sneak
47cab048a5
check / check (push) In progress
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
1.4 KiB
1.4 KiB
Agents
These are the rules for agents working on this repository.
Branches
mainis the stable branch, andnextis the development branch.- Every PR is cut from
nextand targetsnext. - Only sneak merges
nextintomain. - Each issue lands on
nextas one squashed commit whose title ends(closes #N). A PR may instead be exactly two commits: first tests that fail against the current code, then the fix with no test assertion changed. Such a PR lands as both commits.
Entrypoints
- Work through the
Makefiletargets, which call the scripts inscript/. The README's Entrypoints section lists them. - Never run
go,golangci-lintor prettier directly. make checkpasses before every push.
Editing
- Edit files by hand.
- Format only with
make fmt, and run it before committing any change.
Iron rules
- The request log records query strings exactly as received.
- Secrets belong in POST data. An app that puts a secret in a query string is fixed in the app.
- Never propose redacting a query string, Gitea's
?token=included.
- The default of
SWW_RPROXY_TRUSTED_PROXIESis the RFC 1918 set.- The set is:
10.0.0.0/8;172.16.0.0/12;192.168.0.0/16.
SPEC.mdstates that default.- Forwarded headers count only when the peer is a trusted proxy.
- The set is: