sneak
c6ab946c86
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# What the image holds
|
|
|
|
The contents of the `smallwebwaf` image, and how each part is pinned. The image
|
|
runs `rproxy` by default, or `waf` with `SWW_COMMAND=waf`. "Deployment" in
|
|
[`SPEC.md`](../SPEC.md) says why each part is there and why it is pinned that
|
|
way.
|
|
|
|
## Contents
|
|
|
|
- Ubuntu 26.04 LTS, pinned by digest.
|
|
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's archive.
|
|
- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
|
|
`nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
|
|
Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
|
|
Unpacked, nixpkgs takes about 500 MiB.
|
|
- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
|
|
at a fixed commit hash.
|
|
- The `sww` binary, and the user `sww` (uid and gid 65532).
|
|
- The service directory `/etc/service/sww`, with the `run` script
|
|
`share/sww.run`.
|
|
- `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
|
|
default rule file `share/rules.d/00-default.rules`. The `run` script makes
|
|
`SWW_WAF_STATE_DIR` when it is missing.
|
|
- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
|
|
|
|
## Pins
|
|
|
|
- Ubuntu's packages are not pinned: they come from the live archive, whose
|
|
packages change with every update.
|
|
- nixpkgs: the release file `nixexprs.tar.xz` of
|
|
`nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
|
|
SHA-256 hash.
|
|
- `runsvinit`: the archived repository, unchanged since 2015, at its last commit
|
|
(`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
|
|
build writes.
|
|
- The Go image that builds `sww`: by digest.
|