Self-Hosted Pro v1.9.0 — Puma-Embedded Worker, Audit Log Improvements, and Security Hardening
TL;DR: Self-Hosted Pro v1.9.0 ships four improvements: SolidQueue now runs inside Puma (one fewer process to manage), user agents are back in audit logs with readable labels, two IP spoofing fixes harden rate limits and audit log accuracy for proxy-fronted deployments, and Admin Settings has a cleaner email configuration nav. No configuration changes required — pull the updated container and restart.
SolidQueue now runs inside Puma
Previously, self-hosted containers ran a Foreman process manager to start and supervise both Puma (the web server) and a separate SolidQueue worker. That worked, but it meant two OS-level processes per container with coordination overhead between them.
v1.9.0 moves SolidQueue inside Puma, running as threads rather than a forked process. The result is a simpler container: one process, one set of environment variables to configure, and no Foreman supervisor to watch. Background jobs — push expiration, auto-dispatch email queueing, license refresh — all continue to run on the same worker concurrency, just within the Puma process instead of alongside it.
This is closer to how the hosted service at pwpush.com has always run and aligns with the direction the OSS edition took with the v2.12.0 async supervisor change. The benefit for self-hosters is straightforward: one fewer process means slightly lower baseline memory, simpler health-check logic, and cleaner container shutdown.
No action required on upgrade — the change is in the container image. Your existing docker-compose.yml and environment configuration work as-is.
User agents are back in audit logs
The May 2026 dashboard redesign inadvertently dropped the user agent column from push and request audit tables, leaving it hidden behind a hover on the actor name. That’s fixed.
Audit log tables now show a User Agent column with a readable client label — “Chrome 120 on macOS”, “curl/8.x”, and so on — with the raw string available on hover for the full detail. On narrow screens the label appears under the actor name in compact form. The Activity Log CSV export now includes a User Agent column as well, which matters for anyone pulling audit data into a SIEM or spreadsheet review.
Existing audit rows already have the user agent stored — this is a display change only. No migration needed.
IP spoofing protection for rate limits and audit logs
Two related security fixes, both relevant if you run Self-Hosted Pro behind a reverse proxy (Caddy, nginx, Traefik, HAProxy) — which is the recommended production configuration.
Rate limit and blocklist hardening. HTTP defines both X-Forwarded-For (proxy-set) and Forwarded (a newer, client-writable header). By default, Rack preferred the Forwarded header, which meant a client could send Forwarded: for=localhost before their request reached the proxy. Rack would resolve the client IP as localhost, bypassing the blocklist and landing in a different rate-limit bucket. Scanners were exploiting exactly this against Caddy-fronted deployments. Rack now trusts only X-Forwarded-* headers — the client-controlled Forwarded header is ignored entirely. An invalid value in a Forwarded header (such as a hostname) also no longer crashes the request with IPAddr::InvalidAddressError.
Accurate audit log IPs. Push and request audit events were recording the raw X-Forwarded-For chain, which clients could prepend with arbitrary addresses. A chain like 198.51.100.8, 45.148.10.15, 10.110.0.3 would log 198.51.100.8 rather than the actual client IP. Audit logs now store request.remote_ip — the same proxy-resolved value Rack::Attack uses — consistently across push views, creation, expiration, request events, and email-challenge records. New regression tests assert the spoofed address is not what ends up in the log.
If you run a direct-internet deployment with no proxy, neither issue affected you.
Email settings consolidated in Admin nav
A small but noticeable admin UX improvement: Support Email and Default From Email are no longer in the Application settings panel. They now live in the Email section alongside SMTP configuration — which is where you’d expect to find sender addresses. The Administration Center sidebar is also now sorted alphabetically by section label, making it easier to scan.
No configuration migration — the underlying settings are unchanged, just where you find them in the UI.
Availability
Self-Hosted Pro v1.9.0 is available now for all editions: Starter, Advanced, and Enterprise. Pull the updated container image to upgrade.
Peter Giacomo Lombardo Founder & Principal, Apnotic · Creators of Password Pusher