v1.0.32 — TCP/UDP forwarding

TCP/UDP Services adds UI/API management of raw forwarding through Caddy to one
upstream per listener. Admins can manage services; viewers can list them. Changes
are audited, rejected Caddy loads roll back and startup restores saved listeners.

This addresses issue #26.
TCP and UDP can share a port; TLS and STARTTLS pass through to the upstream.
HTTP WAF, authentication, reputation, GeoIP, IP ACL and HTTP rate-limit policies
do not apply to raw traffic. This MVP has no TLS termination, SNI routing, PROXY
protocol, load balancing or transparent client-IP preservation.

Upgrade and publish ports

Follow the deployment guide and edit the
Compose override example to include
only the ports you need. Back up the database, settings and rules first.

From your public deployment checkout:

git pull --ff-only
# Edit .env: WAF_IMAGE_TAG=1.0.32 (no leading v).
cp docker-compose.streams.example.yml docker-compose.streams.yml
# Edit docker-compose.streams.yml to select your ports/protocols.
docker compose -f docker-compose.yml -f docker-compose.streams.yml config --images
docker compose -f docker-compose.yml -f docker-compose.streams.yml pull
docker compose -f docker-compose.yml -f docker-compose.streams.yml up -d --wait
docker compose -f docker-compose.yml -f docker-compose.streams.yml restart admin-api

Upgrade Caddy, waf-sandbox, the API and UI together. Remove obsolete hotfix image
and pull_policy: never overrides for these services while preserving unrelated
customizations. Then create a listener under TCP/UDP Services. The configured
listen port is the container port. Saving it does not publish Docker ports or
change firewalls. Keep using the override with subsequent deployments.

Host TCP 8443 already serves the management UI by default; avoid conflicting
mappings when forwarding other services. The upstream owns TLS certificates and
renewal for raw forwarding, including mail services sharing a hostname with HTTPS.

API startup upgrades to 0037_merge_forwarding_reputation, joining the existing
migration branches without renumbering or restamping. Existing policies, feeds
and listeners are retained. A default-off compatibility sites.ai_review column
is unused by this release; AI review is not enabled.

The release retains Coraza 3.8.1, coraza-caddy 2.6.2, Caddy 2.11.4, reputation
feeds, trusted-IP behavior and the optional PHP2Shell pack from v1.0.31.

Validation

446 backend tests, 85 frontend tests and the production UI build passed. Nine
PostgreSQL starting states upgraded with existing data preserved. Real TCP/UDP,
server-first traffic, HTTP WAF with reputation observation, established TCP across
reloads, rejected-load rollback, concurrent edits, enable/disable, deletion and
Caddy/API restart recovery passed. Local live checks used arm64 builds; the
production linux/amd64 images were built and published successfully.

Public registry verification records
anonymous access, platform and immutable digests for all three images. No private
repository access is needed to deploy them. These are functional checks, not
throughput or protocol certification.

Rollback

Disable/remove raw listeners, remove their Docker mappings and recreate Caddy.
Restore all previous platform images together and restart the previous API after
Caddy is ready. Preserve data volumes. The added database schema can remain; do
not blindly downgrade merged migrations, which would remove stored data.

For future updates, choose Watch → Custom → Releases on this repository or
subscribe to its release feed.