sneak
4a030557f3
check / check (push) Failing after 2m47s
The program is now sww, built from cmd/sww, with two modes: sww rproxy and sww discriminator. servewaf becomes discriminator everywhere it names that daemon: the package (internal/discriminator), its types, functions, files, the discriminator_line log field, and its docs and tests. smallwebwaf is left only where sneak's directive allows it: the documents' product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers, the /_sww/ admin endpoints, the OS user, and the state and rules directories. The SWWAF_ environment variables take the SWW_ form. No logic changes. make check passes. Model: deepseek-v4-pro
53 lines
1.9 KiB
AMPL
Executable File
53 lines
1.9 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for sww, run again whenever sww
|
|
# exits; the wait spaces out the restarts. SWW_COMMAND names the
|
|
# command to run: rproxy when it is unset or empty, or discriminator. With any
|
|
# other value the script starts nothing and stops with a message naming it.
|
|
# exec, so that the signal `sv stop` sends reaches sww itself.
|
|
main() {
|
|
sleep 1
|
|
local command="${SWW_COMMAND:-rproxy}"
|
|
case "$command" in
|
|
rproxy) ;;
|
|
discriminator) give_state_dir_to_sww ;;
|
|
*)
|
|
printf 'SWW_COMMAND: "%s" is not rproxy or discriminator\n' \
|
|
"$command" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
exec chpst -u sww:sww /usr/local/bin/sww "$command"
|
|
}
|
|
|
|
# give_state_dir_to_sww gives the state directory and every file in
|
|
# it to the sww user, so that a volume mounted there needs no change
|
|
# of owner; chown -R changes a symbolic link itself, never what it points
|
|
# to. When SWW_STATE_DIR, in either form, cannot be read or is not the
|
|
# absolute path of a directory, no owner is changed, and discriminator starts and
|
|
# stops with a message naming the setting. A change of owner that fails, as
|
|
# on a volume mounted read-only, does not end the script either: discriminator
|
|
# reports a directory it cannot write.
|
|
give_state_dir_to_sww() {
|
|
local dir
|
|
if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
|
|
chown -R sww:sww "$dir" || true
|
|
fi
|
|
}
|
|
|
|
# state_dir prints SWW_STATE_DIR, /var/lib/sww when it is unset,
|
|
# or what is in the file SWW_STATE_DIR_FILE names, less every newline at
|
|
# its end. It fails when both are set or the file cannot be read.
|
|
state_dir() {
|
|
if [[ ! -v SWW_STATE_DIR_FILE ]]; then
|
|
printf '%s\n' "${SWW_STATE_DIR-/var/lib/sww}"
|
|
elif [[ ! -v SWW_STATE_DIR ]]; then
|
|
cat -- "$SWW_STATE_DIR_FILE" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|