0 Fork 0

Files

T

check / check (push) Waiting to run

Details

Read every setting through viper and rename the settings (closes #211 )

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

2026-11-11 06:37:26 +00:00

1.5 KiB

Raw Blame History

Agents

These are the rules for agents working on this repository.

Branches

main is the stable branch, and next is the development branch.
Every PR is cut from next and targets next.
Only sneak merges next into main.
Each issue lands on next as one squashed commit whose title ends (closes #N). A PR may instead be exactly two commits: first tests that fail against the current code, then the fix with no test assertion changed. Such a PR lands as both commits.

Entrypoints

Work through the Makefile targets, which call the scripts in script/. The README's Entrypoints section lists them.
Never run go, golangci-lint or prettier directly.
make check passes before every push.

Editing

Edit files by hand.
Format only with make fmt, and run it before committing any change.

Iron rules

The request log records query strings exactly as received.
- Secrets belong in POST data. An app that puts a secret in a query string is fixed in the app.
- Never propose redacting a query string, Gitea's ?token= included.
The default of SWW_RPROXY_TRUSTED_PROXIES is the RFC 1918 set.
- The set is:
  - 10.0.0.0/8;
  - 172.16.0.0/12;
  - 192.168.0.0/16.
- SPEC.md states that default.
- Forwarded headers count only when the peer is a trusted proxy.
Every time is in UTC, whatever TZ or the host's time zone says.
- Every day is a date written YYYY-MM-DD, never a time.
- SPEC.md states this near its start.

1.5 KiB Raw Blame History

Agents

Branches

Entrypoints

Editing

Iron rules

1.5 KiB

Raw Blame History