v0,28,2

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.28.1"
+assert manifest["package"]["version"] == "0.28.2"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.28.1"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.28.2"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.28.1",
-    "CHANGELOG.md": "## 0.28.1",
-    "ROADMAP.md": "## 0.28.1",
-    "AGENTS.md": "Current source version: 0.28.1.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.28.1",
+    "README.md": "# RustProxy 0.28.2",
+    "CHANGELOG.md": "## 0.28.2",
+    "ROADMAP.md": "## 0.28.2",
+    "AGENTS.md": "Current source version: 0.28.2.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.28.2",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -124,6 +124,7 @@ assert 'cargo generate-lockfile' in dev and r'version = "0\.9\.0"' not in dev
 assert dev.count('cargo generate-lockfile') == 1, "dev.sh must only create Cargo.lock when it is missing"
 unit = (root / "deploy/rustproxy.service").read_text()
 assert "LogsDirectory=rustproxy" in unit and "/var/log/rustproxy" in unit
+assert "ReadOnlyPaths=-/etc/letsencrypt -/etc/ssl" in unit
 assert "Environment=MALLOC_ARENA_MAX=2" in unit
 assert "Environment=MALLOC_ARENA_MAX=2" in read_deploy_source()
 assert not re.search(r"\b20\d{2}[-/]\d{1,2}[-/]\d{1,2}\b", (root / "CHANGELOG.md").read_text()), "changelog contains a release date"
@@ -284,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.28.1"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.28.2"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -678,7 +679,7 @@ assert 'Ok(line) if command_tx.send(line).is_ok()' not in main_source, 'do not m
 assert 'Ok(line) => {' in main_source and 'command_tx.send(line).is_err()' in main_source
 for marker in ['LIVE_STREAM_CAPACITY', 'broadcast::Sender<LogEntry>', 'pub fn subscribe']:
     assert marker in logging_source, marker
-assert 'SCHEMA_VERSION: i64 = 8' in db_source and 'certificate_renewals' in db_source and '0004_admin_preferences.sql' in db_source and '0005_certificate_api.sql' in db_source and '0006_certificate_api_credentials.sql' in db_source and '0007_secret_store.sql' in db_source and '0008_config_history.sql' in db_source
+assert 'SCHEMA_VERSION: i64 = 9' in db_source and 'certificate_renewals' in db_source and '0004_admin_preferences.sql' in db_source and '0005_certificate_api.sql' in db_source and '0006_certificate_api_credentials.sql' in db_source and '0007_secret_store.sql' in db_source and '0008_config_history.sql' in db_source and '0009_certificate_api_grants.sql' in db_source
 for marker in ['replace_as_restore', 'config.restore', 'source_revision']:
     assert marker in db_source, marker
 for marker in ['restore_config_history', '/api/config/history/restore', 'expected_revision']:
@@ -1300,12 +1301,13 @@ connection.executescript((root / "migrations/0005_certificate_api.sql").read_tex
 connection.executescript((root / "migrations/0006_certificate_api_credentials.sql").read_text())
 connection.executescript((root / "migrations/0007_secret_store.sql").read_text())
 connection.executescript((root / "migrations/0008_config_history.sql").read_text())
-connection.execute("PRAGMA user_version = 8")
+connection.executescript((root / "migrations/0009_certificate_api_grants.sql").read_text())
+connection.execute("PRAGMA user_version = 9")
 assert connection.execute("PRAGMA quick_check").fetchone()[0] == "ok"
 assert connection.execute("SELECT COUNT(*) FROM auth_throttle WHERE id=1").fetchone()[0] == 1
 assert connection.execute("SELECT COUNT(*) FROM certificate_renewals").fetchone()[0] == 0
 assert connection.execute("SELECT COUNT(*) FROM admin_preferences").fetchone()[0] == 0
-assert connection.execute("PRAGMA user_version").fetchone()[0] == 8
+assert connection.execute("PRAGMA user_version").fetchone()[0] == 9
 connection.close()
 for marker_0223 in [
     '"/api/certificates/reload"', 'certificate_reload',
@@ -1394,7 +1396,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.28.1"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.28.2"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1516,33 +1518,65 @@ assert 'listener-active-item' in runtime_web_0280 and 'listener-active-feature'
 assert 'cache-via-enabled' in cache_web_0280 and 'via_header:' in cache_web_0280
 assert 'location-header-direction location-header-editor' in vhost_core_0280
 
-# 0.28.1 external certificate paths and certificate-source UX.
-tls_types_0281 = (root / "src/tls/types.rs").read_text()
-tls_server_0281 = (root / "src/tls/server_config.rs").read_text()
-tls_tests_0281 = (root / "src/tls/tests.rs").read_text()
-backup_snapshot_0281 = (root / "src/backup/snapshot.rs").read_text()
-certificate_admin_0281 = (root / "src/admin/certificates.rs").read_text()
-for marker_0281 in [
+# 0.28.2 external-certificate ACL/path hardening and least-privilege Certificate API.
+tls_types_0282 = (root / "src/tls/types.rs").read_text()
+tls_external_0282 = (root / "src/tls/external_paths.rs").read_text()
+tls_server_0282 = (root / "src/tls/server_config.rs").read_text()
+tls_tests_0282 = (root / "src/tls/tests.rs").read_text() + (root / "src/tls/tests/external_paths.rs").read_text()
+backup_snapshot_0282 = (root / "src/backup/snapshot.rs").read_text()
+certificate_admin_0282 = (root / "src/admin/certificates.rs").read_text()
+certificate_api_db_0282 = (root / "src/db/certificate_api.rs").read_text()
+certificate_session_0282 = (root / "src/admin/session.rs").read_text()
+deploy_core_0282 = (root / "scripts/deploy/deploy_core.py").read_text()
+for marker_0282 in [
     'pub fn certificate_files_are_external',
     'cert_external == key_external',
-    'fs::canonicalize(value)',
-    'Certbot\'s live/ entries are symlinks',
-    'read_configured_pem',
-    'external private key may be owner/group-readable',
 ]:
-    assert marker_0281 in tls_types_0281, marker_0281
-assert 'certificate_files_are_external(cert, key)?;' in tls_server_0281
-assert 'external_absolute_paths_follow_certbot_style_symlinks_on_each_reload' in tls_tests_0281
-assert 'certificate_files_are_external(' in backup_snapshot_0281 and 'External certificate material is intentionally outside' in backup_snapshot_0281
-assert 'uses external file paths; renew those files in place and call the certificate reload endpoint instead of deploy' in certificate_admin_0281
-for marker_0281 in [
+    assert marker_0282 in tls_external_0282, marker_0282
+for marker_0282 in [
+    'validate_external_parent_chain',
+    'fs::canonicalize(configured)',
+    'libc::O_NOFOLLOW',
+    'mode & 0o022 == 0',
+    'mode & 0o004 == 0',
+    'POSIX ACL masks are reflected',
+]:
+    assert marker_0282 in tls_external_0282, marker_0282
+assert 'certificate_files_are_external(cert, key)?;' in tls_server_0282
+for marker_0282 in [
+    'external_absolute_paths_follow_certbot_style_symlinks_on_each_reload',
+    'external_key_permissions_accept_acl_style_group_mask_but_reject_unsafe_write_or_world_read',
+    'external_paths_reject_writable_non_sticky_parent_directories',
+]:
+    assert marker_0282 in tls_tests_0282, marker_0282
+assert 'certificate_files_are_external(' in backup_snapshot_0282 and 'External certificate material is intentionally outside' in backup_snapshot_0282
+assert 'uses external file paths; renew those files in place and call the certificate reload endpoint instead of deploy' in certificate_admin_0282
+for marker_0282 in [
+    'certificate_api_grants',
+    'allow_deploy',
+    'certificate_ids',
+    'value != "*"',
+]:
+    assert marker_0282 in certificate_api_db_0282, marker_0282
+for marker_0282 in [
+    'certificate_api.target_required',
+    'certificate_api.certificate_forbidden',
+    'certificate_api.deploy_forbidden',
+]:
+    assert marker_0282 in certificate_session_0282, marker_0282
+assert 'ReadOnlyPaths=-/etc/letsencrypt -/etc/ssl' in deploy_core_0282
+for marker_0282 in [
     'id="certificate-file-source"',
     'certificateSourceManaged',
     'certificateSourceExternal',
     '/etc/letsencrypt/live/example.com/fullchain.pem',
+    'certificate-external-acl-example',
+    'certificate-api-certificate-ids',
+    'certificate-api-allow-deploy',
 ]:
-    assert marker_0281 in html or marker_0281 in runtime_web_0280 or marker_0281 in (root / 'langs/en_US.json').read_text(), marker_0281
+    assert marker_0282 in html or marker_0282 in runtime_web_0280 or marker_0282 in (root / 'langs/en_US.json').read_text(), marker_0282
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
+assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.28.1 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
+print("PASS: 0.28.2 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.28.1 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.28.2 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -14,6 +14,7 @@ required = [
     DOCS / "README.md",
     DOCS / "WEB_SERVER.md",
     DOCS / "TODO.md",
+    DOCS / "V0.28.2_IMPLEMENTATION.md",
     DOCS / "V0.28.1_IMPLEMENTATION.md",
     DOCS / "V0.27.3_IMPLEMENTATION.md",
     DOCS / "V0.27.2_IMPLEMENTATION.md",
@@ -61,16 +62,16 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.28.1")
+assert readme.startswith("# RustProxy 0.28.2")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme
-assert roadmap.startswith("# RustProxy roadmap") and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
+assert roadmap.startswith("# RustProxy roadmap") and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
 assert "## 0.24." not in roadmap and "## Web Server follow-up" in roadmap and "docs/ROADMAP_HISTORY.md" in roadmap
 assert changelog.startswith("# Changelog\n")
-for release in ["0.28.1", "0.28.0", "0.27.3", "0.27.2", "0.27.1", "0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]:
+for release in ["0.28.2", "0.28.1", "0.28.0", "0.27.3", "0.27.2", "0.27.1", "0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]:
     assert f"## {release}" in changelog, release
-assert changelog.index("## 0.28.1") < changelog.index("## 0.28.0") < changelog.index("## 0.27.3") < changelog.index("## 0.27.2") < changelog.index("## 0.27.1") < changelog.index("## 0.27.0") < changelog.index("## 0.26.7") < changelog.index("## 0.26.6") < changelog.index("## 0.26.5") < changelog.index("## 0.26.4") < changelog.index("## 0.26.1") < changelog.index("## 0.26.0") < changelog.index("## 0.25.6") < changelog.index("## 0.25.5")
+assert changelog.index("## 0.28.2") < changelog.index("## 0.28.1") < changelog.index("## 0.28.0") < changelog.index("## 0.27.3") < changelog.index("## 0.27.2") < changelog.index("## 0.27.1") < changelog.index("## 0.27.0") < changelog.index("## 0.26.7") < changelog.index("## 0.26.6") < changelog.index("## 0.26.5") < changelog.index("## 0.26.4") < changelog.index("## 0.26.1") < changelog.index("## 0.26.0") < changelog.index("## 0.25.6") < changelog.index("## 0.25.5")
 assert "CHANGELOG_TECHNICAL_ARCHIVE.md" in changelog
 for developer_only in ["Clean the remaining compiler warnings", "Update package/source/UI/OpenAPI/release identity", "source regressions and update release identity"]:
     assert developer_only not in changelog, f"developer-only CHANGELOG detail: {developer_only}"

tools/checks/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.28.1 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.28.2 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.28.1 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.28.2 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_smoke.py

@@ -62,17 +62,22 @@ def sql_and_backup_smoke(tmp: Path) -> None:
         )
         connection.execute("PRAGMA user_version = 3")
         connection.commit()
-        # Simulate additive startup migrations through the current schema-v8.
+        # Simulate additive startup migrations through the current schema-v9.
         connection.executescript((ROOT / "migrations/0004_admin_preferences.sql").read_text(encoding="utf-8"))
         connection.executescript((ROOT / "migrations/0005_certificate_api.sql").read_text(encoding="utf-8"))
         connection.executescript((ROOT / "migrations/0006_certificate_api_credentials.sql").read_text(encoding="utf-8"))
         connection.executescript((ROOT / "migrations/0007_secret_store.sql").read_text(encoding="utf-8"))
         connection.executescript((ROOT / "migrations/0008_config_history.sql").read_text(encoding="utf-8"))
+        connection.execute(
+            "INSERT INTO certificate_api_credentials(key_id,token_hash,comment,created_at,last_used_at) VALUES(?,?,?,?,NULL)",
+            ("legacy-hook", "0" * 64, "pre-0.28.2", 1),
+        )
+        connection.executescript((ROOT / "migrations/0009_certificate_api_grants.sql").read_text(encoding="utf-8"))
         connection.execute(
             "INSERT INTO admin_preferences(administrator_id,document) VALUES(1,?)",
             (json.dumps({"live_log_columns": ["time", "status"]}),),
         )
-        connection.execute("PRAGMA user_version = 8")
+        connection.execute("PRAGMA user_version = 9")
         connection.commit()
         assert connection.execute("PRAGMA quick_check").fetchone()[0] == "ok"
         tables = {
@@ -81,8 +86,11 @@ def sql_and_backup_smoke(tmp: Path) -> None:
                 "SELECT name FROM sqlite_master WHERE type='table'"
             )
         }
-        for table in ("configuration", "administrator", "admin_sessions", "admin_audit", "auth_throttle", "certificate_renewals", "admin_preferences", "certificate_api_credential", "certificate_api_credentials", "secret_store", "configuration_history"):
+        for table in ("configuration", "administrator", "admin_sessions", "admin_audit", "auth_throttle", "certificate_renewals", "admin_preferences", "certificate_api_credential", "certificate_api_credentials", "certificate_api_grants", "secret_store", "configuration_history"):
             assert table in tables, table
+        assert connection.execute(
+            "SELECT allow_deploy, certificate_ids FROM certificate_api_grants WHERE key_id='legacy-hook'"
+        ).fetchone() == (0, '["*"]')
     finally:
         connection.close()
     os.chmod(db, 0o600)
@@ -92,7 +100,7 @@ def sql_and_backup_smoke(tmp: Path) -> None:
     assert copied.is_file()
     metadata = json.loads((destination / "backup.json").read_text(encoding="utf-8"))
     assert metadata["project"] == "RustProxy"
-    assert metadata["schema"] == 8
+    assert metadata["schema"] == 9
     assert metadata["configuration_revision"] == 4
     restored = sqlite3.connect(copied)
     try:
@@ -127,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.28.1"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.28.2"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -138,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.28.1"
+    assert manifest["to_version"] == "0.28.2"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -177,6 +185,7 @@ def deployment_gate_smoke(tmp: Path) -> None:
     remote_unit = deploy.service_unit({"prefix":"/opt/rustproxy", "data_dir":"/var/lib/rustproxy", "user":"rustproxy", "group":"rustproxy", "admin":"0.0.0.0:9090", "remote_admin":True, "http":"0.0.0.0:80", "https":"0.0.0.0:443"})
     assert "ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin" in remote_unit
     assert "ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy" in remote_unit
+    assert "ReadOnlyPaths=-/etc/letsencrypt -/etc/ssl" in remote_unit
     assert "TimeoutStopSec=120" in remote_unit
     for marker in ["PrivateDevices=true", "ProtectKernelLogs=true", "RestrictNamespaces=true", "RestrictRealtime=true", "SystemCallArchitectures=native"]:
         assert marker in remote_unit, marker
@@ -610,7 +619,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.28.1"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.28.2"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -997,7 +1006,7 @@ def source_contract_smoke() -> None:
     app_runtime = (ROOT / 'src/admin/web/app/runtime.js').read_text(encoding='utf-8')
     for marker in ['const protocols = ["H1"]', 'protocols.push("H2")', 'protocols.push("H2C")', 'protocols.push("H3/UDP")']:
         assert marker in app_runtime, marker
-    assert "SCHEMA_VERSION: i64 = 8" in db_source and "certificate_renewals" in db_source and "0004_admin_preferences.sql" in db_source and "0005_certificate_api.sql" in db_source and "0006_certificate_api_credentials.sql" in db_source and "0007_secret_store.sql" in db_source and "0008_config_history.sql" in db_source
+    assert "SCHEMA_VERSION: i64 = 9" in db_source and "certificate_renewals" in db_source and "0004_admin_preferences.sql" in db_source and "0005_certificate_api.sql" in db_source and "0006_certificate_api_credentials.sql" in db_source and "0007_secret_store.sql" in db_source and "0008_config_history.sql" in db_source and "0009_certificate_api_grants.sql" in db_source
     runtime_source = rust_source(ROOT, "src/runtime.rs")
     assert 'replace_as_restore' in db_source and 'config.restore' in db_source and 'source_revision' in db_source
     assert 'restore_config_history' in admin and '/api/config/history/restore' in admin
@@ -1100,7 +1109,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.28.1"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.28.2"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1305,7 +1314,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.28.1 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.28.2 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/web_server_contracts.py

@@ -96,7 +96,7 @@ need(web,
      'HeaderValue::from_static("no-store")',
      "builtin_error_response(StatusCode::FORBIDDEN, &method)",
      "empty_index_can_go_directly_to_directory_listing",
-     "RustProxy <b>0.28.1</b>",
+     "RustProxy <b>0.28.2</b>",
      "traversal_and_symlink_escape_are_not_served",
      "try_files_rewrites_cache_rules_headers_and_downloads_work",
      "precompressed_sidecars_keep_mime_validators_and_range_semantics",