The README, SPEC.md, docs/settings.md and docs/request-log.md now say that rproxy runs behind any TLS-terminating proxy. traefik, nginx and Caddy appear as examples.
The README's new section "The TLS-terminating proxy" lists what that proxy must do. Each item matches the code in internal/rproxy:
forward plain HTTP to port 8080;
keep Host, which rproxy passes to waf and to the app;
add the visitor to X-Forwarded-For;
set X-Forwarded-Proto;
close an unused connection in under 120 seconds, before rproxy does;
connect from an address in SWW_RPROXY_TRUSTED_PROXIES. Otherwise rproxy ignores the forwarded headers.
By default nginx sends the host in proxy_pass as Host and no forwarded headers, so the README spells out its proxy_set_header lines. Caddy keeps an unused connection for 120 seconds by default, so the README sets its keepalive to 90 seconds. SPEC.md points to the list instead of repeating it.
No code on next works only behind traefik. Nothing reads TLS fingerprint headers.
Disclosures:
EVALUATION.md still says traefik. It is a dated survey that records what was asked for, so it is left as written.
SPEC.md's upaas section still names traefik labels. It describes how upaas itself routes.
Code comments in internal/rproxy/client.go and the Dockerfile still say traefik. They are not user-facing documents.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/388.
The README, `SPEC.md`, `docs/settings.md` and `docs/request-log.md` now say that `rproxy` runs behind any TLS-terminating proxy. traefik, nginx and Caddy appear as examples.
The README's new section "The TLS-terminating proxy" lists what that proxy must do. Each item matches the code in `internal/rproxy`:
- forward plain HTTP to port 8080;
- keep `Host`, which `rproxy` passes to `waf` and to the app;
- add the visitor to `X-Forwarded-For`;
- set `X-Forwarded-Proto`;
- close an unused connection in under 120 seconds, before `rproxy` does;
- connect from an address in `SWW_RPROXY_TRUSTED_PROXIES`. Otherwise `rproxy` ignores the forwarded headers.
By default nginx sends the host in `proxy_pass` as `Host` and no forwarded headers, so the README spells out its `proxy_set_header` lines. Caddy keeps an unused connection for 120 seconds by default, so the README sets its `keepalive` to 90 seconds. `SPEC.md` points to the list instead of repeating it.
No code on `next` works only behind traefik. Nothing reads TLS fingerprint headers.
Disclosures:
- `EVALUATION.md` still says traefik. It is a dated survey that records what was asked for, so it is left as written.
- `SPEC.md`'s upaas section still names traefik labels. It describes how upaas itself routes.
- Code comments in `internal/rproxy/client.go` and the `Dockerfile` still say traefik. They are not user-facing documents.
Model: opus-5-5
README.md, SPEC.md, docs/settings.md, docs/request-log.md: the proxy that terminates TLS gets two names, "the reverse proxy that terminates TLS" and "the reverse proxy in front". The second is how these documents already describe rproxy itself: "the reverse proxy in front of one app" (README.md "Packages", SPEC.md "rproxy"). In SPEC.md "The usual setup", ""The reverse proxy in front" in README.md lists what that proxy must do" follows sentences about rproxy, so "that proxy" reads as rproxy. Acceptable: one plain name for it everywhere, the README heading included, such as the issue's own "TLS-terminating proxy".
README.md, "The usual setup: three containers": "rproxy, in front of the app, which the reverse proxy that terminates TLS forwards to: ..." nests one relative clause inside another, so the verb comes last. Acceptable: a short clause, such as "which the TLS-terminating proxy forwards to".
SPEC.md, "The usual setup": "rproxy, which the reverse proxy that terminates TLS forwards to, with SWW_RPROXY_UPSTREAM_URL naming the app and SWW_RPROXY_WAF_BACKEND naming waf;" has the same defect. The fix is the same.
README.md, "rproxy in the app's container": "The app sees the headers the reverse proxy in front sent, with that proxy's address added to X-Forwarded-For, from a TCP peer that is rproxy." The verb "sent" comes after a five-word subject buried in the object, and two phrases trail after it. Acceptable: two sentences, such as "The app's TCP peer is rproxy. The app sees the headers the TLS-terminating proxy sent, with that proxy's address added to X-Forwarded-For."
README.md, "The reverse proxy in front": "nginx sets none of the headers by default" is false. By default nginx sets Host to the host in proxy_pass ($proxy_host), which is why the example has to set it. Acceptable: "By default nginx sends the host in proxy_pass as Host and sets neither forwarded header, so its site sets all three:".
README.md, "The reverse proxy in front": "Caddy's reverse_proxy rproxy:8080 needs nothing more" is false. SPEC.md "rproxy's limits" now says the proxy in front should close an unused connection before rproxy closes it at 120 seconds. Caddy keeps one for 2 minutes by default, so it can send a request on a connection rproxy is closing, and the visitor gets 502. SPEC.md also says the README lists what that proxy must do, and the README list leaves this duty out. Acceptable: add "close an unused connection to rproxy in under 120 seconds" to the list, and give the Caddy setting that does it (transport http { keepalive 90s } inside reverse_proxy).
Judgement call: EVALUATION.md still names traefik, as a dated record of what was asked, and code comments fall outside the issue's user-facing scope. Neither is a finding.
Model: opus-5-5
Verdict: FAIL
Head: cddcf3d0657c81697e5c50c0edd09bccfeaf7f36
1. `README.md`, `SPEC.md`, `docs/settings.md`, `docs/request-log.md`: the proxy that terminates TLS gets two names, "the reverse proxy that terminates TLS" and "the reverse proxy in front". The second is how these documents already describe `rproxy` itself: "the reverse proxy in front of one app" (`README.md` "Packages", `SPEC.md` "`rproxy`"). In `SPEC.md` "The usual setup", "\"The reverse proxy in front\" in `README.md` lists what that proxy must do" follows sentences about `rproxy`, so "that proxy" reads as `rproxy`. Acceptable: one plain name for it everywhere, the README heading included, such as the issue's own "TLS-terminating proxy".
2. `README.md`, "The usual setup: three containers": "`rproxy`, in front of the app, which the reverse proxy that terminates TLS forwards to: ..." nests one relative clause inside another, so the verb comes last. Acceptable: a short clause, such as "which the TLS-terminating proxy forwards to".
3. `SPEC.md`, "The usual setup": "`rproxy`, which the reverse proxy that terminates TLS forwards to, with `SWW_RPROXY_UPSTREAM_URL` naming the app and `SWW_RPROXY_WAF_BACKEND` naming `waf`;" has the same defect. The fix is the same.
4. `README.md`, "`rproxy` in the app's container": "The app sees the headers the reverse proxy in front sent, with that proxy's address added to `X-Forwarded-For`, from a TCP peer that is `rproxy`." The verb "sent" comes after a five-word subject buried in the object, and two phrases trail after it. Acceptable: two sentences, such as "The app's TCP peer is `rproxy`. The app sees the headers the TLS-terminating proxy sent, with that proxy's address added to `X-Forwarded-For`."
5. `README.md`, "The reverse proxy in front": "nginx sets none of the headers by default" is false. By default nginx sets `Host` to the host in `proxy_pass` (`$proxy_host`), which is why the example has to set it. Acceptable: "By default nginx sends the host in `proxy_pass` as `Host` and sets neither forwarded header, so its site sets all three:".
6. `README.md`, "The reverse proxy in front": "Caddy's `reverse_proxy rproxy:8080` needs nothing more" is false. `SPEC.md` "`rproxy`'s limits" now says the proxy in front should close an unused connection before `rproxy` closes it at 120 seconds. Caddy keeps one for 2 minutes by default, so it can send a request on a connection `rproxy` is closing, and the visitor gets `502`. `SPEC.md` also says the README lists what that proxy must do, and the README list leaves this duty out. Acceptable: add "close an unused connection to `rproxy` in under 120 seconds" to the list, and give the Caddy setting that does it (`transport http { keepalive 90s }` inside `reverse_proxy`).
Judgement call: `EVALUATION.md` still names traefik, as a dated record of what was asked, and code comments fall outside the issue's user-facing scope. Neither is a finding.
Model: opus-5-5
README, SPEC and docs no longer present traefik as the required front
proxy, and call it the TLS-terminating proxy. The README section of that
name lists what the proxy must do: forward plain HTTP to port 8080, keep
Host, set X-Forwarded-For and X-Forwarded-Proto, close an unused
connection in under 120 seconds, and connect from an address in
SWW_RPROXY_TRUSTED_PROXIES. traefik, Caddy and nginx appear as examples,
with the Caddy and nginx settings their defaults lack.
Model: opus-5-5
Rework, head a3e86333f770f902813c62a25022c6e195a0cfb7:
Fixed: "TLS-terminating proxy" in all four documents, the README heading included. docs/request-log.md's scheme line keeps "the trusted proxy" from next, since it names the trust check.
Fixed as suggested.
Fixed as suggested.
Fixed with the two suggested sentences.
Fixed with the suggested sentence.
Fixed: the duty is in the list, and the README gives Caddy's transport http { keepalive 90s }.
Beyond the findings: SPEC.md drops "nginx, by default, opens a new connection for each request". Since nginx 1.29.7, upstream keepalive is on by default.
Model: opus-5-5
Rework, head `a3e86333f770f902813c62a25022c6e195a0cfb7`:
1. Fixed: "TLS-terminating proxy" in all four documents, the README heading included. `docs/request-log.md`'s `scheme` line keeps "the trusted proxy" from `next`, since it names the trust check.
2. Fixed as suggested.
3. Fixed as suggested.
4. Fixed with the two suggested sentences.
5. Fixed with the suggested sentence.
6. Fixed: the duty is in the list, and the README gives Caddy's `transport http { keepalive 90s }`.
Beyond the findings: `SPEC.md` drops "nginx, by default, opens a new connection for each request". Since nginx 1.29.7, upstream keepalive is on by default.
Model: opus-5-5
No user-facing document now requires traefik, and the README's list of what the TLS-terminating proxy must do matches the code in internal/rproxy.
Judgement call: EVALUATION.md still names traefik in its dated record of what was asked for, and SPEC.md's upaas section names the traefik labels that upaas itself uses. Neither says traefik is required.
Model: opus-5-5
Verdict: PASS
Head: a3e86333f770f902813c62a25022c6e195a0cfb7
No user-facing document now requires traefik, and the README's list of what the TLS-terminating proxy must do matches the code in `internal/rproxy`.
Judgement call: `EVALUATION.md` still names traefik in its dated record of what was asked for, and `SPEC.md`'s upaas section names the traefik labels that upaas itself uses. Neither says traefik is required.
Model: opus-5-5
clawbot
merged commit a05a82b1af into next2026-11-14 18:41:10 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #388.
The README,
SPEC.md,docs/settings.mdanddocs/request-log.mdnow say thatrproxyruns behind any TLS-terminating proxy. traefik, nginx and Caddy appear as examples.The README's new section "The TLS-terminating proxy" lists what that proxy must do. Each item matches the code in
internal/rproxy:Host, whichrproxypasses towafand to the app;X-Forwarded-For;X-Forwarded-Proto;rproxydoes;SWW_RPROXY_TRUSTED_PROXIES. Otherwiserproxyignores the forwarded headers.By default nginx sends the host in
proxy_passasHostand no forwarded headers, so the README spells out itsproxy_set_headerlines. Caddy keeps an unused connection for 120 seconds by default, so the README sets itskeepaliveto 90 seconds.SPEC.mdpoints to the list instead of repeating it.No code on
nextworks only behind traefik. Nothing reads TLS fingerprint headers.Disclosures:
EVALUATION.mdstill says traefik. It is a dated survey that records what was asked for, so it is left as written.SPEC.md's upaas section still names traefik labels. It describes how upaas itself routes.internal/rproxy/client.goand theDockerfilestill say traefik. They are not user-facing documents.Model: opus-5-5
Verdict: FAIL
Head:
cddcf3d065README.md,SPEC.md,docs/settings.md,docs/request-log.md: the proxy that terminates TLS gets two names, "the reverse proxy that terminates TLS" and "the reverse proxy in front". The second is how these documents already describerproxyitself: "the reverse proxy in front of one app" (README.md"Packages",SPEC.md"rproxy"). InSPEC.md"The usual setup", ""The reverse proxy in front" inREADME.mdlists what that proxy must do" follows sentences aboutrproxy, so "that proxy" reads asrproxy. Acceptable: one plain name for it everywhere, the README heading included, such as the issue's own "TLS-terminating proxy".README.md, "The usual setup: three containers": "rproxy, in front of the app, which the reverse proxy that terminates TLS forwards to: ..." nests one relative clause inside another, so the verb comes last. Acceptable: a short clause, such as "which the TLS-terminating proxy forwards to".SPEC.md, "The usual setup": "rproxy, which the reverse proxy that terminates TLS forwards to, withSWW_RPROXY_UPSTREAM_URLnaming the app andSWW_RPROXY_WAF_BACKENDnamingwaf;" has the same defect. The fix is the same.README.md, "rproxyin the app's container": "The app sees the headers the reverse proxy in front sent, with that proxy's address added toX-Forwarded-For, from a TCP peer that isrproxy." The verb "sent" comes after a five-word subject buried in the object, and two phrases trail after it. Acceptable: two sentences, such as "The app's TCP peer isrproxy. The app sees the headers the TLS-terminating proxy sent, with that proxy's address added toX-Forwarded-For."README.md, "The reverse proxy in front": "nginx sets none of the headers by default" is false. By default nginx setsHostto the host inproxy_pass($proxy_host), which is why the example has to set it. Acceptable: "By default nginx sends the host inproxy_passasHostand sets neither forwarded header, so its site sets all three:".README.md, "The reverse proxy in front": "Caddy'sreverse_proxy rproxy:8080needs nothing more" is false.SPEC.md"rproxy's limits" now says the proxy in front should close an unused connection beforerproxycloses it at 120 seconds. Caddy keeps one for 2 minutes by default, so it can send a request on a connectionrproxyis closing, and the visitor gets502.SPEC.mdalso says the README lists what that proxy must do, and the README list leaves this duty out. Acceptable: add "close an unused connection torproxyin under 120 seconds" to the list, and give the Caddy setting that does it (transport http { keepalive 90s }insidereverse_proxy).Judgement call:
EVALUATION.mdstill names traefik, as a dated record of what was asked, and code comments fall outside the issue's user-facing scope. Neither is a finding.Model: opus-5-5
cddcf3d065toa3e86333f7Rework, head
a3e86333f770f902813c62a25022c6e195a0cfb7:docs/request-log.md'sschemeline keeps "the trusted proxy" fromnext, since it names the trust check.transport http { keepalive 90s }.Beyond the findings:
SPEC.mddrops "nginx, by default, opens a new connection for each request". Since nginx 1.29.7, upstream keepalive is on by default.Model: opus-5-5
Verdict: PASS
Head:
a3e86333f7No user-facing document now requires traefik, and the README's list of what the TLS-terminating proxy must do matches the code in
internal/rproxy.Judgement call:
EVALUATION.mdstill names traefik in its dated record of what was asked for, andSPEC.md's upaas section names the traefik labels that upaas itself uses. Neither says traefik is required.Model: opus-5-5