v0.24.10

scripts/check_source.py

@@ -16,7 +16,7 @@ def read_cache_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.24.9"
+assert manifest["package"]["version"] == "0.24.10"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -24,14 +24,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.24.9"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.24.10"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.24.9",
-    "CHANGELOG.md": "## 0.24.9",
-    "ROADMAP.md": "## 0.24.9",
-    "AGENTS.md": "Current source version: 0.24.9.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.9",
+    "README.md": "# RustProxy 0.24.10",
+    "CHANGELOG.md": "## 0.24.10",
+    "ROADMAP.md": "## 0.24.10",
+    "AGENTS.md": "Current source version: 0.24.10.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.10",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -212,7 +212,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.24.9"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.24.10"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -734,7 +734,8 @@ assert 'actions.append(enabledLabel, stateBadge, remove)' in docker_ui
 assert 'row._readListeners = listenerControl.read' in docker_ui and '.docker-agent-listeners' not in docker_ui
 assert 'docker-agent-status-badge' in style_source and 'justify-content: center' in style_source
 assert '.docker-agent-grid>label' in style_source and '#docker-agent-add' in style_source and 'margin-top: 14px' in style_source
-assert '<details class="mini-live-chart mini-live-chart-collapsible">' in html and 'class="mini-live-chart-head"' in html and 'data-i18n="responseLatencyHistory"' in html
+assert '<details class="mini-live-chart mini-live-chart-collapsible">' not in html
+assert 'data-i18n="responseLatencyHistory"' in html and 'data-i18n="responseLatencyHint"' in html and 'data-i18n-aria="responseLatencyInfo"' in html
 assert 'viewBox: "0 0 300 60"' in app_js and 'M0 15H300 M0 30H300 M0 45H300' in app_js
 assert '.network-interface-row {' in style_source and 'background: transparent' in style_source
 assert 'function checkboxField(key, control)' in docker_ui and 'checkboxField("dockerPreserveHost", preserve)' in docker_ui and 'checkboxField("dockerAclInline", inline)' in docker_ui
@@ -1124,9 +1125,15 @@ for marker_0241 in ['"runtime"', '"platform"', '"statistics_source"', '"data_dir
     assert marker_0241 in admin_0241 or marker_0241 in openapi, marker_0241
 assert 'id="process-platform"' in html and 'd.platform' in app_js
 assert 'id="panel-logging"' not in html
-assert 'id="settings-tab-logging"' in html and 'id="settings-page-logging"' in html and 'id="logging-form"' in html
+assert 'id="settings-tab-logging"' in html and 'id="settings-page-logging"' in html and 'id="logging-form"' in html and 'id="error-log-form"' in html
+assert 'data-i18n="errorLogHelp"' not in html
+assert 'bindSettingsForm("error-log-form"' in app_js and '}, "logging", selectLoggingSection);' in app_js
+assert 'const selectLoggingSection = next => ({ logging: next.logging, error_log: next.error_log });' in app_js
+assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log")' in admin_0241
+assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
+assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.24.9"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.24.10"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = (root / "src/tls.rs").read_text()
@@ -1171,5 +1178,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
     node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
     assert "maxItems" not in node, schema_name
 
-print("PASS: 0.24.9 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v7 migrations.")
+print("PASS: 0.24.10 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v7 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

scripts/deploy.py

@@ -97,7 +97,7 @@ def digest(path: Path) -> str:
 def fetch_https(url: str, max_bytes: int) -> bytes:
     if urllib.parse.urlparse(url).scheme != 'https':
         raise ValueError('GeoIP downloads require HTTPS.')
-    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.9'})
+    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.10'})
     with urllib.request.urlopen(request, timeout=30) as response:
         if urllib.parse.urlparse(response.geturl()).scheme != 'https':
             raise ValueError('GeoIP download redirected away from HTTPS.')

scripts/preflight.py

@@ -33,10 +33,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/management.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/migrate_npm.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.24.9 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.24.10 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.24.9 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.24.10 entry point; extract the complete package, not individual files.")
     return messages
 
 

scripts/release_smoke.py

@@ -114,13 +114,13 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.24.9"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.24.10"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
     assert (target / "docker-agent/main.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.24.9"
+    assert manifest["to_version"] == "0.24.10"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -247,6 +247,7 @@ def ui_contract_smoke() -> None:
         'id="settings-tab-logging"',
         'id="settings-page-logging"',
         'id="logging-form"',
+        'id="error-log-form"',
         'id="settings-tab-administration"',
         'id="settings-tab-tls-policy"',
         'id="admin-tls"',
@@ -361,8 +362,9 @@ def ui_contract_smoke() -> None:
         assert marker in html, marker
     for marker in ["lastApiLatencyMs", "cacheMemorySamples", "networkRxSamples", "responseLatencySamples"]:
         assert marker in app, marker
-    assert '<details class="mini-live-chart mini-live-chart-collapsible">' in html
-    assert 'class="mini-live-chart-head"' in html and 'data-i18n="responseLatencyHistory"' in html
+    assert '<details class="mini-live-chart mini-live-chart-collapsible">' not in html
+    assert 'data-i18n="responseLatencyHistory"' in html and 'data-i18n="responseLatencyHint"' in html and 'data-i18n-aria="responseLatencyInfo"' in html
+    assert 'bindSettingsForm("error-log-form"' in app and '}, "logging", selectLoggingSection);' in app
     assert 'viewBox: "0 0 300 60"' in app and 'M0 15H300 M0 30H300 M0 45H300' in app
     assert '.network-interface-row {' in css and 'background: transparent' in css
     assert "hostTagEditor" in vhosts and "vhost-chart-line" in vhosts and "vhLifetimeChart" in vhosts
@@ -506,9 +508,9 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.9"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.10"' in openapi_0241
     assert 'id="panel-logging"' not in html
-    for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"']:
+    for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
     assert 'location.pathname === "/logging"' in settings_ui
 
@@ -950,7 +952,7 @@ def source_contract_smoke() -> None:
     assert "removed_obsolete_runtime_state" in upgrade_source and "legacy-data" not in upgrade_source and "certs_dir.is_symlink()" in upgrade_source
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
-    for marker in ['"version": "0.24.9"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.24.10"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1098,7 +1100,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     debian_grafana_contract_smoke()
-    print("PASS: 0.24.9 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.24.10 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

scripts/routeros-oci-build/README.md

@@ -76,10 +76,10 @@ ENV_FILE=scripts/routeros-oci-build/.env \
   bash scripts/routeros-oci-build/build-routeros-oci.sh push
 ```
 
-With RustProxy version `0.24.9` and the defaults this publishes:
+With RustProxy version `0.24.10` and the defaults this publishes:
 
 ```text
-zot.example.net/network/rustproxy:0.24.9
+zot.example.net/network/rustproxy:0.24.10
 zot.example.net/network/rustproxy:latest
 zot.example.net/network/rustproxy:routeros
 ```

scripts/swagger_assets.py

@@ -85,7 +85,7 @@ def download(destination: Path) -> None:
     """TLS verification uses Python's default trust store; never executes a shell."""
     started = time.monotonic()
     opener = build_opener(HttpsRedirects())
-    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.9"})
+    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.10"})
     with opener.open(request, timeout=30) as response, destination.open("wb") as output:
         length = response.headers.get("Content-Length")
         if length and int(length) > MAX_ARCHIVE:

scripts/upgrade.py

@@ -46,7 +46,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
         for name in MANAGED:
             if (target / name).is_symlink():
                 raise ValueError(f"Managed target {name} is a symlink; refusing to replace it.")
-        backup = target / ".upgrade-backup" / ("before-0.24.9-" + uuid.uuid4().hex[:12])
+        backup = target / ".upgrade-backup" / ("before-0.24.10-" + uuid.uuid4().hex[:12])
         backup.mkdir(parents=True, mode=0o700)
         installed: list[str] = []
         moved: list[str] = []
@@ -84,7 +84,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
             remove_legacy = legacy.exists()
             if remove_legacy and (legacy.is_symlink() or not legacy.is_file()):
                 raise ValueError("Obsolete renewal observation sidecar must be a regular file.")
-            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.9", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
+            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.10", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
             if remove_legacy:
                 legacy.unlink()
         except BaseException:
@@ -115,7 +115,7 @@ def main() -> None:
         backup = upgrade(Path(__file__).resolve().parents[1], args.target, stopped=args.stopped, data_dir=data_dir)
     except (OSError, ValueError) as error:
         parser.exit(2, f"Upgrade refused or rolled back: {error}\n")
-    print(f"Installed RustProxy 0.24.9. Previous managed source files: {backup}")
+    print(f"Installed RustProxy 0.24.10. Previous managed source files: {backup}")
     print("Preserved data, .env, .git, target and other unmanaged files. No database migration was run.")
     print(f"Next: cd {args.target}; ./dev.sh test; ./dev.sh")