v1.13.0

Features

• Routes can balance across services, not just addresses. Each backend row is an IP:Port or an existing service, with its own scheme and weight. Weighted, mirroring and failover are all authorable
• Services can be created and edited on their own, on any server. The Services tab builds a load balancer, weighted, mirroring or failover service without needing a route first, and any service in your config files can be edited, renamed or deleted there
• A service Traefik Manager did not write can be taken over. Its detail panel offers to manage it, which records ownership and writes no YAML
• Composite services show their backends. The detail panel lists each one with its role and share, and mirror shares are shown instead of hidden
• Traefik Manager can be served under a sub path. Set BASE_PATH=/traefik-manager. Unset, nothing changes. If you use OIDC, add the prefix to the redirect URI at your provider
• Six more middleware wizards. Strip Prefix Regex, Replace Path Regex, Custom Error Pages, Content Type, gRPC-Web and Pass TLS Client Cert
• Add Agent starts with a choice of two paths. Install with the tm CLI, which mints the key and gives you the install command plus a Verify connection check, or configure manually
• Rebuilt agent settings screen. Name and URL edited at the top, a Connection panel that checks reachability and the key, and the tm commands to run on the agent. Compose output moved behind Configure manually
• Agents report failures that happen after they answer. A failed git auto-push or Traefik restart now arrives as a notification instead of only reaching the agent's log
• An agent refuses to overwrite a config when its backup failed, and checks at startup that its directories are writable
• A config directory that cannot be written is reported at startup and every five minutes, with a banner while it lasts
• Agent settings take a Traefik API username and password, and a git commit message
• The backend toggle in the route form now reads Build backends and Use a service
• OIDC can be configured with environment variables. OIDC_ENABLED, OIDC_PROVIDER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET and the rest of the fields (#161)
• A secret written to manager.yml or agents.yml in plain text now works. It is read as written, encrypted in place on the next start, and a notification says so
• Certificates and access logs can be read from Docker named volumes with ACME_JSON_PATH and ACCESS_LOG_PATH, now documented (#160)

Security

• After a flask reset-password, anyone could set the admin password from /setup. The window stayed open unless you finished on that page. It now closes on any password change and on the next successful login
• A router rule, entry point or service name could run scripts in the UI. These names come from your providers, so anyone able to create a container on a monitored host could reach it
• Naming a single file in Settings also opened every file beside it. Naming a file now covers only that file; naming a directory still covers the directory, as before
• Testing a git repository sent your stored token to it. The stored token now only goes to the repository you configured

Fixes

• Deleting or shrinking a service silently deleted backends other routes were still using
• A service could be created with a name that overwrote another service's backends
• Editing a service wrote it to the first config file instead of the one it lives in, and renaming one failed outright
• Deleting or renaming a route left its backend services behind, invisible in the Services tab
• Removing the last service row from a route discarded the whole edit without saying so
• A route accepted a third failover backend and silently dropped it
• The Static Config editor did not load under BASE_PATH, and two icons pointed outside it
• An agent stopped accepting added or deleted decisions after CrowdSec restarted, until its cached token expired
• Ledger entries for services deleted by hand were never cleared, hiding those services from the Services tab
• A service Traefik Manager created as a load balancer could not be deleted again
• A TCP or UDP service offered an Edit button, and saving it wrote an HTTP service over it
• Docker container labels in the route detail panel were only read from the Host
• A decision added by hand was recorded with a different origin on the Host than on an agent
• The Static Config provider list wrote kubernetes for the CRD provider, which Traefik does not read
• A decision added by hand did not appear in Custom Decisions until the cached decision list expired. Adding or deleting one now refreshes it immediately
• Decisions added by hand were counted as "other" instead of yours. Newer CrowdSec labels them manual rather than cscli
• CrowdSec alerts stayed broken after the LAPI restarted with a new signing key. A refused machine token now logs in again and retries (#159)
• Composite services were counted as unchecked on the Dashboard and could flip the Services card to "no health checks configured"
• A route pointing at a composite service showed as an error in the routes list and on the route map
• The ping fallback address skipped the check the primary address gets
• Selecting an agent that failed to answer left the previous server's routes and middlewares on screen
• Deleting a route left its serversTransport behind in the config file and the ledger
• Removing an agent left its git clone, disabled-route snapshots and ledger entries on disk
• The CrowdSec alert limit was dropped on the next Settings save. It is now a Settings field under System Monitoring - CrowdSec
• CrowdSec counts were truncated at the alert limit without saying so
• Agent restart settings had two Container name fields and only saved one
• A trailing newline in an agent API key caused a 401 on every request
• An agent that was answering but refusing the key was reported as unreachable
• An untrusted agent certificate was reported as a network failure instead of a certificate one
• Any string was accepted as an agent URL, then failed every request
• Renaming a server, or changing its URL, needed a page reload before it took effect
• On a phone, Host-only settings rows stayed visible while an agent was selected
• Rotating a phone or tablet with Settings open left the layout stretched and part-scrolled
• Leaving the API keys view dropped you back onto a stale agent list