v1.0.33 — Enforce HTTPS for TLS sites

Fix issue #28:
sites using uploaded certificates or Let's Encrypt previously also proxied
application traffic over plain HTTP. They now return a 308 Permanent Redirect
from port 80 to HTTPS, preserving the hostname, path and query string. Clients
following a 308 preserve the request method and body.

HTTP and HTTPS application routes now use separate listeners. Redirects run
before authentication, trusted-IP bypasses and WAF blocking layers. HTTP-only
sites remain on port 80, and active ACME HTTP-01 challenges continue to work.
Unknown hostnames do not become arbitrary redirect targets.

The earlier guidance in issue #9 was incomplete: Security headers / HSTS
is complementary and does not replace an HTTP-to-HTTPS redirect. Browsers ignore
HSTS delivered over HTTP. A redirect cannot protect credentials already sent in
an initial HTTP request; clients should use HTTPS URLs directly.

Upgrade from the public Compose deployment

The three prebuilt images are available without authentication for linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.33 (used by Caddy and the rule sandbox)
• ghcr.io/socfortress/waf-admin-api:1.0.33
• ghcr.io/socfortress/waf-admin-ui:1.0.33

Back up the database and deployment settings. Update this repository while
preserving local customizations, then set WAF_IMAGE_TAG=1.0.33 in your .env.
Upgrade Caddy, the sandbox, API and UI together:

git pull --ff-only
docker compose pull
docker compose up -d --wait
docker compose restart admin-api

Restarting the API after Caddy is ready reapplies the saved site configuration.
If you use TCP/UDP forwarding, keep your explicit ports override in every
Compose invocation, including pull, up and restart; follow the
TCP/UDP deployment guide.
Do not replace your existing .env or remove data volumes.

No new setting or database migration is introduced by this patch. The migration
head remains 0037_merge_forwarding_reputation; installations older than
v1.0.32 still apply the migrations from intervening releases on API startup.

Compatibility

Existing TLS sites that previously accepted application requests over HTTP now
redirect those requests. If an external load balancer terminates TLS, either
connect from it to the WAF over HTTPS or intentionally select certificate mode
None for HTTP between the load balancer and WAF. An HTTPS upstream URL controls
the separate WAF-to-backend connection.

The redirect applies with Security headers disabled and to clients with a full
trusted-IP bypass. HTTP-only sites intentionally using certificate mode None
continue serving HTTP. Existing raw TCP/UDP forwarding and its Docker port
mappings are unchanged.

Verify

For a hostname configured with an uploaded certificate or Let's Encrypt:

curl -sI 'http://your-host.example/path?x=1'

Expect 308 and Location: https://your-host.example/path?x=1. Requests sent
directly to HTTPS should still reach the protected application under its normal
WAF and authentication policies.

Validation

• 452 backend tests passed, including six new redirect regression cases.
• Real Caddy checks verified manual certificates, GET/HEAD/POST redirects,
  escaped paths and queries, removal of the incoming HTTP port, HSTS,
  unknown/wildcard hosts and spoofed proxy scheme headers.
• Counting upstream/auth services proved that HTTP requests to TLS sites never
  reached them, including with trusted-IP bypasses, geo blocking and an HTTP fallback.
• Mixed manual/Let's Encrypt/HTTP-only and Let's Encrypt-only configurations
  obtained certificates from an isolated local ACME CA using HTTP-01 exclusively.
• Reloads, rejected config rollback, mode changes and disabled sites passed.
  The same regression test against the original v1.0.32 builder reproduced the
  reported plaintext HTTP 200 response.
• All three production linux/amd64 images built successfully. Anonymous registry
  access, image versions and the release revision were verified. Immutable image
  digests are recorded in the
  publication validation record.

The runtime regression checks used native arm64 builds in a disposable container
with no external networking or published ports. No frontend or Caddy binary
changes are included in this patch.

Rollback

Set WAF_IMAGE_TAG=1.0.32, pull and recreate the services using the same Compose
files, wait for Caddy, then restart the API. No schema downgrade is needed.
This also restores the old behavior allowing plaintext application traffic for
TLS sites, so prefer correcting load balancer or client configurations that
depend on HTTP.