Repository navigation
chore: release 8.9.0 - #1986
Draft
Tbaile wants to merge 46 commits into
Draft
chore: release 8.9.0#1986Tbaile wants to merge 46 commits into
Tbaile wants to merge 46 commits into
Conversation
Add a setup menu entry to open or close access to the web UI port 9090 from the WAN zone. Assisted-by: Claude Code:claude-sonnet-5-5
New images no longer expose the web UI port 9090 on WAN. Existing installations keep their current rule. Assisted-by: Claude Code:claude-sonnet-5-5
The menu was redrawn right after passwd, hiding its output. Show a dialog telling whether the password was changed. Assisted-by: Claude Code:claude-sonnet-5-5
Make the result of the password change and remote access toggle clear at a glance. Assisted-by: Claude Code:claude-opus-5-5
When a feed download failed, adblock logged the full feed URL to syslog. Nethesis DNS feeds configured by ns-threat_shield embed the subscription credentials as https://<system_id>:<secret>@bl.nethesis.it, so the secret ended up in /var/log/messages and in VictoriaLogs. Strip the user:password@ part before logging, keeping the host and path for debugging. Other URL outputs (etag debug line, JSON report, fetch parameters) do not include the feed URL. Assisted-by: Claude Code:claude-opus-5-5
Tbaile
force-pushed
the
release-8.9.0
branch
from
November 10, 2026 16:51
47c67d2 to
b88f978
Compare
The threat_shield inventory fact reports the number of enabled custom allowlist URLs and custom blocklists. Refs #2005 Assisted-by: Claude Code:claude-opus-5-5
ns.threatshield manages remote allowlist URLs and custom blocklists, and lists the Nethesis global allowlist as a read-only built-in row, enabled only with a subscription. Edits replace the whole entry. Custom list names can't clash with builtin feeds, and a custom list is always listed as custom. Threat Shield IP status no longer depends on the Nethesis allowlist URL. Refs #2005 Assisted-by: Claude Code:claude-opus-5-5
ts-ip rebuilds ban_allowurl and banip.custom.feeds from the ns_allowurl and ns_blockfeed sections. Legacy ban_allowurl entries are moved once to ns_allowurl sections, also on upgrade. The post-commit hook runs ts-ip and drops the banIP backups of lists whose URL changed; ts-fail2ban runs once per commit. On upgrade the feed copy is refreshed without starting fail2ban. Refs #2005 Assisted-by: Claude Code:claude-opus-5-5
A non-empty banip.custom.feeds holds a copy of banip.feeds and banIP reads only that file, so rerun ts-ip after a banip upgrade to pick up new or changed upstream feeds. Refs #2005 Assisted-by: Claude Code:claude-opus-5-5
The Threat Shield IP page had nothing to show when fail2ban banned nobody, even while banIP lists dropped traffic all the time. New method list-blocklist-bans: the addresses dropped by banIP lists in the last hour, read from VictoriaLogs, one row per address, list and direction, most hits first, at most 500 rows. It returns an empty list when VictoriaLogs can't be reached. Assisted-by: Claude Code:Opus 5.5
feat(threat_shield): custom allow and block lists #2005
Build the UI from the head of the nethsecurity-ui release-8.9.0 branch, which has the Threat Shield custom lists pages. Replace it with the tagged UI release later. Assisted-by: Claude Code:Opus 5.5
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #1988