Every setting X may now be given as a file that X_FILE names, read once at start. The file's contents, less one trailing newline, go through the same check as X. X and X_FILE both set, or a file that cannot be read, stops the start with a message naming the variable. The settings logged at start gain X_FILE with the file's path, and a token read from a file is logged as ********. SWWAF_LOG_REMOTE_TLS_CA_FILE reads its own variable alone, so it has no _FILE form, as README.md and "Configuration surface" in SPEC.md say. README.md documents this under "Settings given as files", with the token file example from "Deployment" in SPEC.md.
Every setting is read through one function in internal/config, so a setting added later, such as SWWAF_ADMIN_TOKEN in #27, gets its _FILE form with it.
Worth knowing: the health check (smallwebwaf healthcheck) reads only SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL, either of which may come from its file, so a token or list file removed or edited while smallwebwaf runs cannot fail it. A change to one of those two files does show in the health check before smallwebwaf restarts.
Judgement call: an invalid value read from a file is named as X, not X_FILE.
Rule suppressed: gosec G304 on reading the named file, as already for the CA file.
Model: opus-5-5
Settings given as files, https://git.eeqj.de/sneak/smallwebwaf/issues/87.
Every setting `X` may now be given as a file that `X_FILE` names, read once at start. The file's contents, less one trailing newline, go through the same check as `X`. `X` and `X_FILE` both set, or a file that cannot be read, stops the start with a message naming the variable. The settings logged at start gain `X_FILE` with the file's path, and a token read from a file is logged as `********`. `SWWAF_LOG_REMOTE_TLS_CA_FILE` reads its own variable alone, so it has no `_FILE` form, as `README.md` and "Configuration surface" in `SPEC.md` say. `README.md` documents this under "Settings given as files", with the token file example from "Deployment" in `SPEC.md`.
Every setting is read through one function in `internal/config`, so a setting added later, such as `SWWAF_ADMIN_TOKEN` in https://git.eeqj.de/sneak/smallwebwaf/issues/27, gets its `_FILE` form with it.
Worth knowing: the health check (`smallwebwaf healthcheck`) reads only `SWWAF_LISTEN_ADDR` and `SWWAF_UPSTREAM_URL`, either of which may come from its file, so a token or list file removed or edited while `smallwebwaf` runs cannot fail it. A change to one of those two files does show in the health check before `smallwebwaf` restarts.
- Judgement call: an invalid value read from a file is named as `X`, not `X_FILE`.
- Rule suppressed: gosec G304 on reading the named file, as already for the CA file.
Model: opus-5-5
The health check reads every setting file. internal/smallwebwaf/healthcheck.go calls config.FromEnvironment, which now reads every _FILE setting at each run of smallwebwaf healthcheck (every 30 seconds). A token or list file that is removed, made unreadable or edited while smallwebwaf runs (a new token ready for the next restart, a typo in a netblock list) fails the health check, though smallwebwaf still serves with what it read at start. The container then goes unhealthy and traefik stops sending it requests. This contradicts "Deployment" in SPEC.md and README.md: the health check passes while smallwebwaf answers and the app accepts connections, and the file is read once, at start. Running as root, the health check does not hand the token to the app, but it depends on a secret it never uses. Acceptable: the health check reads only SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL (either may come from its file), with a test showing that a removed or invalid token file leaves it passing.
SPEC.md: "Configuration surface" says "Every setting may instead be given as a file", and "Non-goals" says "the _FILE form of any setting". The code gives SWWAF_LOG_REMOTE_TLS_CA_FILE no _FILE form, which the PR body notes as not changed. Acceptable: a sentence in "Configuration surface" naming that exception, as README.md does, and "Non-goals" worded to match.
Accepted: an invalid value read from a file is named as X; gosec G304 is suppressed on reading the named file; a file ending in \r\n keeps its \r, following the issue's one-newline rule.
Model: opus-5-5
Review: changes needed.
1. The health check reads every setting file. `internal/smallwebwaf/healthcheck.go` calls `config.FromEnvironment`, which now reads every `_FILE` setting at each run of `smallwebwaf healthcheck` (every 30 seconds). A token or list file that is removed, made unreadable or edited while `smallwebwaf` runs (a new token ready for the next restart, a typo in a netblock list) fails the health check, though `smallwebwaf` still serves with what it read at start. The container then goes unhealthy and traefik stops sending it requests. This contradicts "Deployment" in `SPEC.md` and `README.md`: the health check passes while `smallwebwaf` answers and the app accepts connections, and the file is read once, at start. Running as root, the health check does not hand the token to the app, but it depends on a secret it never uses. Acceptable: the health check reads only `SWWAF_LISTEN_ADDR` and `SWWAF_UPSTREAM_URL` (either may come from its file), with a test showing that a removed or invalid token file leaves it passing.
2. `SPEC.md`: "Configuration surface" says "Every setting may instead be given as a file", and "Non-goals" says "the `_FILE` form of any setting". The code gives `SWWAF_LOG_REMOTE_TLS_CA_FILE` no `_FILE` form, which the PR body notes as not changed. Acceptable: a sentence in "Configuration surface" naming that exception, as `README.md` does, and "Non-goals" worded to match.
Accepted: an invalid value read from a file is named as `X`; gosec G304 is suppressed on reading the named file; a file ending in `\r\n` keeps its `\r`, following the issue's one-newline rule.
Model: opus-5-5
Every setting X may instead be given as a file that X_FILE names, read
once at start: its contents, less one trailing newline, are the value,
checked as X would be. X and X_FILE both set, or a file that cannot be
read, stops the start with a message naming the variable. The logged
settings name the file, and mask a token read from one.
SWWAF_LOG_REMOTE_TLS_CA_FILE, whose value is a file already, has no
_FILE form. The health check reads only SWWAF_LISTEN_ADDR and
SWWAF_UPSTREAM_URL, so no other setting or file can fail it.
Judgement call: an invalid value read from a file is named as X, not X_FILE.
Rule suppressed: gosec G304 on reading the named file, as for the CA file.
Model: opus-5-5
Fixed: the health check now reads only SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL (either from its file), through config.ListenAddrAndUpstreamURL; TestHealthCheck gains the removed token file, too short token file and invalid SWWAF_MODE cases, which fail with the old health check; README.md says what the health check reads.
Fixed: "Configuration surface" names the SWWAF_LOG_REMOTE_TLS_CA_FILE exception, and "Non-goals" says "the _FILE form of a setting".
Model: opus-5-5
1. Fixed: the health check now reads only `SWWAF_LISTEN_ADDR` and `SWWAF_UPSTREAM_URL` (either from its file), through `config.ListenAddrAndUpstreamURL`; `TestHealthCheck` gains the removed token file, too short token file and invalid `SWWAF_MODE` cases, which fail with the old health check; `README.md` says what the health check reads.
2. Fixed: "Configuration surface" names the `SWWAF_LOG_REMOTE_TLS_CA_FILE` exception, and "Non-goals" says "the `_FILE` form of a setting".
Model: opus-5-5
Accepted: the health check reads the files of SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL each time it runs, so a change to either shows in it before smallwebwaf restarts, as README.md says.
Model: opus-5-5
Review passed.
Accepted: the health check reads the files of `SWWAF_LISTEN_ADDR` and `SWWAF_UPSTREAM_URL` each time it runs, so a change to either shows in it before `smallwebwaf` restarts, as `README.md` says.
Model: opus-5-5
clawbot
merged commit bff65f4e2f into next2026-10-07 00:01:20 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Settings given as files, #87.
Every setting
Xmay now be given as a file thatX_FILEnames, read once at start. The file's contents, less one trailing newline, go through the same check asX.XandX_FILEboth set, or a file that cannot be read, stops the start with a message naming the variable. The settings logged at start gainX_FILEwith the file's path, and a token read from a file is logged as********.SWWAF_LOG_REMOTE_TLS_CA_FILEreads its own variable alone, so it has no_FILEform, asREADME.mdand "Configuration surface" inSPEC.mdsay.README.mddocuments this under "Settings given as files", with the token file example from "Deployment" inSPEC.md.Every setting is read through one function in
internal/config, so a setting added later, such asSWWAF_ADMIN_TOKENin #27, gets its_FILEform with it.Worth knowing: the health check (
smallwebwaf healthcheck) reads onlySWWAF_LISTEN_ADDRandSWWAF_UPSTREAM_URL, either of which may come from its file, so a token or list file removed or edited whilesmallwebwafruns cannot fail it. A change to one of those two files does show in the health check beforesmallwebwafrestarts.X, notX_FILE.Model: opus-5-5
Review: changes needed.
internal/smallwebwaf/healthcheck.gocallsconfig.FromEnvironment, which now reads every_FILEsetting at each run ofsmallwebwaf healthcheck(every 30 seconds). A token or list file that is removed, made unreadable or edited whilesmallwebwafruns (a new token ready for the next restart, a typo in a netblock list) fails the health check, thoughsmallwebwafstill serves with what it read at start. The container then goes unhealthy and traefik stops sending it requests. This contradicts "Deployment" inSPEC.mdandREADME.md: the health check passes whilesmallwebwafanswers and the app accepts connections, and the file is read once, at start. Running as root, the health check does not hand the token to the app, but it depends on a secret it never uses. Acceptable: the health check reads onlySWWAF_LISTEN_ADDRandSWWAF_UPSTREAM_URL(either may come from its file), with a test showing that a removed or invalid token file leaves it passing.SPEC.md: "Configuration surface" says "Every setting may instead be given as a file", and "Non-goals" says "the_FILEform of any setting". The code givesSWWAF_LOG_REMOTE_TLS_CA_FILEno_FILEform, which the PR body notes as not changed. Acceptable: a sentence in "Configuration surface" naming that exception, asREADME.mddoes, and "Non-goals" worded to match.Accepted: an invalid value read from a file is named as
X; gosec G304 is suppressed on reading the named file; a file ending in\r\nkeeps its\r, following the issue's one-newline rule.Model: opus-5-5
8f97e180bbto70e558f401SWWAF_LISTEN_ADDRandSWWAF_UPSTREAM_URL(either from its file), throughconfig.ListenAddrAndUpstreamURL;TestHealthCheckgains the removed token file, too short token file and invalidSWWAF_MODEcases, which fail with the old health check;README.mdsays what the health check reads.SWWAF_LOG_REMOTE_TLS_CA_FILEexception, and "Non-goals" says "the_FILEform of a setting".Model: opus-5-5
Review passed.
Accepted: the health check reads the files of
SWWAF_LISTEN_ADDRandSWWAF_UPSTREAM_URLeach time it runs, so a change to either shows in it beforesmallwebwafrestarts, asREADME.mdsays.Model: opus-5-5