v1.12.0

v1.12.0

Upgrading

• Your existing webhook keeps working. It is migrated automatically into a channel named
  Webhook on first start, with every category enabled, so nothing goes quiet. No action needed
• Webhook messages now carry a real title. Previously the message text was used as the title,
  most visibly on Discord where it filled the embed title. Messages now have a title and a body,
  so Discord, Gotify, Pushover, Pushbullet and Telegram all render a proper heading. If you parse
  webhook payloads with a script, check it still reads what you expect
• Background checks start reporting on their own. An instance nobody has open now raises
  notifications for certificate expiry, Traefik going unreachable, agents dropping out and new
  releases. If that is more than you want, narrow the categories on each channel or set quiet
  hours under Settings - Notifications

Fixes

• A service whose servers entry was written as a bare string rather than a mapping crashed the whole Routes tab with a 500, on the Host and through an agent. One malformed service hid every other route in that file. The address is now read as written (#119)
• Failures said "Check the connection and try again" no matter what went wrong, while the server already knew the reason and the interface discarded it. An unreachable agent now says so, a rejected credential says so, and a stopped Traefik Manager says so. Applies across every tab
• The Plugins tab reported "Static config not configured on this agent" when the agent was simply unreachable, sending you to check a setting that was fine
• The Logs feed listed oldest first, so with auto refresh on you had to scroll to the bottom to see what had just arrived. It now lists newest first (#156)
• A hand written serversTransport was overwritten or deleted when its route was saved. Traefik Manager names the transport it manages <service>-transport, so a transport you named the same way was treated as its own: unticking Skip TLS verification stripped insecureSkipVerify, and saving with the streaming preset off removed the whole forwardingTimeouts block. It now only touches transports it created (#152)
• Disabling built-in authentication warned that anyone could reach the interface even when OIDC was enabled and still protecting it (#153)
• The CrowdSec tab missed roughly half of all new local bans. Both Gunicorn workers polled the LAPI with the same bouncer key, sharing one server-side cursor, so whichever polled first consumed the delta and the other never saw those decisions. One process now owns the poll and the workers read a shared cache
• The trusted proxy helper opened behind the Settings window when the static config editor is shown in Settings
• Notifications were being lost. Each Gunicorn worker kept its own copy of the log and overwrote the file with it, so whichever worker saved last erased anything the other had recorded, and the bell count changed depending on which worker answered. Writes now merge under a lock. Adds an empty notifications.yml.lock to the config directory
• A password over 72 bytes was rejected with a server error instead of a message. Only the 8 character minimum was checked and bcrypt refuses anything longer, so about 40 accented characters was enough to trigger it. Setup, the forced change screen, the password reset and the API now all report the limit
• A service used only by a weighted, mirroring or failover pool was deleted when an unrelated route was removed or disabled. Traefik Manager checked which routers pointed at a service, but never looked inside composite services, so a hand-written pool was left referencing a service that no longer existed. Composite children are now protected, as is a service that only a disabled route still references
• Editing a route while it was disabled returned a server error and saved nothing. It has been broken since v1.5.0
• Cloning a route whose service is a composite copied the placeholder N/A into the new route's backend, creating a service pointing at http://N/A:80. The backend fields are now left empty for you to fill in
• A highestRandomWeight service was reported as an editable load balancer. Its target field appeared editable while every change was silently discarded on save. It is now marked read-only like the other composite types, and named correctly in the route and service detail panels
• The service detail panel claimed Pass Host Header: true for composite services, which have no such setting
• Enabling a route whose service lives in another provider wrote an empty service block into the config
• Switching servers left the previous host's services in the route form's service picker
• Rotating an agent's API key locked you out of that agent. The new key was generated and saved, but the interface read it from the wrong place, reported "The server did not return a new key" and never showed it. The agent was then unreachable with a key nobody had seen. Rotation now shows the key
• Opening an agent's settings and pressing Save wiped its Git backup configuration whenever Git backup was switched off. The repository, branch and username were never loaded into the form, then written back as blanks
• Renaming an agent could move its backups to another agent's branch. When an agent has no explicit branch, its branch comes from its name, and the collision check only ran when the branch field itself was edited. Two agents sharing a branch overwrite each other's configuration in your Git repository on every push. Renaming is now checked the same way
• Renaming an agent showed "Agent renamed" followed immediately by "Update failed". The rename had worked
• The restart method showed no selection when opening an agent's settings, so a configured agent looked unconfigured. Clicking a method to correct it wiped the real one
• The Traefik API URL and dynamic config path could not be cleared - reopening the form showed the default again
• Copy buttons in the agent panel did nothing at all when Traefik Manager is served over plain HTTP, with no explanation. They now say what happened
• Channels set to an hourly or daily digest never sent anything. Messages were queued correctly and nothing ever emptied the queue, so the report was never built or delivered. The same queue holds messages raised during quiet hours, so those were lost too. A background job now sends each report once its window closes, and a channel you have switched off is skipped rather than being sent whatever it had waiting. Events too old to belong in the next report are discarded, so upgrading does not deliver a backlog of stale summaries
• Traefik update notices for agents arrived again on every sign-in. The check ran in the browser and remembered what it had announced only for the life of the tab, so a new session repeated every notice. It now runs on the background schedule with the Host's own update check and announces each release once, whether or not anyone has the interface open
• Entry points offered a header option your Traefik may not have. No 3.6.x release has underscoreHeadersStrategy, but the form offered it from 3.6.20 onwards. Saving it wrote a key Traefik rejects outright - field not found - so the next restart left the proxy down. The option is now offered only on the versions that actually have it
• Header alias hardening. Traefik 3.7.12 replaces underscoreHeadersStrategy with aliasHeadersStrategy, which covers every aliased spelling rather than underscores alone. The entry point form writes whichever one your Traefik supports, and reads either. Running a version affected by GHSA-rf44-j88r-hh8c now shows a security advisory naming the release to upgrade to, flagged as high priority when a forwardAuth middleware is in use
• Filter the notification drawer by category. Each entry now shows which category it came from, and a chip row above the list narrows it to one, with a count per category. The row only appears once there is more than one category to choose between
• The About page went blank once GitHub's rate limit was hit. Every browser asked GitHub directly for the latest release, so 60 page loads an hour was the ceiling per person, and the failure was silent: the version, the release notes and the Traefik version all sat behind the same request and simply never arrived. The server now looks the release up once an hour for everyone, and says so when GitHub is unavailable instead of showing nothing

Features

• Multiple notification channels. Discord, Slack, ntfy and generic webhooks are joined by Gotify, Pushover, Pushbullet and Telegram, and you can configure as many as you like instead of one. Your existing webhook is migrated automatically into a channel named Webhook
• Control over what each channel hears. Per channel: which categories (config, backups, security, Traefik, certificates, CrowdSec, agents, updates), a minimum severity, a digest schedule, and quiet hours
• Quiet hours queue rather than drop. Anything raised inside the window is held, and at the end you get one report per channel that collapses it by category, not a burst of everything held back
• Background monitoring. Traefik reachability, certificate expiry at 14, 3 and 0 days, agent health, CrowdSec activity, GeoIP staleness and new releases are now checked server-side on a schedule. Previously nothing was watched unless a browser tab was open
• CrowdSec alerts are aggregated by design. One message per window naming the worst source and scenario, never one per ban. A typical instance carries tens of thousands of community blocklist decisions and only a handful earned locally
• Browser notifications. Opt-in desktop alerts while a tab is open, under Settings - Notifications
• Multi-server monitoring. Certificates, Traefik reachability and CrowdSec are watched on every registered agent, not just the Host. Messages name the server that raised them, and an unreachable agent reports once instead of once per check
• Choose your own password when you reset it. flask reset-password now takes the password you want, typed at a hidden prompt, piped in on stdin or passed inline, instead of only printing a random temporary one. You log straight in with it: no forced change screen, and /setup is left closed