sneak
b1a8267165
check / check (push) Successful in 5m51s
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
1.4 KiB
1.4 KiB
Agents
These are the rules for agents working on this repository.
Branches
mainis the stable branch, andnextis the development branch.- Every PR is cut from
nextand targetsnext. - Only sneak merges
nextintomain. - Each issue lands on
nextas one squashed commit whose title ends(closes #N). A PR may instead be exactly two commits: first tests that fail against the current code, then the fix with no test assertion changed. Such a PR lands as both commits.
Entrypoints
- Work through the
Makefiletargets, which call the scripts inscript/. The README's Entrypoints section lists them. - Never run
go,golangci-lintor prettier directly. make checkpasses before every push.
Editing
- Edit files by hand.
- Format only with
make fmt, and run it before committing any change.
Iron rules
- The request log records query strings exactly as received.
- Secrets belong in POST data. An app that puts a secret in a query string is fixed in the app.
- Never propose redacting a query string, Gitea's
?token=included.
- The default of
SWW_RPROXY_TRUSTED_PROXIESis the RFC 1918 set.- The set is:
10.0.0.0/8;172.16.0.0/12;192.168.0.0/16.
SPEC.mdstates that default.- Forwarded headers count only when the peer is a trusted proxy.
- The set is: