v4.0.0-rc.1

Images

ghcr.io/caddyproxymanager/web:4.0.0-rc.1
ghcr.io/caddyproxymanager/caddy:4.0.0-rc.1
ghcr.io/caddyproxymanager/agent:4.0.0-rc.1

Published by the image build this release starts; give it a few minutes. The
docker-compose.yml in the archive below already names these tags, so what you
deploy from it stays on this release until you choose to move -- but it also means
a docker compose pull run before the build finishes has nothing to fetch.

Deployment files

A clone of CaddyProxyManager/deploy upgrades with
git pull && docker compose pull && docker compose up -d.

Important

These live in your deployment directory, not in the images, so
docker compose pull will not update them. git pull the deploy repository
(or take them from the archive below) before docker compose up -d:

• .env.example
• docker-compose.yml
• docker/caddy/go.mod
• docker/caddy/go.sum

caddy-proxy-manager-v4.0.0-rc.1-deploy.tar.gz is ready to run as it unpacks: extract it
into one directory and docker compose up -d works without moving anything. Its one
subdirectory, docker/caddy/, is Caddy's build context, which Settings -> Caddy build
rebuilds from. It includes the managed CrowdSec container, which stays off
until Settings -> CrowdSec turns it on. Its docker-compose.yml differs from the
copy in the repository in exactly two ways: it mounts its files from beside itself
rather than from ./docker/, and it pins the three images to 4.0.0-rc.1 rather
than latest.
The repository copy follows latest on purpose; this one is a snapshot of one
release and says so.

Installing without internet access

The image build attaches an air-gap bundle per architecture before this release is published:
-airgap-<web|caddy|agent>.tar.gz hold our images, -airgap-deploy.tar.gz the
deployment files and a load script, and the signed -airgap-manifest.txt their
checksums and the third-party images to bring in by digest. See
https://caddyproxy.com/start/offline/.

Changes

• chore(release): 4.0.0-rc.1 (87d0c29)
• feat(certificates): choose the DNS provider per certificate in the dashboard (c7efe1c)
• feat(auth): a sign-up page for self-registration (f076eb1)
• fix(settings): render validation errors from codes so the setup screen speaks the reader's language (bc05856)
• feat(graphql): agent pairing, renaming, unpairing and rebuild mutations (2e842bd)
• feat(graphql): WAF preset, CRS plugin, Caddy module and OAuth provider mutations (354695b)
• feat(graphql): user creation, session revocation, forward-auth access and DNS credential mutations (9d9c611)
• feat(graphql): certificate, CA, client certificate and mTLS mutations (88c204a)
• docs(compose): say how to narrow the dashboard port after setup (4aa3e89)
• fix(i18n): word the last English strings from the catalog (04217cc)
• perf(db): index the audit filters, prune revisions in one statement, drop two dead tables (a0e6215)
• fix(caddy): hold crowdsec where the bouncer still builds (1f8abc5)
• perf(agent): run commands beside the event stream, not on it (ace03cf)
• fix(i18n): count with plural forms in the English fallback too (43a1db9)
• chore: satisfy the lint the test workflow runs (b4409ad)
• fix(i18n): settle the catalog's spellings and stop building one label in code (06418f2)
• fix(docs): forward the documented agent variables and document three REST routes (020856a)
• feat(agent): honour the Caddy build timeout setting (8da511f)
• fix(ui): give the upstream DNS pinning disclosure a body-sized label (d1640d9)
• feat(proxy-hosts): save through the review alone, with the editor's problems in view (795625d)
• feat(waf): let risky custom directives through with a warning, behind a strict setting (ac19ebd)
• perf: trim the hot paths and sweep tables nothing pruned (694b0d8)
• fix(security): close the gaps from the security pass (b1c63fc)
• fix(dns): send the DigitalOcean token under the key the module reads (0d9406a)
• docs(agents): spell out the branch naming rule (7ec0a3c)
• feat(docker): replace the HAProxy socket proxy with wollomatic/socket-proxy (ba42dbc)
• feat(waf): show the user agent and ASN in the event metadata list (cb4c235)
• feat(docker): bake the health check into the web image (995bf85)

Full diff: v3.9.0...v4.0.0-rc.1