CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

## [1.7.0] - 2026-10-28

- ``New`` The dashboard is customizable: drag and resize tiles, add or remove widgets, and reset to the default layout. Layouts are saved per user (existing ones migrate automatically and are included in backups); editing needs a viewport of 992 px or more.
- ``New`` Peers not seen for a configurable number of months (Settings → WireGuard, default 6) show an orange `Stale` badge that clears once the peer reappears.
- ``Fix`` The dashboard and other pages no longer end in a doubled bottom gap or scroll past their last card on desktop (the footer and the page bottom spacing were reserved twice), and edited stylesheets/scripts are now revalidated instead of being served stale from the browser cache.
- ``Fix`` Node traffic metrics are delivered reliably, with no gaps or double-counting after partial writes; country, ASN and DNS trend totals no longer skew after transient storage errors.
- ``Fix`` Long-range traffic, DNS trend and country/ASN charts now cover the full requested window instead of being cut short at the time-series query limit.
- ``Fix`` DNS log-retention changes (including 0 days) apply to the running resolver within seconds, global allow rules consistently override client-specific blocks, and a crashed ingestion writer no longer hangs.
- ``Fix`` GeoIP lookups no longer hang after a cancellation or a stalled system resolver.
- ``Fix`` Node enrollment against an IPv6 master address, importing an existing WireGuard keypair for a new peer, and peer config/QR downloads using the interface DNS (ad-blocker off) work again.
- ``Fix`` Backup restore rejects archives with foreign-key violations, and a failed node deletion is now flagged so it can be retried.
- ``Fix`` Dates, times and certificate expiry on the Users and Settings pages are shown in your browser's locale and time zone.
- ``Security`` New opt-in `WIREBUDDY_REQUIRE_HTTPS_AUTH` rejects password logins and node authentication over plaintext HTTP (loopback exempt).
- ``Security`` The client IP behind a reverse proxy is resolved via `X-Forwarded-For` against `WIREBUDDY_TRUSTED_PROXIES`, so a spoofed header can no longer influence login lockout, MFA binding or auditing.
- ``Security`` The first-boot admin password is no longer logged; it is printed once to the console (stdout) and never stored in a file.
- ``Security`` Peer enable/disable/migrate and client isolation now fail closed: if a change cannot be applied to the live interface or firewall, the request fails and the stored state is rolled back.
- ``Security`` Regenerating a node's token now fully re-enrolls it: the old tunnel peer is removed from the live interface and config, stale control commands are purged, and the node's event stream is closed.
- ``Security`` Rate limiting is counted before authentication and IPv6 clients share one counter per /64; Unbound now runs from fixed absolute paths with locked-down config permissions.

<details markdown="1">
<summary>Previous versions...</summary>

## [1.6.2] - 2026-10-01

- ``Fix`` Deleting a WireGuard interface works again when nodes were provisioned for it, and a failed database delete no longer removes its config file.
- ``Fix`` Interface changes and peer config/QR-code downloads no longer block other requests.
- ``Fix`` Settings stored as `true`/`yes`/`on` are now recognised everywhere, so features can no longer appear enabled without running.
- ``Fix`` Passphrases longer than 72 bytes are accepted again.
- ``Fix`` Expired passkey sign-in challenges are now cleaned up hourly.
- ``Fix`` Switching tabs no longer cancels a running speed test, and after a restore the page keeps waiting for the restart even if the server briefly answers with an error.
- ``Fix`` OTP setup no longer hangs on "Verifying…" when the network stalls and now explains why a code was rejected; the password-change notice is styled correctly again under the strict CSP.
- ``Fix`` UI: the DNS query log is visible on mobile again, the traffic page shows "no data" instead of hanging, error messages on sign-in and setup pages are visible again, the two-factor step offers "Back to sign in", and signed-in users opening `/` or the login page land on the dashboard.
- ``Fix`` Accessibility and polish: charts have text alternatives for screen readers, auth pages honour "reduce motion", info cards no longer lift on hover, dashboard cards no longer show a hard-edged shadow in light mode, and non-admins are no longer pointed to admin-only buttons.
- ``Fix`` **Serve GUI over HTTPS** now works in Docker: the container starts the built-in TLS listener after a restart instead of staying on plain HTTP and rejecting every login. If no certificate can be prepared, WireBuddy refuses to start rather than falling back to HTTP. An invalid ACME listener port, or one equal to the GUI port, now only disables that listener.
- ``Fix`` Let's Encrypt certificates can be requested again: since 1.6.1 every certificate, account-key and challenge file write failed.
- ``Fix`` The container health check probes `/ready` on the transport the container actually started with (HTTP or HTTPS, any port), so a broken database, scheduler or DNS ingestion marks it unhealthy.
- ``Security`` The Compose file no longer ships a built-in `WIREBUDDY_SECRET_KEY` and refuses to start until one is set in `.env`. If you used the old Compose file unchanged, put its previous key value into `.env` (otherwise existing encrypted data cannot be read), or start fresh with a new key.
- ``Security`` Sessions now end when MFA is switched on (except the current browser), when passkeys are reset or disabled, and when an account is deactivated.
- ``Security`` TOTP codes are single-use, and OTP setup can no longer be re-run or confirmed twice on an account that already has MFA.
- ``Security`` A pending mandatory password change is now enforced server-side (`428` for the API, redirect for UI pages).
- ``Security`` Interface deletion reports and later removes a leftover private key; PostUp/PostDown hooks are limited to 2048 bytes of printable ASCII.

## [1.6.1] - 2026-09-21

- ``New`` A single `WIREBUDDY_PUBLIC_ORIGIN` setting now configures CSRF origins, passkeys, the Host-header allowlist and secure cookies/HSTS. `WIREBUDDY_TRUSTED_PROXIES` replaces `TRUSTED_PROXY_CIDRS`, `WIREBUDDY_STATUS_TRUSTED_PROXY_CIDRS`, `FORWARDED_ALLOW_IPS` and `WIREBUDDY_TRUST_PROXY_HEADERS`; update your configuration when upgrading, as the old variables are now silently ignored.
- ``New`` `WIREBUDDY_SKIP_APPLICATION_LOCK` allows running on filesystems without `flock` support.
- ``New`` WireBuddy is now released under the MIT License (previously AGPL-3.0).
- ``Fix`` Improved reliability of multi-node WireGuard operation: config changes across interfaces roll back together on failure, nodes always re-sync fully after a restart, and enrollment credentials survive a failed shutdown.
- ``Fix`` Improved DNS robustness: query logging no longer drops entries under load, client-specific block rules are now counted correctly, and the resolver's own DNS setup is applied and restored more reliably.
- ``Fix`` Per-interface "show on dashboard" visibility is honored again; it previously crashed the network statistics API.
- ``Fix`` Shutdown no longer lets a slow WireGuard stop phase stall the DNS service stop and metrics save that follow it.
- ``Fix`` Let's Encrypt HTTP-01 challenge files are reliably cleaned up, and deleting a certificate can no longer collide with a running issuance or renewal.
- ``Fix`` A malformed `Origin`/`Referer` header now results in a 403 instead of a server error, and opening the login page in several tabs no longer invalidates the others' CSRF token.
- ``Fix`` Peers can no longer end up assigned to both a single node and to all nodes at once, including when created.
- ``Fix`` Speed tests against a slow-resolving host no longer strand background DNS-lookup threads.
- ``Security`` Startup now fails if required system binaries (`ip`, `wg`, `wg-quick`, `sysctl`, `iptables`, `ip6tables`) are only found via `PATH` instead of a trusted, fixed location, closing a path where a compromised `PATH` could substitute a malicious binary run as root.
- ``Security`` The public status page and node mTLS fingerprint header only trust forwarded headers from configured proxies, and CSRF origin validation is stricter (`http`/`https` only, no bearer+cookie bypass).

## [1.6.0] - 2026-08-28

- ``New`` Built-in HTTPS for the GUI with automatic self-signed certificates and Let's Encrypt support, including HTTP-01 validation and HTTP-to-HTTPS redirects.
- ``Fix`` Backups now use a consistent database snapshot, and backup/restore operations no longer release their lock while work is still running.
- ``Fix`` WireGuard, DNS, and speed-test operations recover more reliably from failures and timeouts, avoiding orphaned processes, partial network state, and stalled updates.
- ``Fix`` Fixed concurrent password/passkey updates and improved the reliability of login, MFA, and passkey setup flows, including mobile OTP autofill.
- ``Fix`` Corrected network-history range handling and multi-worker statistics/rate-limit behavior.
- ``Security`` HTTPS can now be enforced for logins and node enrollment, with secure session cookies when enabled.
- ``Security`` WireGuard hook validation blocks shell injection and other privileged command pivots.
- ``Security`` Node deletion revokes live WireGuard access before removing the node; interface isolation is retained until shutdown succeeds.
- ``Security`` Strengthened MFA brute-force protection, passkey registration rate limiting, WebAuthn origin validation, and resource/input limits.

## [1.5.4] - 2026-08-26

- ``New`` Docker images now build `wg` and `wg-quick` from the current official WireGuard tools source; WireGuard kernel support is provided by the host
- ``New`` Material Icons, Roboto Flex, and Noto Serif are bundled locally for consistent UI rendering without build-time font downloads
- ``Fix`` Peer Locations map now uses Esri's Light/Dark Gray Canvas basemaps instead of CARTO, which started requiring an API key
- ``Fix`` Dashboard counters and traffic metrics now show an em dash for empty values, and empty-card text uses the same muted tone as its icon
- ``Fix`` Local Docker builds no longer depend on CI-generated build metadata; image health checks and DNSSEC root-key setup are more reliable
- ``Security`` Debian WireGuard packages are blocked inside the image so only the intended upstream userspace tools are used with the host kernel
- ``Security`` Local `settings.env` files are excluded from Git and Docker build contexts to prevent accidental inclusion of configuration secrets
- ``Security`` Updated runtime dependencies, including `cbor2` for WebAuthn, `cryptography`, `fastapi`, `uvicorn`, and `webauthn`

## [1.5.3] - 2026-06-24

- ``New`` Bootstrap password is now auto-generated on first start and printed to the container log — the `WIREBUDDY_BOOTSTRAP_ADMIN_PASSWORD` environment variable has been removed
- ``New`` First login, and any admin-initiated password reset, now forces a mandatory password change before continuing
- ``Fix`` Redesigned password change screen that reliably validates strength and submits
- ``Fix`` Peer list "Last Seen" no longer flickers, and DNS service controls (Start/Restart/Stop) are no longer stuck greyed out
- ``Fix`` Readiness probes (`/ready`) are no longer rate limited, and startup/access logs are much quieter
- ``Security`` Hardened user accounts and OTP recovery codes: brute-force rate limits on user management, recovery codes only via a one-time secure download, and no password hashes or recovery codes in API responses
- ``Security`` Optional stale-interface cleanup now only removes WireGuard interfaces managed by WireBuddy
- ``Security`` Stricter Content-Security-Policy and updated dependencies (fastapi 0.138.0, nh3 0.3.6, pydantic-settings 2.14.2)

## [1.5.2] - 2026-06-16

- ``New`` Backups now include your full configuration (interfaces, peers, users, settings); restoring a backup brings back a working setup instead of an empty first-run database
- ``New`` Backups can optionally export metrics history with a configurable time range from the last 7 days up to 1 year
- ``Fix`` Speed test scheduling and result recording fixed: nodes run at most one scheduled test per day and failed measurements are no longer stored as valid results
- ``Fix`` Live progress (SSE) and per-IP rate limiting corrected for edge cases
- ``Security`` CSRF referer validation hardened; login protection now also throttles repeated failed attempts per username across changing IP addresses

## [1.5.1] - 2026-05-29

- ``Fix`` DNS statistics and DNS query logs are displayed reliably again in the GUI
- ``Fix`` DNS blocklist updates, reloads and logging are more stable and no longer break as easily in daily use
- ``Fix`` Speed tests now start more reliably and show live progress correctly again
- ``Fix`` Dashboard KPIs and traffic cards were visually refined for clearer values, better empty states and improved mobile layout
- ``Fix`` Login, MFA and passkey sign-in flows are more reliable
- ``Fix`` Additional security hardening in the web UI and API

## [1.5.0] - 2026-05-26

- ``New`` A new feature allows each peer to connect to all available nodes.
- ``New`` arm64 images are now built natively
- ``Fix`` Massive Redesign of many the Frontend/GUI Elements
- ``Fix`` Improved Caching behavior of DNS stats
- ``Fix`` Several Security Improvements
- ``Fix`` Update Python dependencies

## [1.4.6] - 2026-05-10

- ``Fix`` A rollback bug in the backup routine has been fixed
- ``Fix`` On iOS, the country table was not displayed correctly in the traffic metrics
- ``Fix`` It was not possible to add additional nodes
- ``Fix`` A persistent bug was preventing speed tests
- ``Fix`` Various stability improvements in the Wirebuddy engine
- ``Fix`` General stability improvements in WireBuddy engine
- ``Fix`` Several design improvements in the GUI
- ``Fix`` Update Python dependencies

## [1.4.5] - 2026-04-26

- ``Fix`` Various improvements to the GUI and fixes for display errors
- ``Fix`` Peers connected via a node did not display traffic details in the statistics
- ``Fix`` After restarting the Docker container, the Speedtest results from the last run were gone
- ``Fix`` Numerous stability improvements in the Wirebuddy engine
- ``Fix`` Update Python dependencies

## [1.4.4] - 2026-04-20

- ``New`` SVG flags removed from the Docker image and replaced with CDN Load
- ``New`` "Recent Peer Activity" now only shows peers who have been active in the last 30 days
- ``Fix`` 🔥 A bug in the passkey validation process allowed users to log in even if their passkey had been deleted
- ``Fix`` When a token is regenerated for a node, the associated peer is left orphaned
- ``Fix`` Front-end performance improvements
- ``Fix`` Update Python dependencies

## [1.4.3] - 2026-04-10

- ``Fix`` 🔥 Node re-enrollment loop when state file was lost (certificate-based recovery)
- ``Fix`` Traffic analysis queries now cached for 30s (faster page loads)
- ``Fix`` Peer names now support apostrophes (e.g., "John's iPhone")
- ``Fix`` API validation consistency improved for peer updates
- ``Fix`` Reduced unnecessary warnings in logs during normal operation
- ``Fix`` Various stability improvements in the Wirebuddy engine

## [1.4.2] - 2026-04-10

- ``New`` Update multiple Python dependencies
- ``Fix`` Metrics from the nodes were not reliably transmitted to the master 
- ``Fix`` No Speedtest results for the master were displayed on the dashboard
- ``Fix`` Various stability improvements in the Wirebuddy engine

## [1.4.1] - 2026-04-02

- ``New`` Switching the speed test to ``librespeed-cli`` for more reliable results [↗](https://gill-bates.github.io/wirebuddy/features/speedtest/)
- ``New`` Speed tests are now also conducted regularly on nodes with real-time progress updates [↗](https://gill-bates.github.io/wirebuddy/features/speedtest/)
- ``New`` Time range filters added to DNS trend chart (7d, 30d, 90d, 180d, 1y) [↗](https://gill-bates.github.io/wirebuddy/features/dns/#time-range-filter)
- ``New`` Dashboard speedtest chart now shows upload/download for all nodes with time range selection [↗](https://gill-bates.github.io/wirebuddy/features/speedtest/#viewing-history)
- ``New`` DNS metrics are now also available via TSDB for faster display in the GUI
- ``Fix`` When a ``docker stop`` command is executed, the SQLite database is now closed correctly
- ``Fix`` Dashboard node counter displayed 0 even when nodes existed
- ``Fix`` DNS query logs not displayed correctly on mobile devices
- ``Fix`` Restarting a node triggered a 503 error
- ``Fix`` 🔥 Nodes deleted themselves when master was unavailable
- ``Fix`` Improved security against host header injection attacks
- ``Fix`` General stability improvements in WireBuddy engine
- ``Fix`` DNS module: Improved thread-safety and performance
- ``Fix`` Better error handling during application shutdown
- ``Fix`` Optimized retry logic to prevent load spikes

## [1.4.0] - 2026-03-30

- ``New`` Node mode is here! 🎉 WIrebuddy can now run on multiple instances at the same time! [↗](https://gill-bates.github.io/wirebuddy/features/multi-node/)
- ``New`` DNS logging can be enabled or disabled for each peer [↗](https://gill-bates.github.io/wirebuddy/features/dns/#per-peer-dns-query-logging)
- ``New`` Added the ``tzdata`` package to support time zones [↗](https://gill-bates.github.io/wirebuddy/configuration/environment/#tz)
- ``New`` PSK is now enabled by default [↗](https://gill-bates.github.io/wirebuddy/configuration/wireguard/#preshared-keys)
- ``Fix`` Python dependencies updated
- ``Fix`` Fixed an issue with the test server selection for the speed test
- ``Fix`` Improved caching behavior for graphs
- ``Fix`` Several design improvements in the GUI

## [1.3.3] - 2026-03-23

- ``New`` The dashboard now also displays the network load for each interface [↗](https://gill-bates.github.io/wirebuddy/features/monitoring/#dashboard-overview)
- ``Fix`` Design optimized for iPad display
- ``Fix`` The DNS ad blocker could be launched even if Unbound wasn't installed
- ``Fix`` The changes to the downstream and upstream values were not saved
- ``Fix`` In some cases, the peer name was not displayed in the DNS logs
- ``Fix`` If a DNS blocklist has been disabled, the filter has not been updated
- ``Fix`` Several design improvements in the GUI

## [1.3.2] - 2026-03-16

- ``New`` A documentary is now available online: https://gill-bates.github.io/wirebuddy/ [↗](https://gill-bates.github.io/wirebuddy/)
- ``New`` Search filter for peers
- ``New`` Connection animation on the status page [↗](https://gill-bates.github.io/wirebuddy/configuration/status-page/#connection-flow)
- ``Fix`` Hardening the TDSB Engine for Handling Compressed Files
- ``Fix`` Improved stability in the Unbound Watchdog process
- ``Fix`` Improved stability in the speed test engine
- ``Fix`` Sessions expired after 1 hour, despite user interaction
- ``Fix`` A validation routine in the DNS Leak Indicator produced incorrect results
- ``Fix`` Several design improvements

## [1.3.1] - 2026-03-13

- ``New`` New ``health`` endpoint for a Docker health check [↗](https://gill-bates.github.io/wirebuddy/getting-started/docker/#health-checks)
- ``New`` Added speed test to monitor server performance [↗](https://gill-bates.github.io/wirebuddy/features/speedtest/)
- ``Fix`` An incorrectly entered password did not generate an error message
- ``Fix`` The charts for traffic metrics provided some contradictory information
- ``Fix`` When logged in, several error messages appeared in the GUI under Settings
- ``Fix`` A timeout occurred while saving DNS custom rules
- ``Fix`` Security hardening in the MFA routine & Credential handling
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.3.0] - 2026-03-07

- ``New`` Introducing Passkey for Users to Signin [↗](https://gill-bates.github.io/wirebuddy/security/passkeys/)
- ``New`` A global quick filter for peers has been introduced under DNS
- ``New`` The Swagger endpoint can now be disabled in the settings [↗](https://gill-bates.github.io/wirebuddy/configuration/environment/#swagger_enabled)
- ``Fix`` Security hardening of settings endpoints
- ``Fix`` The adaptive calculation of measurement points optimizes
- ``Fix`` Fixed display issues on tablets
- ``Fix`` The retention policy for DNS logs did not apply correctly
- ``Fix`` Fixed a bug that caused Unbound to crash on startup

## [1.2.2] - 2026-03-05

- ``New`` The ad blocker can now be temporarily disabled on a time-based basis [↗](https://gill-bates.github.io/wirebuddy/features/dns/)
- ``New`` Added a ``/swagger`` endpoint [↗](https://gill-bates.github.io/wirebuddy/api/overview/)
- ``New`` Metrics can now be saved and deleted in a more differentiated manner
- ``New`` Traffic statistics are now also grouped by ASN [↗](https://gill-bates.github.io/wirebuddy/features/geoip/#traffic-by-asn)
- ``New`` Users without admin rights can log in with read-only rights [↗](https://gill-bates.github.io/wirebuddy/features/users/#read-only-users)
- ``Fix`` The logs now show the real IP addresses and not those from the reverse proxy
- ``Fix`` Various stability improvements in the backend and GUI
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.2.1] - 2026-03-02

- ``New`` Passwords for users now require a minimum level of complexity [↗](https://gill-bates.github.io/wirebuddy/security/authentication/#password-requirements)
- ``New`` The DNS ad blocker can now be enabled and disabled globally [↗](https://gill-bates.github.io/wirebuddy/features/dns/)
- ``New`` A new "Traffic" section now bundles all network activities in an overview [↗](https://gill-bates.github.io/wirebuddy/features/monitoring/#traffic-analytics)
- ``New`` Completely revised migration framework for the database
- ``Fix`` The /status page now reliably detects an existing Wireguard connection
- ``Fix`` Various stability improvements in the backend engine
- ``Fix`` Disabling OTP for a user had no effect
- ``Fix`` Due to a regex validation error, no new user could be created
- ``Fix`` The block lists did not update automatically every 24 hour
- ``Fix`` Creating another Wireguard interface used the same IP range
- ``Fix`` When a peer is deleted, the time series data is now also deleted
- ``Fix`` Application made more resilient when started with an incorrect encryption key
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.2.0] - 2026-02-26

- ``New`` Introducing MFA to provide an additional layer of access restriction [↗](https://gill-bates.github.io/wirebuddy/security/authentication/#multi-factor-authentication-mfa)
- ``New`` Easylist has been replaced by the significantly more comprehensive HaGeZi Pro [↗](https://gill-bates.github.io/wirebuddy/features/dns/#blocklists)
- ``New`` Update Dependencies (``fastapi``)
- ``New`` A new status page now allows you to check the configuration on the client side [↗](https://gill-bates.github.io/wirebuddy/configuration/status-page/)
- ``New`` You can now define your own filter rules for each client [↗](https://gill-bates.github.io/wirebuddy/features/dns/#per-client-rules)
- ``Fix`` The ``bleach`` package has been replaced by ``nh3``
- ``Fix`` The creation of new peers also automatically created a new PSK
- ``Fix`` The blocklists are no longer downloaded again each time the container is restarted
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.1.1] - 2026-02-24

- ``New`` When Wirebuddy is running in bridge mode, an alternative port can be defined for the Wireguard configuration
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.1.0] - 2026-02-23

- ``New`` Switching from HTTP authentication to cookie authentication [↗](https://gill-bates.github.io/wirebuddy/security/authentication/#session-management)
- ``New`` You can now add your own allow and block lists to the DNS [↗](https://gill-bates.github.io/wirebuddy/features/dns/#custom-rules)
- ``New`` DNS logs can now be deleted [↗](https://gill-bates.github.io/wirebuddy/configuration/dns/#query-logging)
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.0.2] - 2026-02-22

- ``New`` Update Dependencies (``fastapi``)
- ``Fix`` Changing the password had no effect
- ``Fix`` Unbound crashed unexpectedly when the blocklist was updated
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.0.1] - 2026-02-20

- ``New`` Internal DNS serve (Unbound) is now dual-stack capable
- ``New`` Custom DNS upstream servers added by the user are now checked before saving [↗](https://gill-bates.github.io/wirebuddy/features/dns/#validate-servers)
- ``Fix`` The pie charts under DNS displayed incorrect values due to a race condition
- ``Fix`` In the front end, each block list was displayed with the same size (7 MB)
- ``Fix`` Various security hardening measures (e.g. brute force, IP spoofing)
- ``Fix`` And as always: Several design improvements to make the front end more mobile-friendly

## [1.0.0] - 2026-02-19
- Project initialization