sneak
68da92f414
check / check (push) Failing after 3m27s
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Every place a name appeared changed: the code, the viper keys, tests, documents, examples, the README's settings table and the image files. Model: deepseek-v4-pro
53 lines
1.9 KiB
AMPL
Executable File
53 lines
1.9 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for sww, run again whenever sww
|
|
# exits; the wait spaces out the restarts. SWW_COMMAND names the
|
|
# command to run: rproxy when it is unset or empty, or discriminator. With any
|
|
# other value the script starts nothing and stops with a message naming it.
|
|
# exec, so that the signal `sv stop` sends reaches sww itself.
|
|
main() {
|
|
sleep 1
|
|
local command="${SWW_COMMAND:-rproxy}"
|
|
case "$command" in
|
|
rproxy) ;;
|
|
discriminator) give_state_dir_to_sww ;;
|
|
*)
|
|
printf 'SWW_COMMAND: "%s" is not rproxy or discriminator\n' \
|
|
"$command" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
exec chpst -u sww:sww /usr/local/bin/sww "$command"
|
|
}
|
|
|
|
# give_state_dir_to_sww gives the state directory and every file in
|
|
# it to the sww user, so that a volume mounted there needs no change
|
|
# of owner; chown -R changes a symbolic link itself, never what it points
|
|
# to. When SWW_WAF_STATE_DIR, in either form, cannot be read or is not the
|
|
# absolute path of a directory, no owner is changed, and discriminator starts and
|
|
# stops with a message naming the setting. A change of owner that fails, as
|
|
# on a volume mounted read-only, does not end the script either: discriminator
|
|
# reports a directory it cannot write.
|
|
give_state_dir_to_sww() {
|
|
local dir
|
|
if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
|
|
chown -R sww:sww "$dir" || true
|
|
fi
|
|
}
|
|
|
|
# state_dir prints SWW_WAF_STATE_DIR, /var/lib/sww when it is unset,
|
|
# or what is in the file SWW_WAF_STATE_DIR_FILE names, less every newline at
|
|
# its end. It fails when both are set or the file cannot be read.
|
|
state_dir() {
|
|
if [[ ! -v SWW_WAF_STATE_DIR_FILE ]]; then
|
|
printf '%s\n' "${SWW_WAF_STATE_DIR-/var/lib/sww}"
|
|
elif [[ ! -v SWW_WAF_STATE_DIR ]]; then
|
|
cat -- "$SWW_WAF_STATE_DIR_FILE" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|