v1.0.3

Performance (#47, #49)

• Keep-alive connection pools to backends, batched access logs, leaner Lua request path: about 4–5× the throughput of 1.0.2 (78% of plain nginx with default settings, 56% with every protection on). See docs/benchmark.md.

Proxy

• Custom locations: send paths of a proxy host to other backends, imported from NPM (#54)
• Streams: TCP/UDP port forwarding, optional TLS for TCP, imported from NPM (#57)
• Redirection hosts, imported from NPM (#37)
• IPv6 listeners when the system has IPv6 (CORVUS_IPV6=auto|on|off) (#58)
• Per-host maximum upload size and upstream timeout; gzip compression of text responses, on by default (#59)
• Replace an uploaded certificate in place, keeping its hosts (#60)
• Larger proxy buffer defaults (fewer 502 "upstream sent too big header"), PUID / PGID (#24, #25)

Security

• Security rule action "challenge" (JavaScript proof of work / cookie check) and "under attack" mode (#42, #44)
• Ban on bad behaviour immediately, per host (#40)
• IP and User-Agent lists from URL feeds (#41)
• Security header presets and cookie flags per proxy host (#39)
• Automatic bans: repeat offenders get longer bans (up to 30 days), optional permanent bans, "Make permanent" button (#22, #23)

Console and operations

• Backup and restore (#36), custom block and error pages (#38)
• Traffic logs: click a row for details (User-Agent, rule) (#50)
• Access queue: "please wait" answers to API requests are 429 instead of 503, so they no longer count as server errors (#52)

Upgrade notes

• Gzip is now on for existing hosts; turn it off per host if needed.
• Request logs in the console can appear up to 0.5 s late (batched).
• Backend names are re-resolved every 30 s instead of per request.
• Advanced configs that use $proxy_host now see corvus_up_<id>.
• Streams on a bridge network need their ports published in docker-compose.yml (see README).

Image: ghcr.io/corvus-gateway/gateway:1.0.3 (also latest).

v1.0.3-rc.1

Release candidate for 1.0.3 (testing).

Performance (#47, #49)

• Keep-alive connection pools to backends, batched access logs, leaner Lua request path: about 4–5× the throughput of 1.0.2 (78% of plain nginx with default settings, 56% with every protection on). See docs/benchmark.md.

New features

• Backup and restore from the console (#36)
• Redirection hosts, imported from NPM too (#37)
• Custom block and error pages (#38)
• Security header presets and cookie flags per proxy host (#39)
• Ban on bad behaviour immediately, per host (#40)
• IP and User-Agent lists from URL feeds (#41)
• Security rule action "challenge" (JavaScript proof of work / cookie check) (#42)
• "Under attack" mode, manual or automatic (#44)

Bans (#22, #23)

• Repeat offenders get longer bans (up to 30 days), optional permanent bans after N offenses, and a "Make permanent" button.

Other

• PUID / PGID, larger proxy buffer defaults (fewer 502 "upstream sent too big header"), custom ACME CA documented (#27)
• Benchmark workflow (#46), README translations synced (#48)

Notes

• Request logs in the console can appear up to 0.5 s late (batched).
• Backend names are re-resolved every 30 s instead of per request.
• Advanced configs that use $proxy_host now see corvus_up_<id>.

Image: ghcr.io/corvus-gateway/gateway:1.0.3-rc.1 (does not move latest).

v1.0.2

Changes

• More DNS providers for Let's Encrypt DNS-01: DigitalOcean, DuckDNS, Gandi, GoDaddy, Hetzner and Namecheap, in addition to Cloudflare. Credentials use the same certbot keys as Nginx Proxy Manager, and NPM certificates using these providers are imported with automatic renewal. No new dependencies. (#19, #20)
• Actionable alerts: active alerts on Alerts show their description. Alerts about an IP (possible scanner, attack source) link to that IP's request log and offer a 24-hour ban; host alerts link to the host's traffic; certificate, access queue, deployment and sign-in alerts open their page. The traffic page accepts ?tab=, ?range=, ?host= and ?q=. (#17, #18)
• "Cache DB" instead of "Redis" in the console and alert messages — the built-in store is Valkey. API fields, rule ids, metric names and CORVUS_REDIS_* settings are unchanged. (#15, #16)

Upgrade

docker compose pull && docker compose up -d

Image

ghcr.io/corvus-gateway/gateway — tags 1.0.2, 1.0, 1, latest · linux/amd64 and linux/arm64, signed with Sigstore, with SLSA provenance and SBOM.

v1.0.1

Fixes found while migrating a real Nginx Proxy Manager server.

Changes

• Forward hosts work like in NPM. 127.0.0.1 / localhost now mean the Docker host when Corvus runs on a Docker network, and names added with extra_hosts (e.g. host.docker.internal) work. Container names and private IPs work as before. See Forward hosts. (#12, #13)
• network_mode: host works. The gateway binds ports 80/443 without root (it keeps only CAP_NET_BIND_SERVICE), and the DNS resolver is taken from /etc/resolv.conf. If the host already uses port 6379, set CORVUS_REDIS_PORT. (#11, #13)
• NPM import from MySQL/MariaDB. NPM installations configured with DB_MYSQL_* can be imported; the connection is read-only and the password isn't stored. (#8, #9)
• Clear NPM import errors. The import page shows the actual reason (missing mount, permission denied, non-SQLite database) instead of a generic message. (#7)
• Docs: step-by-step NPM migration guide for SQLite and MySQL/MariaDB setups; HTTP API reference (docs/API.md).

New settings: CORVUS_REDIS_PORT, CORVUS_RESOLVER, CORVUS_LOOPBACK=container (keeps 127.0.0.1 pointing at the container).

Upgrade

docker compose pull && docker compose up -d

Forward hosts set to 127.0.0.1/localhost now reach the Docker host instead of the container itself. To pick up the new address mapping for existing hosts, save any proxy host once (or use Deployments → Redeploy).

Image

ghcr.io/corvus-gateway/gateway — tags 1.0.1, 1.0, 1, latest · linux/amd64 and linux/arm64, signed with Sigstore, with SLSA provenance and SBOM.

v1.0.1-rc.2

Release candidate for 1.0.1 (testing).

• Forward hosts work like in NPM: 127.0.0.1 / localhost mean the Docker host; names from extra_hosts work (#12, #13)
• network_mode: host works: ports 80/443 bind without root, resolver taken from /etc/resolv.conf (#11, #13)
• NPM import: MySQL/MariaDB installations (#8, #9); clear errors when the data path can't be read (#7)

Image: ghcr.io/corvus-gateway/gateway:1.0.1-rc.2 (does not move latest).

v1.0.1-rc.1

Release candidate for 1.0.1 (testing).

• NPM import: NPM installations that use MySQL/MariaDB can be imported (#8, #9)
• NPM import: the actual reason is shown when the data path can't be read (#7)

Image: ghcr.io/corvus-gateway/gateway:1.0.1-rc.1 (does not move latest).

Corvus AWPG 1.0.0

First stable release of Corvus AWPG — a self-hosted gateway that is as easy to run as Nginx Proxy Manager and also watches, protects and controls the traffic that passes through it.

Install

services:
  corvus:
    image: 'ghcr.io/corvus-gateway/gateway:1'
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '9443:9443'
    volumes:
      - ./data:/data

docker compose up -d
docker compose logs corvus | grep setup_token

Open https://<your-server>:9443, enter the token and create the first administrator. Full setup, the hardened variant and NPM migration are in the README.

Upgrade: docker compose pull && docker compose up -d

Highlights

• Proxy & TLS — proxy hosts, Let's Encrypt (HTTP-01 / Cloudflare DNS-01) with auto-renewal, real client IP behind Cloudflare and proxies, per-host password protection, validated atomic deploys with rollback
• Corvus Sentinel — security rules (IP, IP list, country, path, query, method, header → block / allow / log), request body inspection, one-click CVE virtual patches, signed managed-rule updates, automatic IP bans, rate limits with dry run
• Access Queue — capacity-based admission with a fair queue, fail-open / fail-closed, live counts, emergency release, waiting page in 8 languages
• Monitoring — live RPS, status codes and latency, per-host and per-path stats, request log search and export, persistent history with retention and log rotation, alerts (Slack, Mattermost, Discord, Teams, Telegram, webhooks), Prometheus /metrics
• Administration — roles, MFA, OIDC SSO, API tokens, admin-console allowlist, audit log, Nginx Proxy Manager import, console in 8 languages
• One container — gateway, console and the access-queue store (embedded Valkey) in one image, running as an unprivileged user; OpenResty 1.31.8.1 built from signature-verified sources

Image

ghcr.io/corvus-gateway/gateway — tags 1.0.0, 1.0, 1, latest · linux/amd64 and linux/arm64

Each architecture is smoke-tested before publishing. The image is signed with Sigstore (keyless) and carries SLSA build provenance and an SBOM:

gh attestation verify oci://ghcr.io/corvus-gateway/gateway:1.0.0 -R corvus-gateway/corvus