clawbot
4b0af7f85b
check / check (push) Successful in 17m6s
`smallwebwaf` with no command now prints the commands and exits with status 2. The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The passing-on code, its settings and its log fields and metric go. internal/proxy keeps the checks, answers, reports and own endpoints; its tests run through the real rproxy. The documents describe the pair. Judgement call: clients.json keeps token_refused, since state files refuse unknown fields. Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests. Model: opus-5-5
46 lines
1.7 KiB
AMPL
Executable File
46 lines
1.7 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for smallwebwaf, run again whenever smallwebwaf
|
|
# exits; the wait spaces out the restarts. SMALLWEBWAF_COMMAND names the
|
|
# command to run: rproxy when it is unset, or servewaf. exec, so that the
|
|
# signal `sv stop` sends reaches smallwebwaf itself.
|
|
main() {
|
|
sleep 1
|
|
local command="${SMALLWEBWAF_COMMAND:-rproxy}"
|
|
if [[ "$command" == servewaf ]]; then
|
|
give_state_dir_to_smallwebwaf
|
|
fi
|
|
exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf "$command"
|
|
}
|
|
|
|
# give_state_dir_to_smallwebwaf gives the state directory and every file in
|
|
# it to the smallwebwaf user, so that a volume mounted there needs no change
|
|
# of owner; chown -R changes a symbolic link itself, never what it points
|
|
# to. When SWWAF_STATE_DIR, in either form, cannot be read or is not the
|
|
# absolute path of a directory, no owner is changed, and servewaf starts and
|
|
# stops with a message naming the setting. A change of owner that fails, as
|
|
# on a volume mounted read-only, does not end the script either: servewaf
|
|
# reports a directory it cannot write.
|
|
give_state_dir_to_smallwebwaf() {
|
|
local dir
|
|
if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
|
|
chown -R smallwebwaf:smallwebwaf "$dir" || true
|
|
fi
|
|
}
|
|
|
|
# state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,
|
|
# or what is in the file SWWAF_STATE_DIR_FILE names, less every newline at
|
|
# its end. It fails when both are set or the file cannot be read.
|
|
state_dir() {
|
|
if [[ ! -v SWWAF_STATE_DIR_FILE ]]; then
|
|
printf '%s\n' "${SWWAF_STATE_DIR-/var/lib/smallwebwaf}"
|
|
elif [[ ! -v SWWAF_STATE_DIR ]]; then
|
|
cat -- "$SWWAF_STATE_DIR_FILE" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|