Merge pull request #2865 from bunkerity/staging

Road to 1.6.6-rc2 🚀

Author: TheophileDiot

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -47,7 +47,7 @@ body:
       label: BunkerWeb version
       description: What version of BunkerWeb are you running?
       placeholder: Version
-      value: 1.6.6-rc1
+      value: 1.6.6-rc2
     validations:
       required: true
   - type: dropdown

.github/workflows/container-build.yml

@@ -99,7 +99,7 @@ jobs:
       # Compute metadata
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: bunkerity/${{ inputs.IMAGE }}
       # Build cached image

.github/workflows/linux-build.yml

@@ -151,7 +151,7 @@ jobs:
       - name: Extract metadata
         if: inputs.TEST == true
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ghcr.io/bunkerity/${{ inputs.LINUX }}-tests:${{ inputs.RELEASE }}
       - name: Build test image

.github/workflows/push-docker.yml

@@ -76,7 +76,7 @@ jobs:
       # Compute metadata
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: bunkerity/${{ inputs.IMAGE }}
       # Build and push

CHANGELOG.md

@@ -1,6 +1,21 @@
 # Changelog
 
-## v1.6.6-rc1 - ????/??/??
+## v1.6.6-rc2 - ????/??/??
+
+- [FEATURE] Refactor `Let's Encrypt` mail handling: validate the configured email and warn if missing/invalid. Use normal registration when valid; otherwise add **--register-unsafely-without-email** to Certbot and log that choice.
+- [FEATURE] Add `DuckDNS` as a DNS provider in the `letsencrypt` plugin
+- [FEATURE] Add `AUTH_BASIC_ROUNDS` setting to the `authbasic` plugin to configure password hashing strength (default: 656000, range: 1000-999999999).
+- [FEATURE] Add new `mtls` plugin for mutual TLS client certificate authentication, allowing services to require and verify client certificates against trusted CA bundles with configurable verification modes, chain depth control, and optional header forwarding for downstream authorization.
+- [AUTOCONF] Implement event debouncing in Docker, Ingress, and Swarm controllers for improved configuration management
+- [MISC] Update default value for Permissions-Policy header to include additional features (`private-state-token-issuance` and `private-state-token-redemption`).
+- [DEPS] Update coreruleset-v4 version to v4.20.0
+- [DEPS] Updated luajit2 version to v2.1-20251030
+- [DEPS] Updated lua-resty-core version to v0.1.32
+- [DEPS] Updated lua-nginx-module version to v0.10.29
+- [DEPS] Updated stream-lua-nginx-module version to v0.0.17
+- [DEPS] Update lua-resty-openssl version to v1.7.0
+
+## v1.6.6-rc1 - 2025/10/31
 
 - [BUGFIX] Update BunkerWeb integration to use dedicated CrowdSec collection so that CrowdSec now works with the log format used by BunkerWeb.
 - [FEATURE] Enhance plugin update process with per-plugin commit option and improved error handling

README.md

@@ -1,8 +1,8 @@
 # Advanced usages
 
-Many real-world use case examples are available in the [examples](https://github.com/bunkerity/bunkerweb/tree/v1.6.6-rc1/examples) folder of the GitHub repository.
+Many real-world use case examples are available in the [examples](https://github.com/bunkerity/bunkerweb/tree/v1.6.6-rc2/examples) folder of the GitHub repository.
 
-We also provide numerous boilerplates, such as YAML files for various integrations and database types. These are available in the [misc/integrations](https://github.com/bunkerity/bunkerweb/tree/v1.6.6-rc1/misc/integrations) folder.
+We also provide numerous boilerplates, such as YAML files for various integrations and database types. These are available in the [misc/integrations](https://github.com/bunkerity/bunkerweb/tree/v1.6.6-rc2/misc/integrations) folder.
 
 This section only focuses on advanced usages and security tuning, see the [features section](features.md) of the documentation to see all the available settings.
 
@@ -87,7 +87,7 @@ You will find more settings about real IP in the [features section](features.md#
             -p 80:8080/tcp \
             -p 443:8443/tcp \
             -p 443:8443/udp \
-            bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+            bunkerity/bunkerweb-all-in-one:1.6.6-rc2
         ```
 
         Please note that if your container is already created, you will need to delete it and recreate it so the new environment variables will be updated.
@@ -98,15 +98,15 @@ You will find more settings about real IP in the [features section](features.md#
 
         ```yaml
         bunkerweb:
-          image: bunkerity/bunkerweb:1.6.6-rc1
+          image: bunkerity/bunkerweb:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
             REAL_IP_FROM: "1.2.3.0/24 100.64.0.0/10"
             REAL_IP_HEADER: "X-Forwarded-For"
           ...
         bw-scheduler:
-          image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+          image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -123,15 +123,15 @@ You will find more settings about real IP in the [features section](features.md#
 
         ```yaml
         bunkerweb:
-          image: bunkerity/bunkerweb:1.6.6-rc1
+          image: bunkerity/bunkerweb:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
             REAL_IP_FROM: "1.2.3.0/24 100.64.0.0/10"
             REAL_IP_HEADER: "X-Forwarded-For"
           ...
         bw-scheduler:
-          image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+          image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -178,15 +178,15 @@ You will find more settings about real IP in the [features section](features.md#
 
         ```yaml
         bunkerweb:
-          image: bunkerity/bunkerweb:1.6.6-rc1
+          image: bunkerity/bunkerweb:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
             REAL_IP_FROM: "1.2.3.0/24 100.64.0.0/10"
             REAL_IP_HEADER: "X-Forwarded-For"
           ...
         bw-scheduler:
-          image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+          image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -251,7 +251,7 @@ You will find more settings about real IP in the [features section](features.md#
             -p 80:8080/tcp \
             -p 443:8443/tcp \
             -p 443:8443/udp \
-            bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+            bunkerity/bunkerweb-all-in-one:1.6.6-rc2
         ```
 
         Please note that if your container is already created, you will need to delete it and recreate it so the new environment variables will be updated.
@@ -262,7 +262,7 @@ You will find more settings about real IP in the [features section](features.md#
 
         ```yaml
         bunkerweb:
-          image: bunkerity/bunkerweb:1.6.6-rc1
+          image: bunkerity/bunkerweb:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -272,7 +272,7 @@ You will find more settings about real IP in the [features section](features.md#
           ...
         ...
         bw-scheduler:
-          image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+          image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -290,7 +290,7 @@ You will find more settings about real IP in the [features section](features.md#
 
         ```yaml
         bunkerweb:
-          image: bunkerity/bunkerweb:1.6.6-rc1
+          image: bunkerity/bunkerweb:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -300,7 +300,7 @@ You will find more settings about real IP in the [features section](features.md#
           ...
         ...
         bw-scheduler:
-          image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+          image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -352,7 +352,7 @@ You will find more settings about real IP in the [features section](features.md#
 
         ```yaml
         bunkerweb:
-          image: bunkerity/bunkerweb:1.6.6-rc1
+          image: bunkerity/bunkerweb:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -362,7 +362,7 @@ You will find more settings about real IP in the [features section](features.md#
           ...
         ...
         bw-scheduler:
-          image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+          image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
           ...
           environment:
             USE_REAL_IP: "yes"
@@ -514,7 +514,7 @@ To enable systemd-resolved as your DNS resolver in BunkerWeb, set the `DNS_RESOL
         -p 80:8080/tcp \
         -p 443:8443/tcp \
         -p 443:8443/udp \
-        bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+        bunkerity/bunkerweb-all-in-one:1.6.6-rc2
     ```
 
 === "Docker"
@@ -542,7 +542,7 @@ To enable systemd-resolved as your DNS resolver in BunkerWeb, set the `DNS_RESOL
           - bw-dns
 
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         ...
         environment:
           DNS_RESOLVERS: "dnsmasq"
@@ -553,7 +553,7 @@ To enable systemd-resolved as your DNS resolver in BunkerWeb, set the `DNS_RESOL
           - bw-dns
 
       bw-scheduler:
-        image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+        image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
         ...
         environment:
           DNS_RESOLVERS: "dnsmasq"
@@ -667,7 +667,7 @@ Some integrations provide more convenient ways to apply configurations, such as
           }" \
         -p 80:8080/tcp \
         -p 443:8443/tcp \
-        bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+        bunkerity/bunkerweb-all-in-one:1.6.6-rc2
     ```
 
     Please note that if your container is already created, you will need to delete it and recreate it for the new environment variables to be applied.
@@ -707,7 +707,7 @@ Some integrations provide more convenient ways to apply configurations, such as
         -p 80:8080/tcp \
         -p 443:8443/tcp \
         -p 443:8443/udp \
-        bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+        bunkerity/bunkerweb-all-in-one:1.6.6-rc2
     ```
 
 === "Docker"
@@ -730,7 +730,7 @@ Some integrations provide more convenient ways to apply configurations, such as
     ```yaml
     ...
     bw-scheduler:
-      image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+      image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
       environment:
         - |
           CUSTOM_CONF_SERVER_HTTP_hello-world=
@@ -773,7 +773,7 @@ Some integrations provide more convenient ways to apply configurations, such as
 
     ```yaml
     bw-scheduler:
-      image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+      image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
       volumes:
         - ./bw-data:/data
       ...
@@ -843,7 +843,7 @@ Some integrations provide more convenient ways to apply configurations, such as
 
     ```yaml
     bw-scheduler:
-      image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+      image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
       volumes:
         - ./bw-data:/data
       ...
@@ -1073,7 +1073,7 @@ For complete list of settings regarding `stream` mode, please refer to the [feat
         -p 443:8443/udp \
         -p 10000:10000/tcp \
         -p 20000:20000/tcp \
-        bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+        bunkerity/bunkerweb-all-in-one:1.6.6-rc2
     ```
 
     Please note that if your container is already created, you will need to delete it and recreate it for the new environment variables to be applied.
@@ -1096,7 +1096,7 @@ For complete list of settings regarding `stream` mode, please refer to the [feat
 
     services:
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         ports:
           - "80:8080" # Keep it if you want to use Let's Encrypt automation when using http challenge type
           - "10000:10000" # app1
@@ -1111,7 +1111,7 @@ For complete list of settings regarding `stream` mode, please refer to the [feat
           - bw-services
 
       bw-scheduler:
-        image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+        image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
         environment:
           <<: *bw-api-env
           BUNKERWEB_INSTANCES: "bunkerweb" # This setting is mandatory to specify the BunkerWeb instance
@@ -1162,7 +1162,7 @@ For complete list of settings regarding `stream` mode, please refer to the [feat
     ```yaml
     services:
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         ports:
           - "80:8080" # Keep it if you want to use Let's Encrypt automation when using http challenge type
           - "10000:10000" # app1
@@ -1392,7 +1392,7 @@ For complete list of settings regarding `stream` mode, please refer to the [feat
     ```yaml
     services:
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         ports:
           # Keep it if you want to use Let's Encrypt automation when using http challenge type
           - published: 80
@@ -1522,7 +1522,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
         -p 80:8080/tcp \
         -p 443:8443/tcp \
         -p 443:8443/udp \
-        bunkerity/bunkerweb-all-in-one:1.6.6-rc1
+        bunkerity/bunkerweb-all-in-one:1.6.6-rc2
     ```
 
     Please note that if your container is already created, you will need to delete it and recreate it for the new environment variables to be applied.
@@ -1566,7 +1566,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
 
     services:
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         ports:
           - "80:8080/tcp"
           - "443:8443/tcp"
@@ -1581,7 +1581,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
           - bw-services
 
       bw-scheduler:
-        image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+        image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
         environment:
           <<: *bw-api-env
           BUNKERWEB_INSTANCES: "bunkerweb" # This setting is mandatory to specify the BunkerWeb instance
@@ -1675,7 +1675,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
 
     services:
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         labels:
           - "bunkerweb.INSTANCE=yes"
         environment:
@@ -1688,7 +1688,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
           - bw-services
 
       bw-scheduler:
-        image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+        image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
         environment:
           <<: *bw-api-env
           BUNKERWEB_INSTANCES: "" # We don't need to specify the BunkerWeb instance here as they are automatically detected by the autoconf service
@@ -1703,7 +1703,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
           - bw-db
 
       bw-autoconf:
-        image: bunkerity/bunkerweb-autoconf:1.6.6-rc1
+        image: bunkerity/bunkerweb-autoconf:1.6.6-rc2
         depends_on:
           - bunkerweb
           - bw-docker
@@ -1943,7 +1943,7 @@ BunkerWeb supports PHP using external or remote [PHP-FPM](https://www.php.net/ma
     ```yaml
     services:
       bunkerweb:
-        image: bunkerity/bunkerweb:1.6.6-rc1
+        image: bunkerity/bunkerweb:1.6.6-rc2
         volumes:
           - /shared/www:/var/www/html
     ...
@@ -2042,7 +2042,7 @@ By default, BunkerWeb will only listen on IPv4 addresses and won't use IPv6 for
     ```yaml
     services:
       bw-scheduler:
-        image: bunkerity/bunkerweb-scheduler:1.6.6-rc1
+        image: bunkerity/bunkerweb-scheduler:1.6.6-rc2
         environment:
           USE_IPv6: "yes"
 
@@ -2101,7 +2101,7 @@ You can configure the logging driver for your services in your `docker-compose.y
 ```yaml
 services:
   bunkerweb:
-    image: bunkerity/bunkerweb:1.6.6-rc1
+    image: bunkerity/bunkerweb:1.6.6-rc2
     logging:
       driver: "json-file"
       options: