v0.0.5

What's changed

• Replace the embedded dashboard config builder with the external Config Builder — the dashboard footer link now opens it with the running config pre-loaded via a base64url URL hash
• Add GET /config.toml on the management port: exports the running config as TOML with secrets blanked (Captcha.Secret/SecretKey, signing secrets, webhook URLs)
• Restore per-country captcha/log actions: IP.Countries.Captcha bumps WAFScore by +5 and defers to the decision engine, IP.Countries.Log logs only; priority: block > captcha > log
• Re-raise http.ErrAbortHandler in access-log panic recovery — client disconnects during proxying abort quietly instead of being logged as panics (metrics and access log still recorded)

Upgrade notes

• The embedded /builder/ page on the management port is removed — use the external Config Builder (the dashboard footer link opens it with your config)

Full changelog: v0.0.4...v0.0.5

v0.0.4

What's changed

• Add Proxy.PreserveHost (*bool, default true): forward the original client Host to the backend and advertise it via X-Forwarded-Host; set false to rewrite Host to the backend address (previous default behavior)
• Migrate captcha status code from 499 to 403 and add the X-WAF-Action response header (captcha | block | throttle) to disambiguate challenge vs denial
• Require Captcha.Secret (≥32 bytes) when Captcha.Provider is set — fixes forgeable waf_pass cookies from the hardcoded default secret; warn at startup when captcha runs on memory storage (multi-instance-unsafe)
• Emit Retry-After on block, soft block, blacklist and 429; add Decision.BlockRetryAfter and RateLimit.RetryAfter (60s default)
• Metrics polish: add wafsrv_attack_mode_active gauge, rename attack_score_boost_applied_total → attack_score_boost_total, clarify help text and proxy no_backends target label
• Simplify deployments/Dockerfile ENTRYPOINT — config path and log format are now supplied at deploy time

⚠️ Upgrade notes

• Host handling default flips: backends now receive the original client Host by default. Set Proxy.PreserveHost = false to keep the old rewrite-to-backend behavior.
• Captcha.Secret is now required when a captcha provider is configured (openssl rand -hex 32, identical on every instance behind a load balancer).
• Dockerfile ENTRYPOINT is bare: the orchestrator must pass -config / WAFSRV_CONFIG and -json.

Full changelog: v0.0.3...v0.0.4

v0.0.3

What's changed

• Under Attack Mode: Decision.AttackScoreBoost boosts request score and TrafficRule.AttackOnly gates rules via waf.AttackState; hot-path cost tightened with atomic snapshot reads
• Surface AttackOnly and AdaptiveSection.ScoreBoost in dashboard and config builder UI with TOML round-tripping
• Add e2e test for AttackOnly rule gating, metrics unit tests, and replace concrete hostnames with example.com across code, templates and samples

Full changelog: v0.0.2...v0.0.3

v0.0.2

What's changed

• Add MCP mode for JSON-RPC tools/call (per-tool rate limits, whitelist, metrics) and per-URL rate limit rules (HTTP path/method/host matching)
• Differentiate proxy error status codes: 503+Retry-After for circuit-breaker open and empty backend pool, 502 for real upstream errors, 500 for panic recovery; new wafsrv_proxy_errors_total{target, reason} metric
• Surface URLRules and Proxy.NoBackendRetryAfter in the dashboard config view and config builder UI; alerter cleanup and nil-interface fix

Full changelog: v0.0.1...v0.0.2

v0.0.1

Initial release