shadowdaoandClaude Sonnet 5.5 a476bb5352 coraza-spoa: multi-arch (amd64+arm64) by cross-compiling; push-by-digest + imagetools index ...

Dockerfile: Go stages pinned to $BUILDPLATFORM, GOOS/GOARCH from TARGETOS/
TARGETARCH (CGO already off); amd64 rootfs/binary byte-identical to before.
Workflow: one trusted x86 job, amd64 + arm64 pushed untagged by digest to both
registries, arm64 continue-on-error, tag assembled by
scripts/assemble-multiarch-index.sh (arm64 only from this run's successful
step; otherwise amd64-only). Offline test + local e2e rehearsal script.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

2026-11-11 16:44:24 -08:00

..

test-fixtures/san-certs

fix(ssl): retire SAN-overlapping certs, never publish expired lineages, report no-op renewals

2026-10-09 11:05:07 -07:00

assemble-multiarch-index.sh

coraza-spoa: multi-arch (amd64+arm64) by cross-compiling; push-by-digest + imagetools index

2026-11-11 16:44:24 -08:00

cert-publish-lib.sh

fix(ssl): review round 1 - exact --cert-name lineage, retire whole lineage tree, sweep expired pems

2026-10-09 14:00:03 -07:00

clear-ip.sh

Add safeguards to prevent false positive blocking

2025-08-25 11:09:57 -07:00

dns-challenge-auth-hook.sh

Add wildcard domain support with DNS-01 ACME challenge flow

2026-02-19 13:06:08 -08:00

dns-challenge-cleanup-hook.sh

Add wildcard domain support with DNS-01 ACME challenge flow

2026-02-19 13:06:08 -08:00

e2e-coraza-multiarch.sh

coraza-spoa: multi-arch (amd64+arm64) by cross-compiling; push-by-digest + imagetools index

2026-11-11 16:44:24 -08:00

ensure_haproxy.py

fix(supervisor): restart haproxy in-place if it dies while container lives

2026-07-01 09:07:11 -07:00

external-monitoring-example.conf

Major upgrade: API key authentication, certificate renewal/download endpoints, monitoring/alerting scripts, improved logging, and documentation updates. See UPGRADE_SUMMARY.md for details.

2025-07-11 06:24:56 -07:00

haproxy-log-receiver.py

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00

healthcheck.sh

fix(api): stop silent clients from wedging the gunicorn thread pool

2026-10-09 10:13:12 -07:00

host-crontab-example.txt

Fix certificate renewal cron job and add host-side scheduling

2025-10-28 17:36:48 -07:00

host-renew-certificates.sh

Simplify certificate renewal scripts and add certbot cleanup

2025-11-20 09:56:56 -08:00

init.py

swap werkzeug dev server for gunicorn + accept all HTTP methods on default/blocked pages

2026-05-12 15:24:28 -07:00

manage-blocked-ips.sh

fix(blocked-ips): correct map format + worker socket in manage-blocked-ips.sh

2026-06-24 13:40:11 -07:00

monitor-attacks.sh

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00

monitor-errors-external.sh

Major upgrade: API key authentication, certificate renewal/download endpoints, monitoring/alerting scripts, improved logging, and documentation updates. See UPGRADE_SUMMARY.md for details.

2025-07-11 06:24:56 -07:00

monitor-errors.sh

Major upgrade: API key authentication, certificate renewal/download endpoints, monitoring/alerting scripts, improved logging, and documentation updates. See UPGRADE_SUMMARY.md for details.

2025-07-11 06:24:56 -07:00

monitoring-example.conf

Major upgrade: API key authentication, certificate renewal/download endpoints, monitoring/alerting scripts, improved logging, and documentation updates. See UPGRADE_SUMMARY.md for details.

2025-07-11 06:24:56 -07:00

pkg-cache-repos.sh

ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7)

2026-10-22 07:19:54 -07:00

renew-certificates.sh

fix(ssl): review round 1 - exact --cert-name lineage, retire whole lineage tree, sweep expired pems

2026-10-09 14:00:03 -07:00

show-edge-ip-rates.sh

fix(security-stats): stop reporting counters the stick tables never stored

2026-08-22 10:48:49 -07:00

show-tarpit-ips.sh

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00

start-up.sh

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00

sync-certificates.sh

fix(ssl): review round 1 - exact --cert-name lineage, retire whole lineage tree, sweep expired pems

2026-10-09 14:00:03 -07:00

test-access-log-receiver.py

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00

test-api.sh

Major upgrade: API key authentication, certificate renewal/download endpoints, monitoring/alerting scripts, improved logging, and documentation updates. See UPGRADE_SUMMARY.md for details.

2025-07-11 06:24:56 -07:00

test-assemble-multiarch-index.py

coraza-spoa: multi-arch (amd64+arm64) by cross-compiling; push-by-digest + imagetools index

2026-11-11 16:44:24 -08:00

test-cert-scripts.py

fix(ssl): review round 1 - exact --cert-name lineage, retire whole lineage tree, sweep expired pems

2026-10-09 14:00:03 -07:00

test-cert-write-safety.py

test(ssl): certbot re-issue test skips on ANY certbot import/init failure

2026-10-09 14:26:19 -07:00

test-certificate-request.sh

Add /api/certificates/request endpoint for programmatic certificate requests, update docs and add test script

2025-07-11 17:14:01 -07:00

test-config-rollback.py

fix(config): write blocked_ips.map atomically; close review gaps

2026-08-06 09:45:35 -07:00

test-default-splash.py

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00

test-gunicorn-socket-timeouts.py

test(api): starvation test asserts no-starvation; latency bounds only under HAPROXY_MGR_STRICT_TIMING

2026-10-09 15:40:22 -07:00

test-ip-blocking.sh

Add IP blocking functionality to HAProxy Manager

2025-08-21 18:32:47 -07:00

test-multipart-cve-mitigation.py

fix(edge): CVE-2026-109618/-109619 multipart mitigations (2026.10.6)

2026-10-21 07:27:42 -07:00

test-runtime-map-contract.py

fix(ip-blocking): the runtime map fast path has never once run

2026-08-22 11:15:01 -07:00

test-stick-table-contract.py

fix(security-stats): stop reporting counters the stick tables never stored

2026-08-22 10:48:49 -07:00

test-trusted-proxy-gate.py

fix(haproxy): only honour proxy headers from trusted sources

2026-08-13 13:28:31 -07:00

test-waf-body-inspection.py

fix(waf): stamp X-WHP-WAF-Body from the Content-Length header, not req.body_size

2026-10-19 08:59:29 -07:00

test-wpadmin-gate.py

fix(haproxy): silence the ACL pattern warning on wp_admin_asset

2026-08-17 12:54:22 -07:00

test-xmlrpc-rate-limit.py

feat(haproxy): rate-limit POST /xmlrpc.php floods per client IP

2026-08-13 14:48:25 -07:00

validate-rendered-config.py

Default splash for unrouted hosts (404+noindex, answered before the WAF) and in-container access log (2026.11.2) (#15)

2026-11-08 20:03:23 +00:00