sneak
4ea0a975c8
check / check (push) Waiting to run
docs/core-rule-set.md, docs/lookup.md, docs/reputation.md and docs/bans.md restated the spec and are folded back into it and removed. The remaining docs files hold only lists: settings with their defaults and value forms, the request log's fields, the metrics, the endpoints, the state files and their contents, the rule file format and default file, the alert events and messages, the image's contents and pins, and the gitea notes. Every behaviour each of them held moves to the spec, said once. The settings groups have the same names in both files. Stale comments in internal/state and script/example-app point at the right places. Model: fable-5-1
37 lines
1.7 KiB
Markdown
37 lines
1.7 KiB
Markdown
# What the image holds
|
|
|
|
The contents of the `smallwebwaf` image, and how each part is pinned.
|
|
"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
|
|
is pinned that way.
|
|
|
|
## Contents
|
|
|
|
- Ubuntu 26.04 LTS, pinned by digest.
|
|
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
|
|
archive at `20261001T000000Z`.
|
|
- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
|
|
`nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
|
|
Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
|
|
Unpacked, nixpkgs takes about 500 MiB.
|
|
- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
|
|
at a fixed commit hash.
|
|
- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
|
|
- The service directory `/etc/service/smallwebwaf`, with the `run` script
|
|
`share/smallwebwaf.run`.
|
|
- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
|
|
with the default rule file `share/rules.d/00-default.rules`.
|
|
- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
|
|
|
|
## Pins
|
|
|
|
- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
|
|
`apt-get update` and `apt-get install`. The SHA-256 hash of each of the
|
|
snapshot's `InRelease` files is named in the `Dockerfile` and checked after
|
|
`apt-get update`. The hashes are the amd64 archive's.
|
|
- nixpkgs: the release file `nixexprs.tar.xz` of
|
|
`nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
|
|
SHA-256 hash.
|
|
- `runsvinit`: the archived repository, unchanged since 2015, at tag `v2.0.0`,
|
|
by commit hash, with a `go.mod` the build writes.
|
|
- The Go image that builds `smallwebwaf`: by digest.
|