Commit Graph

Select branches

Hide Pull Requests

fix/config-backup-ordering

main

#1

#2

#3

#4

#5

Mono Color

• b931baa9a7 chore: release 2026.08.5 main shadowdao 2026-08-14 09:55:57 -07:00
• 2148d72334 Merge branch 'ci/haproxy-config-gate' shadowdao 2026-08-14 09:55:57 -07:00
• 17ca731ed3 build: pin haproxy to 3.0.11-1+deb13u3 shadowdao 2026-08-14 09:55:51 -07:00
• bcd56b8352 ci: gate the build on a real haproxy -c of the rendered config shadowdao 2026-08-14 09:36:33 -07:00
• e545f3b6e0 test(haproxy): harden wp-admin gate suite against comment-collision, fix two false doc claims shadowdaoandClaude Opus 5 2026-08-14 09:38:49 -07:00
• 8a8d9c5fe3 fix(haproxy): normalise the URI before matching, closing five gate bypasses shadowdaoandClaude Opus 5 2026-08-14 09:09:35 -07:00
• 18750861b4 fix(haproxy): close open redirect in wp-admin edge gate shadowdaoandClaude Opus 5 2026-08-14 08:19:02 -07:00
• 6b0b5893b6 fix(haproxy): repair wp-admin edge gate redirect + anchor allowlist shadowdaoandClaude Opus 5 2026-08-14 08:02:00 -07:00
• 704be38882 feat(haproxy): gate unauthenticated wp-admin requests at the edge shadowdao 2026-08-14 07:45:52 -07:00
• 2171bedb20 feat(haproxy): ship per-site exempt list for the wp-admin edge gate shadowdao 2026-08-14 07:43:20 -07:00
• 992bf49138 chore: release 2026.08.4 shadowdao 2026-08-13 14:52:59 -07:00
• 491f54928a Merge branch 'feat/xmlrpc-rate-limit' shadowdao 2026-08-13 14:52:59 -07:00
• ecc1184533 feat(haproxy): rate-limit POST /xmlrpc.php floods per client IP shadowdaoandClaude Opus 5 2026-08-13 14:48:25 -07:00
• 53422c35e8 Merge branch 'fix/seed-lists-past-volume' shadowdao 2026-08-13 13:50:55 -07:00
• f21ade06d9 fix(haproxy): stop the trusted-proxy volume from shadowing Cloudflare/proxy lists shadowdaoandClaude Opus 5 2026-08-13 13:48:34 -07:00
• 871181c345 chore: release 2026.08.2 shadowdao 2026-08-13 13:40:51 -07:00
• fda73c62de Merge branch 'fix/trusted-proxy-header-gate' shadowdao 2026-08-13 13:40:51 -07:00
• 79a1b84ca2 fix(haproxy): only honour proxy headers from trusted sources shadowdao 2026-08-13 13:28:31 -07:00
• af9fb1d2f0 feat(haproxy): ship trusted-proxy source lists for header gating shadowdao 2026-08-13 13:23:52 -07:00
• 77b8cb029b Merge branch 'fix/cert-write-safety' shadowdaoandClaude Opus 5 2026-08-06 10:08:14 -07:00
• 4f0949d534 fix(certs): stop the test suite bricking the container; make the pairing check real shadowdaoandClaude Opus 5 2026-08-06 10:02:28 -07:00
• 22dab685d0 fix(certs): never truncate a live PEM; validate before publishing shadowdaoandClaude Opus 5 2026-08-06 08:58:47 -07:00
• 233044fb1d fix(config): write blocked_ips.map atomically; close review gaps shadowdaoandClaude Opus 5 2026-08-06 09:45:35 -07:00
• 9d16151120 fix(config): take the rollback backup BEFORE writing the new config fix/config-backup-ordering shadowdao 2026-08-06 08:22:02 -07:00
• b892438070 feat(waf): block anonymous WP REST batch endpoint (wp2shell CVE-2026-63030) shadowdaoandClaude Opus 4.8 2026-07-20 07:02:45 -07:00
• 2a2b9739fc fix(api): bound all subprocess calls + run 2 workers to prevent API stall shadowdaoandClaude Opus 4.8 2026-07-06 17:31:44 -07:00
• 7732e2a2ff chore(log): downgrade "no backend name" domain-skip from WARNING to INFO shadowdaoandClaude Opus 4.8 2026-07-02 05:50:22 -07:00
• 89c74c10cf fix(supervisor): restart haproxy in-place if it dies while container lives shadowdaoandClaude Opus 4.8 2026-07-01 09:07:11 -07:00
• 1b557b9931 feat(waf): wp-login cookie challenge (defeats distributed credential-stuffing) shadowdaoandClaude Opus 4.8 2026-06-24 20:30:12 -07:00
• 6ced2f8797 feat(waf): edge brute-force throttle for wp-login.php shadowdaoandClaude Opus 4.8 2026-06-24 19:52:52 -07:00
• 3917b6d1ae feat(templates): add hap_backend_longlived override template shadowdaoandClaude Opus 4.8 2026-06-24 13:40:11 -07:00
• d9cc5311de feat(quic): enable HTTP/3 over QUIC on the edge + versioned images shadowdaoandClaude Opus 4.8 2026-06-24 13:40:11 -07:00
• f1c1954378 fix(blocked-ips): correct map format + worker socket in manage-blocked-ips.sh shadowdaoandClaude Opus 4.8 2026-06-24 13:40:11 -07:00
• e190ca9f8e Merge pull request 'Add hap_backend_websocket.tpl long-lived/websocket backend template' (#5) from add-websocket-backend-template into main jknapp 2026-06-18 18:57:30 +00:00
• a204a44d42 Add hap_backend_websocket.tpl long-lived/websocket backend template shadowdao 2026-06-18 11:56:27 -07:00
• 04c98b1c1b docker: set image.source label to GitHub mirror for ghcr.io linking shadowdaoandClaude Opus 4.7 2026-06-03 11:24:26 -07:00
• 1ff51da6f0 sanitize public mirror: drop personal IP and infra/customer hostnames shadowdaoandClaude Opus 4.8 2026-06-04 06:32:15 -07:00
• 158ad3bde8 ci: mirror image pushes to ghcr.io/shadowdao (#3) jknapp 2026-06-03 17:08:35 +00:00
• 8b74cd5a4e ci: mirror image pushes to ghcr.io/shadowdao shadowdaoandClaude Opus 4.7 2026-06-03 10:08:19 -07:00
• eb3658b68e docs: add haproxy-manager-deploy skill shadowdaoandClaude Opus 4.7 2026-05-15 06:02:56 -07:00
• 83fee2ff78 waf-block page: escape literal % as %% (HAProxy lf-file expansion) shadowdaoandClaude Opus 4.7 2026-05-15 05:48:14 -07:00
• fedb025fb8 waf-block: render a real HTML page on Coraza-denied requests shadowdaoandClaude Opus 4.7 2026-05-15 05:41:16 -07:00
• 6448cffb91 haproxy: use req.hdr_ip for real-IP resolution (string-IP crashed Coraza SPOA) shadowdao 2026-05-14 08:57:05 -07:00
• 47b9c87e1d coraza: pass var(txn.real_ip) instead of src to Coraza (real client IP in WAF logs) shadowdao 2026-05-14 08:52:01 -07:00
• 8d04fe43fd coraza: pin go.mod to 1.23 (matches go mod tidy output; Dockerfile still uses 1.25 image) shadowdao 2026-05-14 08:08:38 -07:00
• 99dfe98aaf coraza: pre-CRS Include for runtime per-host exemptions (load-order fix) shadowdaoandClaude Sonnet 4.6 2026-05-14 07:55:51 -07:00
• e2290192f3 coraza: ship rules-catalog.json generated from bundled CRS at build time shadowdaoandClaude Opus 4.7 2026-05-14 06:57:42 -07:00
• 2e19513851 coraza: reserve rule-ID range 990000000-990999999 for WHP-generated rules shadowdao 2026-05-14 06:53:37 -07:00
• de221a1326 coraza: add second Include for runtime-managed local-overrides.conf shadowdao 2026-05-14 06:51:24 -07:00
• e1d479b74e coraza: drop 913xxx scanner-UA from enforce list (FP on Mastodon + SiteLock) shadowdao 2026-05-13 19:13:22 -07:00
• 131284fd0c refactor(suspension): serve via /suspended route on default-backend, drop bk_suspended shadowdaoandClaude Opus 4.7 2026-05-13 12:08:45 -07:00
• edb02d6206 fix(suspended): tolerate startup DNS failure + use docker_dns resolvers shadowdaoandClaude Opus 4.7 2026-05-13 11:52:50 -07:00
• c4a9d9d7e6 feat(suspension): opt-in routing for suspended hosts via bk_suspended backend shadowdaoandClaude Opus 4.7 2026-05-13 11:46:18 -07:00
• 657584c88e coraza: promote 920440 + 930130 to enforce list (empirical detect-only data) shadowdaoandClaude Opus 4.7 2026-05-12 18:00:21 -07:00
• 4262b24b7e fix(coraza): add deny rules that act on Coraza's verdict + spop-check on backend shadowdaoandClaude Opus 4.7 2026-05-12 17:16:03 -07:00
• ddb4c20073 fix(coraza-spoe): match upstream's required spoe shape (groups, arg order, names) shadowdaoandClaude Opus 4.7 2026-05-12 17:12:09 -07:00
• 69bed61697 fix(coraza-spoe): collapse args to one line + ensure trailing LF on spoe cfg shadowdaoandClaude Opus 4.7 2026-05-12 17:07:12 -07:00
• fed3457f29 fix(coraza): ensure haproxy.cfg ends with LF when SPOE backend appended shadowdaoandClaude Opus 4.7 2026-05-12 17:03:56 -07:00
• df56321167 fix(template): strip Jinja2 whitespace so no-env-var listener is byte-identical shadowdaoandClaude Opus 4.7 2026-05-12 16:59:40 -07:00
• a89cdab886 PR 2/3: opt-in SPOE integration for Coraza WAF shadowdaoandClaude Opus 4.7 2026-05-12 16:49:29 -07:00
• b359af15e5 ci: mirror golang:1.25 alongside python:3.12-slim, switch coraza-spoa FROM shadowdaoandClaude Opus 4.7 2026-05-12 16:40:42 -07:00
• 9b329fa52b PR 1/3: add coraza-spoa sidecar image shadowdaoandClaude Opus 4.7 2026-05-12 16:28:44 -07:00
• fd79ac2b70 ci: add weekly Gitea Action to mirror python:3.12-slim into in-house registry shadowdaoandClaude Opus 4.7 2026-05-12 16:18:32 -07:00
• e11d8c4269 ci: mirror python:3.12-slim into in-house registry shadowdaoandClaude Opus 4.7 2026-05-12 16:08:44 -07:00
• c22d2cd1f4 swap werkzeug dev server for gunicorn + accept all HTTP methods on default/blocked pages shadowdaoandClaude Opus 4.7 2026-05-12 15:24:28 -07:00
• be3bc040df feat: clear stale certbot lock files before each ACME run + at startup shadowdaoandClaude Opus 4.7 2026-05-09 12:09:19 -07:00
• 873048e837 feat(api/ssl/bundle): clean up superseded lineages after issuance shadowdaoandClaude Opus 4.7 2026-05-09 11:58:21 -07:00
• c931e54d4d feat(api): add /api/ssl/bundle for per-site SAN cert issuance shadowdaoandClaude Opus 4.7 2026-05-09 11:32:15 -07:00
• 3770dae20f Self-heal trusted IP whitelist files at startup shadowdaoandClaude Opus 4.7 2026-04-30 10:02:16 -07:00
• b5bb141899 Fix resolvers block placement — must be outside global section shadowdaoandClaude Opus 4.6 2026-04-02 05:18:48 -07:00
• 5ebc3fb8e8 Add DNS resolver for automatic container IP re-resolution shadowdaoandClaude Opus 4.6 2026-04-01 22:27:07 -07:00
• df758a3fde Don't abort cert renewal when a single domain fails shadowdaoandClaude Opus 4.6 2026-04-01 15:17:15 -07:00
• fbb94e6dc3 Update CLAUDE.md with HAProxy hardening and AI log monitor docs shadowdaoandClaude Opus 4.6 2026-04-01 08:16:44 -07:00
• 58bb5b4f18 Fix: remove comments from trusted IP files breaking HAProxy startup shadowdaoandClaude Opus 4.6 2026-03-31 14:19:29 -07:00
• 68a6f1bc27 Raise rate limits further for media-heavy sites shadowdaoandClaude Opus 4.6 2026-03-31 14:12:24 -07:00
• 5bdc95109e Raise rate limit thresholds to avoid false positives on normal traffic shadowdaoandClaude Opus 4.6 2026-03-31 14:10:53 -07:00
• 978f173814 Add trusted IP whitelist for rate limit bypass shadowdaoandClaude Opus 4.6 2026-03-31 13:39:41 -07:00
• 2ba8f87c2c Raise connection rate limit from 60 to 150 per 10s shadowdaoandClaude Opus 4.6 2026-03-31 12:25:53 -07:00
• a3b19ce352 Add rate limiting, connection limits, and timeout hardening shadowdaoandClaude Opus 4.6 2026-03-31 10:00:53 -07:00
• 94af4e47c1 Add Host header capture to frontend for connection debugging shadowdaoandClaude Opus 4.6 2026-02-26 15:31:14 -08:00
• 124a5373d2 Fix wildcard SSL cert: find certbot -NNNN dirs and use _wildcard_ filename shadowdaoandClaude Opus 4.6 2026-02-20 06:38:28 -08:00
• 657cd28344 Fix certbot hook script paths and add logging shadowdaoandClaude Opus 4.6 2026-02-20 06:18:14 -08:00
• 91c92dd07e Add wildcard domain support with DNS-01 ACME challenge flow shadowdaoandClaude Opus 4.6 2026-02-19 13:04:32 -08:00
• 6cd64295d2 Add separate SSE backend for secure Server-Sent Events support shadowdaoandClaude 2025-12-26 13:48:24 -08:00
• eadd6b798f Adding support for SSE Streaming shadowdao 2025-12-26 13:07:29 -08:00
• 6902daaea1 Add automatic SSE detection and support to backend template shadowdao 2025-12-26 13:02:04 -08:00
• 1fcb25bb88 Update SQL logic to update instead of delete and re-add shadowdao 2025-12-18 12:23:06 -08:00
• bff18d358b Remove set -e and database dependency from certificate scripts shadowdaoandClaude 2025-11-21 08:50:24 -08:00
• 1d22d789b8 Simplify certificate renewal scripts and add certbot cleanup shadowdaoandClaude 2025-11-20 09:56:56 -08:00
• adc20d6d0b Improve certificate renewal script with atomic file updates shadowdaoandClaude 2025-11-19 19:27:40 -08:00
• 71f4b9ef05 Add CIDR notation support for IP blocking shadowdao 2025-11-17 12:07:32 -08:00
• 8d732318b4 Fix certificate renewal to properly update HAProxy combined certificate files shadowdaoandClaude 2025-11-11 20:10:58 -08:00
• 7eeba0d718 Remove ACL-based security protections to eliminate false positives shadowdaoandClaude 2025-11-03 15:35:25 -08:00
• 76b2e85ca8 Fix certificate renewal cron job and add host-side scheduling shadowdaoandClaude 2025-10-28 17:36:48 -07:00
• 288f4eb8a9 adding net-tools to allow connection number tracking shadowdao 2025-10-09 18:42:44 -07:00
• 8636b69ee1 Fix AWK syntax errors in monitoring scripts shadowdaoandClaude 2025-09-22 19:42:54 -07:00
• 4c4e99883b Fix table reference and log-format response header issues shadowdaoandClaude 2025-09-22 18:49:50 -07:00
• b293588eef Fix log-format multiline syntax causing parsing errors shadowdaoandClaude 2025-09-22 18:45:43 -07:00
• b55a2fa691 Fix ACL compound reference error for xmlrpc abuse detection shadowdaoandClaude 2025-09-22 18:39:37 -07:00
• 2889fda014 Fix HAProxy 3.0.11 variable comparison syntax in conditions shadowdaoandClaude 2025-09-22 18:34:45 -07:00