v0.2.0

Added

• Support for locally managed firewalls (MANAGEMENT=local): a second
  Terraform module, using the PaloAltoNetworks/panos provider, creates the
  same URL category, address objects, tag, EDLs, profile and no-decrypt
  rules in a vsys on the firewall, and the app commits them over the XML
  API. Commits include only FIREWALL_USERNAME's changes. One-click
  bypasses, review, retry and the CLI work as with SCM.
• FIREWALL_CA_FILE is also trusted by Terraform in local mode.
• panos-decrypt-bypass commit as an alias of push.
• panos-decrypt-bypass terraform <args> runs any Terraform command with the
  app's settings, for destroy, import and state commands.
• The status area now flags missing SCM or firewall settings for the
  selected mode.

Changed

• Renamed from scm-decrypt-bypass to panos-decrypt-bypass: the
  repository, images (ghcr.io/former-stranger/panos-decrypt-bypass,
  docker.io/formerstranger/panos-decrypt-bypass), CLI command, Python
  package and compose service. PDB_VERSION replaces SDB_VERSION. See
  upgrading from 0.1.0.
• The bypass tag's comment now names panos-decrypt-bypass, so the first
  deploy after upgrading shows it as a change to review.
• Signing in again is needed once, because the session cookie was renamed.
• The SCM Terraform module moved to terraform/scm/. Data directories are
  migrated automatically, and module files from older versions are removed.

Notes

• Decryption exclusions (exclusion-hostnames.txt) remain SCM-only. On a
  locally managed firewall they're ignored with a warning.

v0.1.0

First public release.

Added

• Web GUI that polls the firewall's XML API for decryption logs, groups
  failures by destination, explains each error, and shows which bypass
  entries already cover it.
• One-click bypass: adds hostnames to the no-decrypt URL category, plans,
  applies and pushes to the firewall, stopping for review when the plan
  changes anything else.
• Built-in password login with signed session cookies, cross-site request
  protection and security headers.
• CLI (scm-decrypt-bypass) with an interactive menu and add / remove /
  list / plan / deploy / push / init / serve commands.
• Terraform module (PaloAltoNetworks/scm provider) for custom decryption
  exclusions and ordered no-decrypt rules matching URL lists, URL
  categories, addresses, users and EDLs.
• Docker image with Terraform and the SCM provider pre-installed, for
  linux/amd64 and linux/arm64.
• Demo mode with sample logs and simulated deploys.