chore: bump version to 1.3.2 + CHANGELOG + release notes

Author: cmos486

CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to argos-edge are documented here. Format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versions use [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.2] - 2026-04-24
+
+Bug-fix release. The panel's Caddy config omitted the
+`apps.crowdsec.appsec_fail_open` flag, so a misconfigured or
+missing AppSec sidecar (`cscli appsec-configs list` empty on the
+out-of-the-box CrowdSec image) would cascade into HTTP 500
+responses for **every host on the panel**. v1.3.2 emits the flag,
+defaults it to `true`, and gives operators a UI toggle.
+
+See [release notes](docs/release-notes/v1.3.2.md) for the
+reproduction, full fix story, and rollback.
+
+### Fixed
+
+- `caddycfg` now emits `appsec_fail_open: true` (or `false`) inside
+  the `apps.crowdsec` block whenever `appsec_url` is set. Previously
+  absent; the plugin defaulted to fail-closed, so an unreachable
+  AppSec endpoint 500'd every request.
+
+### Added
+
+- New setting `appsec.fail_open` (bool, default `true`). Wired
+  through `api/settings.go` whitelist and the reconciler's
+  `CrowdSecOpts`.
+- New notification event `appsec_unavailable` (severity warning).
+  Fires on the reachable → unreachable transition of a 5-minute
+  background probe of the AppSec URL.
+- New UI: **AppSec → Fail policy** card, two-radio chooser
+  (fail-open vs fail-closed). Only shown when AppSec mode != disabled.
+- New troubleshooting section:
+  ["Every request to every host returns 500 with `dial tcp ... :7423: connect: connection refused`"](docs/operations/troubleshooting.md)
+  — covers the pre-v1.3.2 symptom, the fail-open default, and the
+  `setup-appsec.sh` runbook.
+
+### Not changed
+
+- No migrations. `appsec.fail_open` is a key/value setting; the
+  default is read on each reconcile, no DB row required up front.
+- No changes to AppSec mode semantics (detect / block / disabled
+  continue to mean exactly what they did in v1.3.1).
+
 ## [1.3.1] - 2026-04-22
 
 Docs-only patch. No code changes since 1.3.0.

backend/cmd/argos/main.go

@@ -43,7 +43,7 @@ import (
 // The source-tree default tracks the most recent released tag; CI
 // overrides with the exact tag on release builds and with
 // "<tag>-dev-<short-sha>" on main builds between tags.
-var argosVersion = "1.3.1"
+var argosVersion = "1.3.2"
 
 // argosCommit is baked in at build time via -ldflags "-X main.argosCommit=...".
 var argosCommit = ""

docs/release-notes/v1.3.2.md

@@ -0,0 +1,111 @@
+# v1.3.2 — AppSec fail-open (bug fix)
+
+Patch release. Fixes an availability regression where a
+misconfigured or missing AppSec sidecar would cascade into HTTP 500
+responses for every host on the panel.
+
+## The bug
+
+Pre-v1.3.2, the panel emitted `apps.crowdsec.appsec_url` in its
+Caddy config whenever `appsec.mode != disabled`. The bouncer plugin
+(`hslatman/caddy-crowdsec-bouncer/appsec`) defaults to
+fail-**closed** behaviour: if the AppSec HTTP endpoint is
+unreachable, the handler returns an error and Caddy serves HTTP 500.
+
+That default is dangerous for argos-edge installations because:
+
+- The CrowdSec image ships with **zero** AppSec collections by
+  default. Ports `:7422` and `:7423` refuse connections until
+  `setup-appsec.sh` is run.
+- AppSec mode defaults to `detect` at first boot, which means the
+  panel emits the `appsec_url` from minute zero.
+- A single dead sidecar = every host on the panel 500s. Twenty
+  hosts, one broken CrowdSec, zero working sites.
+
+Confirmed in the wild on a freshly-deployed v1.3.1:
+
+```
+caddy_error.log →  "crowdsec.appsec" "appsec component unavailable"
+                   "dial tcp 172.20.0.2:7423: connect: connection refused"
+curl archive.cmos486.es → HTTP 500
+```
+
+## The fix
+
+The plugin already exposes an `appsec_fail_open` knob on its app-
+level config (v0.12.1). v1.3.2 starts emitting it, defaulted to
+`true`. Requests now pass through to the backend when the AppSec
+sidecar is unreachable or errors; the WAF-inline round-trip is
+skipped for that request.
+
+Operators who actively run AppSec and want strict enforcement can
+flip the new **AppSec → Fail policy** card in the panel from
+"Fail-open (default, recommended)" to "Fail-closed (strict)".
+
+### Pieces shipped
+
+- `caddycfg` emits `appsec_fail_open: true|false` inside the
+  `apps.crowdsec` block whenever `appsec_url` is set. Absent when
+  AppSec is fully disabled so Caddy doesn't get an orphan field.
+- New setting `appsec.fail_open` (bool, default `true`) wired
+  through `api/settings.go` + the reconciler.
+- New notification event `appsec_unavailable` — severity warning,
+  fires on the reachable → unreachable transition of a background
+  5-minute probe of the AppSec URL. `appsec.fail_open` true means
+  traffic keeps flowing; the notification is how the operator
+  learns their WAF-inline silently degraded.
+- New UI card **AppSec → Fail policy** with a two-radio chooser
+  (fail-open vs fail-closed). Only shown when AppSec mode is not
+  `disabled`.
+- New troubleshooting section in `docs/operations/troubleshooting.md`
+  covering the "connection refused on :7423" symptom, the
+  setup-appsec.sh runbook, and how to hook up the new
+  notification rule.
+
+## What's NOT here
+
+- **Automatic setup-appsec.sh execution**: the panel does not try
+  to install AppSec collections for you. Fail-open prevents
+  breakage; getting AppSec actually running is still an operator
+  task.
+- **Block-mode auto-downgrade**: the panel does not flip a host
+  from block to detect when AppSec is down. Fail-open is per-
+  request; the policy is at the bouncer level, not the host level.
+- **AppSec health badge in the status card**: out of scope for the
+  hotfix. Today the signal is via the notification event +
+  `GET /api/appsec/status` consumed by the card as before.
+
+## Migration
+
+Drop-in. The new setting defaults to `"true"` without a DB
+migration (it's a key/value setting, read-on-demand; absence =
+default). Existing stacks pick up the fix on the next reconcile
+after deploying the new panel + caddy images.
+
+```bash
+cd argos-edge
+git pull
+docker compose build
+docker compose up -d
+```
+
+No data touched. The `appsec.fail_open` setting surfaces in the UI
+immediately as "Fail-open (default)".
+
+## Rollback
+
+- `git checkout v1.3.1`
+- `docker compose build && up -d`
+
+The setting row may remain in `settings` on rollback — v1.3.1's
+`settingWhitelist` doesn't know about it, but the row is inert:
+the older reconciler never reads it. Harmless orphan, gone on the
+next v1.3.2+ upgrade.
+
+## Related
+
+- [AppSec troubleshooting section](../operations/troubleshooting.md)
+  — the "connection refused on :7423" runbook.
+- [Notifications event catalog](../features/notifications.md) —
+  `appsec_unavailable` is the new event.
+- [v1.3.1](v1.3.1.md) — previous release (screenshots patch).

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "argos-edge-frontend",
   "private": true,
-  "version": "1.3.1",
+  "version": "1.3.2",
   "type": "module",
   "scripts": {
     "dev": "vite",

mkdocs.yml

@@ -151,6 +151,7 @@ nav:
       - reference/cli.md
       - reference/database-schema.md
   - Release notes:
+      - v1.3.2: release-notes/v1.3.2.md
       - v1.3.1: release-notes/v1.3.1.md
       - v1.3.0: release-notes/v1.3.0.md
       - v1.2.0: release-notes/v1.2.0.md