bunkerity/bunkerweb v1.6.16

on GitHub

Documentation : https://docs.bunkerweb.io/1.6.16/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.16 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.16
• BunkerWeb : bunkerity/bunkerweb:1.6.16 or ghcr.io/bunkerity/bunkerweb:1.6.16
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.16 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.16
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.16 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.16
• UI : bunkerity/bunkerweb-ui:1.6.16 or ghcr.io/bunkerity/bunkerweb-ui:1.6.16
• API : bunkerity/bunkerweb-api:1.6.16 or ghcr.io/bunkerity/bunkerweb-api:1.6.16
  GitLab mirror : registry.gitlab.com/bunkerity/bunkerweb/<image>:1.6.16 (same digests)

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.16&filter=all&dist=

Changelog :

BREAKING CHANGES

• [BREAKING] METRICS_REDIS_TTL now takes time units: m means minutes, not millions. Values stored in the database are migrated; values set through the environment are not.

SECURITY

• [SECURITY] A restart with KEEP_CONFIG_ON_RESTART=yes keeps every access control enforced instead of disabling most of them until the next configuration push.
• [SECURITY] ui: the Support page configuration export masks password settings and the database password by default; only an admin can export clear values.

FEATURES

• [FEATURE] redis: Redis Cluster support via the new REDIS_CLUSTER_NODES setting.
• [FEATURE] BANS_TLS_DROP_REASONS closes the TLS handshake of banned IPs for the listed ban reasons instead of serving the 403 page.
• [FEATURE] BANS_TLS_DROP_REASONS also drops banned clients at the TLS ClientHello behind PROXY protocol when real IP uses proxy_protocol, trusting the PROXY address only from proxies listed in REAL_IP_FROM.
• [FEATURE] crowdsec: CROWDSEC_BAN_REFRESH turns CrowdSec blocks into short, renewed bans listed on the Bans page and removed with their decisions on Unban.
• [FEATURE] letsencrypt: certificates for public IPv4 addresses in SERVER_NAME, using the shortlived profile and the http challenge. (Fixes #3628)
• [FEATURE] realip, blacklist, whitelist, greylist: IP list URLs also support JSON, JSON lines, CSV and tab-separated lists, with a #key=value filter.
• [FEATURE] ui: an admin-only Web UI Diagnostics bundle is available on the Support page; /support/logs also anonymizes IPv6 addresses and credentials.
• [FEATURE] antibot: ANTIBOT_JAVASCRIPT_DIFFICULTY (16 to 28 bits) raises the JavaScript challenge cost. Regenerate custom JavaScript pages first.
• [FEATURE] antibot: redesigned challenge pages that follow browser preferences (theme, reduced motion, contrast and text size), with a discreet reload link.
• [FEATURE] headers: the default PERMISSIONS_POLICY also denies publickey-credentials-remote-client-data-json.
• [FEATURE] scheduler: a job can exit with code 3 to request a reload while still being reported as failed.

PERFORMANCE

• [UI] Web UI responses are compressed using Brotli/gzip, and static assets carry versioned, long-lived cache headers for faster direct access. The API also gains gzip compression.
• [PERF] ui: the Reports table no longer rebuilds every tooltip on each draw, improving performance and preventing memory growth.
• [PERF] ui: restoring saved hidden columns measures the table once instead of once per column.

BUG FIXES

Security, Access Control & Protection

• [BUGFIX] api: each request counts once against the rate limit instead of accumulating costs until clients receive 429 errors. The rate-limit Redis password is also no longer logged.
• [BUGFIX] antibot: the JavaScript challenge no longer fails on every attempt and loops until the client is rate limited.
• [BUGFIX] crowdsec: serving a CAPTCHA no longer fails with attempt to concatenate a nil value.
• [BUGFIX] ui: with USE_MODSECURITY_GLOBAL_CRS=yes, the Web UI ModSecurity exclusions cover every name in the UI service's SERVER_NAME, not only the first.
• [BUGFIX] ui: a logout sent while Redis is unreachable revokes the session, so the old cookie stays refused once Redis is back.
• [BUGFIX] blacklist: BLACKLIST_IGNORE_USER_AGENT_URLS entries are no longer cut at their first space, which exempted most browsers.
• [BUGFIX] headers: cookie flags such as SameSite=Lax are no longer randomly missing from Set-Cookie.
• [BUGFIX] headers: COOKIE_FLAGS refuses Expires, Domain, Path and entries without a flag, which previously caused reload failures and retained the old configuration.
• [BUGFIX] antibot: fixed the can't get session data error when an earlier plugin already handled the challenge request.
• [BUGFIX] whitelist, greylist, antibot, blacklist: rDNS rules now correctly confirm IPv6 clients instead of treating them as spoofing their reverse DNS. (Fixes #3966)
• [BUGFIX] errors: custom error pages are correctly served to blocked POST and PUT requests instead of returning 405.

Configuration, Database & Scheduler

• [BUGFIX] db: on SQLite, settings written in the same save as a service rename or removal are no longer deleted by reused row IDs, which could leave a renamed service without settings and trigger configuration failover.
• [BUGFIX] ui: renaming a service moves its settings, custom configurations and job cache in one transaction, across all editor modes, instead of deleting and recreating the service and losing its per-service certificates and job cache.
• [BUGFIX] ui, api: editing a service no longer deletes another one sharing a server name; shared server names are now refused.
• [BUGFIX] ui: creating or deleting a service no longer rewrites other services' settings. (Fixes #3986)
• [BUGFIX] ui: renaming a service no longer drops the settings of services whose names start with the old one.
• [BUGFIX] A service without its own SERVER_NAME is named by its ID instead of inheriting the global value, which could produce an invalid server_name ; and cause reload failures or unexpected service deletion/renaming. An empty SERVER_NAME is refused for a service but remains allowed globally.
• [BUGFIX] The scheduler and autoconf log a warning when two services share a server name.
• [BUGFIX] ui: custom configurations with leading/trailing _ or non-ASCII letters can be opened and renamed again instead of failing with "does not exist".
• [BUGFIX] ui: deleting a custom configuration with a digit-only name no longer deletes other configurations of the same service and type on MariaDB.
• [BUGFIX] ui: row actions on the Jobs, Plugins, Templates, Services and Bans pages preserve digit-only IDs as text.
• [BUGFIX] db: large blobs are stored in chunks, so PRO plugin updates no longer require an increased max_allowed_packet on MariaDB/MySQL. (Fixes #3965)
• [BUGFIX] scheduler: a read-only database with pending plugin changes no longer causes the scheduler to crash-loop.
• [BUGFIX] scheduler: the configuration saver and generator run with the scheduler's own Python, preventing failures on RHEL 9 installations using Python 3.9.
• [BUGFIX] jobs: plugin cached files are no longer all loaded at startup, preventing potential scheduler OOM kills.
• [BUGFIX] jobs: the update check stays on the installed release line; a newer line such as 1.7 only logs a link to the upgrade guide.
• [BUGFIX] ui: fixed a startup crash while the database is still migrating (no such column: bw_global_values.is_draft).
• [BUGFIX] pro: plugin files have group and other write permissions removed before checksums are stored, preventing repeated PRO plugin reinstalls when restoring under a group-writable umask. (Fixes #4024)
• [BUGFIX] A PRO force update no longer deletes unchanged PRO plugin pages.
• [BUGFIX] metrics: instances sharing one Redis no longer overwrite each other's metrics; each instance must have a distinct hostname.
• [BUGFIX] metrics: invalid Redis counter values are discarded and rewritten with the live count, fixing recurring Invalid Redis metric counter errors and stalled synchronization on instances upgraded from 1.6.13 or older.
• [BUGFIX] metrics: rebuilding request filters and trimming stored reports now read lists in slices instead of decoding everything inside Redis, avoiding excessive script memory usage and report eviction, particularly after upgrading from 1.6.14.
• [BUGFIX] bunkernet: the queue of unsent reports keeps only the newest 10,000 entries instead of growing without limit.
• [BUGFIX] backup: the built-in backup no longer fails on MySQL 26.x.
• [BUGFIX] autoconf: Gateway API backends use KUBERNETES_SERVICE_PROTOCOL instead of the listener protocol, so an HTTPS listener no longer breaks HTTP backends. (Fixes bunkerity/bunkerweb-helm#121)
• [BUGFIX] autoconf: with KUBERNETES_SKIP_FOREIGN_CLASSES=yes, the Kubernetes controller ignores Ingresses and Gateways whose class belongs to another controller.

TLS, Let's Encrypt & Reverse Proxy

• [BUGFIX] misc: the default server certificate and key are regenerated together when they no longer match, instead of causing every reload to fail. (Fixes #4031)
• [BUGFIX] In single-site mode, every SERVER_NAME entry is served and covered by the certificate, not only the first.
• [BUGFIX] letsencrypt: renewed certificates reach instances immediately after renewal instead of waiting for the next reload.
• [BUGFIX] letsencrypt: adding names to a certificate expands it instead of deleting it first, so a failing new name preserves the current certificate.
• [BUGFIX] letsencrypt: the certbot deploy hook retries a busy instance instead of failing the reload after renewal.
• [BUGFIX] letsencrypt: certbot hooks log the instance API's HTTP status and response instead of raising KeyError: 'status'.
• [BUGFIX] letsencrypt: a passed-through ACME challenge preserves the client's Host header instead of using a fixed REVERSE_PROXY_CUSTOM_HOST. (Fixes #3957)
• [BUGFIX] grpc, reverseproxy: new or rotated upstream CA, CRL or client certificate files are applied even when another service's files fail.
• [BUGFIX] grpc, reverseproxy: gRPC and the reverse proxy can now be enabled on the same service without failing the NGINX configuration check. (Fixes #3950)
• [BUGFIX] api: POST /instances/{hostname}/reload retries a busy instance instead of returning 502.
• [BUGFIX] /healthz answers ok during a graceful reload instead of loading, preventing readiness probes from failing on every reload. (Refs bunkerity/bunkerweb-helm#97)
• [BUGFIX] The loading page returns 503 with Retry-After instead of 200. (Fixes #3988)
• [BUGFIX] misc: the default server serves its placeholder page only on / and answers 404 elsewhere instead of 200. (Fixes #3992)

Web UI & User Experience

• [BUGFIX] ui: logins no longer fail with "The CSRF session token is missing" on a fresh worker or with mixed proxied and direct access.
• [BUGFIX] ui: the Web UI in the All-In-One image starts correctly instead of failing with No module named '_zstd'.
• [BUGFIX] ui: signed-in users can submit form fields larger than 500 kB, such as large Easy Resolve requests, without receiving 413.
• [BUGFIX] ui: updating a plugin replaces its page, routes and templates instead of leaving the old versions served.
• [BUGFIX] ui: updated external plugin pages load correctly after a scheduler restart instead of serving the old versions.
• [BUGFIX] ui: PRO and external plugin pages no longer remain outdated when two plugin updates occur a few seconds apart.
• [BUGFIX] ui: after saving a setting, the page immediately displays the new value instead of the old one until refresh. (Fixes #3991)
• [BUGFIX] ui: the Jobs page sorts the RELOAD and ASYNC columns by value. (Fixes #4023)
• [BUGFIX] ui: setting help tooltips are wider and wrap long words, preventing truncated help text. (Fixes #4026)
• [BUGFIX] ui: the language selector flag updates when the language changes. (Fixes #4002)
• [BUGFIX] ui: the Unban button tooltip displays the IP address instead of {{ip}}. (Fixes #4001)
• [BUGFIX] ui: the Bans page offers Investigate only for CrowdSec bans. (Refs #4000)
• [BUGFIX] ui: server-rendered labels match the English translations, preventing text from changing case during page loading. (Refs #3963)
• [BUGFIX] ui: the Templates delete confirmation correctly references templates instead of instances.
• [BUGFIX] ui: the setup wizard's Public Suffix switch clearly indicates that enabling it skips the check.
• [BUGFIX] ui: the "More info" link for core and PRO plugins opens the corresponding section of the Features page. (Fixes #3990)
• [BUGFIX] ui: country flags load correctly on Reports, Bans and plugin pages.
• [BUGFIX] ui: raw translation keys no longer flash during page loading. (Fixes #3963)
• [BUGFIX] ui: wrapped table toolbars keep their controls aligned. (Fixes #3969)
• [BUGFIX] ui: plugins without a page, such as PRO Maintenance, no longer request a Web UI restart.
• [BUGFIX] ui: the Global configuration breadcrumb and the service conversion and cache deletion modals are translated.
• [BUGFIX] ui: the active PRO plugin entry in the dark-mode menu is readable again.
• [BUGFIX] ui: the Bans table header and country tooltips display correctly.
• [BUGFIX] ui: the RAW editor's draft help is translated into every language.

DOCKER & INSTALLATION

• [DOCKER] Final releases also publish a floating 1.6 Docker image tag that follows the latest 1.6.x release.
• [MISC] install-bunkerweb.sh pulls the 1.6 Docker tag by default, ensuring installations stay on the 1.6.x release line when newer versions become available.

DOCUMENTATION

• [DOCS] Links in the documentation, installer, service files and examples now point to the 1.6 documentation instead of latest.
• [DOCS] letsencrypt: clarified LETS_ENCRYPT_DISABLE_PUBLIC_SUFFIXES behavior: yes skips the public suffix check, while no refuses matching domains.

DEPENDENCIES

• [DEPS] modsecurity: updated libmodsecurity to v3.0.17, including security fixes. Custom rules selecting MULTIPART_FILENAME by file name must now use the field name.
• [DEPS] Patched lua-nginx-module and lua-resty-core to expose the PROXY protocol client address during the TLS handshake through ngx.ssl.proxy_protocol_addr().
• [DEPS] Updated libmaxminddb to v1.14.1.
• [DEPS] Added resty-redis-cluster v1.6.1 (Kong) for Redis Cluster support.

MISCELLANEOUS

• [MISC] Duration settings now accept nginx-style time suffixes (ms, s, m, h, d, w, M, y) across antibot, badbehavior, sessions, cors, reversescan, redis, metrics, crowdsec, db, letsencrypt, selfsigned and scheduler timeouts. Bare numbers keep their previous units.
• [MISC] headers: the default PERMISSIONS_POLICY removes shared-storage and shared-storage-select-url, which Chromium no longer supports.

CONTRIBUTIONS

• [CONTRIBUTION] Thank you @MageInt for syncing metrics to Redis incrementally. (#3972)
• [CONTRIBUTION] Thank you @rayshoo for adding SameSite=None to COOKIE_FLAGS. (#3066)
• [CONTRIBUTION] Thank you @Ayushsinha322 for anchoring the BROTLI_MIN_LENGTH regex so trailing garbage is rejected. (#3959)