v1.6.14-rc3

Documentation : https://docs.bunkerweb.io/1.6.14~rc3/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.14-rc3
• BunkerWeb : bunkerity/bunkerweb:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb:1.6.14-rc3
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.14-rc3
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.14-rc3
• UI : bunkerity/bunkerweb-ui:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-ui:1.6.14-rc3
• API : bunkerity/bunkerweb-api:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-api:1.6.14-rc3

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.14~rc3&filter=all&dist=

Changelog :

• [SECURITY] db: the database password is no longer written to the logs, where a malformed DATABASE_URI was logged in full before exiting. Connection failures now name the masked target and the reason. (Refs #3361)
• [SECURITY] api: a configuration or plugin push no longer empties the target directory on a live instance while it copies the new content in, which made every request to every service fail for the duration of the copy. Entries are now swapped one at a time with a rename, and a push whose content is unchanged is skipped instead of rewriting an identical tree on every Scheduler start.
• [SECURITY] core: client-supplied X-SSL-* request headers are stripped before reaching an upstream. With mTLS header forwarding off, or on any PHP-FPM service, a client could spoof X-SSL-Client-Verify: SUCCESS. See the mTLS documentation to re-publish them when another proxy terminates mTLS.
• [SECURITY] linux: the API_TOKEN set in /etc/bunkerweb/variables.env is applied to the configuration BunkerWeb starts with, instead of being dropped so that the API accepted untokenized requests until the scheduler pushed the real configuration.
• [SECURITY] ui: a TOTP code can no longer be used more than once. The replay guard never persisted the last accepted time step, leaving a captured code valid for the rest of its 30 second window.
• [SECURITY] ui: removed the year-long "remember me" token, which survived logout, password changes and Wipe other sessions and bypassed IP/User-Agent pinning and the absolute session cap. "Remember me" now marks the session cookie permanent, so it still survives a browser restart but is a normal revocable session; raise both SESSION_LIFETIME_HOURS and SESSION_ABSOLUTE_HOURS to stay logged in longer. Existing tokens are rejected and deleted on the next request.
• [SECURITY] ui: revoked sessions are recorded in the session store (Redis when enabled) instead of a file outside the persistent volume, where recreating the container forgot every revocation and revocations never reached other replicas. Wipe other sessions and the password-change cleanup now keep the session you are using instead of the newest one.
• [FEATURE] crowdsec: every CROWDSEC_* setting is now multisite, so services on one instance can use different Local API and AppSec endpoints, or only one of the two. Set CROWDSEC_API to an empty string for a service to keep AppSec inspection without the decision lookup. Cached decisions are keyed by Local API, so services pointing at different CrowdSec instances no longer read each other's. See the CrowdSec documentation for per-service examples.
• [FEATURE] ui: a Validate certificate button on the custom certificate settings checks the pasted or uploaded pair before the service is saved, reporting a mismatched or encrypted key, expiry, and a server name the certificate does not cover. A certificate given as a path is still only checked by the scheduler, which is the only component that can read it. (Refs #3630)
• [BUGFIX] letsencrypt: an ACME account the certificate authority no longer accepts, or that was removed locally, is replaced instead of leaving every renewal failing forever with AccountNotFound. A deactivated account was not even recognized as the cause, because only one of the two rejections the authority can send was matched. The account is now retired, a new one registered, and every renewal configuration moved onto it in the same run, on renewal as well as on issuance. The retired account is kept aside for 30 days rather than deleted, so its key stays available. No certificate is re-issued and the repair itself costs no request. (Fixes #3783)
• [BUGFIX] letsencrypt: DNS credential items are split on any whitespace and the key is no longer taken verbatim, so a leading space or a quoted key stops silently discarding the credential; an invalid one now names the missing setting instead of logging [('', 'value_error')]. (Refs #3783)
• [BUGFIX] letsencrypt: one service no longer ends the job for all the others, whether its renewal configuration is missing, unreadable, or it fails unexpectedly in the default non-concurrent mode, which also skipped the cache save. Certbot output is logged in full instead of being cut short whenever certbot writes faster than the job reads, which hid the failure reason, and a renewal that stops responding is killed after 15 minutes; the timeout existed but could never fire. (Refs #3783)
• [BUGFIX] letsencrypt: skip services whose only names are IP addresses or single-label hosts, which no public CA can issue for, instead of asking for a certificate on every run and keeping the job red for every other service. (Refs #3772)
• [BUGFIX] letsencrypt: when listing the existing certificates fails, keep the ones already on disk instead of deleting and re-issuing every certificate, which burned the ACME rate limits on each restart. (Refs #3773)
• [BUGFIX] scheduler: push the configuration before running the jobs on every change, not only on the first start, so a new service already has its server{} when certbot-new asks Let's Encrypt to validate it. (Fixes #3772)
• [BUGFIX] scheduler: wait for an instance to answer before pushing the initial configuration, instead of leaving it on its loading configuration (no service, no certificate) until the once-jobs finish. (Refs #3773)
• [BUGFIX] ssl: AUTO_REDIRECT_HTTP_TO_HTTPS and REDIRECT_HTTP_TO_HTTPS no longer redirect the ACME challenge, which made an HTTP-01 validation depend on port 443 being reachable. (Refs #3772)
• [BUGFIX] core: deleting a plugin's cache entry no longer empties that plugin's cache directory on disk. For Let's Encrypt this destroyed the ACME accounts, archives and live certificate links, which is what the Cache page was being recommended for. (Refs #3635)
• [BUGFIX] core: a setting left empty no longer renders a directive with no argument, such as gzip_proxied ;, real_ip_header ;, proxy_no_cache ; or proxy_cache_bypass ;, which nginx refuses to start on. An empty SERVER_NAME in single-site mode now renders no server at all, as multisite already did.
• [BUGFIX] core: KEEP_CONFIG_ON_RESTART is no longer listed as a setting. It is read by the entrypoint before the database is reachable, so setting it from the web UI never had any effect; set it in the environment, or in /etc/bunkerweb/variables.env on Linux, as before.
• [BUGFIX] core: application-generated upstream 403 responses remain in access logs without appearing as unknown Security Reports or being reported to BunkerNet.
• [BUGFIX] core: appending to a list in a full shared dictionary evicts only what the append needs instead of overwriting the whole list, and reports a readable error when there is nothing to evict. A saturated antiddos_metrics zone was holding PRO anti-DDoS IPs over the threshold and aborting the logging phase for first-seen ones.
• [BUGFIX] metrics: MAX_LRU_HISTORY really caps the per-worker metrics cache: it is applied in every worker instead of a single one, the Redis sync no longer reverses the cache ordering on every pass (which evicted the busiest counters first), and an evicted counter is deleted from Redis instead of being left there with its last value forever. (Refs #3758)
• [BUGFIX] metrics: badbehavior, authbasic and limit no longer build metric keys from request data, where one cache slot per client IP, username or URI let a scan flood evict every other plugin's metrics. Blocked requests are counted per path instead of per full URI, and the limit top URLs chart shows the matched rule instead of the raw URI. (Refs #3475, #3758)
• [BUGFIX] limit: the local copy of the rate-limit counters written when Redis is enabled now expires with its window instead of never, where one permanent entry per client and URL filled the shared memory zone and evicted other plugins' data.
• [BUGFIX] modsecurity: a request declaring an XML Content-Type with no body is no longer denied with a 400. Rule 200000 arms the XML processor from the header alone, so the empty body failed to parse and 200002/200005 blocked it, which broke WebDAV and SOAP clients. Genuine parse failures, including chunked bodies, are still blocked. (Refs #3682)
• [BUGFIX] modsecurity: USE_MODSECURITY_GLOBAL_CRS no longer breaks the configuration when no service is defined yet, where an empty allowed-methods list surfaced as a syntax error in the CRS setup file. (Fixes #3761)
• [BUGFIX] customcert: validate the private key and its pairing with the certificate. Only the certificate was parsed, so a malformed, encrypted or mismatched key was shipped and the service silently served the default certificate instead. Expiry only warns. (Refs #3630)
• [BUGFIX] reverseproxy: a REVERSE_PROXY_URL starting with ^ or ending with $ renders as a regex location instead of a prefix that broke the configuration or matched nothing. (Fixes #3768)
• [BUGFIX] ui: settings on a service created by the setup wizard can be edited again. Every change was silently discarded, with no error and the old value redrawn, because the wizard's own method was not recognized as compatible with the UI's. (Fixes #3751)
• [BUGFIX] ui: CSV, Excel and clipboard exports no longer contain raw HTML; the formula-injection guard had replaced the formatters that strip it. (Fixes #3770)
• [BUGFIX] ui: serve /favicon.ico; the 404 counted toward the badbehavior threshold and could ban an administrator out of the web UI on default settings. (Refs #3759)
• [BUGFIX] ui: stopping the temporary setup web UI no longer raises a TypeError in the signal handler. (Fixes #3345)
• [BUGFIX] autoconf: write IPv6 load balancer addresses to the Ingress and Gateway status as addresses, not hostnames, which Kubernetes rejected with a 422 on dual-stack clusters. (Fixes #3771)
• [BUGFIX] cli: bwcli ban and bwcli unban reported success even when every instance refused the request, so a ban that was never lifted looked lifted. (Fixes #3759)
• [BUGFIX] linux: commands dropped to the nginx user get a writable HOME instead of root's, which made SSL PostgreSQL connections fail on an unreadable /root/.postgresql/postgresql.crt. (Fixes #3354)