What's new: per-site paranoia level and anomaly threshold
Each site can now have its own paranoia level and anomaly threshold. For example, you can run an admin portal at PL3 while the rest of your sites stay at PL1.
- Where: Sites → Edit → WAF Behaviour. Pick a paranoia level and/or enter a threshold. Leave either field blank to follow WAF Config. The form shows the value the site will inherit.
- Defaults: the values on WAF Config are now the defaults for every site that doesn't set its own.
- At a glance: sites with their own values show a badge such as
PL3 · threshold 4in the Sites list. - Audit log: changes to these per-site values are recorded with their before and after values.
Things to know
- Nothing changes on upgrade. Existing sites have no per-site values, so they keep following WAF Config.
- Raising the level on one site? Turn on that site's Detection mode first and check WAF Logs for false positives before you switch back to blocking.
- The upgrade adds two columns to the
sitestable. They're created automatically when the admin API starts.
Upgrade
docker compose pull
docker compose up -d
latest points to this release. If you pin versions, set WAF_IMAGE_TAG=1.0.22 (no v prefix) before pulling.
Images: ghcr.io/socfortress/waf-caddy:1.0.22, ghcr.io/socfortress/waf-admin-api:1.0.22, ghcr.io/socfortress/waf-admin-ui:1.0.22