v0.28.0

docs/INSTALL.md

@@ -1,4 +1,4 @@
-# Installing and updating RustProxy 0.27.3
+# Installing and updating RustProxy 0.28.0
 
 The scripts prepare a Linux/systemd installation. This source archive is **not a
 verified production build**: Rust/Cargo, real CA operations, live systemd startup
@@ -67,12 +67,15 @@ precompiled binary in the archive. Set `--binary` explicitly when using a custom
 
 ## First installation
 
-The normal first install also downloads `user-country-ipv4.csv` and
-`user-country-ipv6.csv` from the `sapics/ip-location-db` latest release over HTTPS and
-verifies each file against the publisher SHA-256 release before writing it privately to
-`DATA_DIR/geoip`. This enables country access/rate rules. Use `--skip-geoip` only when
-you intentionally do not want the database; allow-only country policies then fail
-closed for unresolved clients. Updates preserve the installed database.
+`install.sh` also downloads the direct `user-country-ipv4.csv` and `user-country-ipv6.csv`
+assets from the `sapics/ip-location-db` latest release over HTTPS, validates their CSV
+structure and writes them privately to `DATA_DIR/geoip`. Package/plugin installs may omit
+that packaging-time download: after all listeners bind successfully, RustProxy starts an
+enabled-by-default GeoIP worker, performs an immediate background refresh and then checks
+every 24 hours by default. Country allow-only policies continue to fail closed until a valid
+database is available. Settings can use separate IPv4/IPv6 CSV files or one native MaxMind
+MMDB file; direct source URLs, optional per-file SHA-256 URLs, maximum file size and interval
+are configurable under **Settings -> GeoIP updates**.
 
 
 ```bash
@@ -225,11 +228,14 @@ bash update.sh --plan --binary target/release/rust-proxy
 sudo bash update.sh --binary target/release/rust-proxy
 ```
 
-Before stopping the service, the updater fetches the current publisher SHA-256
-files for the `user-country` GeoIP IPv4/IPv6 assets. Matching local files are left
-untouched; stale or missing assets are staged, verified and published only after
-the private-data backup exists. Use `--skip-geoip` only when intentionally accepting
-a stale/missing country database (for example during an upstream outage).
+Before stopping the service, the updater downloads the current direct `user-country`
+IPv4/IPv6 CSV assets, validates their structure and compares their local SHA-256 with the
+installed files. Unchanged files are left untouched; changed or missing assets are staged
+and published only after the private-data backup exists. This intentionally avoids requiring
+a separately moving publisher-checksum release. The manual updater and the in-process GeoIP
+worker use the same `.geoip-update.lock`, so they cannot publish concurrently. Use
+`--skip-geoip` only when intentionally accepting a stale/missing country database (for
+example during an upstream outage).
 
 Use the original `--prefix` for a non-default installation. Other startup/account/
 data settings are read from root-owned `install.json`; update does not silently