sneak/smallwebwaf
1
0 Fork 0
Code Issues 20 Pull Requests 4 Actions Packages Projects Releases Wiki Activity
Files
42643be662251f78f95a01faed2fe16d934c9a0f
smallwebwaf/docs/image.md
T
sneak 42643be662
check / check (push) Successful in 3m13s
Details
Rename the program to sww and its deciding daemon to discriminator 
The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro
2026-11-07 04:47:34 +00:00

1.6 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or discriminator with SWW_COMMAND=discriminator. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu's archive.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The sww binary, and the user sww (uid and gid 65532).
  • The service directory /etc/service/sww, with the run script share/sww.run.
  • /var/lib/sww for discriminator's state files, and /etc/sww/rules.d with the default rule file share/rules.d/00-default.rules.
  • EXPOSE 8080, and the HEALTHCHECK that runs sww healthcheck.

Pins

  • Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds sww: by digest.
Reference in new issue View Git Blame Copy Permalink