sneak e44ba7ee5e SPEC rework after review: each requirement once, gitea notes to docs/ ...

Every requirement is stated once, where it belongs, and linked from
elsewhere. The notes on gitea move to docs/gitea.md, which
script/gitea-requests points at. The list of settings that take off
is exact, the non-goal that contradicted the planned item is gone,
and the sentences the review named are split or reordered. The
package comments in internal/waf and internal/anomaly point at the
renamed sections.

Model: fable-5-1

2026-10-22 19:43:03 +00:00

..

alerts

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

anomaly

SPEC rework after review: each requirement once, gitea notes to docs/

2026-10-22 19:43:03 +00:00

bans

A ban's earlier_bans counts a ban dropped after an admin's ban (closes #128)

2026-10-20 12:59:52 +02:00

config

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00

lookup

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

metrics

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

proxy

An answer from the app without a Content-Type reaches the client without one (closes #127)

2026-10-20 16:41:18 +02:00

ratelimit

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

remotelog

Send every log line to a syslog server as well (closes #28)

2026-10-06 22:02:36 +02:00

reputation

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

requestlog

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 09:37:13 +02:00

rules

Path rules and trap paths match the path decoded once too (closes #85)

2026-10-14 18:20:31 +02:00

smallwebwaf

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

state

A ban in bans.json that ends at or before its start is refused, as other malformed entries are (closes #150)

2026-10-20 17:42:01 +02:00

waf

SPEC rework after review: each requirement once, gitea notes to docs/

2026-10-22 19:43:03 +00:00