Make GeoIP cache and iptables timeout configurable

[dchaudhari7177]

Closes #25

All three knobs are configurable, by flag and by config file, with flags winning. Defaults are unchanged — the goal is configurability, and a test pins each default so that stays true.

One correction to the issue

All three are already var (not const), so they are reassignable — the fix is just exposing setters.

iptablesTimeout is a var. geoCacheTTL and geoCacheMaxSize are const (pkg/enrich/geoip.go:18-20), so setters alone would not have compiled. They are now var, which is safe: every use is a comparison (geoip.go:436, :446, :449, :466) — no array size, no other const expression.

What was added

enrich.SetGeoCacheTTL(d)      // 0 disables caching; negative ignored
enrich.SetGeoCacheMaxSize(n)  // 0 disables caching; negative ignored
guard.SetIPTablesTimeout(d)   // must be positive; non-positive ignored

Plus GeoCacheTTL(), GeoCacheMaxSize() and IPTablesTimeout() readers, so a caller can show what is in effect rather than re-deriving the default — and so the tests assert through the public surface.

Each setter's doc comment says call once at startup, and why: the values are read without synchronisation, so changing them mid-run is a data race.

Flags and precedence

flag	scope	default
--geo-cache-ttl	persistent (root + all subcommands)	24h
--geo-cache-size	persistent	50000
--iptables-timeout	guard only	10s

Resolution lives in applyTuning, called from a PersistentPreRunE on rootCmd so it runs once before any command. Precedence is flag > config file > default, implemented by writing the config layer first and the flag layer second — neither layer needs to know about the other.

"Was the flag set?" is asked of cobra via f.Changed(...), not inferred by comparing against the default. Passing --geo-cache-ttl 24h explicitly is a deliberate choice and should count as one.

Validation, and one place I diverged

The setters ignore out-of-range values (defensive, for a library caller). The CLI rejects them:

$ caddy-analyze --geo-cache-ttl=-1s access.log
Error: --geo-cache-ttl must not be negative

$ caddy-analyze guard --iptables-timeout=0
Error: --iptables-timeout must be positive

Silently ignoring a bad flag would hide a typo that looks like it took effect — the opposite of the "hard to diagnose" failures this issue is about. A malformed value in the config file is rejected the same way, naming the key.

Verified through the built binary

$ caddy-analyze --help | grep geo-cache
      --geo-cache-size int       Max cached GeoIP lookups. 0 disables caching (default 50000)
      --geo-cache-ttl duration   How long a GeoIP lookup stays cached. 0 disables caching, which is much slower on busy traffic (default 24h0m0s)

$ caddy-analyze guard --help | grep iptables-timeout
      --iptables-timeout duration   Timeout for each iptables invocation. Raise it for a huge ruleset on a busy box (default 10s)

$ caddy-analyze --geo-cache-ttl=1h --geo-cache-size=100 testdata/sample.log
CADDY LOG ANALYSIS REPORT

The --help text carries the "0 disables caching, which is much slower" warning the issue asks for.

Tests — 14

Per setter (valid values, the disabling zero, the ignored negative), plus applyTuning: config-only, flags beating config, nothing-set leaving every default untouched, and seven rejection cases across both layers.

Docs

docs/subcommands.html gains all three flags with defaults and the config-key mapping; tools/minify.sh regenerated search-index.json as AGENTS.md requires. I reverted the seven unrelated HTML files it also touched — those diffs were only a doc:modified timestamp shifted by my machine's timezone, and they would have buried the real change.

Verification

go build ./... ; go vet ./...   # clean
go test ./...                    # all packages ok
gofmt -l (every touched file)    # no output