Deleted deploy/gitea/, docs/gitea.md, script/gitea-setup, script/gitea-requests and their Makefile targets.
README.md: the "In front of gitea" compose example is deleted, so no example uses traefik any more. The entrypoint and document entries for the deleted files are gone.
SPEC.md, docs/settings.md, docs/rules.md and EVALUATION.md use "a code forge" or a generic site where Gitea was the example deployment. The rules-file example is now 50-site.rules.
internal/config/config.go: the error message's example name is blog. Tests use fsn1app1/blog and blog as instance and app names.
Unchanged, per the amendment: the Core Rule Set exclusions for Gitea's false positives in internal/waf/waf.go, their comments and tests, the list of six changes in SPEC.md, and TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused. git grep -i gitea finds those, REPO_POLICIES.md and .gitea/.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/209, with the owner's amendment in https://git.eeqj.de/sneak/smallwebwaf/issues/209#issuecomment-170192.
- Deleted `deploy/gitea/`, `docs/gitea.md`, `script/gitea-setup`, `script/gitea-requests` and their `Makefile` targets.
- `README.md`: the "In front of gitea" compose example is deleted, so no example uses traefik any more. The entrypoint and document entries for the deleted files are gone.
- `SPEC.md`, `docs/settings.md`, `docs/rules.md` and `EVALUATION.md` use "a code forge" or a generic site where Gitea was the example deployment. The rules-file example is now `50-site.rules`.
- `internal/config/config.go`: the error message's example name is `blog`. Tests use `fsn1app1/blog` and `blog` as instance and app names.
- Unchanged, per the amendment: the Core Rule Set exclusions for Gitea's false positives in `internal/waf/waf.go`, their comments and tests, the list of six changes in `SPEC.md`, and `TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused`. `git grep -i gitea` finds those, `REPO_POLICIES.md` and `.gitea/`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-07 02:58:07 +01:00
SPEC.md line 869, a sentence this PR edits: "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the image servewaf runs from, or mounts." It runs 33 words. Its verb comes after 18 of them. "WordPress probes in front of an app that is not WordPress" says one thing twice. Split it, for example: "Put any other rule, such as one banning WordPress probes, in a file of your own. Add that file to the image servewaf runs from, or mount it."
README.md line 341, a sentence this PR adds: "Each publishes rproxy's port on the host, for trying it out." It follows "where each reaches the others by service name", so "Each" first reads as each service. That reading is false, since the app and servewaf publish nothing. Name the subject: "Each example publishes rproxy's port on the host, for trying it out."
Judgement call: SPEC.md's list of six Core Rule Set changes and TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused in internal/servewaf/coreruleset_test.go still name gitea. I read the amendment in #209 (comment) as keeping the description and tests of the Gitea exclusions too.
Model: opus-5-5
**FAIL** (`needs-rework`)
1. `SPEC.md` line 869, a sentence this PR edits: "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the image `servewaf` runs from, or mounts." It runs 33 words. Its verb comes after 18 of them. "WordPress probes in front of an app that is not WordPress" says one thing twice. Split it, for example: "Put any other rule, such as one banning WordPress probes, in a file of your own. Add that file to the image `servewaf` runs from, or mount it."
2. `README.md` line 341, a sentence this PR adds: "Each publishes `rproxy`'s port on the host, for trying it out." It follows "where each reaches the others by service name", so "Each" first reads as each service. That reading is false, since the app and `servewaf` publish nothing. Name the subject: "Each example publishes `rproxy`'s port on the host, for trying it out."
Judgement call: `SPEC.md`'s list of six Core Rule Set changes and `TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused` in `internal/servewaf/coreruleset_test.go` still name gitea. I read the amendment in https://git.eeqj.de/sneak/smallwebwaf/issues/209#issuecomment-170192 as keeping the description and tests of the Gitea exclusions too.
Model: opus-5-5
: "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the image servewaf runs from, or mounts."
no. this program needs to support common selfhosted things out of the box. explicitly supported (no false positives allowed):
wordpress
drupal
mediawiki
gitea
mastodon
vaultwarden
nextcloud
etc
> : "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the image servewaf runs from, or mounts."
no. this program needs to support common selfhosted things out of the box. explicitly supported (no false positives allowed):
- wordpress
- drupal
- mediawiki
- gitea
- mastodon
- vaultwarden
- nextcloud
etc
For the reworker, two review findings and sneak's comment above:
SPEC.md line 869: delete the sentence "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the image servewaf runs from, or mounts." sneak rejected it: smallwebwaf is to support common self-hosted apps out of the box (#210 (comment)). Do not replace it with a claim of that support: it is not built yet, and it is filed as its own issue.
README.md line 341: "Each publishes rproxy's port on the host, for trying it out." becomes "Each example publishes rproxy's port on the host, for trying it out."
The review's judgement call stands: the Gitea exclusions, their description in SPEC.md and their test stay.
Change nothing else. Keep one commit, run make check, and push with --force-with-lease.
Model: opus-5-5
**For the reworker**, two review findings and sneak's comment above:
- **`SPEC.md` line 869:** delete the sentence "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the image `servewaf` runs from, or mounts." sneak rejected it: smallwebwaf is to support common self-hosted apps out of the box (https://git.eeqj.de/sneak/smallwebwaf/pulls/210#issuecomment-170208). Do not replace it with a claim of that support: it is not built yet, and it is filed as its own issue.
- **`README.md` line 341:** "Each publishes `rproxy`'s port on the host, for trying it out." becomes "Each example publishes `rproxy`'s port on the host, for trying it out."
- The review's judgement call stands: the Gitea exclusions, their description in `SPEC.md` and their test stay.
- Change nothing else. Keep one commit, run `make check`, and push with `--force-with-lease`.
Model: opus-5-5
Delete the Gitea compose setup, its document, its two scripts and their
make targets. Documents and tests no longer use Gitea as the example
deployment. The Core Rule Set exclusions for Gitea's false positives in
internal/waf stay, with their comments and tests.
Model: opus-5-5
SPEC.md: sentence deleted, nothing put in its place.
README.md: subject is now "Each example".
Gitea exclusions, their SPEC.md description and their test: unchanged.
Model: opus-5-5
Reworked as `ec87992`, still one commit on `next`:
- `SPEC.md`: sentence deleted, nothing put in its place.
- `README.md`: subject is now "Each example".
- Gitea exclusions, their `SPEC.md` description and their test: unchanged.
Model: opus-5-5
Judgement call: SPEC.md line 867 and internal/rules/rules_test.go keep Gitea's /src/branch/main/ repository paths as a code forge example; I read the definition of done as covering Gitea's name and hosts, not its URL layout.
Model: opus-5-5
**PASS**: ready to squash-merge into `next`.
Judgement call: `SPEC.md` line 867 and `internal/rules/rules_test.go` keep Gitea's `/src/branch/main/` repository paths as a code forge example; I read the definition of done as covering Gitea's name and hosts, not its URL layout.
Model: opus-5-5
clawbot
merged commit 7fed6b6d36 into next2026-11-07 03:52:03 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #209, with the owner's amendment in #209 (comment).
deploy/gitea/,docs/gitea.md,script/gitea-setup,script/gitea-requestsand theirMakefiletargets.README.md: the "In front of gitea" compose example is deleted, so no example uses traefik any more. The entrypoint and document entries for the deleted files are gone.SPEC.md,docs/settings.md,docs/rules.mdandEVALUATION.mduse "a code forge" or a generic site where Gitea was the example deployment. The rules-file example is now50-site.rules.internal/config/config.go: the error message's example name isblog. Tests usefsn1app1/blogandblogas instance and app names.internal/waf/waf.go, their comments and tests, the list of six changes inSPEC.md, andTestDisabledRulesSwitchOffWhatGiteaWouldBeRefused.git grep -i giteafinds those,REPO_POLICIES.mdand.gitea/.Model: opus-5-5
1c70104677to3543a9f616Remove everything specific to a Gitea deploymentto Remove what is about deploying behind GiteaFAIL (
needs-rework)SPEC.mdline 869, a sentence this PR edits: "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the imageservewafruns from, or mounts." It runs 33 words. Its verb comes after 18 of them. "WordPress probes in front of an app that is not WordPress" says one thing twice. Split it, for example: "Put any other rule, such as one banning WordPress probes, in a file of your own. Add that file to the imageservewafruns from, or mount it."README.mdline 341, a sentence this PR adds: "Each publishesrproxy's port on the host, for trying it out." It follows "where each reaches the others by service name", so "Each" first reads as each service. That reading is false, since the app andservewafpublish nothing. Name the subject: "Each example publishesrproxy's port on the host, for trying it out."Judgement call:
SPEC.md's list of six Core Rule Set changes andTestDisabledRulesSwitchOffWhatGiteaWouldBeRefusedininternal/servewaf/coreruleset_test.gostill name gitea. I read the amendment in #209 (comment) as keeping the description and tests of the Gitea exclusions too.Model: opus-5-5
no. this program needs to support common selfhosted things out of the box. explicitly supported (no false positives allowed):
etc
For the reworker, two review findings and sneak's comment above:
SPEC.mdline 869: delete the sentence "Anything else, such as a rule banning WordPress probes in front of an app that is not WordPress, belongs in a file the deployer adds to the imageservewafruns from, or mounts." sneak rejected it: smallwebwaf is to support common self-hosted apps out of the box (#210 (comment)). Do not replace it with a claim of that support: it is not built yet, and it is filed as its own issue.README.mdline 341: "Each publishesrproxy's port on the host, for trying it out." becomes "Each example publishesrproxy's port on the host, for trying it out."SPEC.mdand their test stay.make check, and push with--force-with-lease.Model: opus-5-5
3543a9f616toec879925b2Reworked as
ec87992, still one commit onnext:SPEC.md: sentence deleted, nothing put in its place.README.md: subject is now "Each example".SPEC.mddescription and their test: unchanged.Model: opus-5-5
PASS: ready to squash-merge into
next.Judgement call:
SPEC.mdline 867 andinternal/rules/rules_test.gokeep Gitea's/src/branch/main/repository paths as a code forge example; I read the definition of done as covering Gitea's name and hosts, not its URL layout.Model: opus-5-5