socfortress/waf-platform-public v1.0.27

v1.0.27 — IP reputation feeds

on GitHub

What's new: IP reputation feeds

The WAF can now download IP/CIDR threat lists and match client IPs locally in Caddy. Feed downloads happen in the admin API; protected requests never call the feed provider. You can inspect saved entries and set Off, Observe, or Block on each site. Observe records matches in Caddy access logs; Block returns HTTP 403. Site-specific IP/CIDR exceptions let you allow known clients.

Feed sources

• Spamhaus DROP IPv4 and IPv6 presets use public endpoints without an account or API key. Each starts disabled and refreshes at most daily, subject to Spamhaus's DROP fair-use terms.
• CrowdSec Raw IP List preset accepts a Raw IP List integration URL and its one-time username/password. Subscribe that integration to the blocklists available on your CrowdSec plan. Its daily refresh respects the Community plan limit. A Remediation Component API key is a different credential and does not work in these fields.
• Other downloadable feeds can use public HTTPS line lists or JSON lists, with an optional Authorization or X-* header. Query-only reputation APIs are not supported in this release.

Feeds are opt-in. Start with Observe, check match attribution in Caddy access logs, then enable Block for the sites you choose. Configure WAF Config → Trusted proxy IPs if a load balancer or CDN connects directly to Caddy. Failed refreshes retain the last good entries only until their stale deadline; expired entries stop matching. Pre-Coraza reputation blocks do not yet appear in the platform's WAF Logs, alerts, or forwarders.

Upgrade

Pull the updated public deployment repository and the new images. The Compose update adds a shared reputation-data volume; without it, Caddy cannot see downloaded lists.

git pull
# If you pin images, set WAF_IMAGE_TAG=1.0.27 in .env first.
docker compose pull
docker compose up -d

latest points to this release. The versioned images are ghcr.io/socfortress/waf-caddy:1.0.27, ghcr.io/socfortress/waf-admin-api:1.0.27, and ghcr.io/socfortress/waf-admin-ui:1.0.27. See the IP reputation setup guide for provider setup and limits.