Files

T

check / check (push) Waiting to run

Details

SPEC: the one place for behaviour and reasons; docs/ as lookup lists only

docs/core-rule-set.md, docs/lookup.md, docs/reputation.md and docs/bans.md
restated the spec and are folded back into it and removed. The remaining
docs files hold only lists: settings with their defaults and value forms,
the request log's fields, the metrics, the endpoints, the state files and
their contents, the rule file format and default file, the alert events
and messages, the image's contents and pins, and the gitea notes. Every
behaviour each of them held moves to the spec, said once. The settings
groups have the same names in both files. Stale comments in
internal/state and script/example-app point at the right places.

Model: fable-5-1

2026-10-22 21:51:39 +00:00

1.7 KiB

Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Ubuntu 26.04 LTS, pinned by digest.
ca-certificates, nix-bin and runit from Ubuntu, from the snapshot of its archive at 20261001T000000Z.
Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
/var/lib/smallwebwaf for the state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

Ubuntu's packages: the snapshot service, --snapshot 20261001T000000Z on both apt-get update and apt-get install. The SHA-256 hash of each of the snapshot's InRelease files is named in the Dockerfile and checked after apt-get update. The hashes are the amd64 archive's.
nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
runsvinit: the archived repository, unchanged since 2015, at tag v2.0.0, by commit hash, with a go.mod the build writes.
The Go image that builds smallwebwaf: by digest.

1.7 KiB Raw Blame History

What the image holds

Contents

Pins

1.7 KiB

Raw Blame History