cache: keep redis readers by pointer

A pooled SimpleRedis holds a sync.Mutex, so appending one into rc.readers
by value copies the lock and trips go vet's copylocks check. Keep the
readers by pointer instead; the round-robin over replicas is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D95Nh68xKXhynPXHzozrXp

.github/workflows/e2e.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           # Track go.mod (Go 1.22) — the plugin's yaegi-bound floor. Keeps the
           # single source of truth and builds the mock on the supported version.

.github/workflows/main.yml

@@ -32,7 +32,7 @@ jobs:
 
       # https://github.com/marketplace/actions/setup-go-environment
       - name: Set up Go ${{ env.GO_VERSION }}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
 

.github/workflows/release-prepare.yml

@@ -0,0 +1,83 @@
+name: Release (1/2) Prepare
+
+# Step 1 of the release process: bump pluginVersion *before* the tag exists.
+#
+# The version reported to the Crowdsec LAPI lives in version.go, so it has to
+# be correct in the very commit the tag points at. Anything that patches
+# version.go after the release is published is too late: Traefik's plugin
+# service caches the plugin archive per module+version, so users keep the
+# source that was there when the tag was first resolved (see #322, #363).
+#
+# This workflow opens a "release" PR containing only that bump. Merging it
+# triggers Release (2/2) Publish, which creates the tag and the GitHub release
+# on the merged commit.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release, e.g. v1.7.1 or v1.8.0-alpha"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    name: Open release PR for ${{ inputs.version }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out main
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Validate version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
+            echo "::error::'$VERSION' is not a vX.Y.Z / vX.Y.Z-suffix version"
+            exit 1
+          fi
+          if git rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
+            echo "::error::tag $VERSION already exists"
+            exit 1
+          fi
+
+      - name: Bump version.go
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          sed -i 's/pluginVersion = "[^"]*"/pluginVersion = "'"$VERSION"'"/' version.go
+          cat version.go
+          if git diff --quiet -- version.go; then
+            echo "::error::version.go already reads $VERSION, nothing to release"
+            exit 1
+          fi
+
+      - name: Push release branch and open PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git switch -c "release/$VERSION"
+          git commit -am "🔖 release $VERSION"
+          git push -u origin "release/$VERSION"
+
+          cat > /tmp/pr-body.md <<EOF
+          Bumps \`pluginVersion\` to \`$VERSION\` so the tag carries the version
+          the plugin reports to the Crowdsec LAPI.
+
+          Merging this PR tags \`$VERSION\` on the resulting commit and publishes
+          the GitHub release automatically.
+
+          > Keep the PR title as-is: **Release (2/2) Publish** matches on it.
+          EOF
+
+          gh pr create --base main --head "release/$VERSION" --title "🔖 release $VERSION" --body-file /tmp/pr-body.md

.github/workflows/release-publish.yml

@@ -0,0 +1,53 @@
+name: Release (2/2) Publish
+
+# Step 2 of the release process: tag and publish the commit prepared by
+# Release (1/2) Prepare.
+#
+# Triggered by the release PR landing on main. The tag is created on that
+# commit, so version.go inside the released source always matches the tag —
+# no post-release patching, no force-moved tags.
+
+on:
+  push:
+    branches: [main]
+    paths: ["version.go"]
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Tag and publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the pushed commit
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Resolve release version
+        id: resolve
+        run: |
+          version="$(git log -1 --format='%B' | grep -oP '🔖 release \Kv[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?' || true)"
+          [ -z "$version" ] && { echo "version.go changed outside a release commit, nothing to do"; echo "release=false" >> "$GITHUB_OUTPUT"; exit 0; }
+
+          in_source="$(sed -n 's/.*pluginVersion = "\([^"]*\)".*/\1/p' version.go)"
+          [ "$in_source" != "$version" ] && { echo "::error::commit says $version but version.go reads $in_source"; exit 1; }
+          git rev-parse -q --verify "refs/tags/$version" >/dev/null && { echo "::error::tag $version already exists"; exit 1; }
+
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "prerelease=$([[ "$version" == *-* ]] && echo '--prerelease')" >> "$GITHUB_OUTPUT"
+
+      - name: Tag and create the GitHub release
+        if: steps.resolve.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.resolve.outputs.version }}
+          PRERELEASE: ${{ steps.resolve.outputs.prerelease }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "$VERSION" -m "$VERSION"
+          git push origin "$VERSION"
+          gh release create "$VERSION" --title "$VERSION" --generate-notes $PRERELEASE

.github/workflows/renovate.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run Renovate
-        uses: renovatebot/github-action@v46.1.20
+        uses: renovatebot/github-action@v46.2.2
         with:
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:

README.md

@@ -384,8 +384,8 @@ make run
   - Transmit only the first number of bytes to Crowdsec Appsec Server.
 - CrowdsecAppsecUnreadableBodyBlock
   - bool
-  - default: false
+  - default: true
-  - Behaviour when the request body cannot be buffered for inspection (HTTP/2 or HTTP/3 request without a `Content-Length`, typically a bidirectional gRPC stream). When `false` (default) the request is forwarded to the Appsec Server with headers only (the body is left to stream through untouched). When `true` the request is blocked outright. Mirrors the reference bouncers' `APPSEC_DROP_UNREADABLE_BODY` option.
+  - Behaviour when the request body cannot be buffered for inspection (HTTP/2 or HTTP/3 request without a `Content-Length`, typically a bidirectional gRPC stream). When `false` the request is forwarded to the Appsec Server with headers only (the body is left to stream through untouched). When `true` the request is blocked outright. Mirrors the reference bouncers' `APPSEC_DROP_UNREADABLE_BODY` option.
 - CrowdsecAppsecKey
   - string
   - default: value of `CrowdsecLapiKey`

bouncer.go

@@ -641,7 +641,12 @@ func handleStreamCache(bouncer *Bouncer) error {
 	if err.Error() != cache.CacheMiss {
 		return err
 	}
-	bouncer.cacheClient.Set(cacheTimeoutKey, cache.NoBannedValue, bouncer.updateInterval-1)
+	// To avoid every instance trying to update the cache, set 1 second at least
+	leaseDuration := bouncer.updateInterval - 1
+	if leaseDuration < 1 {
+		leaseDuration = 1
+	}
+	bouncer.cacheClient.Set(cacheTimeoutKey, cache.NoBannedValue, leaseDuration)
 	streamRouteURL := url.URL{
 		Scheme:   bouncer.crowdsecScheme,
 		Host:     bouncer.crowdsecHost,

docker-compose.local.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -12,7 +12,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       # - './ban.html:/ban.html:ro'

examples/appsec-enabled/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

examples/behind-proxy/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   cloudflare:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "cloudflare"
     restart: unless-stopped
     command:
@@ -19,7 +19,7 @@ services:
       - 8080:8080
 
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -33,7 +33,7 @@ services:
       - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - logs-traefik:/var/log/traefik

examples/captcha/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

examples/custom-ban-page/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

examples/custom-captcha/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -14,7 +14,7 @@ services:
       - "--entrypoints.web.forwardedheaders.trustedips=172.18.0.0/24"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

examples/kubernetes/traefik/values.yml

@@ -1,5 +1,5 @@
 image:
-  tag: v3.7.8
+  tag: v3.7.11
 
 logs:
   general:
@@ -15,4 +15,4 @@ experimental:
   plugins:
     bouncer:
       moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.6.0"
+      version: "v1.7.1"

examples/redis-cache/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -87,7 +87,7 @@ services:
       - "traefik.enable=false"
 
   redis-secure:
-    image: "redis:8.8.0-alpine"
+    image: "redis:8.10.0-alpine"
     container_name: "redis-secure"
     hostname: redis-secure
     restart: unless-stopped

examples/standalone-mode/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

examples/tls-auth/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

examples/trusted-ips/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.11"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -13,7 +13,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.6.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro

pkg/cache/cache.go

@@ -52,7 +52,7 @@ func (localCache) delete(key string) {
 type redisCache struct {
 	log     *slog.Logger
 	writer  simpleredis.SimpleRedis
-	readers []simpleredis.SimpleRedis
+	readers []*simpleredis.SimpleRedis
 	counter atomic.Uint64
 }
 
@@ -62,7 +62,7 @@ func (rc *redisCache) nextReader() *simpleredis.SimpleRedis {
 		return &rc.writer
 	}
 	idx := rc.counter.Add(1) % uint64(n)
-	return &rc.readers[idx]
+	return rc.readers[idx]
 }
 
 func (rc *redisCache) get(key string) (string, error) {
@@ -115,7 +115,9 @@ func (c *Client) New(log *slog.Logger, isRedis bool, writeHost string, readHosts
 		rc := &redisCache{log: log}
 		rc.writer.Init(writeHost, pass, database)
 		for _, h := range readHosts {
-			var r simpleredis.SimpleRedis
+			// A pooled SimpleRedis holds a mutex, so it is kept by pointer:
+			// appending it by value would copy the lock along with it.
+			r := &simpleredis.SimpleRedis{}
 			r.Init(h, pass, database)
 			rc.readers = append(rc.readers, r)
 		}

pkg/cache/cache_test.go

@@ -130,7 +130,7 @@ func indexOfReader(rc *redisCache, r *simpleredis.SimpleRedis) int {
 		return -1
 	}
 	for i := range rc.readers {
-		if r == &rc.readers[i] {
+		if r == rc.readers[i] {
 			return i
 		}
 	}
@@ -151,7 +151,10 @@ func Test_nextReader(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			rc := &redisCache{log: logger.New("INFO", "")}
-			rc.readers = make([]simpleredis.SimpleRedis, tt.readers)
+			rc.readers = make([]*simpleredis.SimpleRedis, tt.readers)
+			for i := range rc.readers {
+				rc.readers[i] = &simpleredis.SimpleRedis{}
+			}
 			for call, want := range tt.want {
 				if got := indexOfReader(rc, rc.nextReader()); got != want {
 					t.Errorf("call %d: nextReader() -> reader[%d], want reader[%d]", call, got, want)

renovate.json

@@ -25,16 +25,6 @@
     }
   ],
   "customManagers": [
-    {
-      "description": "Plugin self-pin in version.go (pluginVersion)",
-      "customType": "regex",
-      "managerFilePatterns": ["/^version\\.go$/"],
-      "matchStrings": [
-        "pluginVersion\\s*=\\s*\"(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)\""
-      ],
-      "depNameTemplate": "maxlerebourg/crowdsec-bouncer-traefik-plugin",
-      "datasourceTemplate": "github-tags"
-    },
     {
       "description": "Plugin self-pin in docker-compose CLI args (--experimental.plugins.bouncer.version=vX)",
       "customType": "regex",

tests/e2e/mock/lib/common.sh

@@ -14,7 +14,7 @@
 set -euo pipefail
 
 # Pinned to match the Docker suite (tests/e2e/scenarios/*/docker-compose.yml).
-TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.8}"
+TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.11}"
 
 WEB_PORT="${WEB_PORT:-8000}"
 LAPI_PORT="${LAPI_PORT:-8090}"

version.go

@@ -1,4 +1,5 @@
 package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck
 
-// pluginVersion is updated automatically by the release workflow and Renovate.
+// pluginVersion is what the plugin reports to the Crowdsec LAPI.
-var pluginVersion = "v1.6.0" //nolint:gochecknoglobals
+// Do not edit by hand: the "Release (1/2) Prepare" workflow bumps it.
+var pluginVersion = "v1.7.1" //nolint:gochecknoglobals