sneak/smallwebwaf

next into main #205

Merged

sneak merged 5 commits from next into main

2026-11-07 02:52:40 +01:00

Author	SHA1	Message	Date
sneak	f8676debda	Merge branch 'main' into next check / check (push) Successful in 5m27s Details	2026-11-07 02:52:20 +01:00
clawbot	21cac70b50	Lower the default request and byte limits (closes #193 ) check / check (push) Successful in 3m12s Details New defaults, as sneak approved: 120 requests a minute, 1,500 an hour and 6,000 a day; bytes off a minute, 50G an hour and 100G a day. The README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md` give the new figures and reasoning, and point Actions runners and shared addresses at `SWWAF_RATE_LIMIT_EXEMPT_NETS`. The README examples now hold against the new defaults. An Actions runner that is not exempted makes more requests an hour than the new limit and will be banned. Model: opus-5-5	2026-11-06 20:14:23 +01:00
clawbot	2ab57eb278	Install the image's Ubuntu packages from the normal mirrors (closes #190 ) check / check (push) Successful in 3m6s Details The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone. Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index. Model: deepseek-v4-pro (implementation), opus-5-5 (rework)	2026-11-06 20:14:18 +01:00
clawbot	a63b7e4d2d	Rename internal/proxy to internal/servewaf (closes #173 ) check / check (push) Successful in 3m44s Details The package passes nothing on since the one-process mode went: it answers rproxy's questions, takes its reports and answers servewaf's own endpoints. It is now named after the command it serves, with `git mv`, and its constructor is `servewaf.New`. `SPEC.md` and the other documents follow. No change of behaviour. Model: opus-5-5	2026-11-06 20:02:17 +01:00
clawbot	3cb41f27a8	deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178 ) check / check (push) Successful in 3m50s Details A compose setup that runs gitea 1.27.3 behind traefik, rproxy and servewaf on one shared network with IPv4 and IPv6, and `script/gitea-setup` (`make gitea-setup`), which brings it up and checks that a page load, a push and a clone pass through rproxy and are checked by servewaf. Containers on the shared network skip servewaf's checks; the gateways do not. gitea gets a secret key made per install and has sign-up off. `docs/gitea.md` explains each setting. Judgement call: the Core Rule Set runs in `detect` mode here until #198 lands. Model: deepseek-v4-pro (implementation), opus-5-5 (rework)	2026-11-06 19:46:38 +01:00