sneak
91438f54da
check / check (push) Waiting to run
The old README opened with project history and one list of a hundred settings. The new one leads with what smallwebwaf is, what it protects against, how to build and deploy it, what happens to a request, the settings most deployments touch, how to check it works, the entrypoints, the rationale and the design, as REPO_POLICIES.md requires. The reference lists, every setting, the rule file format, the endpoints, the request log's fields, the alert events, the metrics, the state files, the image and the gitea notes, move to files under docs/, each linked from the README, with SPEC.md as the one place for behaviour. Every statement was checked against the code on next. Model: fable-5-1
37 lines
1.7 KiB
Markdown
37 lines
1.7 KiB
Markdown
# What the image holds
|
|
|
|
The contents of the `smallwebwaf` image, and how each part is pinned.
|
|
"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
|
|
is pinned that way.
|
|
|
|
## Contents
|
|
|
|
- Ubuntu 26.04 LTS, pinned by digest.
|
|
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
|
|
archive at `20261001T000000Z`.
|
|
- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
|
|
`nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
|
|
Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
|
|
Unpacked, nixpkgs takes about 500 MiB.
|
|
- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
|
|
at a fixed commit hash.
|
|
- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
|
|
- The service directory `/etc/service/smallwebwaf`, with the `run` script
|
|
`share/smallwebwaf.run`.
|
|
- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
|
|
with the default rule file `share/rules.d/00-default.rules`.
|
|
- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
|
|
|
|
## Pins
|
|
|
|
- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
|
|
`apt-get update` and `apt-get install`. The SHA-256 hash of each of the
|
|
snapshot's `InRelease` files is named in the `Dockerfile` and checked after
|
|
`apt-get update`. The hashes are the amd64 archive's.
|
|
- nixpkgs: the release file `nixexprs.tar.xz` of
|
|
`nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
|
|
SHA-256 hash.
|
|
- `runsvinit`: the archived repository, unchanged since 2015, at tag `v2.0.0`,
|
|
by commit hash, with a `go.mod` the build writes.
|
|
- The Go image that builds `smallwebwaf`: by digest.
|