v0.34.8

CHANGELOG.md

@@ -1,9 +1,3 @@
-## Docker Agent Linux packaging extension (source-level changes)
-
-- Added independent `rustproxy-docker-agent` DEB/RPM build and signed APT/DNF publication to the external Package Builder; no FreeBSD `pkg` for the agent.
-- Agent CLI now supports `init`, `info` (text/JSON, token redacted by default), `show-token`, `rotate-token`, `cert-init`, `print-fingerprint` and `version`; existing flags and default server invocation remain supported.
-- Manual and package installation share token/certificate provisioning; upgrades preserve TLS files and existing tokens, while startup journals print only nonsecret connection and certificate metadata.
-
 # Changelog
 
 Release history focused on **features, settings, default behavior, compatibility and fixes**. Changes to internal code structure and preliminary performance experiments are intentionally omitted. Historical descriptions reflect their respective releases; consult the current documentation for the settings available in 0.34.8.

SHA256SUMS

@@ -2,7 +2,7 @@
 4140a2956264b44f259e6a37fc00ba02097bbe68b09296e04d3d243c1287129b  .env.example
 9e6356475bf587091bab72246ec9e325b498f7e48a6220e9a18baa50d0a385a6  .gitignore
 e9aa7d23f867dabab4b254154dc81833511138f7679ef7d0583afcdff2ff231e  AGENTS.md
-25add9aeb6f0e052c751380b6d81a42ef1704c093963ab1d119c6bdcd382e59e  CHANGELOG.md
+82fea9271a4c7a112334076c5c76b6bb2f354b362aef6fe7c7822d4477c50e6a  CHANGELOG.md
 3bce5792c1588ec7de8d97239d7e9e3304ce21eb76c619f48e6e62577c6cfac5  Cargo.lock
 15821dc3b17d2da6d139b91a885269a817457d271fbeabb49c3d68bccc5efd22  Cargo.toml
 25c7f3c8162cbf5cc156439774118a81dae9fdc52b611ec7e40c230fc99a772c  Dockerfile
@@ -37,7 +37,7 @@ f24767c2f9d4db4db5005b700d03323dd20f0a1d180ae939be4fe54a126aaf32  docs/CONFIGURA
 80bcc666736b10f6202386d0342e8d6feeba858d77aea310bf3ec6de01c2bfb3  docs/CONTAINER.md
 dc670d912a6a946160c2f8528c9bb710ec38ebe406dcb7dcaf18fb2653f667b6  docs/CUSTOM_LOCATIONS.md
 9fb2d0bcac70d1883dd16557622851a1f0527b3d3569a4b5177f5e6dedd3c74d  docs/DASHBOARD.md
-f8ea2daf22ea464121dc128aea5385f4bd413d66745714e9196cc3bff3520d61  docs/DOCKER_DISCOVERY.md
+3e2f7670d136911c1b7bfe8571c60590932f74a60bcac308add4ccb0446bf970  docs/DOCKER_DISCOVERY.md
 f1baabe34e8a1b204d7c78e2f558c019c156b03adfa6ddecb931b4b8a5501f78  docs/INSTALL.md
 37001cbf8ed248ca05ec40f12dd9876d33f6e0c97dcb21eb2e6f53c3d97a60bb  docs/INTEGRATIONS.md
 694cb7b15c5bbdc94cecd15dc516c05dcb3467849322cdd125b872d36dee4699  docs/LOGS.md
@@ -220,7 +220,7 @@ a8afc6e70950bc70b98725eb049d73cff35dc3a3ee659229a15a8e08d3eb4f12  src/admin/web/
 be9b78bee4ef0026608191d36a2aed831f93c1baaa5bc73da86bf09bc217ce76  src/admin/web/settings.js
 8eadbada619b15087783dcfa0e889a81f88e78034d084c5ab616f7912b835940  src/admin/web/status_200.html
 6feb1996b1caa9d19e0dc56eae7ca5b48b7e7cdf0a93bb2e4b527fb8f13a2fe5  src/admin/web/streams.js
-80dce3464824590a92596a8df959ddc287df5158a068705caeb80abda4668b2d  src/admin/web/style.css
+38716fae968aeb8f6a8510f28bb9054a73a438a969c3b69f9c9d921acfed6e06  src/admin/web/style.css
 d290c048450655b3eeae7c6ec54a82d645d1965513694ab29fdf7eef796a1abd  src/admin/web/traffic-panel.js
 dfb4ded2fefb90fc1e2d33370cdef10b040a85cb43235ea9dbc1d73bef823a79  src/admin/web/transform-panel.js
 a55f45dad5b540def419f8487161fb506b7e52744c76a5e661c7a5fa0a98a426  src/admin/web/vhosts/core.js

src/admin/web/certificate-api.js

@@ -1,6 +1,4 @@
 "use strict";
-// Credential management is separated from generic Settings to keep UI modules bounded.
-// Only non-secret metadata is retained in client state.
 (() => {
   let certificateApiState = null, certificateApiLoading = false;
   let certificateApiEditingKey = null, certificateApiDetailsKey = null;

src/admin/web/index.html

@@ -2211,22 +2211,43 @@
                                         One byte range can be served from a complete cached object;
                                         multipart/unsupported ranges pass through.</p>
                                     <div class="cache-varnish-setting">
-                                        <label class="check"><input id="cache-varnish-compatible" type="checkbox" /><span
+                                        <label class="check"><input id="cache-varnish-compatible"
-                                                data-i18n="cacheVarnishCompatible">Varnish-compatible cache policy (recommended; enabled by default)</span></label>
+                                                type="checkbox" /><span
+                                                data-i18n="cacheVarnishCompatible">Varnish-compatible cache policy
+                                                (recommended; enabled by default)</span></label>
                                         <details class="metric-info cache-varnish-info">
                                             <summary data-i18n-aria="cacheVarnishCompatibleInfoLabel"
                                                 aria-label="Varnish-compatible cache behavior">i</summary>
                                             <div class="metric-info-popover" role="note">
-                                                <p class="fine" data-i18n="cacheVarnishCompatibleHelp">A browser Shift+F5 (no-cache, max-age=0 or Pragma: no-cache) uses a fresh cache HIT without replacing it or resetting Age.</p>
+                                                <p class="fine" data-i18n="cacheVarnishCompatibleHelp">A browser
-                                                <p class="fine" data-i18n="cacheVarnishCompatibleSafeguards">Preserves client no-store, only-if-cached (504 on MISS; no origin contact or background refresh), min-fresh and max-stale (including max-stale=0 during grace); existing cookie rules, Authorization, Vary, PURGE/BAN, HOT/COLD and transformations stay active.</p>
+                                                    Shift+F5 (no-cache, max-age=0 or Pragma: no-cache) uses a fresh
-                                                <p class="fine" data-i18n="cacheVarnishCompatibleBackendHelp">Origin no-cache with a validator remains revalidatable. If an explicit fallback TTL is set, public no-cache responses may instead be reused for that TTL, even without a validator. Private/no-store/Set-Cookie and Surrogate-Control: no-store remain blocked. Zero-TTL objects may be retained for stale-if-error or revalidation; explicit stale-while-revalidate=0 is respected.</p>
+                                                    cache HIT without replacing it or resetting Age.</p>
-                                                <p class="fine" data-i18n="cacheVarnishCompatibleModeHelp">Implicit grace (60 seconds by default, configurable below) only applies to eligible fresh-at-storage responses without an explicit stale-while-revalidate directive. Off restores strict client reload semantics. Changing the mode invalidates existing cached objects. This is not full Varnish VCL emulation.</p>
+                                                <p class="fine" data-i18n="cacheVarnishCompatibleSafeguards">Preserves
+                                                    client no-store, only-if-cached (504 on MISS; no origin contact or
+                                                    background refresh), min-fresh and max-stale (including max-stale=0
+                                                    during grace); existing cookie rules, Authorization, Vary,
+                                                    PURGE/BAN, HOT/COLD and transformations stay active.</p>
+                                                <p class="fine" data-i18n="cacheVarnishCompatibleBackendHelp">Origin
+                                                    no-cache with a validator remains revalidatable. If an explicit
+                                                    fallback TTL is set, public no-cache responses may instead be reused
+                                                    for that TTL, even without a validator. Private/no-store/Set-Cookie
+                                                    and Surrogate-Control: no-store remain blocked. Zero-TTL objects may
+                                                    be retained for stale-if-error or revalidation; explicit
+                                                    stale-while-revalidate=0 is respected.</p>
+                                                <p class="fine" data-i18n="cacheVarnishCompatibleModeHelp">Implicit
+                                                    grace (60 seconds by default, configurable below) only applies to
+                                                    eligible fresh-at-storage responses without an explicit
+                                                    stale-while-revalidate directive. Off restores strict client reload
+                                                    semantics. Changing the mode invalidates existing cached objects.
+                                                    This is not full Varnish VCL emulation.</p>
                                             </div>
                                         </details>
                                     </div>
                                     <div class="cache-varnish-grace-field">
-                                        <label for="cache-varnish-grace" data-i18n="cacheVarnishGrace">Default grace (seconds, 0 = off)</label>
+                                        <label for="cache-varnish-grace" data-i18n="cacheVarnishGrace">Default grace
-                                        <input id="cache-varnish-grace" type="number" min="0" max="604800" step="1" required />
+                                            (seconds, 0 = off)</label>
+                                        <input id="cache-varnish-grace" type="number" min="0" max="604800" step="1"
+                                            required />
                                     </div>
                                     <div class="card soft-card cache-memory-sizing">
                                         <div class="card-heading">

src/admin/web/style.css

@@ -85,8 +85,7 @@
   --ui-check-size: 15px;
   --ui-range-height: 18px;
   --mono: ui-monospace, SFMono-Regular, Consolas, monospace;
-  --sans: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif
+  --sans: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-;
 }
 
 html[data-theme=light] {
@@ -135,8 +134,7 @@ html[data-theme=light] {
   --neutral-soft: rgba(70, 78, 72, .05);
   --scrollbar-track: #e7ece4;
   --scrollbar-thumb: #a9b5a6;
-  --scrollbar-thumb-hover: #879684
+  --scrollbar-thumb-hover: #879684;
-;
 }
 
 html:is([data-theme=light], [data-theme=cream]) {
@@ -2514,16 +2512,14 @@ body[data-density=dense] {
   --ui-gap: 4px;
   --ui-card: 7px;
   --ui-font: 11.5px;
-  --ui-control: 25px
+  --ui-control: 25px;
-;
 }
 
 body[data-density=comfortable] {
   --ui-gap: 13px;
   --ui-card: 17px;
   --ui-font: 14px;
-  --ui-control: 36px
+  --ui-control: 36px;
-;
 }
 
 .shell {
@@ -3664,6 +3660,7 @@ dialog .window-heading {
 }
 
 @media (max-width:640px) {
+
   .acl-rule,
   .basic-user {
     grid-template-columns: 1fr 1fr;
@@ -4251,6 +4248,7 @@ dialog .window-heading {
 }
 
 @media (max-width:720px) {
+
   .logging-grid,
   .traffic-chart-grid {
     grid-template-columns: 1fr;
@@ -4771,6 +4769,7 @@ dialog .window-heading {
 }
 
 @media (max-width:900px) {
+
   .acl-profile-layout,
   .logging-builder-layout,
   .logging-format-actions {
@@ -4947,6 +4946,7 @@ dialog .window-heading {
 }
 
 @media (max-width:760px) {
+
   .redirect-card .vhost-detail-strip,
   .redirect-rule .vh-grid {
     grid-template-columns: 1fr;
@@ -5632,6 +5632,7 @@ dialog .window-heading {
 }
 
 @media (max-width:1000px) {
+
   .docker-acl-grid,
   .docker-timeout-grid {
     grid-template-columns: 1fr 1fr;
@@ -5639,6 +5640,7 @@ dialog .window-heading {
 }
 
 @media (max-width:760px) {
+
   .docker-acl-grid,
   .docker-timeout-grid {
     grid-template-columns: 1fr;
@@ -5878,6 +5880,7 @@ dialog .window-heading {
 }
 
 @media (prefers-reduced-motion: reduce) {
+
   .docker-publish-field .docker-publish,
   .docker-publish-field .docker-publish::before {
     transition: none;
@@ -6513,6 +6516,7 @@ body[data-density=compact] .page-footer {
 }
 
 @media (max-width:760px) {
+
   .docker-route-grid,
   .transform-diagnostics {
     grid-template-columns: 1fr;
@@ -6747,6 +6751,7 @@ body[data-density=compact] .page-footer {
 }
 
 @media (max-width:700px) {
+
   #panel-tls .certificate-operation-heading,
   #panel-tls .certificate-subheading,
   #panel-tls .certificate-workspace-heading,
@@ -7272,6 +7277,7 @@ body[data-density=compact] .page-footer {
 }
 
 @media (max-width:760px) {
+
   .certificate-api-credential-row,
   .network-interface-row-head {
     align-items: flex-start;
@@ -8090,6 +8096,7 @@ button.config-history-day.is-selected {
 }
 
 @media (max-width:700px) {
+
   .file-logs-heading-actions,
   .file-logs-table-toolbar {
     align-items: stretch;
@@ -9115,6 +9122,7 @@ html[data-chart-style] :is(#workspace, dialog) svg polyline {
 }
 
 @media (max-width:900px) {
+
   .acl-policy-custom-controls,
   .acl-policy-modes,
   .acl-profile-layout {
@@ -9127,6 +9135,7 @@ html[data-chart-style] :is(#workspace, dialog) svg polyline {
 }
 
 @media (max-width:640px) {
+
   .acl-policy-preview-head,
   .acl-policy-step-head {
     align-items: stretch;
@@ -9364,7 +9373,7 @@ html[data-chart-style] :is(#workspace, dialog) svg polyline {
   overflow-y: auto;
 }
 
-.cache-varnish-info .metric-info-popover .fine + .fine {
+.cache-varnish-info .metric-info-popover .fine+.fine {
   margin-top: 8px;
 }
 
@@ -9536,6 +9545,7 @@ html[data-chart-style] :is(#workspace, dialog) svg polyline {
 }
 
 @media (max-width:700px) {
+
   #file-log-view-counts,
   #file-log-view-entries,
   #panel-filelogs,
@@ -12220,6 +12230,7 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
 }
 
 @media (max-width:760px) {
+
   .docker-acl-grid .docker-profile-field,
   .docker-agent-grid .docker-profile-field {
     grid-column: auto;
@@ -12434,6 +12445,7 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
 }
 
 @media (max-width:600px) {
+
   .stream-backend-section,
   .web-service-setting-section {
     padding: 10px;
@@ -12578,7 +12590,7 @@ html:is([data-corner-style=square], [data-corner-style=subtle], [data-corner-sty
     gap: 6px;
   }
 
-  .docker-service-quick-actions > * {
+  .docker-service-quick-actions>* {
     flex: 0 0 auto;
   }
 
@@ -12597,17 +12609,13 @@ html:is([data-corner-style=square], [data-corner-style=subtle], [data-corner-sty
   }
 }
 
-html:is([data-corner-style=square], [data-corner-style=subtle], [data-corner-style=rounded], [data-corner-style=extra]) :is(
+html:is([data-corner-style=square], [data-corner-style=subtle], [data-corner-style=rounded], [data-corner-style=extra]) :is(.nav, .file-log-tab, .vhost-backend-trigger, .backend-column-options,
-    .nav, .file-log-tab, .vhost-backend-trigger, .backend-column-options,
   .docker-service-quick-actions a, .docker-service-quick-actions button,
-    .docker-view-toggle, .provider-picker, .renewal-meta-item
+  .docker-view-toggle, .provider-picker, .renewal-meta-item) {
-) {
   border-radius: var(--rp-radius-control) !important;
 }
 
-html:is([data-corner-style=square], [data-corner-style=subtle], [data-corner-style=rounded], [data-corner-style=extra]) :is(
+html:is([data-corner-style=square], [data-corner-style=subtle], [data-corner-style=rounded], [data-corner-style=extra]) :is(.backend-column-options, .renewal-meta-item) {
-    .backend-column-options, .renewal-meta-item
-) {
   border-radius: var(--rp-radius-surface) !important;
 }