v1.0.43 — WAF Logs host filter

Filter Logs → WAF Logs by Host in both saved logs and the live feed. This release addresses issue #43. It has no database migrations or Compose changes.

What changed

• A Host field appears alongside the existing log filters. It matches the complete host value without regard to case and ignores surrounding whitespace. Include a port if the event's Host value includes one; partial names and wildcards are not supported.
• Changing the host returns saved logs to page 1. In live mode it reconnects the stream and clears events from the previous filter.
• Clear filters also removes the host filter.
• Live-feed query values are URL-encoded, and authentication query construction now works when no action filter is selected.

Images and upgrade

Production images target linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.43
• ghcr.io/socfortress/waf-admin-api:1.0.43
• ghcr.io/socfortress/waf-admin-ui:1.0.43

Back up the database, configuration, certificate storage, and deployment settings. Preserve local Compose overrides. If upgrading from v1.0.40 or older, review the v1.0.41 security changes, v1.0.40 certificate persistence migration, and any earlier applicable release prerequisites.

Update deployment files with git pull --ff-only, preserving customizations, and set both values in .env:

WAF_IMAGE_TAG=1.0.43
CRS_CADDY_DIGEST=sha256:af5e2f714794fb069baf7a3cec71018f9d3a99f8e868d604dc15fcfd3d089313

The digest takes precedence over the tag. Production Caddy and the CRS validator must use the same release digest. Verify docker compose config, stop configuration edits, and upgrade the services together:

docker compose pull
docker compose stop admin-ui admin-api caddy-waf waf-sandbox
docker compose up -d --wait postgres redis http-echo caddy-waf waf-sandbox
docker compose up -d --wait admin-api admin-ui
docker compose ps

After upgrading, check About → Version shows v1.0.43. In WAF Logs, enter a Host value from an event, verify the filtered results, and check Clear filters. With live mode enabled, new matching events should appear as traffic arrives. Existing v1.0.42 installations with update checks enabled discover this release on their next cached check (up to 6 hours).

Validation

• Backend suite: 717 passed, including 17 log tests.
• Frontend suite: 138 passed, including 14 Logs and Tuning tests.
• Frontend production build passed.
• Public Compose configuration resolves to the 1.0.43 images, with matching production Caddy and CRS validator digest pins.
• The published API image was run with networking disabled: it reports version 1.0.43 and contains the host-filter implementation.

Images are built from merged source eb425cf7b3de7a953d63cacb34d4870f7ee0b1d4. See publication verification for digests, revisions, platforms, anonymous manifest/config access, and matching image aliases.

Rollback

There are no schema changes. To return to v1.0.42, restore these values in .env and follow the same upgrade sequence:

WAF_IMAGE_TAG=1.0.42
CRS_CADDY_DIGEST=sha256:5c63210e65ae83c6c940f74f1438bc64481003ea0de1c4d9196e539d7c9a9b85

Publishing this release does not upgrade existing servers automatically.