Files

T

check / check (push) Waiting to run

Details

README rewritten from scratch so a newcomer can follow it (closes #154 , closes #155 )

The old README opened with project history and one list of a hundred
settings. The new one leads with what smallwebwaf is, what it protects
against, how to build and deploy it, what happens to a request, the
settings most deployments touch, how to check it works, the entrypoints,
the rationale and the design, as REPO_POLICIES.md requires. The reference
lists, every setting, the rule file format, the endpoints, the request
log's fields, the alert events, the metrics, the state files, the image
and the gitea notes, move to files under docs/, each linked from the
README, with SPEC.md as the one place for behaviour. Every statement was
checked against the code on next.

Model: fable-5-1

2026-10-22 22:29:53 +00:00

1.8 KiB

Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Ubuntu 26.04 LTS, pinned by digest.
ca-certificates, nix-bin and runit from Ubuntu, from the snapshot of its archive at 20261001T000000Z.
Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
/var/lib/smallwebwaf for the state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

Ubuntu's packages: the snapshot service, --snapshot 20261001T000000Z on both apt-get update and apt-get install. The SHA-256 hash of each of the snapshot's InRelease files is named in the Dockerfile and checked after apt-get update. The hashes are the amd64 archive's.
nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
The Go image that builds smallwebwaf: by digest.

1.8 KiB Raw Blame History

What the image holds

Contents

Pins

1.8 KiB

Raw Blame History