From e44e932e45cc87b1eb30a832c62494b49eec2b48 Mon Sep 17 00:00:00 2001
From: fuomag9 <1580624+fuomag9@users.noreply.github.com>
Date: Thu, 5 Mar 2026 00:30:44 +0100
Subject: [PATCH] fix: sync global WAF and GeoBlock settings to slave instances

Both "waf" and "geoblock" settings were missing from the sync payload,
meaning slaves used their own (potentially unconfigured) values.
Per-host WAF was already synced via the proxyHosts table.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/lib/instance-sync.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/lib/instance-sync.ts b/src/lib/instance-sync.ts
index dd3096f1..e5dbbd66 100644
--- a/src/lib/instance-sync.ts
+++ b/src/lib/instance-sync.ts
@@ -14,6 +14,8 @@ export type SyncSettings = {
   logging: unknown | null;
   dns: unknown | null;
   upstream_dns_resolution: unknown | null;
+  waf: unknown | null;
+  geoblock: unknown | null;
 };
 
 export type SyncPayload = {
@@ -243,7 +245,9 @@ export async function buildSyncPayload(): Promise<SyncPayload> {
     metrics: await getSetting("metrics"),
     logging: await getSetting("logging"),
     dns: await getSetting("dns"),
-    upstream_dns_resolution: await getSetting("upstream_dns_resolution")
+    upstream_dns_resolution: await getSetting("upstream_dns_resolution"),
+    waf: await getSetting("waf"),
+    geoblock: await getSetting("geoblock"),
   };
 
   const sanitizedAccessLists = accessListRows.map((row) => ({
@@ -398,6 +402,8 @@ export async function applySyncPayload(payload: SyncPayload) {
   await setSyncedSetting("logging", payload.settings.logging);
   await setSyncedSetting("dns", payload.settings.dns);
   await setSyncedSetting("upstream_dns_resolution", payload.settings.upstream_dns_resolution ?? null);
+  await setSyncedSetting("waf", payload.settings.waf ?? null);
+  await setSyncedSetting("geoblock", payload.settings.geoblock ?? null);
 
   // better-sqlite3 is synchronous, so transaction callback must be synchronous
   db.transaction((tx) => {