bunkerity/bunkerweb v1.6.15 on GitHub

Documentation : https://docs.bunkerweb.io/1.6.15/

Docker tags :

All-in-one : bunkerity/bunkerweb-all-in-one:1.6.15 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.15
BunkerWeb : bunkerity/bunkerweb:1.6.15 or ghcr.io/bunkerity/bunkerweb:1.6.15
Scheduler : bunkerity/bunkerweb-scheduler:1.6.15 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.15
Autoconf : bunkerity/bunkerweb-autoconf:1.6.15 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.15
UI : bunkerity/bunkerweb-ui:1.6.15 or ghcr.io/bunkerity/bunkerweb-ui:1.6.15
API : bunkerity/bunkerweb-api:1.6.15 or ghcr.io/bunkerity/bunkerweb-api:1.6.15
GitLab mirror : registry.gitlab.com/bunkerity/bunkerweb/<image>:1.6.15 (same digests)

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.15&filter=all&dist=

Changelog :

Security

[SECURITY] jobs: folder caches and Let’s Encrypt imports are now verified link by link on disk, preventing relative symlink chains from escaping the cache directory. Invalid archives are refused and the previous cache is preserved. (Fixes #3930)
[SECURITY] reverseproxy, grpc: values rendered into NGINX directives now reject characters that can terminate or escape the directive, preventing configuration injection through upstream, header and include settings. Shipped defaults are unaffected.
[SECURITY] ui: escape and sanitise user-controlled data in flash messages, settings editors and session details, closing script injection paths through service and custom-config names.
[SECURITY] jobs: ASN and country MMDB downloads are verified against DB-IP checksums over host- and size-bounded transfers. Failed verification keeps the existing database instead of caching an unchecked file.
[SECURITY] api: moving a custom config with PATCH /configs now requires config_update on the destination service. Omitting service keeps the current service instead of moving the config globally.
[SECURITY] api, ui: cache deletion marks a plugin changed only when rows were actually deleted, and cache_delete can no longer trigger another plugin’s jobs.
[SECURITY] kubernetes: example manifests now load API_TOKEN from a Secret and include a NetworkPolicy restricting port 5000 to the Scheduler and Web UI.
[SECURITY] mtls: unverified clients are no longer accepted before the CA bundle arrives. Invalid CA or CRL replacements keep the last working material, while removals take effect on reload.
[SECURITY] crowdsec: use SHA-256 cache namespaces, make /crowdsec/ping query the Local API directly, and fail closed when per-service CAPTCHA providers fail.
[SECURITY] whitelist: USE_WHITELIST=no no longer removes an active ban, and the global WHITELIST_IP fallback only applies when whitelisting is globally enabled.
[SECURITY] core: KEEP_CONFIG_ON_RESTART=yes no longer leaves an instance stuck in its loading state with Lua plugins skipped after a restart. Affects 1.6.14 only.
[SECURITY] modsecurity: reject the RFC 2231 filename* multipart parameter, which could hide a malicious filename from the WAF.
[SECURITY] api: instances_create and instances_update are now treated as admin-equivalent operations because registered instances receive configuration and TLS keys.
[SECURITY] ui: update DOMPurify to 3.4.14, fixing DOM clobbering and sanitizer bypasses.

Features

[FEATURE] grpc: expand the plugin to match Reverse Proxy configurability, including client response headers, pass/ignore headers, underscores in headers, buffer and body-size controls, auth_request and upstream TLS verification.
[FEATURE] reverseproxy, grpc: support presenting a client certificate to upstreams for mutual TLS, with configurable upstream CRL, TLS protocols and ciphers. The Scheduler validates and distributes the material.
[FEATURE] crowdsec: investigate IPs, inspect allowlists and remove decisions through the Web UI and API, with richer report details and on-page allowlist guidance.
[FEATURE] antibot, blacklist, whitelist, greylist, dnsbl, country: match on a request header name and optional PCRE value regex as an ignore or list criterion. Header values are stored as password settings and are never logged or cached.
[FEATURE] reverseproxy: add per-URL REVERSE_PROXY_MAX_CLIENT_SIZE, controlling both request body size and the ModSecurity body limit.
[FEATURE] installer: Docker Full installs can optionally configure a local syslog-ng collector with persistent storage, exposing BunkerWeb and component logs in the Web UI while retaining normal Docker logs.
[FEATURE] ui: add UI_USE_REDIS=no to disable Redis only for the Web UI without disabling the global Redis-backed sharing of bans and reports.
[FEATURE] ui: individual settings can now remain as drafts in the RAW editor, with explicit activation and inherited/default effective values. (Refs #3631)
[FEATURE] modsecurity: add opt-in Concurrent audit logging with instance-side storage validation. (Fixes #3891)
[FEATURE] sessions: reject a destroyed cookie session on its next use, locally or cluster-wide when Redis is enabled.
[FEATURE] all-in-one: rotate log files with logrotate; mount /etc/logrotate.d/bunkerweb to provide a custom policy.
[FEATURE] modsecurity: add MODSECURITY_SEC_AUDIT_LOG to configure the audit log path under /var/log/bunkerweb.
[FEATURE] installer: install-bunkerweb.sh --docker can upgrade Docker stacks it previously generated in place, backing up the database and preserving secrets, ports and Compose edits while refusing downgrades.

Performance

[PERFORMANCE] errors: reduce inline SVG whitespace on error pages without changing their artwork.

Bug fixes

Scheduler, core, jobs and cache

[BUGFIX] scheduler: acknowledge configuration changes before rendering them, ensuring a write received while previous once-jobs are still running gets its own job cycle instead of being rendered without its jobs.
[BUGFIX] scheduler, ui: validate manual plugins before database updates and preserve rejected plugin folders and stored configuration during scans/restores. Unchanged sibling plugins are retained and config-saver exit codes are logged. (Refs #3303)
[BUGFIX] jobs: folder caches containing valid relative symlinks, including Let’s Encrypt live/ links, restore from the database again while absolute and escaping links remain rejected.
[BUGFIX] backup: use a real flock for database operations. Concurrent backup, restore or Scheduler operations wait up to 30 seconds and then report the database as busy instead of stealing an active lock.
[BUGFIX] scheduler: configuration and cache push timeouts scale with the number of services; folder uploads have their own body timeout, and an explicit SEND_FILES_MIN_TIMEOUT is no longer capped at 120 seconds. (Fixes #2924)
[BUGFIX] scheduler: retry a busy instance returning 503, repush instances that return to loading, and avoid evicting healthy instances when another push fails.
[BUGFIX] scheduler: once-jobs wait until an instance receives its configuration, custom-config edits survive failed writes, and skipped healthchecks no longer leave processing stuck.
[BUGFIX] scheduler: cache restoration retains a recoverable backup, cleanup is confined to the cache directory, and permission repair skips child symlinks.
[BUGFIX] scheduler: failed configuration publications use backoff instead of retrying on every tick, and each applied change is published only once.
[BUGFIX] scheduler: propagate CUSTOM_LOG_LEVEL to the generator and stop pushing a bare IPv6 instance twice.
[BUGFIX] scheduler: systemctl reload bunkerweb-scheduler now rereads /etc/bunkerweb/configs instead of overwriting manual changes until restart.
[BUGFIX] scheduler: config-saver and generator output follows the Scheduler logging destination instead of going separately to the journal on Linux.
[BUGFIX] scheduler: skip custom configuration files nested too deeply instead of importing them under the wrong config type.
[BUGFIX] scheduler: multi-line values survive variables.env instead of being truncated and written back over working values such as certificates. (Fixes #3835)
[BUGFIX] core: configuration push swaps no longer run during reloads, keep their digest outside the pushed tree and do not restore their own bookkeeping.
[BUGFIX] core: failed push-swap rollbacks preserve unrestored entries under .bw-rescue. instead of deleting them.
[BUGFIX] core: variables files no longer fold a following variable into the previous setting and correctly preserve URL-safe base64 and PEM chains.
[BUGFIX] core: Lua has_variable falls back to the global value, and eviction of an unexpired shared-dict entry is logged with the affected setting.
[BUGFIX] core: a cache event lost because a shared dictionary is full no longer makes every subsequent request wait for it, which previously added roughly 0.3 seconds per request until restart.
[BUGFIX] jobs: unchanged folder caches now produce identical bytes instead of rewriting the complete blob on every reload.

API and database

[BUGFIX] api: PATCH /services/{service} now performs service renames and setting updates atomically, preserves custom configs, per-service settings and job cache, and rejects unknown/global-only variables. Services owned by the environment, Autoconf or the wizard cannot be renamed through this endpoint.
[BUGFIX] database: compute missing custom-config checksums to prevent save failures and configuration loss during service renames. (Refs #3893)
[BUGFIX] database: initialize by reflecting only BunkerWeb-owned tables, preventing an unreadable unrelated MariaDB table from aborting startup.
[BUGFIX] db: save_config no longer empties the configuration object it receives, which made Autoconf reload on every reconcile, and query-string credentials are masked in logs.
[BUGFIX] db: upgrading MariaDB/MySQL databases originally created by 1.5.6 no longer fails on the differently named bw_jobs_cache foreign key.
[BUGFIX] api: reject plugin IDs beginning with .bw-, return 502 when an instance call fails, and give folder pushes their own body-write deadline.
[BUGFIX] api: service conversion now checks service_convert, and an explicitly empty template is returned as empty instead of being reported as the global template.

Web UI and sessions

[BUGFIX] ui: keep serving sessions when Redis becomes unavailable after startup by falling back to a local per-host session store, then return to Redis when it recovers.
[BUGFIX] ui: a session changed or destroyed while Redis is unavailable can no longer be replaced by Redis’s older copy after recovery; the local copy wins and is written back.
[BUGFIX] ui: store flash messages as plain strings so Redis-backed sessions can serialise them; previously USE_REDIS=yes could make every login return 500.
[BUGFIX] ui: use one Redis client per worker instead of one per request and reduce writes for unchanged sessions to once per quarter of their lifetime.
[BUGFIX] ui: persist TOTP replay counters in the database across workers and replicas; read-only databases no longer lock users out of 2FA.
[BUGFIX] ui: align CSRF token lifetime with session lifetime so forms left open for more than one hour no longer log users out as expired. (Refs #2359)
[BUGFIX] ui: allow settings that have never previously been set to be drafted from the RAW editor.
[BUGFIX] ui: the Reports table shows the CrowdSec investigation action only for CrowdSec reports, alongside the ban action rather than replacing it.
[BUGFIX] ui: the Reports view continues past discarded Redis entries instead of hiding valid rows behind them. (Refs #3685)
[BUGFIX] ui: METRICS_MAX_BLOCKED_REQUESTS_REDIS=0 keeps reports out of Redis while allowing Reports, Dashboard and the metrics endpoint to read them from instances.
[BUGFIX] ui: read the reports list length only once per scan and fetch the writer certificate in one round trip; a failed config read no longer authorises scanning ten times the configured window.
[BUGFIX] ui, cli: ban listings scan Redis in batches of 1000 and pipeline value retrieval; the bans page merges instance bans in linear time.
[BUGFIX] ui, cli: honor REDIS_SSL_VERIFY, allowing TLS Redis instances using a private CA to work from both interfaces.
[BUGFIX] ui: the session-expired notice survives redirects to /setup, follows the selected language and all locales contain the complete key set.
[BUGFIX] ui: theme, language and table-column changes are no longer lost when a link is followed immediately afterward.
[BUGFIX] ui: saving a custom config containing an XSS rule pattern no longer triggers the Web UI’s own CRS rules.
[BUGFIX] ui: stop showing HTML entities in validation errors and tooltips.
[BUGFIX] ui: remove broken source-map references that could cause bans when browser developer tools were opened. (Fixes #3896)
[BUGFIX] ui: avoid false success notifications after failed service saves, surface background errors and prevent crashes when adding a custom config. (Refs #3893)
[BUGFIX] ui: fix the raw {{pro_services}} placeholder shown in the PRO licence-limit alert.
[BUGFIX] ui: certificate validity dates from Let’s Encrypt are now displayed using timezone-aware properties instead of being shifted outside UTC. (Fixes #3839)

Redis and metrics

[BUGFIX] redis: pooled connections no longer re-authenticate and re-select the database on every use, and ban checks fetch both Redis keys together, reducing the default request path from seven round trips to two. Locally cached bans remain enforced while Redis is unreachable.
[BUGFIX] redis: REDIS_KEEPALIVE_POOL now defaults to 64 per NGINX worker; size Redis maxclients according to WORKER_PROCESSES × REDIS_KEEPALIVE_POOL × instances.
[BUGFIX] metrics: rebuild request facets once across workers and instances and retain precomputed Reports filter counts.
[BUGFIX] metrics: Dashboard IP counts now respect the selected time window and cold counters keep their persisted baseline if the worker cache is full.
[BUGFIX] metrics: refill the Redis Reports list after eviction/deletion, remove existing expiries when METRICS_REDIS_TTL=0, and log failed TTL refreshes.

Reverse proxy, gRPC and headers

[BUGFIX] reverseproxy: custom upstream request headers replace generated defaults with the same case-insensitive name instead of being sent alongside them. (Fixes #3936)
[BUGFIX] grpc: custom upstream request headers likewise replace generated defaults, and X-Forwarded-Protocol is now forwarded consistently with Reverse Proxy.
[BUGFIX] reverseproxy, grpc: validate every certificate in trusted CA bundles, retain cached material on transient failures instead of silently disabling upstream verification, and request a reload when trusted material is removed.
[BUGFIX] reverseproxy, grpc: semicolon-separated header and authentication lists now accept repeated whitespace. (Refs #2577)
[BUGFIX] reverseproxy, redirect, grpc: quote location operands and reject whitespace, ;, {, } and bare location modifiers in location settings.
[BUGFIX] headers: all hardcoded Permissions-Policy copies used by loading pages, the default server, error pages and Web UI now match the plugin default.

Let’s Encrypt and certificates

[BUGFIX] letsencrypt: with LETS_ENCRYPT_PASSTHROUGH=yes, GET or HEAD requests for a single token below /.well-known/acme-challenge/ reach the backend without ModSecurity, bans, Antibot or other checks. (Fixes #3927)
[BUGFIX] letsencrypt: preserve the full base of explicit wildcard names and keep independent wildcard scopes aligned between issuance and certificate loading. Affected services request a new certificate after upgrade. (Refs #3326)
[BUGFIX] letsencrypt: detect wildcard groups mixing hostname depths as misconfigured, and only add the ACME path exception when HTTP challenges are enabled.
[BUGFIX] letsencrypt: quarantine incomplete renewal lineages instead of leaving affected services permanently unable to renew.
[BUGFIX] letsencrypt: wildcard certificates no longer shadow certificates belonging to other services under the same base. (Refs #3841)
[BUGFIX] customcert: skip wildcard SNI fallback when USE_CUSTOM_SSL=no, preventing another service’s certificate from being served. (Fixes #3841)
[BUGFIX] letsencrypt: certificate lookups now ignore hostname case and a trailing dot.
[BUGFIX] letsencrypt: correct certificate-profile validity periods and name limits in setting help and translations, and warn before issuance when a known profile exceeds its name limit. (Refs #3251)
[BUGFIX] letsencrypt: prevent preferred_profile errors in the legacy certificate-list helper. (Refs #3839)

ModSecurity and security plugins

[BUGFIX] modsecurity: show request-body parser denials in Reports with the originating rule ID and HTTP method, without changing enforcement or BunkerNet sharing. (Fixes #3905)
[BUGFIX] modsecurity: failed CRS plugin downloads retain the last complete set and unchanged sets no longer trigger reloads.
[BUGFIX] modsecurity: MODSECURITY_SEC_AUDIT_LOG must end in .log.
[BUGFIX] antibot: add accessible error messages and reload controls for all external CAPTCHA providers. (Fixes #3867)
[BUGFIX] errors: preserve the plugin responsible for blocking a request when a custom error page is configured instead of reporting unknown. (Fixes #3916)
[BUGFIX] bunkernet: back off failed registration attempts exponentially up to 24 hours while retaining the previous exit status. HTTP 429 and 403 remain non-fatal. (Refs #3636)
[BUGFIX] crowdsec: cache prefixes no longer change according to another service’s Local API, and health checks report all failures together.

Kubernetes and Autoconf

[BUGFIX] autoconf: Kubernetes BunkerWeb pods that are running but not yet Ready now receive their configuration, because readiness itself depends on it; pods being deleted are skipped.
[BUGFIX] autoconf: detect stuck Kubernetes watches automatically and skip invalid Ingress or HTTPRoute paths with a warning.
[BUGFIX] kubernetes: example manifests point DNS_RESOLVERS to the kube-dns Service rather than a service name absent from many clusters. (Refs #2524)

Installer, Linux and operational fixes

[BUGFIX] installer: refuse a same-core Docker retag to an older pre-release as a downgrade.
[BUGFIX] installer: Docker upgrades validate image startup, health and restart stability and roll back both generated files on failure. .env uses last-value-wins semantics and a stack that fails to stabilise exits with code 2.
[BUGFIX] installer: rerunning the Docker installer preserves the existing Compose project name and published ports instead of recomputing defaults and orphaning volumes.
[BUGFIX] linux, all-in-one: run log rotation on every pass instead of once per day and retain fourteen generations. (Fixes #3838)
[BUGFIX] cli, linux: bwcli and the pre-upgrade backup also read DATABASE_URI from scheduler.env. (Fixes #3836)
[BUGFIX] cli: bwcli falls back to /etc/bunkerweb/variables.env for DATABASE_URI and rejects database URIs without a scheme. (Refs #3836)
[BUGFIX] linux: abort upgrades when the automatic pre-upgrade backup fails. Use --no-auto-backup to explicitly skip it. (Refs #3836)
[BUGFIX] healthcheck: /healthz reports loading while an instance loads or reloads instead of always returning ok, and the container healthcheck now matches the status exactly.
[BUGFIX] pro: forcing a PRO plugin update reimports the plugins so their pages and hooks are restored.

Configuration and rendering

[BUGFIX] api, ui: settings are now reported as rendered values, and service-specific settings remain effective when a template is selected globally. (Fixes #3866)

UI

[UI] PRO page: add a Refresh UI plugins button that re-extracts PRO plugins from the database and reloads Web UI workers.

Linux / All-in-One

[LINUX] fedora: Fedora 43 packages now build against NGINX 1.30.5, removing the previous 1.30.4 exception.
[ALL-IN-ONE] Update bundled CrowdSec to v1.8.0, including fixes for two datasource denial-of-service issues.

Build and release

[BUILD] release: build release candidates once, test the exact resulting artifacts and promote them by digest with a manifest. Publication requires approval through the release environment by the release owners.

Dependencies

[DEPS] bunkerweb: update NGINX to 1.30.5, fixing CVE-2026-90439, an HTTP/3 buffer overflow. Fedora 43 packages now also build their modules against 1.30.5.
[DEPS] Update lua-resty-session to v4.2.0.
[DEPS] Update LuaJIT to v2.1-20260914.
[DEPS] Update libmaxminddb to v1.14.0.
[DEPS] Update Web UI vendored libraries: ApexCharts 6.10.0 and i18next 26.4.0.
[DEPS] Update build tooling: cssnano 8.0.8 and postcss 8.5.26.

Documentation

[DOCS] templates: document that template values override global settings while service-level settings override the template.
[DOCS] integrations, metrics: document KEEP_CONFIG_ON_RESTART and correct SEND_FILES_MIN_TIMEOUT and DISABLE_ONLINE_API.
[DOCS] crowdsec: document that the All-In-One CrowdSec agent starts only when the unprefixed USE_CROWDSEC=yes setting is enabled.
[DOCS] Add documentation for the Maintenance PRO plugin.

Miscellaneous

[MISC] Add haptics to the default Permissions-Policy header. Override PERMISSIONS_POLICY to allow it.

Contributions

[CONTRIBUTION] Thank you Ayushsinha322⁠ for fixing Concurrent audit validation on inactive scopes. (#3907)
[CONTRIBUTION] Thank you Ayushsinha322⁠ for correcting the ModSecurity audit-log documentation. (#3890)
[CONTRIBUTION] Thank you teguh02⁠ for contributing the Indonesian Web UI translation. (#3859)
[CONTRIBUTION] Thank you robotter112⁠ for fixing wildcard SNI fallback when USE_CUSTOM_SSL=no. (#3842)