v0,28,2

README.md

@@ -1,9 +1,9 @@
-# RustProxy 0.28.1
+# RustProxy 0.28.2
 
 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.28.1 release source.**
+**0.28.2 release source.**
 
 ## Layer-4 streams
 
@@ -11,17 +11,17 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
-## What changed in 0.28.1
+## What changed in 0.28.2
 
-- Add an explicit **External files (absolute paths)** certificate mode for operator-managed PEM pairs such as `/etc/letsencrypt/live/example.com/fullchain.pem` and `privkey.pem`. RustProxy resolves Certbot-style `live/` symlinks on every reload, validates the resulting pair and publishes it atomically for new TLS/H2/H3 handshakes without copying the files into `<data-dir>/certs`.
-- Keep the existing `POST /api/certificates/{certificate_id}/reload` contract for renewal wrappers. A Certbot/acme.sh hook may renew files in place and then call the targeted reload endpoint; the saved configuration revision is unchanged.
-- Preserve the safer managed-file mode for simple filenames inside `<data-dir>/certs`, reject mixed managed/external pairs, and keep upload/deploy endpoints from accepting arbitrary host filesystem paths in their request bodies.
-- Clarify all certificate-source UI text in English and Polish: ACME tabs state that RustProxy/Certbot owns the generated files, Import explains that browser-selected PEMs are copied into RustProxy storage, and Existing files explains the managed-directory versus external-path modes.
-- Exclude externally referenced certificate material from RustProxy backups. The absolute paths remain in configuration and must exist or be mounted separately after restore.
-- Retain all 0.28.0 GeoIP, listener protocol-badge, cache Via/invalidation, Security-editor and ACME runtime-reporting improvements.
-- Keep SQLite schema 8 and COLD on-disk format 3 unchanged.
+- Harden external certificate-file loading without requiring one exact `chmod`: POSIX ACL based read access is supported, group read is allowed for external private keys, and harmless execute-mask bits no longer cause rejection. Private keys still reject world-read and group/world-write; all external certificate/key files reject group/world-write.
+- Validate both the configured path and the resolved Certbot `live/ -> archive/` target through a trusted parent chain. Parent directories must be owned by root or the RustProxy service user and cannot be group/world-writable, except root-owned sticky ancestors such as `/tmp`.
+- Make Certificate API credentials least-privilege. New tokens are reload-only by default, require an explicit allowlist of 1-32 certificate IDs, cannot call the global reload endpoint, and may receive deploy permission only when explicitly enabled. Existing credentials migrate to reload-only broad access and should be rotated to explicit IDs.
+- Add schema 9 for Certificate API grants while preserving the existing proxy configuration document and COLD cache format 3.
+- Add explicit read-only systemd paths for `/etc/letsencrypt` and `/etc/ssl`; Unix/ACL permissions still decide which files the `rustproxy` user can actually read.
+- Expand English/Polish certificate help with concrete POSIX ACL examples, including `setfacl -m u:rustproxy:--x /etc/ssl/`, and clarify the external-file security requirements.
+- Retain the 0.28.1 external-file/Certbot hot-reload workflow and all 0.28.0 GeoIP, listener protocol-badge, cache Via/invalidation, Security-editor and ACME runtime-reporting improvements.
 
-0.28.1 is configuration-compatible with 0.28.0; no database migration is required. Historical details are in [CHANGELOG.md](CHANGELOG.md).
+0.28.2 upgrades SQLite schema 8 to schema 9 with an additive Certificate API grants table. Saved proxy configuration remains compatible with 0.28.1. Historical details are in [CHANGELOG.md](CHANGELOG.md).
 
 ### Historical 0.26.7 release notes