sneak/smallwebwaf
1
0 Fork 0
Code Issues 12 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

README: any TLS-terminating reverse proxy, not traefik specifically #388

New Issue
Closed
opened 2026-11-14 17:38:12 +01:00 by clawbot · 1 comment
clawbot commented 2026-11-14 17:38:12 +01:00
Collaborator
Copy link
Copy source

sneak, chat, 14 November 2026:

> the readme and use case should not be so traefik-specific. it should work fine behind any tls-terminating reverse proxy.

Task

Rewrite the parts of README.md (and any other user-facing document on next that describes deployment) that present traefik as the way to run smallwebwaf. They should say that rproxy runs behind any reverse proxy that terminates TLS, and state in a short list what that proxy must do. For example: forward plain HTTP to rproxy; set X-Forwarded-For and X-Forwarded-Proto; connect from an address in the trusted-proxy set, which defaults to RFC 1918. traefik, nginx and Caddy may appear as examples, with no one of them treated as the required one.

If anything in the code works only behind traefik (for example the TLS client fingerprint headers from our patched traefik), say so in one sentence as an optional extra, and list it on this issue.

Definition of done

  • No user-facing document on next implies traefik is required.
  • The proxy's duties are listed, and match what the code on next reads.
  • The prose meets the README rules.
  • make check passes. One PR into next.

Model: opus-5-5

sneak, chat, 14 November 2026: > the readme and use case should not be so traefik-specific. it should work fine behind any tls-terminating reverse proxy. ## Task Rewrite the parts of `README.md` (and any other user-facing document on `next` that describes deployment) that present traefik as the way to run smallwebwaf. They should say that `rproxy` runs behind any reverse proxy that terminates TLS, and state in a short list what that proxy must do. For example: forward plain HTTP to `rproxy`; set `X-Forwarded-For` and `X-Forwarded-Proto`; connect from an address in the trusted-proxy set, which defaults to RFC 1918. traefik, nginx and Caddy may appear as examples, with no one of them treated as the required one. If anything in the code works only behind traefik (for example the TLS client fingerprint headers from our patched traefik), say so in one sentence as an optional extra, and list it on this issue. ## Definition of done - No user-facing document on `next` implies traefik is required. - The proxy's duties are listed, and match what the code on `next` reads. - The prose meets the README rules. - `make check` passes. One PR into `next`. Model: opus-5-5
clawbot commented 2026-11-14 17:43:27 +01:00
Author
Collaborator
Copy link
Copy source

PR: #391, branch issue-388-any-tls-proxy.

The README, SPEC.md and docs/ now describe a generic TLS-terminating proxy. The README lists what that proxy must do, and gives traefik, Caddy and nginx as examples.

Traefik-only features on next: none. No code reads TLS fingerprint headers.

Model: opus-5-5

PR: https://git.eeqj.de/sneak/smallwebwaf/pulls/391, branch `issue-388-any-tls-proxy`. The README, `SPEC.md` and `docs/` now describe a generic TLS-terminating proxy. The README lists what that proxy must do, and gives traefik, Caddy and nginx as examples. Traefik-only features on `next`: none. No code reads TLS fingerprint headers. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
Reviewed and ready for the owner to merge
 needs-checks
Checks must be fixed before review
 needs-decision
Waits on an owner decision
 needs-decision
Waiting on a decision by the owner
 needs-decision
needs-rebase
Conflicts with next; rebase required
 needs-review
Review not yet done
 needs-rework
Review found issues to fix
 post-1.0
red-next
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#388