chr0nzz/traefik-manager v1.14.0 on GitHub

v1.14.0

Enhancements:

[certs, acme] Remove certificates from acme.json when it is mounted read-write and a restart method is set, checking every store before changing any and refusing a store Traefik rewrites mid-edit
[certs, acme] Select several certificates at once for removal, with Select unused, tied to the server they were picked on
[certs, routes] Offer to remove a route's certificate when the route is deleted and the server confirms nothing else, including routers from other providers, still uses it
[certs] Mark certificates no router serves as unused, and ones whose resolver is gone as no resolver
[certs] Filter the Certs tab by registered domain, unused, no resolver, and expiring
[certs, backup] Restore an acme.json backup from Settings, Backups, on the Host and on agents, into the store it came from even when two stores share a file name
[routes, tls] Make the tls.domains fields of a route editable instead of only the wildcard pair
[routes, services] Offer h2c as a backend scheme, which Traefik 3.7.13 made the only way to reach a cleartext HTTP/2 backend
[crowdsec] Add a Targeted routes card naming the router and host behind each attack (#169)
[crowdsec] Read a decisions summary and page the decisions view on the server instead of fetching every decision
[routes] Allow a route to point at noop@internal instead of an invented backend (#170)
[routes, services] List services from every provider in the route service picker
[providers] Add an Internal tab for the routers and services Traefik creates for itself
[providers] Switch a provider tab on the first time Traefik reports routers from it
[webui] Keep the last data per tab for the session and paint it when the tab opens
[webui] Open the route, service and middleware forms before their dropdowns have loaded
[webui] Spin refresh buttons while a refresh runs
[webui, crowdsec] Replace the CrowdSec card skeleton with the spinner the Logs tab uses
[server] Serve eight requests at once instead of two, tunable with GUNICORN_THREADS and WEB_CONCURRENCY
[server] Read manager.yml and agents.yml once per change instead of parsing them on every settings lookup
[server] Add the Traefik 3.7.13 and 2.11.57 advisories to the version check
[unraid] Install Traefik Manager and the agent from Community Applications, templates in chr0nzz/unraid-templates

Bug fixes:

[setup, security] Answer the setup page's git and CrowdSec checks only for a signed-in admin, and refuse link-local targets in every git connection test without following redirects
[settings, security] Send the saved Traefik API password only to the saved API URL, in the connection test and when a new URL is saved
[auth, security] Read forwarding headers only from trusted proxy addresses, set with TRUSTED_PROXIES, so a client reaching Traefik Manager directly cannot choose its own IP for the login rate limit and audit log
[settings, security] Refuse Settings file paths under /proc, /sys and /dev, inside Traefik Manager's own files, or of the wrong type, stop allowing a path once it is changed, and stop treating all of /app as writable
[auth, security] Close the password reset window on every sign-in, including two-factor and OIDC, ask for a current two-factor code on the reset page, and refuse the reset when ADMIN_PASSWORD is set or local login is off
[auth, security] Keep a browser signed in with a temporary password on the change-password screen until it is replaced
[auth, security] Sign out every other session when the password is changed or reset, two-factor is turned off, or ADMIN_PASSWORD changes, and add a button to sign out other sessions
[auth, security] Cap wrong passwords and wrong two-factor codes across all addresses, set with LOGIN_FAILURE_LIMIT and OTP_FAILURE_LIMIT, and send a sign-in back to the password step after 5 wrong codes or 10 minutes
[auth] Rate limit password posts to the setup page
[auth, security] Count rate limits and wrong two-factor codes once across every worker, so running two workers no longer doubles each limit
[agent, security] Check backup file names inside the agent's backup helper, so a single-file config can no longer write a backup outside the backup folder
[routes, notifications] Group more than 5 routes going down, degraded or back up in one check into one notification per server
[agent, notifications] Report agent failures recorded after the agent restarted, using a boot token in /api/events and an ID check for older agents
[agent, config] Write config saves, route edits and restores on an agent one at a time with a unique temporary file each, so overlapping writes cannot leave a mixed file
[agent, security] Keep a revoked agent API key revoked across restarts, and move a corrupt key file aside instead of discarding it
[logs] Reject a lines value that is not a positive whole number on the Host and on agents, instead of crashing the agent
[server] Read manager.yml and agents.yml once per request instead of on every settings lookup, so the first page load no longer waits on the same files being parsed a dozen times
[routes, config] Show a route saved into a new config file on every request, instead of only the ones the worker that wrote it answers, so the Routes tab stops flickering after a save
[settings] Serialize settings writes so two saves cannot lose one another
[config, routes] Run route, middleware, service, TLS option and restore edits on the same server one at a time, and save only what each edit changed in the route ledger and disabled routes, so overlapping edits no longer drop one another
[monitor, settings] Stop automatic provider tab detection from undoing a password change or agent key rotation made at the same moment
[server] Stop a request that outlives the worker timeout from dropping every request queued behind it
[agent, git] Restore every dynamic config file and the static config stored in the chosen commit on an agent, never write the static config into the dynamic directory, and report a failed write
[agent, git] Commit only dynamic config files and the static config from an agent, never other files that sit in its config directory
[git, security] Ignore any git credential helper on the machine, so a token it stored is never sent to another remote and the configured token is never saved into it
[backup] Restore a backup's own content when it was taken in the same second as the restore, instead of the safety copy that overwrote it
[backup, git] Keep same-named config files from different folders apart in git backups, local backups and restores, and refuse a restore that matches more than one file
[config, git] Exclude Traefik Manager's own state files from the config scan and from git backup (#173)
[crowdsec, webui] Show an Attack Evidence alert's details when compact stat cards are on (#175)
[crowdsec] Read decisions and alerts independently so a 401 on alerts still renders bans (#174)
[services] Keep a health check that names no path (#165)
[services] Show a health check interval in its short form rather than as a Go duration string (#165)
[services] Count a service with every backend down as down rather than degraded (#165)
[routes] Show backend health in the route info panel (#165)
[dashboard] Mark every affected route when a group's down or degraded count is clicked (#165)
[dashboard] Label the Services card's count of services with every backend down as down, not backends down (#165)
[services] List a service with every backend down under Errors, where the Services card's down count opens (#165)
[routes] List a router whose service name ends in provider@internal
[providers, agent] Compare an agent's File (external) tab against that agent's own config instead of the Host's
[acme, tls] Ignore negated matchers when parsing rule domains
[config] Parse HostSNI, quoted Host, and the v2 multi-host rule form
[routes, tls] Carry tls.domains for TCP routes and Docker labels
[routes, services] Read a server URL with an h2c scheme instead of leaving the scheme glued to the host
[routes] Report whether every protocol was read in full instead of returning a short list
[certs] Word an expired certificate instead of counting into negative days
[crowdsec, webui] Show country flags in Chrome and Edge on Windows, which have no flag emoji, from a bundled flag font (#176)
[certs, agent] Tell a user who cannot read acme.json to run Traefik Manager or the agent as its owner instead of chmod o+r, which makes Traefik refuse the file, and stop the agent reporting an unreadable file as not found
[certs] Stop a TCP route that terminates no TLS from claiming every certificate
[certs] Match a wildcard tls.domains request to the certificate it was issued for
[webui, security] Escape backup names an agent returns, and pass every inline handler value through the JSON escaping helper so a quote cannot end the string
[webui, routes] Switch the Routes tab between cards and list from the routes already loaded instead of fetching them all again
[webui] Name the routes in a bulk delete confirmation
[webui] Make delete confirmations red and lay out their options
[webui] Add a gap under the bulk selection bar so it clears the first row of cards
[webui] Use a colour token that exists for the forward auth warning icon
[ci] Fail the test step when pytest fails

Documentation:

[certs] Document the read-write mount and restart method that certificate removal needs
[routes, services] Say when to pick the h2c backend scheme
[server] Document the Gunicorn tuning variables in .env.example
[linux] Start the systemd service and test run from gunicorn.conf.py instead of pinning one worker
[crowdsec] Document the context fields the Targeted routes card reads
[crowdsec] Cover the tm CLI CrowdSec options: the bouncer plugin, the native package install and the custom LAPI port
[install] Document the full-native mode, which runs Traefik and Traefik Manager as Linux services
[unraid] Rewrite the install instructions for Community Applications