57:23 +01:00
sneak's ruling (comment above, 13 November): Remove it. The CrowdSec decision feed goes: its code in internal/bans, the two settings SWW_CROWDSEC_LAPI_URL and SWW_CROWDSEC_LAPI_KEY, its tests, and every mention in README.md, SPEC.md, docs/settings.md, docs/alerts.md and docs/request-log.md. EVALUATION.md may keep its historical comparison.
Model: opus-5-5
**sneak's ruling** (comment above, 13 November): **Remove it**. The CrowdSec decision feed goes: its code in `internal/bans`, the two settings `SWW_CROWDSEC_LAPI_URL` and `SWW_CROWDSEC_LAPI_KEY`, its tests, and every mention in `README.md`, `SPEC.md`, `docs/settings.md`, `docs/alerts.md` and `docs/request-log.md`. `EVALUATION.md` may keep its historical comparison.
Model: opus-5-5
sneak
was unassigned by clawbot2026-11-13 19:53:54 +01:00
clawbot
self-assigned this 2026-11-13 19:53:54 +01:00
Removed in #384 (branch issue-315-remove-crowdsec, into next). The feed went from internal/waf, internal/reputation, internal/bans, internal/config, internal/state, internal/metrics, internal/alerts and internal/requestlog, with its tests, and from README.md, SPEC.md and docs/. EVALUATION.md is unchanged.
Model: opus-5-5
Removed in https://git.eeqj.de/sneak/smallwebwaf/pulls/384 (branch `issue-315-remove-crowdsec`, into `next`). The feed went from `internal/waf`, `internal/reputation`, `internal/bans`, `internal/config`, `internal/state`, `internal/metrics`, `internal/alerts` and `internal/requestlog`, with its tests, and from `README.md`, `SPEC.md` and `docs/`. `EVALUATION.md` is unchanged.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
You wrote on #217 (comment) that the CrowdSec part can be left unimplemented or postponed, since you don't use it and are not sure where it came from.
What exists: it is already built. When
SWW_CROWDSEC_LAPI_URLandSWW_CROWDSEC_LAPI_KEYare set, smallwebwaf fetches the decision list of a CrowdSec engine and refuses the addresses on it. It lives ininternal/bans(about 30 places in the code), with its own tests (internal/bans/crowdsec_test.go) and sections inREADME.md,SPEC.md,docs/settings.md,docs/alerts.mdanddocs/request-log.md. With those settings unset, which is the default, it does nothing. It came from the original design comparison inEVALUATION.md, which listed a CrowdSec decision feed as an option.Options:
Recommendation: remove it. You don't use it, it is off by default, and fewer moving parts is the simpler 1.0.
Model: opus-5-5
remove it
sneak's ruling (comment above, 13 November): Remove it. The CrowdSec decision feed goes: its code in
internal/bans, the two settingsSWW_CROWDSEC_LAPI_URLandSWW_CROWDSEC_LAPI_KEY, its tests, and every mention inREADME.md,SPEC.md,docs/settings.md,docs/alerts.mdanddocs/request-log.md.EVALUATION.mdmay keep its historical comparison.Model: opus-5-5
Removed in #384 (branch
issue-315-remove-crowdsec, intonext). The feed went frominternal/waf,internal/reputation,internal/bans,internal/config,internal/state,internal/metrics,internal/alertsandinternal/requestlog, with its tests, and fromREADME.md,SPEC.mdanddocs/.EVALUATION.mdis unchanged.Model: opus-5-5