- Implement API tests for DNS Provider Types, validating built-in and custom providers.
- Create UI tests for provider selection, ensuring all types are displayed and descriptions are shown.
- Introduce fixtures for consistent test data across DNS Provider tests.
- Update manual DNS provider tests to improve structure and accessibility checks.
Implement Phase 3 of Custom DNS Provider Plugin Support with comprehensive
security controls for external plugin loading.
Add CHARON_PLUGIN_SIGNATURES env var for SHA-256 signature allowlisting
Support permissive (unset), strict ({}), and allowlist modes
Add directory permission verification (reject world-writable)
Configure container with non-root user and read-only plugin mount option
Add 22+ security tests for permissions, signatures, and allowlist logic
Create plugin-security.md operator documentation
Security controls:
Signature verification with sha256: prefix requirement
World-writable directory rejection
Non-root container execution (charon user UID 1000)
Read-only mount support for production deployments
Documented TOCTOU mitigation with atomic deployment workflow
- Add encryption key environment variable to docker-compose.yml,
docker-compose.dev.yml, docker-compose.local.yml, docker-compose.test.yml
- Update README.md Quick Start examples (compose and docker run)
- Include generation instructions: openssl rand -base64 32
Required for DNS provider and plugin features which encrypt sensitive data at rest.
- Updated the QA/Security Validation Report with new dates and status.
- Enhanced coverage verification metrics for backend and frontend tests.
- Improved TypeScript checks and security scans, ensuring all checks passed.
- Refactored ProxyHosts tests to utilize mock implementations for hooks and APIs.
- Added smoke test for login functionality using Playwright.
- Adjusted vitest configuration to use thread pooling for tests.
- Removed unnecessary peer dependency from package-lock.json.
Fixes CrowdSec failing to start due to multiple permission issues:
- Log directory path was /var/log/ instead of /var/log/crowdsec/
- Database files owned by root (cscli runs as root)
- Config files owned by root after envsubst
Changes to .docker/docker-entrypoint.sh:
- Add sed to fix log_dir path to /var/log/crowdsec/
- Add chown after each envsubst config operation
- Add final chown -R after all cscli commands complete
Testing:
- CrowdSec now starts automatically on container boot
- LAPI listens on port 8085 and responds
- Backend coverage: 85.5%
- All pre-commit checks pass
- 0 security vulnerabilities (Critical/High)
