v3.9.0

Images

ghcr.io/caddyproxymanager/web:3.9.0
ghcr.io/caddyproxymanager/caddy:3.9.0
ghcr.io/caddyproxymanager/agent:3.9.0

Published by the image build this release starts; give it a few minutes. The
docker-compose.yml in the archive below already names these tags, so what you
deploy from it stays on this release until you choose to move -- but it also means
a docker compose pull run before the build finishes has nothing to fetch.

Deployment files

A clone of CaddyProxyManager/deploy upgrades with
git pull && docker compose pull && docker compose up -d.

Important

These live in your deployment directory, not in the images, so
docker compose pull will not update them. git pull the deploy repository
(or take them from the archive below) before docker compose up -d:

• .env.example
• docker-compose.yml

caddy-proxy-manager-v3.9.0-deploy.tar.gz is ready to run as it unpacks: extract it
into one directory and docker compose up -d works without moving anything. Its one
subdirectory, docker/caddy/, is Caddy's build context, which Settings -> Caddy build
rebuilds from. It includes the managed CrowdSec container, which stays off
until Settings -> CrowdSec turns it on. Its docker-compose.yml differs from the
copy in the repository in exactly two ways: it mounts its files from beside itself
rather than from ./docker/, and it pins the three images to 3.9.0 rather
than latest.
The repository copy follows latest on purpose; this one is a snapshot of one
release and says so.

Installing without internet access

The image build attaches an air-gap bundle per architecture before this release is published:
-airgap-<web|caddy|agent>.tar.gz hold our images, -airgap-deploy.tar.gz the
deployment files and a load script, and the signed -airgap-manifest.txt their
checksums and the third-party images to bring in by digest. See
https://caddyproxy.com/start/offline/.

Changes

• chore(release): 3.9.0 (80923af)
• feat(email): add a sender name setting, keep the server out of the test email (94302d3)
• feat(oidc): read roles from a claim of their own (237c3c6)
• fix(live): drop the held report on new traffic, link audit history by uuid (694c10f)
• feat(live): push logs, analytics and WAF events to open pages (7774500)
• feat(proxy-hosts): address hosts by uuid, not serial id (a13ef66)
• feat(proxy-hosts): leave a host out of the access log (d5ea787)
• fix(agent): warn when the compose override is a symlink the container cannot follow (55fd5b5)

Full diff: v3.8.2...v3.9.0