v0.24.5

docs/STREAMS.md

@@ -0,0 +1,61 @@
+# TCP/UDP streams
+
+RustProxy 0.13.0 exposes raw Layer-4 forwarding on the main **Streams** page, alongside **Vhosts** and **Redirects**. A stream combines one dedicated TCP or UDP listener with one upstream. Stream traffic does **not** enter the HTTP pipeline: no HTTP vhost routing, ACL, cache, headers, compression, Tinyauth or TLS termination is applied.
+
+## Dashboard workflow
+
+Use **Streams > New stream** or **Add TCP/UDP listener**. The modal mirrors the Vhost workflow and contains Details, Listener & upstream, and Limits tabs. Existing streams are shown as searchable cards with live runtime counters and RX/TX rate charts.
+
+A saved listener change is desired state only until RustProxy restarts. The page keeps the active startup listener visible and marks changed/new/removed stream configuration as pending restart.
+
+The HTTP/HTTPS listener editor remains under **Settings > Listeners**. Its bind addresses use the same chip-style interaction as vhost hostnames. Those named HTTP/HTTPS listeners are separate from stream listeners.
+
+## Configuration document
+
+```json
+{
+  "streams": [
+    {
+      "id": "ssh",
+      "name": "SSH relay",
+      "enabled": true,
+      "protocol": "tcp",
+      "listen": "0.0.0.0:2222",
+      "upstream": "10.0.0.20:22",
+      "connect_timeout_seconds": 5,
+      "idle_timeout_seconds": 300,
+      "max_connections": 512
+    },
+    {
+      "id": "dns-udp",
+      "name": "DNS UDP",
+      "enabled": true,
+      "protocol": "udp",
+      "listen": "0.0.0.0:5353",
+      "upstream": "10.0.0.53:53",
+      "connect_timeout_seconds": 5,
+      "idle_timeout_seconds": 30,
+      "max_connections": 2048
+    }
+  ]
+}
+```
+
+TCP uses a bidirectional byte relay with a connect timeout, inactivity timeout and connection limit. UDP creates a bounded per-client session mapped to one connected upstream socket, expires it after inactivity and limits concurrent sessions.
+
+## Runtime telemetry
+
+The administration status snapshot exposes fixed-cardinality metrics for active startup streams. The Streams page displays:
+
+- active TCP connections or UDP client sessions;
+- accepted connections/sessions and completed sessions;
+- capacity rejects and relay/upstream errors;
+- bytes received from clients and returned from upstreams;
+- UDP packet counters;
+- live RX/TX rates derived from monotonic backend byte counters.
+
+The chart history exists only in the current browser panel session. Backend counters are process-lifetime counters and reset on process restart.
+
+## Listener safety
+
+RustProxy validates collisions before publishing configuration. TCP stream listeners may not overlap HTTP/TLS, administration or Prometheus TCP listeners. UDP stream listeners may not overlap HTTP/3 UDP listeners. TCP and UDP may intentionally use the same numeric port because they are different transports. Direct loops into another RustProxy listener of the same transport are rejected.