Commit Graph

Select branches

Hide Pull Requests

feat/coraza-txn-id-equals-request-reference

feat/default-splash

fix/config-backup-ordering

fix/cve-2026-109618-multipart-edge

fix/remove-domain-shared-cert-refcount

main

#1

#11

#12

#13

#14

#15

#2

#3

#4

#5

#6

#7

#8

#9

Mono Color

• 50c58c4e9e Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15) main jknapp 2026-11-08 20:03:23 +00:00
• 0075b2e0de feat(edge): unrouted hosts 404+noindex everywhere; access log moves into the container (2026.11.2) feat/default-splash shadowdaoandClaude Sonnet 5.5 2026-11-08 08:05:58 -08:00
• 8787e0d99e feat(edge): static default splash for unrouted hosts, answered before the WAF (2026.11.1) shadowdaoandClaude Sonnet 5.5 2026-11-08 06:55:42 -08:00
• 1ee5760c1b Merge pull request 'ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7)' (#14) from ci/pkg-cache into main jknapp 2026-10-22 14:20:16 +00:00
• dc1cbeb12a ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7) shadowdaoandClaude Opus 5.5 2026-10-22 07:19:54 -07:00
• 4345732dad Merge pull request 'fix(edge): CVE-2026-109618/-109619 multipart mitigations (2026.10.6)' (#13) from fix/cve-2026-109618-multipart-edge into main jknapp 2026-10-21 14:38:27 +00:00
• 729098a8f9 fix(edge): CVE-2026-109618/-109619 multipart mitigations (2026.10.6) fix/cve-2026-109618-multipart-edge shadowdaoandClaude Opus 5.5 2026-10-21 07:27:42 -07:00
• b6cc3adfaa Merge pull request 'fix(waf): HTTP/3 bodies were stamped complete when truncated (2026.10.5)' (#12) from fix/waf-h3-body-stamp into main jknapp 2026-10-19 21:22:13 +00:00
• 77812399d4 chore: VERSION 2026.10.5 shadowdaoandClaude Opus 5.5 2026-10-19 08:59:45 -07:00
• 2cc6790db1 fix(waf): stamp X-WHP-WAF-Body from the Content-Length header, not req.body_size shadowdaoandClaude Opus 5.5 2026-10-19 08:59:29 -07:00
• cbbd15b787 feat(waf): log why Coraza acted (wrule/wrules/wscore); VERSION 2026.10.4 feat/coraza-txn-id-equals-request-reference shadowdaoandClaude Opus 5.5 2026-10-16 08:20:46 -07:00
• 519f2d8ade feat(waf): Coraza transaction ID = HAProxy request reference UUID shadowdaoandClaude Opus 5.5 2026-10-16 08:03:53 -07:00
• 7ae8a4780c test(api): starvation test asserts no-starvation; latency bounds only under HAPROXY_MGR_STRICT_TIMING shadowdaoandClaude Opus 5.5 2026-10-09 15:40:22 -07:00
• 765b2ce00a Merge fix/ssl-renewal-durable into release/2026.10.3 shadowdaoandClaude Opus 5.5 2026-10-09 15:22:52 -07:00
• 3712860429 Merge feat/waf-body-hardening into release/2026.10.3 shadowdaoandClaude Opus 5.5 2026-10-09 15:22:46 -07:00
• 17c9a8faf8 test(ssl): certbot re-issue test skips on ANY certbot import/init failure shadowdaoandClaude Opus 5.5 2026-10-09 14:26:19 -07:00
• 957fba29d9 fix(api): refuse non-local peers on :8000; count header deadline from enqueue shadowdaoandClaude Opus 5.5 2026-10-09 14:25:32 -07:00
• 2da2020305 fix(waf): stop promoting 944110/944120 chain starters (round 3) shadowdaoandClaude Opus 5.5 2026-10-09 14:10:41 -07:00
• 234029c249 fix(waf): promote 920440 chain-safely, not on its chain starter (round 2) shadowdaoandClaude Opus 5.5 2026-10-09 14:00:22 -07:00
• 8c7fd93387 fix(ssl): review round 1 - exact --cert-name lineage, retire whole lineage tree, sweep expired pems shadowdaoandClaude Opus 5.5 2026-10-09 14:00:03 -07:00
• fd06b30d78 fix(api): reap never-readable conns, bound total header time, harden watchdog shadowdaoandClaude Opus 5.5 2026-10-09 13:58:28 -07:00
• cc0652e0c0 fix(waf): 400 duplicate Content-Type; JSON depth limit 64 (round 1) shadowdaoandClaude Opus 5.5 2026-10-09 11:21:49 -07:00
• e58996d6c9 fix(ssl): retire SAN-overlapping certs, never publish expired lineages, report no-op renewals shadowdaoandClaude Opus 5.5 2026-10-09 11:05:07 -07:00
• 4f21bb2f76 feat(waf): make Coraza see request bodies; stamp complete/partial; 2026.10.2 shadowdaoandClaude Opus 5.5 2026-10-09 10:49:27 -07:00
• 0ce144d2fb fix(api): stop silent clients from wedging the gunicorn thread pool shadowdaoandClaude Opus 5.5 2026-10-09 10:13:12 -07:00
• e134b2b234 Merge pull request 'fix(haproxy): set X-CLIENT-IP instead of adding it' (#11) from fix/x-client-ip-set-not-add into main jknapp 2026-09-18 23:33:05 +00:00
• cc2cfd82a2 chore: bump VERSION to 2026.09.1 shadowdaoandClaude Sonnet 5 2026-09-18 16:26:52 -07:00
• ab3ad42625 fix(haproxy): set X-CLIENT-IP instead of adding it shadowdaoandClaude Sonnet 5 2026-09-18 16:19:23 -07:00
• 43e522104b Merge pull request 'fix(domain-removal): stop deleting certificates other live sites are served from' (#9) from fix/remove-domain-shared-cert-refcount into main jknapp 2026-08-23 14:52:02 +00:00
• b072786192 fix(domain-removal): stop deleting certificates other live sites are served from fix/remove-domain-shared-cert-refcount shadowdaoandClaude Opus 5 2026-08-23 04:47:26 -07:00
• a00431854d Merge pull request 'fix(ip-blocking): the runtime map fast path has never once run' (#8) from fix/runtime-map-worker-prefix-and-path into main jknapp 2026-08-22 18:20:06 +00:00
• c8d16b6990 fix(ip-blocking): the runtime map fast path has never once run shadowdaoandClaude Opus 5 2026-08-22 11:09:52 -07:00
• e33167159d Merge pull request 'fix(security-stats): stop reporting counters the stick tables never stored' (#7) from fix/stick-table-field-contract into main jknapp 2026-08-22 17:57:57 +00:00
• b6a62e7f9f fix(security-stats): stop reporting counters the stick tables never stored shadowdaoandClaude Opus 5 2026-08-22 10:48:49 -07:00
• b2f835a88c fix(logging): capture the full User-Agent, drop per-request SPOE log noise Claude 2026-08-22 10:17:07 -07:00
• 711c670319 fix(logging): stop silently discarding every access log line Claude 2026-08-22 10:10:59 -07:00
• 67837f59cb Merge pull request 'fix(haproxy): silence the ACL pattern warning on wp_admin_asset' (#6) from fix/haproxy-acl-pattern-warning into main jknapp 2026-08-17 19:59:17 +00:00
• e7d08c3b30 chore: release 2026.08.6 shadowdao 2026-08-17 12:54:22 -07:00
• 465253c640 fix(haproxy): silence the ACL pattern warning on wp_admin_asset shadowdao 2026-08-17 12:54:22 -07:00
• b931baa9a7 chore: release 2026.08.5 shadowdao 2026-08-14 09:55:57 -07:00
• 2148d72334 Merge branch 'ci/haproxy-config-gate' shadowdao 2026-08-14 09:55:57 -07:00
• 17ca731ed3 build: pin haproxy to 3.0.11-1+deb13u3 shadowdao 2026-08-14 09:55:51 -07:00
• bcd56b8352 ci: gate the build on a real haproxy -c of the rendered config shadowdao 2026-08-14 09:36:33 -07:00
• e545f3b6e0 test(haproxy): harden wp-admin gate suite against comment-collision, fix two false doc claims shadowdaoandClaude Opus 5 2026-08-14 09:38:49 -07:00
• 8a8d9c5fe3 fix(haproxy): normalise the URI before matching, closing five gate bypasses shadowdaoandClaude Opus 5 2026-08-14 09:09:35 -07:00
• 18750861b4 fix(haproxy): close open redirect in wp-admin edge gate shadowdaoandClaude Opus 5 2026-08-14 08:19:02 -07:00
• 6b0b5893b6 fix(haproxy): repair wp-admin edge gate redirect + anchor allowlist shadowdaoandClaude Opus 5 2026-08-14 08:02:00 -07:00
• 704be38882 feat(haproxy): gate unauthenticated wp-admin requests at the edge shadowdao 2026-08-14 07:45:52 -07:00
• 2171bedb20 feat(haproxy): ship per-site exempt list for the wp-admin edge gate shadowdao 2026-08-14 07:43:20 -07:00
• 992bf49138 chore: release 2026.08.4 shadowdao 2026-08-13 14:52:59 -07:00
• 491f54928a Merge branch 'feat/xmlrpc-rate-limit' shadowdao 2026-08-13 14:52:59 -07:00
• ecc1184533 feat(haproxy): rate-limit POST /xmlrpc.php floods per client IP shadowdaoandClaude Opus 5 2026-08-13 14:48:25 -07:00
• 53422c35e8 Merge branch 'fix/seed-lists-past-volume' shadowdao 2026-08-13 13:50:55 -07:00
• f21ade06d9 fix(haproxy): stop the trusted-proxy volume from shadowing Cloudflare/proxy lists shadowdaoandClaude Opus 5 2026-08-13 13:48:34 -07:00
• 871181c345 chore: release 2026.08.2 shadowdao 2026-08-13 13:40:51 -07:00
• fda73c62de Merge branch 'fix/trusted-proxy-header-gate' shadowdao 2026-08-13 13:40:51 -07:00
• 79a1b84ca2 fix(haproxy): only honour proxy headers from trusted sources shadowdao 2026-08-13 13:28:31 -07:00
• af9fb1d2f0 feat(haproxy): ship trusted-proxy source lists for header gating shadowdao 2026-08-13 13:23:52 -07:00
• 77b8cb029b Merge branch 'fix/cert-write-safety' shadowdaoandClaude Opus 5 2026-08-06 10:08:14 -07:00
• 4f0949d534 fix(certs): stop the test suite bricking the container; make the pairing check real shadowdaoandClaude Opus 5 2026-08-06 10:02:28 -07:00
• 22dab685d0 fix(certs): never truncate a live PEM; validate before publishing shadowdaoandClaude Opus 5 2026-08-06 08:58:47 -07:00
• 233044fb1d fix(config): write blocked_ips.map atomically; close review gaps shadowdaoandClaude Opus 5 2026-08-06 09:45:35 -07:00
• 9d16151120 fix(config): take the rollback backup BEFORE writing the new config fix/config-backup-ordering shadowdao 2026-08-06 08:22:02 -07:00
• b892438070 feat(waf): block anonymous WP REST batch endpoint (wp2shell CVE-2026-63030) shadowdaoandClaude Opus 4.8 2026-07-20 07:02:45 -07:00
• 2a2b9739fc fix(api): bound all subprocess calls + run 2 workers to prevent API stall shadowdaoandClaude Opus 4.8 2026-07-06 17:31:44 -07:00
• 7732e2a2ff chore(log): downgrade "no backend name" domain-skip from WARNING to INFO shadowdaoandClaude Opus 4.8 2026-07-02 05:50:22 -07:00
• 89c74c10cf fix(supervisor): restart haproxy in-place if it dies while container lives shadowdaoandClaude Opus 4.8 2026-07-01 09:07:11 -07:00
• 1b557b9931 feat(waf): wp-login cookie challenge (defeats distributed credential-stuffing) shadowdaoandClaude Opus 4.8 2026-06-24 20:30:12 -07:00
• 6ced2f8797 feat(waf): edge brute-force throttle for wp-login.php shadowdaoandClaude Opus 4.8 2026-06-24 19:52:52 -07:00
• 3917b6d1ae feat(templates): add hap_backend_longlived override template shadowdaoandClaude Opus 4.8 2026-06-24 13:40:11 -07:00
• d9cc5311de feat(quic): enable HTTP/3 over QUIC on the edge + versioned images shadowdaoandClaude Opus 4.8 2026-06-24 13:40:11 -07:00
• f1c1954378 fix(blocked-ips): correct map format + worker socket in manage-blocked-ips.sh shadowdaoandClaude Opus 4.8 2026-06-24 13:40:11 -07:00
• e190ca9f8e Merge pull request 'Add hap_backend_websocket.tpl long-lived/websocket backend template' (#5) from add-websocket-backend-template into main jknapp 2026-06-18 18:57:30 +00:00
• a204a44d42 Add hap_backend_websocket.tpl long-lived/websocket backend template shadowdao 2026-06-18 11:56:27 -07:00
• 04c98b1c1b docker: set image.source label to GitHub mirror for ghcr.io linking shadowdaoandClaude Opus 4.7 2026-06-03 11:24:26 -07:00
• 1ff51da6f0 sanitize public mirror: drop personal IP and infra/customer hostnames shadowdaoandClaude Opus 4.8 2026-06-04 06:32:15 -07:00
• 158ad3bde8 ci: mirror image pushes to ghcr.io/shadowdao (#3) jknapp 2026-06-03 17:08:35 +00:00
• 8b74cd5a4e ci: mirror image pushes to ghcr.io/shadowdao shadowdaoandClaude Opus 4.7 2026-06-03 10:08:19 -07:00
• eb3658b68e docs: add haproxy-manager-deploy skill shadowdaoandClaude Opus 4.7 2026-05-15 06:02:56 -07:00
• 83fee2ff78 waf-block page: escape literal % as %% (HAProxy lf-file expansion) shadowdaoandClaude Opus 4.7 2026-05-15 05:48:14 -07:00
• fedb025fb8 waf-block: render a real HTML page on Coraza-denied requests shadowdaoandClaude Opus 4.7 2026-05-15 05:41:16 -07:00
• 6448cffb91 haproxy: use req.hdr_ip for real-IP resolution (string-IP crashed Coraza SPOA) shadowdao 2026-05-14 08:57:05 -07:00
• 47b9c87e1d coraza: pass var(txn.real_ip) instead of src to Coraza (real client IP in WAF logs) shadowdao 2026-05-14 08:52:01 -07:00
• 8d04fe43fd coraza: pin go.mod to 1.23 (matches go mod tidy output; Dockerfile still uses 1.25 image) shadowdao 2026-05-14 08:08:38 -07:00
• 99dfe98aaf coraza: pre-CRS Include for runtime per-host exemptions (load-order fix) shadowdaoandClaude Sonnet 4.6 2026-05-14 07:55:51 -07:00
• e2290192f3 coraza: ship rules-catalog.json generated from bundled CRS at build time shadowdaoandClaude Opus 4.7 2026-05-14 06:57:42 -07:00
• 2e19513851 coraza: reserve rule-ID range 990000000-990999999 for WHP-generated rules shadowdao 2026-05-14 06:53:37 -07:00
• de221a1326 coraza: add second Include for runtime-managed local-overrides.conf shadowdao 2026-05-14 06:51:24 -07:00
• e1d479b74e coraza: drop 913xxx scanner-UA from enforce list (FP on Mastodon + SiteLock) shadowdao 2026-05-13 19:13:22 -07:00
• 131284fd0c refactor(suspension): serve via /suspended route on default-backend, drop bk_suspended shadowdaoandClaude Opus 4.7 2026-05-13 12:08:45 -07:00
• edb02d6206 fix(suspended): tolerate startup DNS failure + use docker_dns resolvers shadowdaoandClaude Opus 4.7 2026-05-13 11:52:50 -07:00
• c4a9d9d7e6 feat(suspension): opt-in routing for suspended hosts via bk_suspended backend shadowdaoandClaude Opus 4.7 2026-05-13 11:46:18 -07:00
• 657584c88e coraza: promote 920440 + 930130 to enforce list (empirical detect-only data) shadowdaoandClaude Opus 4.7 2026-05-12 18:00:21 -07:00
• 4262b24b7e fix(coraza): add deny rules that act on Coraza's verdict + spop-check on backend shadowdaoandClaude Opus 4.7 2026-05-12 17:16:03 -07:00
• ddb4c20073 fix(coraza-spoe): match upstream's required spoe shape (groups, arg order, names) shadowdaoandClaude Opus 4.7 2026-05-12 17:12:09 -07:00
• 69bed61697 fix(coraza-spoe): collapse args to one line + ensure trailing LF on spoe cfg shadowdaoandClaude Opus 4.7 2026-05-12 17:07:12 -07:00
• fed3457f29 fix(coraza): ensure haproxy.cfg ends with LF when SPOE backend appended shadowdaoandClaude Opus 4.7 2026-05-12 17:03:56 -07:00
• df56321167 fix(template): strip Jinja2 whitespace so no-env-var listener is byte-identical shadowdaoandClaude Opus 4.7 2026-05-12 16:59:40 -07:00
• a89cdab886 PR 2/3: opt-in SPOE integration for Coraza WAF shadowdaoandClaude Opus 4.7 2026-05-12 16:49:29 -07:00
• b359af15e5 ci: mirror golang:1.25 alongside python:3.12-slim, switch coraza-spoa FROM shadowdaoandClaude Opus 4.7 2026-05-12 16:40:42 -07:00