diff --git a/AGENTS.md b/AGENTS.md index e9de025..73edf51 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,7 +2,7 @@ Read README.md, ROADMAP.md and docs/TEST_REPORT.md before making changes. The project name is RustProxy; the Cargo package/binary remains `rust-proxy` for -compatibility. Current source version: 0.26.7. +compatibility. Current source version: 0.27.0. ## Delivery diff --git a/CHANGELOG.md b/CHANGELOG.md index 056e8be..e275a52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,17 @@ > test-only changes and packaging implementation notes were moved to > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md). +## 0.27.0 + +- Enable downstream response compression by default for zstd, Brotli and gzip; keep deflate opt-in. Client q-values remain authoritative and equal-quality encodings use `zstd -> br -> gzip -> deflate` priority. Existing `Content-Encoding` is passed through unchanged. +- Compress eligible authenticated/cookie/private/no-store responses instead of broadly excluding them. Explicit `no-transform`, ranges, SSE, upgrades and already encoded responses remain uncompressed by RustProxy. +- Add inherit/enable/disable dynamic-compression controls plus per-scope zstd/Brotli/gzip/deflate filters to ordinary vhosts, generated Docker vhosts and Web Server services. Global Response settings remain the hard codec ceiling and own the minimum size. When a scope is explicitly Disabled, codec inheritance controls disappear and are disabled while their saved values are retained for later re-enable. +- Keep every explicitly published Docker hostname routed until it is explicitly unpublished. Missing services return `503 Service Unavailable`; temporary agent failures reuse the last successful inventory when present, and returning services are reattached automatically. +- Fix HOT/COLD cache progress meters so their configured-limit fill is visible in Chromium/WebKit and Firefox. +- Make fresh installations emit `Server: RustProxy` by default while preserving existing saved/legacy behavior. +- Remove Debian package-build metadata from the main source tree; ready Debian packages are maintained separately at `https://rustproxy.linuxiarz.pl`. +- Keep SQLite schema 8; the new compression override fields are defaulted/additive and require no database migration. + ## 0.26.7 - Add HOT and COLD cache occupancy progress bars on `/cache` for configured object and byte limits, with explicit percentage/limit details. diff --git a/Cargo.lock b/Cargo.lock index 2638514..c25e959 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1688,7 +1688,7 @@ dependencies = [ [[package]] name = "rust-proxy" -version = "0.26.7" +version = "0.27.0" dependencies = [ "anyhow", "arc-swap", diff --git a/Cargo.toml b/Cargo.toml index c94b0af..07ecef1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rust-proxy" -version = "0.26.7" +version = "0.27.0" edition = "2021" rust-version = "1.88" description = "RustProxy - independent reverse proxy with local administration" diff --git a/README.md b/README.md index e6fb917..e3d5b1a 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ -# RustProxy 0.26.7 +# RustProxy 0.27.0 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration, streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools. -**0.26.7 release source.** +**0.27.0 release source.** ## Layer-4 streams @@ -11,7 +11,18 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners. -## What changed in 0.26.7 +## What changed in 0.27.0 + +- Enable downstream compression by default with `zstd`, Brotli and gzip codecs; deflate remains opt-in. Honor client `q` values first and use deterministic `zstd -> br -> gzip -> deflate` server preference when quality is equal. Existing `Content-Encoding` is never recompressed. +- Stop treating authentication/cookie/cache-privacy headers as blanket compression blockers. `Cookie`, `Authorization`, `Set-Cookie`, `private` and `no-store` may be compressed; `no-transform`, ranges, SSE, upgrades and already encoded responses remain excluded. +- Add dynamic compression inheritance/overrides to ordinary vhosts, generated Docker vhosts and Web Server services, including per-scope codec filters. Global Response settings remain the hard codec ceiling and own the minimum size. When a scope explicitly disables compression, its codec selectors are hidden/disabled without erasing the saved overrides. +- Keep an explicitly published Docker vhost routed until the administrator unpublishes it. A missing container/service now keeps the hostname and returns `503 Service Unavailable`; an agent transport failure reuses the last successful inventory when available, and service return is reconciled automatically. +- Make `/cache` occupancy meters render their filled portion consistently in Chromium/WebKit and Firefox instead of relying only on native `accent-color`. +- Keep SQLite schema 8. New saved compression fields are additive/defaulted, so older 0.26.x documents continue to load. Fresh installations default the `Server` response header to exactly `RustProxy`. + +0.27.0 retains the 0.26.7 cache/backend/container fixes below. + +### Retained 0.26.7 release notes - Show explicit HOT and COLD cache occupancy progress on `/cache`, including object-count and byte/disk limits from Cache settings plus percentage usage. - Preserve compatible upstream client pools across unrelated active-snapshot rebuilds so generation age, request count and `Rotations` diagnostics do not restart at zero unless the backend connection policy actually changes. @@ -77,7 +88,7 @@ Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost - Replace backend sort text (`A-Z` / `Z-A`) with direction arrows (`↑` / `↓`). - Keep SQLite schema 8 and the saved proxy configuration format unchanged; upgrading from 0.26.1 requires no data migration. -The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.26.7 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md). +The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.27.0 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md). ## Documentation @@ -155,7 +166,9 @@ CARGO_BUILD_JOBS=1 CARGO_PROFILE_RELEASE_LTO=false \ CARGO_PROFILE_RELEASE_CODEGEN_UNITS=8 cargo build --release --locked ``` -The 0.26.7 source archive preserves the resolved `Cargo.lock` supplied with the source tree and +Ready Debian packages are published separately at `https://rustproxy.linuxiarz.pl`; Debian package-build metadata is intentionally not shipped in this source tree. + +The 0.27.0 source archive preserves the resolved `Cargo.lock` supplied with the source tree and updates only this package's own version entry. This packaging environment has no Cargo, so the dependency graph was not re-resolved here. On the compiler-enabled deployment host, run the locked check/test/release gates below and retain the verified lockfile. `dev.sh` can generate a @@ -308,16 +321,18 @@ Purge is authenticated, CSRF-protected, audited and invalidates both tiers plus fills. See [cache behavior and limits](docs/CACHE.md) and [cache diagnostics](docs/CACHE_DIAGNOSTICS.md). -Response compression is streamed and negotiated with `Accept-Encoding`; enabled -algorithms are gzip, Brotli, Zstandard and deflate, and the selected algorithm is -reported in `Content-Encoding` with `Vary: Accept-Encoding`. Compression is disabled -by default and must be enabled in Settings. Privacy-sensitive, ranged, upgraded, -pre-encoded and `no-transform` responses are excluded. Cookie-bearing requests are -also excluded unless the response is an already accepted shared-cache HIT or a local -static Web Server response. Strong ETags are weakened after transformation, and -obsolete content digests are removed. Server policy is applied after generic response -rules. Protected framing/identity headers and cache-owned `Age` cannot be edited -through generic rules. +Response compression is streamed and negotiated with `Accept-Encoding`; zstd, Brotli +and gzip default ON while deflate defaults OFF, and equal client quality uses +`zstd -> br -> gzip -> deflate` server preference. The selected algorithm is reported +in `Content-Encoding` with `Vary: Accept-Encoding`. Existing `Content-Encoding`, ranges, +SSE, upgrades and `no-transform` are passed through without recompression. Cookie, +Authorization, Set-Cookie, private and no-store headers do not by themselves disable +dynamic compression. Ordinary vhosts, Docker publications and Web Server services may +inherit/enable/disable compression and individual codecs; explicitly disabling a scope +hides/disables its codec selectors in the dashboard while preserving their saved values. +Strong ETags are weakened after transformation, and obsolete content digests are removed. +Server policy is applied after generic response rules. Protected framing/identity headers +and cache-owned `Age` cannot be edited through generic rules. With the separate demo enabled, `/cache-demo` returns an explicitly public 30-second object. Enable cache and X-Cache in Settings, then issue this twice without cookies: @@ -398,7 +413,7 @@ python3 scripts/release_smoke.py # Runs those checks first, then the Rust suite when Cargo is available: bash dev.sh test # Source-only package, with no Git checkout required: -python3 make_zip.py /tmp/RustProxy-0.26.7.zip +python3 make_zip.py /tmp/RustProxy-0.27.0.zip ``` ## New management and test-origin guide diff --git a/ROADMAP.md b/ROADMAP.md index e1db541..ec25c72 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,5 +1,19 @@ # RustProxy roadmap +## 0.27.0 - Compression policy and persistent Docker publications + +Current direction: 0.26.7 -> 0.27.0 + +- [x] Enable zstd/Brotli/gzip downstream compression by default, keep deflate opt-in, honor client q-values and use deterministic `zstd -> br -> gzip -> deflate` tie priority. +- [x] Allow authenticated/cookie/private/no-store responses to compress while retaining explicit no-transform/range/SSE/upgrade/existing-encoding exclusions. +- [x] Add inherited dynamic-compression overrides for vhosts, Docker publications and Web Server services, including per-scope codec filters under the global codec ceiling; hide/disable codec controls while a scope is explicitly OFF without clearing saved overrides. +- [x] Default fresh installations to `Server: RustProxy` without rewriting existing saved policies. +- [x] Remove Debian package-build metadata from this source tree; packaging is maintained separately at `rustproxy.linuxiarz.pl`. +- [x] Keep published Docker hostnames materialized while a service is missing, return 503 until it returns, and reuse last-known inventory during temporary agent communication failures. +- [x] Render cache occupancy progress fill consistently across Chromium/WebKit and Firefox. +- [x] Keep SQLite schema 8 and additive/defaulted saved configuration compatibility with 0.26.x. +- [ ] Run compiler-enabled `cargo fmt --all`, `cargo check --locked --all-targets` and `cargo test --locked --all-targets` on a Rust release host. + ## 0.26.7 - Cache occupancy and backend rotation continuity Current direction: 0.26.6 -> 0.26.7 diff --git a/SHA256SUMS b/SHA256SUMS index d21a5bd..d87193a 100644 --- a/SHA256SUMS +++ b/SHA256SUMS @@ -1,30 +1,18 @@ 61bf40a0572889dc8b0dda9eae4e93e44b0de9364b3c798106c85700ffb37c23 .dockerignore 4140a2956264b44f259e6a37fc00ba02097bbe68b09296e04d3d243c1287129b .env.example 9e6356475bf587091bab72246ec9e325b498f7e48a6220e9a18baa50d0a385a6 .gitignore -c39fd74d633dc36cd7caa8d9b6785151b116752b79bd629d4d810cb03e1096cc AGENTS.md -6308cefa554fa14a9e456eaeb5c98e329e4f8b922fc4b481062ac4323db8ac93 CHANGELOG.md -91e57afc931cf4cb929c85a5dca872ce1388f93d38645fbeb4bfd77ba89b2787 Cargo.lock -bd39e691ce35a1677c6c8a540423f83e51351d7aa9bddd090c9a92408ec2fc20 Cargo.toml +e2fd35a4ed8c601bab52efb6befbe6e0fc9718cc6616644f11f90d9dcee69db3 AGENTS.md +da0b500b5c92478754f03f5ea53bb347e81b43b294a4d1ca564ca608df053e17 CHANGELOG.md +2803cc34dda0304778ba0de378ec9653c1da9ba4b14200395de52022de55839e Cargo.lock +aacc4711428f707ddc18bdbbda6257d8d7b5a1f77fce5ef2a2cc0d3042fc40d5 Cargo.toml 239713948df0d54504989f1ab30f5bf0128b90b4e5ac45d50a132aa033323baf Dockerfile -e88ff59b0e79d0c468178a4d9cbe6405175b61d7201112855c83b72b6e4f0fad README.md -340b8c205b773fbcfb096190bd854b320f05a0ac1e14a011ffb914f65dd87d70 ROADMAP.md +f2225bc6a95a0957b89deaaf457c6fc829cacfefd45c68fc032b0f20d44d625e README.md +ed04220708678e9c414765900f4b4bcb1cd16d89cfb99294d92e7752a5707c7d ROADMAP.md da8311e3db945290666324a2f24bf4521b365272d7ac3f862ded1be993eea646 UPDATE_CHECK.toml 928ba6a504bc431ae100c6e587861e5088b28822d2cb19da5d437b39d26c864a build.rs -834e8de4387354b23a2cb8c2d484f0f641dfed09472a9db12efcd0e683969a06 debian/README.md -b8963ff89cd98d3232e09449f34efe4a40874a640acc0779e64218b16b195bdf debian/build-package.sh -0763a4bd8b429f7922b23a7276ff694f3a751b83fb127f6ad7ec654e5e507ecd debian/build-repository.sh -d7cd8cfea6ea52aef826e27d6970a700b1b8d1654c8628bbbc8ad3ea9c5b42b8 debian/changelog -c90457b19b1b2f7998d3db59a656d215eb0fab23769197405960457b66d95cf7 debian/control -dff2ecb9c14623416981f444bc6df1c4e2bf55d330260f36a312d8d42245400f debian/rules -c537d54fd92a9b97c5f6e6ec63bc1276cda324513e2946b341b2193f63b62e6a debian/rustproxy.environment -f14b43b9ff4c8d767aa0476b28d0c66bcabf18d20986bc897e4a826695184f37 debian/rustproxy.logrotate -d1c483406fb53674ed8db5f30de599b5a91fa1c6b28242eb70a64d6a736430bb debian/rustproxy.postinst -cb0db03a2c1b06fa04a11f7690755a0ca90b17f19ed8fdb228810f505c48c78a debian/rustproxy.service -8e3884153448d76cb5027296ce50a1b614854d9732ba88a4ad3f6b25a3810753 debian/rustproxy.tmpfiles -e8e18df40bcd69d6aa404282679186d9b8256ac63a5b4e80d7f081e8a0095a2e debian/source/format 385ac7970fa94f043d0bcf04a91184e6e2c807587b85e55517ed064bb4bddba6 deploy/README.md 7b7fdf383bbaea4f37b5c120e98a24e9a075fba56ae7838a31a5152c7edcde02 deploy/rustproxy.service -5d864e5cc179055e8e9f065923800b8169bb4d79367c2bbeccc24053151981e5 dev.sh +b17933ea587cd696a21f956359ba720880fb7aad6980e4ac52cc7158ef105233 dev.sh 5f51efe621f45512a466fa7f2656867c6502a135ca040f4bfeec06a6919b39b6 docker-agent/README.md 7fee7d51a7deb67e73e53a0bdff3aa4630aea9bab9b23a0f9b8001b2169892b1 docker-agent/certificate.go 5e4f565c3c9de4dba897af2e801ea646a83395e72eae4717a6d502dff2fcec10 docker-agent/docker-agent.env.example @@ -33,25 +21,25 @@ bf687a851374d8f1fa59d050f3f76532f7c12f16a6daa7d3c36102c2d9a8ec9c docker-agent/d 9d77c90767fa929ee8338734d72ce83284d3d965673270f62cb2b1613d587a33 docker-agent/install.sh b68234472bec5cedd67c7cfe1de7d8806a965dfd4101f944aa6320132f18c14e docker-agent/main.go 3d4051a1f805d145df3877476e4b87773e74be8e123045065955a5133afdc68c docker-agent/main_test.go -a5b63a02952283d80ce729fe827d7a4d65e7ea9507229a7b433187d2a4e7c756 docker-agent/model.go +e9a3a2dc8c99df585358a2fcb2716e9fda0d234753209d805a89101a445560d4 docker-agent/model.go e52b31d0abf65ae3034f6cb367cca113633014ce8d1d799ad4dd5624d2c7b8bb docker-agent/network.go 634790f35ff4627df2a78cec2ed371f6e9ec9df00afb386075595fc7f3ed72eb docker-agent/rustproxy-docker-agent.service 5220d669171ec3ad65f50e0bc8de5178dadaa4904def8e1a4f61002aa9e9a55b docker-agent/server.go e2d3f7a9a3d5d47bada8bb50a9e7b3e1c237463197665c97aea83fb288a46a0d docs/ACME_PROVIDERS.md ec15163f5f51c9212003b7edd1fc380321311c2496fbaa9b45c838281b9af475 docs/ACME_RFC2136.md d699f2261a0d7854e49e9b8bae44fa37008a7d2f6340a73cdc37e840722ea211 docs/API.md -96f0cdc4af8961b69c19d0f8204d467b2b70abf3882f1fe1a540c82cac9c063b docs/API_ACCESS.md +9faba7a4f082cb253175e3fd4b66d174643978b29084a1d03f13ed20895c5ecc docs/API_ACCESS.md 0f7f159ad5b4b5277f80c19f3c47f4e7823ea439ef02e5913e1391f1b34d129f docs/ARCHITECTURE.md 86469d17f9786c3e6f20c66791b47e10e11695d2f1a88c66c9ded157a585c85f docs/CACHE.md 6266163e17d2921468abdae92c1620266af8351321530e2c9b7dca6f3dd89c88 docs/CACHE_DIAGNOSTICS.md c6003dcbc0b95e2cfa9523b7017186cc8b4826248b588af77111ac5eb15174f9 docs/CHANGELOG_TECHNICAL_ARCHIVE.md -d99fddfc982316c4e915cc6437fe339385350c49a2d06d570d42fd0100227e78 docs/CONTAINER.md +f2e03c3fc70607101bd69cf85f7d6ca31075b2c0f3e36a8119ff9218951517bb docs/CONTAINER.md 9538a52d508d8d7053c1387c42eef60e6d5dc1879c300b6fe951b3374c16884c docs/CUSTOM_LOCATIONS.md -7db65a96f696aff1d7f74e2041cfc6ecdf437b1412ece90cee26da1ceff4cf7e docs/DOCKER_DISCOVERY.md -86bb62f288f2e999994c302716fc9986dba1ac7a26e598dc97cb56a7bc21cfb5 docs/ERROR_LOGGING.md -27b452643076c390775a88b7c57ee9efbf19f150c18dba22e7fe6e1b67fc7027 docs/FILE_LOGS.md +c9c4700db7b59effb6b31620c57180761f31e3f838bc2604380fa7d3ad6020e7 docs/DOCKER_DISCOVERY.md +9ea8db4d034ecb573976dd323da29f044538525c230df9f43a47be1ac867b24c docs/ERROR_LOGGING.md +bd429bc96634de84178b6b59b225fe22fe5c402acdd85d84a15685fea2dce3db docs/FILE_LOGS.md df6ecd4a50796640243676ad4b3a87789f6e5d20cbebea6255e92fbfff1c7131 docs/HTTP3.md -af555f092a554f803c72be533f9a7b1167df1c963d150199ba9b1b55ae440d9e docs/INSTALL.md +5f4f4b66b1d35ebdf5437216e50937249bebb1fc6c58ade88630e527b5cb409f docs/INSTALL.md 3b5c31c805e5aee0dc2100b81246a9b631b5abb996faa598ae94f87ba39305f3 docs/INTEGRATIONS_040.md 4bb56add544f15d54695cf797cd16a51c09024360cdeef803a88988f4a54b3a5 docs/LIVE_LOGS.md 7c35c4cdbe7bbb81d94f3bf6aeb22b8a866af3e7f0d62bbedc299e4d6f264e0d docs/MANAGEMENT.md @@ -62,7 +50,7 @@ e7516646dfb107d6240370f4e7460b1189f2eb21f398740381d5d102847bbfe6 docs/NOT_FOUND 0c2241828e01b12f749562e2ac206a4519908fff63f46eba207b1cffa932dc5b docs/NPM_MIGRATION.md 712cb1cbf84515384b081fd2929e86e40af7c10f65bc69919b78b7b3e2fd12b5 docs/PHP_FPM.md 572c70fbd2f61fecd80a8ff9fa5de4a94c4f158de5e90da8e920f99b051241fa docs/PROMETHEUS.md -628d02baad016a6a39e30258d917521a3262daa6063cbc8573fe7ec84d593a8a docs/README.md +1c31f47dc3529a962d83975dd44f978c32ac5982161a2f98f126a9cb90e05d6c docs/README.md 6e46a137b9c88dac8cb9e3fdca877430092392de9913d746278dbff8652460c2 docs/REDIRECTS.md 0dfd0d431c5aedc67abac1ce5de040ffa790ec9578fd7d6f91a987c333d73358 docs/REFERENCES.md ce5afb4f531bb5fb4c453deb49f643f2a563f32f7908c995e5bc8e0d7de995b7 docs/RENEWAL.md @@ -70,9 +58,9 @@ ce5afb4f531bb5fb4c453deb49f643f2a563f32f7908c995e5bc8e0d7de995b7 docs/RENEWAL.m 4bf7b3ea0bfe6c6b0ae0b7884b48b10ba29ff3a71611ec96957a3327d3c6ec88 docs/SECRET_STORE_BACKUP.md 5dbdf45fddba198a28f511dbbd2f12bf7d2b88c41c3cbedbc20dfea3858779d3 docs/SECURITY.md 620b69e566d27af04f0604f4ca3f88cf95cdfea7fbc6ae9dd92446d2b2b5d9be docs/SECURITY_AUDIT.md -0c312c26930153a5e7ee77431d3df4d544b5aadbfcbbb1c8aba2a2d0a7d5e656 docs/SETTINGS.md +0a62406838257f329f5d27f74ae1867efc7d411f26e7ccaa4909420aa9b5aac9 docs/SETTINGS.md 3611defd206cde107e75cac006159856d12cd8f15df7ae2eb9ec3592ed2b4abd docs/STREAMS.md -007f768f6989e49ee90c6d3c51036630042bdad3bca69b44d453a3c7f11380e4 docs/TEST_REPORT.md +da7e46207a92fa88e5db01c1516ae496fa65f4be140831e9bf7acdea3e769035 docs/TEST_REPORT.md cfb452d8496839e832b5fbacdd4e52525b0ecc3112fbb62340c1e580bd5c1717 docs/TODO.md 8ee6187a5460ca45643b7fd789e27bffd264449e3a92ff70e9359edee011bbbb docs/TRANSFORM.md a1e9c6d38d21067d1ce7115ca3395ae8ff1f6a4c40fb0ebf00a6940ef79df439 docs/TRANSPORT.md @@ -87,7 +75,7 @@ ab7d48c2a359928da653263e69b4739cfff849a03fa1270491cb1ce553989788 docs/V0.23.1_A e4d47b50fb0ce33d26817fc0afcc2f05ac53bc9b62c7e50e61b9fa9734e817b0 docs/V0.23.3_AUDIT.md 984092eeb3899ed696f94059d88f7834703b151682d5c8af9fabacc7a823ea0b docs/V0.24.0_AUDIT.md 5782adf99a292783149882e844ad07b49d4ac0ea478e8393758cff849d48c13d docs/V0.24.1_AUDIT.md -230005cbd56fed4bc832940c0a49cc14f50231650308724df105b0506bb34210 docs/V0.24.3_AUDIT.md +521d6ef17bb0df7ec05f068411ed96a19e579c68b8e166dc314878d2c3cb0627 docs/V0.24.3_AUDIT.md b891db1453cd7cf6b10f79879f4edaf7c83f14e91e4e95826919d40cb5dca2d4 docs/V0.24.4_AUDIT.md 8d6519b00e01e5cd41ee6772941fdc7e9a70fe29626df71cefced6eefe6a94d0 docs/V0.24.5_AUDIT.md 4d2d8b84b38df57f5c6a03995019f8418806fe5867ee34ce192a90ef561986a8 docs/V0.24.6_AUDIT.md @@ -107,9 +95,10 @@ da5ec87b9482f2fc506c4334d9365f3bfaec89254a14e5585dd6460326b20e10 docs/V0.26.4_I 0ddf5215c40c8366844350bc6462d8013dba747b6f3e8fbf477985af215e5e8d docs/V0.26.5_IMPLEMENTATION.md dd9b5dcdbd53a04fd32458caaf03b56aa335f0153b1a0e332fdf230fec12680e docs/V0.26.6_IMPLEMENTATION.md f9667fe81b31762e64d36126a7e94b609316dfa856de8f8e3b96661dd2a918c6 docs/V0.26.7_IMPLEMENTATION.md -0f0e0e2920c76b2f82f38c6e60ed992a532c63851f593f2a1fa59e8d0014bb41 docs/VHOSTS.md +38cc8cd9119f211141c568c0008ae9c3d6b2c677134a4ad8ce611cd9070933da docs/V0.27.0_IMPLEMENTATION.md +bc2ac0117528ed4616c68cf7fe05cb1d9bbd36ecaa8573828cb3b3136923f265 docs/VHOSTS.md 09b60fb7b40db4d0139fa2a9e69a2aa9f28d4e61b8643521cfc7e936d7df8774 docs/VHOST_ACCESS.md -f0e76167944861517d1d42b9186ff0b2f184be0371b9e8597827e60895de4a76 docs/WEB_SERVER.md +4026a4adeee70f98a96cc7aa8d8be16cda42ffb2e5890d38f1ba638134ab0675 docs/WEB_SERVER.md c336f998027330c58d5afbbbb3a3a682fd44ae3997643882fe342633822f8bb3 docs/screenshots/README.md 5502e8ce44276213803b66c58e3a4d804a1354f5ed5d83f47ee805e8c44ab088 examples/acl-headers.json 2431dd88a2d9ad2cf3cd4b8fcdfa602563ab1013c612d8917fddbe7febfb2dc3 examples/cache-dashboard.json @@ -121,14 +110,14 @@ b26833cb4251f9390a44192ecc827ff7f052fd19016a5ccf7498c94503ab4ce3 examples/mock- 5a8f3a8a054abc89c6e78896b9fe2f903212199a24dc3d2d2bcbd0696a31bcde examples/transport.json d242de9614fbb52933b4accd32f4715ca94107abe4a3b1d7e088362b07a6ba60 examples/vhosts-balanced.json af2bdb1343a8141069e94ccd2c7f92574ad848437e2f9fdb5c7576a9a18ef4a5 examples/vhosts-private.json -04b72dfad46afa2efbc9ca31bbc8a3598c087d6d37c3511fcc2a2b371f54d801 grafana/README.md -c294a5dcb94c1cf7edf72243bb533cc487a17452a7c0ac8c72f23cce0ec42fc6 grafana/rustproxy-overview.json +f30e15ebe2102337933dad6f8cd334261716787073499168b389df504700a2b1 grafana/README.md +50e88b2944efcba3f872ee6e9a8ac84e222fa5d5bd20137dde16f9193350c78e grafana/rustproxy-overview.json 30763fc61c38992a44bc24ad6932b88fd3b322724fce799db1f17f9a747eb59a install-debian13.sh 858b39fa6886b71d20690bf369e76580922364b3cc7f0cf6ba9b040df9cd76e3 install.sh 29cada0936762f26495064d1524a668262ed729b21f20aebddc8b6e5cfea363b langs/README.md -9f367283c849d5217cb9386cf743221cc1d44ea4e76aa50a08234bbe71455837 langs/en_US.json -028c8d841c8cf246a021675054e638d6ab9f0c9785f823e2e4eec60a70fa8823 langs/pl_pl.json -8b258ac4654a046dc649c7fa8cef273c0f9431c9a12ea9b772dd0a1c95bb281f make_zip.py +49fc9fed9683b3afc56d63cd0b49d0a2d5b4dc9af1412624c9318b7b8eef513a langs/en_US.json +ec1d161006bc27426b9aeb7903a8ac0cffa3c8868b2a6db34197497d6efea962 langs/pl_pl.json +2cd6a1edc556ef1712b07fc88e7ea9fdb8869ca2d73175bcd367906791cbafb1 make_zip.py e830d37dd1f81a4b0aa7d535f5bba69e34e433b0fd99cc8ee0b296786c32379a migrations/0002_admin.sql 20112cc82192098b8d602f1c4f7ca08712e9e1366c845fabb92753187c370d35 migrations/0003_certificate_renewals.sql 5c62da30fa9db594a4d656c77ae676d3c388072b6a85f91170ec7d911d7cde43 migrations/0004_admin_preferences.sql @@ -147,11 +136,11 @@ edb6ee1445b01cd6f3a74a3a607f39fb107d411b49df028d2e0f4679e093de31 scripts/acme_p e69813fb1d3a4cdcfb7243964cc323fc21a603087bf2e84188fa42b9d3cee4b5 scripts/acme_rfc2136.py a5b4451e45ce975685772aa8409b64a57a20a7548466584c3ea7fb975e64729c scripts/admin_audit.py 20e83f8b6347b819d1d1ea3de5c691c36f0816954a4210b0d3f39557fefe1931 scripts/backup.py -1d88238e867dcc45c9666f765667674a7dce595a6db578dbfec15311b751f567 scripts/check_source.py +5076407d19a3bee94f5b99cfd846fbfa3e3b2d4bda04749451bd4c9033ab8535 scripts/check_source.py 187ee92c8029cdd59e89b4447cf4d170e856017a2091ceb85ae7c22dd1a79c72 scripts/deploy.py -fe28d6d580a53d95a0fc318ebc4da5bbc71a23781bb827158848934985477035 scripts/deploy_core.py +5bb760451359cd1673d286fdffea9f0e9151af41e573371720ce4e47d86d8f48 scripts/deploy_core.py f014472588e889488976970dbaa95a8745b6907516aa81a7cca21d0f81eaaad3 scripts/deploy_runtime.py -6288336261c8affd24de4456eafe84e2d9d82efebfb7c9b59d4deffc0779fd45 scripts/docs_check.py +d1fc7ba88777cca4e94ee6f3af14286f86084f3aeb0f8b746b02f8f59d29dcb8 scripts/docs_check.py d391681dc3f6786552ca44929979286a5c76a2b86785635871b59d2eb4d73389 scripts/langs_check.py 2e35b7c78887fd56f83ca9017caa168630963a9f47da71dfc53b1a8f9ad436c2 scripts/memory_contracts.py 2cc658faaa610b21b48942c59b955525539ad4503fd60f2a49c7e626a22faaff scripts/migrate_npm.py @@ -161,8 +150,8 @@ d1418f8e574a7390fd45a2aa879bdf5720b773162d65e295ab0350506aa5220a scripts/mock_a 2d3ff92300b09ce9cecbbaaa9309b4d33160fa4b2291c9952b784e8cfb599ab5 scripts/mock_server.py 2d4c859aae5ba357a6d30024c8487ae8f59f01b192711f13f9c2f8fee0f48b50 scripts/os-acme-client/README.md c73b814a42bb4ff703441dbd177ee625055eeb115f9b5bb0c2150aede573a159 scripts/os-acme-client/opnsense-rustproxy-cert-deploy.sh -d9238a75848a10621d518c26d5a00b76aedb393502e8e7c907e7ebc11ef3765a scripts/preflight.py -9d92089846dd1d850652bc464e78496d37bd987dfac8ecf8878c799986288272 scripts/release_smoke.py +42c5c863d01d157a8cf159218ded01ffcaac2c1f6d23be396a5708007fb39790 scripts/preflight.py +ab9ed9416691581dc6c60baf9b122f2e021fa2582c097509f50b85e260934453 scripts/release_smoke.py 45be151cd85fc2ef2f1fdc3003ace63381af262e73af8a685ab48cb697cc0de1 scripts/routeros-oci-build/.env.routeros.example 3b48cff8506e5a6ae7d3876f47721f5de7d63e2e02264a78cf5b6ddd52d9fbc6 scripts/routeros-oci-build/Dockerfile.routeros 7c7a3e51f43b43e1c962a4b0bb591f99c1f06977bf77f23719f7f867dfe7eb8e scripts/routeros-oci-build/Dockerfile.routeros.dockerignore @@ -174,12 +163,12 @@ ecfe0bb21a7549225a19b0846bb6de8c99cbfbbf5a706d33cf84db2c7146abed scripts/rust_s 1c83054336b3508d7ad72cd259f039394682642439877fe69639c0b76be09154 scripts/security_contracts.py 295b6f2625b1875950ea3eecccd142f49be327afdd00c92641286e6de530ec51 scripts/security_dependency_contracts.py 6fefb5c459aacdef3dcabe9c5e6e7718a2145a0190b165c29d7a46216ac53bad scripts/source_module_contracts.py -d22d858bceb7434fdc228c293c05a677316146861e3adca81a4d9fca92ee826d scripts/swagger_assets.py +dddc1312ec792f57dfcd8bb7ba37c502b6f0fc8b5f56542d58b677c0fd1a9faf scripts/swagger_assets.py 538b5f6cfa738355a729940ee3d92e7ab3dc25ca69ae330ddaa08f831775b8ba scripts/test_compression.py -f220969197c7f70e2f68b8527ecb66f57d2c267f9960543e8bb786e4ab8d5838 scripts/upgrade.py +553f1e989ab5cd5e0e9c68bc1f65cb2e27ebf13dd042333924879429f4b568fb scripts/upgrade.py 0aaa80453e25aae7ea953fadb91b3ae3eaff627977c81c9ab5a2779f9a93582f scripts/web_assets.py -00a80203c63b16cc2ccf0fe95260555352adb2ce22930593165262cd2e10769d scripts/web_server_contracts.py -ced042b5e283fd40fe25c261457dceb57d946dffebd89876cd80d69b92823932 scripts/web_service_ui_test.mjs +b2df6504a3f6939dbaac42737c323e3e8a605dd4c6df68d7576bea90931602dd scripts/web_server_contracts.py +c245f8f832bd2c36a3fbd5e66fe98e7367c70a8db840c79e6b640f1d9d74f2ac scripts/web_service_ui_test.mjs ad62f73bb42906d617cc1b479f02d4648c7324cb89fc11d2c6aa6bf13774eec9 src/acl.rs ea272433e7f92e983509a8ab1aa54242440abef21df526c2f99944ef279e09b9 src/acl/tests.rs 992126cb77249a6a173a71b2e5387f218b987545a04b26bc0340f922b4600ec1 src/acme.rs @@ -191,13 +180,13 @@ b9e57db4bd80ef37564dfc533a96897d8a494671d53acea9fb4bf28d23ba370d src/acme/provi 55ef7ceb44c25c7a8ddcbfd5e0d4b647526f9bdcde901ee08db5314e4d055b39 src/admin/access.rs 85f00f8157e83a152cc531f4cfecd0b1472ce269be9c8eb1ac17ad0693748b42 src/admin/certificates.rs 1de4c7c116eeab2452ccccbaba3f2b7b63c6eb1c1e146ab870d19c5a5ca16f80 src/admin/documentation.rs -953f88620657c0e3cc347d29d2589f8c150b5ef7c6b9403561329a52a7d6c53b src/admin/documentation/documents.rs +6403ff8ed09aa22544d2f61292cda03e3c9a1de3dc5f46342531ba5526b51af0 src/admin/documentation/documents.rs 67b901485d5858d5b5bf78a6260035db32241531d99481754c3533fdf404facb src/admin/documentation/tests.rs 002922c91aa07cbea17cb0ee11127bb6e7e015de108ee032761b34507dcfa06d src/admin/file_log_search.rs d3210e037481e1f95e840550428e088ffd83ec9a42f1810e4c976298fb555a9a src/admin/file_logs.rs beb8be241e4f1a8cea7b6c4e02b42f0359fb1fff10ab5ce2c70ccd0e63a554b0 src/admin/logging_api.rs 58802528128f53e493f7339063433a747b605007a8842b5efc670132d897d6f7 src/admin/mod.rs -64a8ceff5f5919b78b7cddd64c2cd47f28c776044fecabf9efcca93e0ae74a75 src/admin/openapi.json +e03abf110393aedf1fb30d540a4b772a96f39bd09d3dab6cedde39d6f08e0016 src/admin/openapi.json a53309daf118381031122ca70764f7a2f92adc44af3fc91df5f946e6856f76ae src/admin/operations.rs e9ea015aabdfdbb2f8dd72ea734002b5d648dc1bbef4cc4a0b85d2bcc059e9a5 src/admin/preferences.rs b4fa393b780b2676b5d72e0f90cd7290292f424b8062d4b5983e722d6ca72c32 src/admin/public.rs @@ -218,10 +207,10 @@ f869e4da5de149fc04ce1aab658befeaf3208c862f149ca976235d15832c3cdb src/admin/test 9eccd075880950e9100c7a8cca936d92f0c7106ce5140515deb3cc57f03c2bf0 src/admin/web/app/core.js 6f15cbcfa47adf98b5da962811fbbc6731880bf99f128b372b6f9f41391eeed1 src/admin/web/app/preferences.js 5891cbb5bfe7219ecb85d6f8d1794be1c3e4593fd3caa0668b53bd4121d083ce src/admin/web/app/runtime.js -7968cb16d0f2da862261f3dfafd98392d639827a4562c8b2df6b345f9533cf53 src/admin/web/app/settings.js +adb56a17d6e1d517693d26c02353ed10ae277d9ce39ce15d9809ca91c9a736b1 src/admin/web/app/settings.js 74777adaba5a448f3a9abf3a46d91efc6eb81ff6f3b5441e5b99a9e1d6c09af0 src/admin/web/cache-panel.js 50d1ebcbaf4d0b2968da23bb943fc3f67131c5d32df3f61d23ff37aad9da5b81 src/admin/web/demo.html -3b84a7a08f9f68e2c78fed4523b594c31a251addc5480a69c5f6949908230539 src/admin/web/docker.js +e0be753633deff452230d444163bd01fab688bbc07f349138ada8a967bb0639b src/admin/web/docker.js d4aef376cb44b2a13174dca1cb9383f64c04b0b93279f4f0b4805e76002548a1 src/admin/web/docs.css 60a4944a0a24b889296991b8af44b467f776fc85ec3597eb2e2940ef1f6fc713 src/admin/web/docs.html 6adb291fcc98d516fd9745d9673db16e408854a32cbf41335ae956bda11d46de src/admin/web/docs.js @@ -235,7 +224,7 @@ e6c4d91d1542d0a5b47bb8736f9539d43a6713df5a473b635519d5b7eac2eb9c src/admin/web/ 0a5fff35555153f59d4346933030a67b6e1a8768cee7a47cfa2fcf1a2c564f63 src/admin/web/favicon.svg af6e7a2e890df2fb7385a374bcb3fba52fb5a53dbe18adc1fb7865660fcba842 src/admin/web/file-logs.js 631860ab3793ffd827c7cf19ddd049d14419509f2c2d8b27994b0e54baa0e32a src/admin/web/host404.js -4e8c9a1a1bd9870f0cd8aad5c9da80ff130497f11dbda116d79f91d9bfc129c6 src/admin/web/index.html +80608bd7d854fef3857480b77bdf27398b08a4263393a6bd8659191bb0b28a96 src/admin/web/index.html 24db88842707f764064657712d3660c6ac129fbfb47d188c0903925cf8244ce5 src/admin/web/integrations.js cdab0c11a28deebdf401c0453fbc76b675e9e643722106fb20e812bb9648ccde src/admin/web/login-keys.json a253d202dc9a147f2add34c64e0f35c38fdc7f667f9908933ce5f959b1a92a2e src/admin/web/login.html @@ -244,13 +233,13 @@ e169d77359785ba604ce1a728420571fdc9b491fc1c0088642399466fbed8c1b src/admin/web/ a2dbdd205b899b92cb9817f76d0c79a27b153c80ac0fd60da435c7a4fddbb958 src/admin/web/redirects.js f1ab20afa09f75f3635511756e36afea46a7917f04937d6f4e89c4e9f3f43204 src/admin/web/settings.js 0ffc345ffbbd0a60b80fd39413a4d2ca1023012c0f73ff61af6f5456c5072030 src/admin/web/streams.js -f5831c2188233e425beecedc9e5e2829b620f80fc5326b73198024d27b81d1e7 src/admin/web/style.css +96460ed220d7f3fb332e88f4a437d3bd71ddb81580a4faf99061d1e0d9e384f2 src/admin/web/style.css a8a73a4fa849ae49391fcd6143e900c515c8b577f71b55cbae9701fa9f5bbe47 src/admin/web/traffic-panel.js e686d68fd6a368110a85dc4c5dc64e8093950d20d63e9aa44790c03dea6fc193 src/admin/web/transform-panel.js -6856c230c4f6b18145e16efb6636433f8b21ce3ec5d34246d6561f0150ea0554 src/admin/web/vhosts/core.js -4d4ee863a3d77e5213ae4bdcad1f533a6222353b9c32e0b5f12f7ea60ab62bea src/admin/web/vhosts/editor.js +f746b0aa758c1f9fbf5e656ab269f3ffe32675b90c83f0ed5b1e398322095e34 src/admin/web/vhosts/core.js +4cf331c897574f7cba035e0af12f3fc5e2c8a6efae790f8ca3be77d29e4fa593 src/admin/web/vhosts/editor.js e0011edc708d245cb514be170c1bbe846a0298b81d86276fe29af05010d215a4 src/admin/web/vhosts/render.js -b3d8d3e22e4cbab10c5d588c268da6eb3075a9ec857728ce6b5d56e3ffd3c9a6 src/admin/web/web-server.js +319b1f0b8b9591d54da7a9be86633b33520a259ba96e7eb32fa2a28817e768da src/admin/web/web-server.js 98c00d99822f9be54fc58afb6d4b577901712effd2c5eddce014312681864625 src/auth/files.rs b2f948bcc3dbd24952c7b1b02d41d06757f49f0c38a78caf51f8f8a687d8480d src/auth/files/tests.rs 97b5a060f24a102bbaa2f406426e985236c0d719b8038db210c25b34fcd8e923 src/auth/mod.rs @@ -315,13 +304,13 @@ cdc41a7241739b89297494323f29e0230fa06abbd74e219fedfda11df1db4334 src/cache/test 15e85357c3ddf4fc2283d621f5f4cd8ca309275e06677020299d4105f0475949 src/cache/tests/v022_cache_tests/part_01.rs 7ee652a781081c0b53d39dff213c2bda38e405a18a3d0b908f97cd3ac51d556f src/cache/tests/v022_cache_tests/part_02.rs f9a3c4f0c7363819a0904860531078df89e2ee1ed5bcff7047986e40c9f38a0c src/cache/tickets.rs -04c2e149ee74e1ae0294e60803d111b85dcccb84381653616f7c0ba4ee35d484 src/compression.rs -574f8ad7de9366f6d836d5879ba601c46305367cf5ec4ee84c3587722cc5910e src/compression/tests.rs +3fc79b09474fe23b5b6fc98e4a376469afb02a41d6cc2dbbba59dc6091c790c8 src/compression.rs +e2f58279499b7c3b47c65d3a7814bb5c7cd6506544d939875fbb0f91fa9aa59d src/compression/tests.rs 7921ae451ccd65d647165b02919bd97399399da471454a6a1a1f63e682b76fc8 src/config.rs 7ba52d3de4d77d1f3cad1b10de418953adc33901727a0791980847ae223929aa src/config/backend.rs 8b39e92594133c32b6e113c67849fc10f51ceec9e3bbf69211779f6628d0e001 src/config/compile.rs -02be5c799ad0dece8b15957e056294f02807e58af1060c0d9c1998003ef7d6d2 src/config/model.rs -4d2a4a078e890a9d1582e2cc6f9b8f0e8c2c676c4c94bc927bffdbe55e932610 src/config/routing.rs +756967406faf9336fa07dceb2269f330f965d0522a2ce45543f566986a5c7007 src/config/model.rs +2ee73f5f68b3fdaaef787319b8871ab3817a2052779fd0575965edee1d468fba src/config/routing.rs 9662674d17740df4999f28bec42a2fbd3453a93e591c88f0796edc396bb23a18 src/config/snapshot.rs 7d94d1bd4eb698e0588b822d93e56e3dc5594c46edac4aa9713f148893ebe6d5 src/config/tests.rs 7592bdeaad9950a720e2d841fcb1a4edb2a68af5333a6163e672d0392616103c src/config/tests/part_01.rs @@ -332,10 +321,10 @@ eb0f3d5ca222d36a915493e9bb96ef34dfe3abc627ec887782f9dda6f3174754 src/db/tests.r 19ab6c3ae37009c544291cb0b65c1bb9c721e168f95c1ed3fa88155aca7463ad src/demo.rs e69031875ffec32c9f548c43bed5f1a5c4c626e9568c9173e3b093f9a8b73036 src/diagnostics.rs b45d6040810c93ae2acb04ef6b0a59c189751edf9008cd81a4521c9e04e7f07d src/docker.rs -27ba9cfd11b13cbce3725e971e1f54844d219bfb62e19bf72a6c499bcbca8203 src/docker/client.rs -a1eebaf42bd039fd72015adc062a04554f18a26c5aa652008f9d4e17d5558674 src/docker/model.rs -845192f983bbd1fa82500543d2dcb0fdb32b755bbca4c409b05300c6b329c07b src/docker/reconcile.rs -fe571c85a924c827097f4be01b3a827a16bc5dd17a55fbf991ee3ad016641305 src/docker/tests.rs +93a8a3f6ba12761ddcbd19f22f32fb2c0e6948b660fb774ddd7ebdba9b6562a5 src/docker/client.rs +94c59c997a3c8674aae7bfb417c2a49f6cc8bce35110a5a236738b4bf6b91f39 src/docker/model.rs +1ca6aecec9b5942f24451430c20fd0d7ad062d06acadde3f8c4c3743f15cae3a src/docker/reconcile.rs +4f917f124f4c2ad035f68b07ee1d7a9b62b1a5b67cbdaeba681ba365e6d5af7a src/docker/tests.rs 2a02ea2e010cde1b1fe99b2e6baa80ea344ea6b332dbb3c4be795b71541f64a7 src/forwarding.rs 057e652f216a1478638cbb53b1c64ac88c7f413a65825caacbf893c5af004a63 src/forwarding/tests.rs 72215ef6911893f55cc82278169268f03d869b94728f118bf007fc555d609fde src/geoip.rs @@ -354,11 +343,11 @@ a16613114273c54b6d2a16a94fa8748550e91468585469642622bd2c86087baa src/logging/fo 17425ebbca6bbbb0dcaeb65ebc44b1e51488a4092b7b6add556e764c6d486d6a src/logging/tests.rs 3836ed14b6710e183f048ee4d7807a35366c27a27338057fe4a2811129b63302 src/main.rs 46732ed6d9cf2a33031624f941b8318d2676fb1b6bb5142e96820301f9fa1ac4 src/main/admin_runtime.rs -aba35a32fac19aaa7f1da172e995a21d0d3a40724b56b50e60c3897ac6bb75fc src/main/bootstrap.rs +e9ea5c293b55474425ca7aa287fc07cd978c144e4054cfa450c08cab0f3e49a2 src/main/bootstrap.rs 5a98d0e249338e73aa57ae2e352dc16db2f79c2d042c1544ce1c2022da76a31c src/main/proxy_runtime.rs 4dd7c1084a6214c0f2513ebf86fe8ef144470695557772bfe25979edd64491ab src/main/shutdown.rs 0a6578a0f4023b9f8d73043bf942dc5e096ef9afb8c0d2f131c14f65d08ac01d src/main/shutdown/tests.rs -e5cd6ac48b927bb864991ebf10fe0e21ac918fbf1b4334709a0df250142ccd51 src/main/tasks.rs +e18fec9a56171c6fd2e47eb849b2fc602c37fc3bd73893615ed9c3e1b6f4854c src/main/tasks.rs 49d7e104585c8791ac9a203dddd95802784b68c0ba65d6f90f3d57154b4c7871 src/metrics.rs 201ab702722d6d21585fe8bb49939150d61bfac7ed8dc198b98c2cc6098ffb5f src/metrics/global.rs 49b11df65b4fb0b5b727f9f867436584680b45e3f4fbd53f74bc0cab8b9a88ec src/metrics/vhost.rs @@ -379,17 +368,17 @@ b5856fd38a957b2ca9c7e3606d84d13d5cfcf3a45b487b15ae1d2dc248cbda57 src/proxy/body f0cb26ed34c35bacc74b914457acac8a611390de14cf46e2e6d3bcc848e914e8 src/proxy/cache_helpers.rs cfb0910af8cd868bde3f6c9992319e46d5328d6d8f69c50701df0ea12bef2108 src/proxy/forward/cache_lookup.rs 212de22f407dd96800afcf65fd1fc7c40fede1b88f80d04850eb8d1227b08a5b src/proxy/forward/response.rs -a74deecbdbc5953c46b885a4627b3d1e820752b03921b80406ae11080ea56cc4 src/proxy/forward/route_cache.rs +4992d8c2fabc468337999b3d4b58560a9e10632893cebe1669ecb3267ad1bdc9 src/proxy/forward/route_cache.rs 51c620b77004cca26edf387f9650f07d27801e093d32cc0162eaee1d0702c126 src/proxy/forward/success_finish.rs -5b639e63bc0110c93ab166bd22ac5bea5d8fa260e62c41d4bdb25d5ffff129d4 src/proxy/forward/success_prepare.rs +e5b1812c75b4cca91c32e99d28622cac1dea8e347bdf1c46e43546cb341f95a4 src/proxy/forward/success_prepare.rs 23b6bd26f6175b52c13d2571318fddd12550ba34ee77b87b5ac0e4811f8e2bee src/proxy/forward/upstream.rs 1a7bf906e74fa0286d84f8e88a1b2a977353dab91d036d192d5f28989e7ddebb src/proxy/forward_entry.rs c438066616527a3108f2ad53e3698ae9b2a80961714394cdd0a450c92f99d992 src/proxy/headers.rs 5cb7522ceb9a9f083a15596ac4898559295e38d1138c80099577211de8a868ec src/proxy/headers/tests.rs f6aef54204b5bb9305dd1367818c7ffd3cb273008404c9fab0317af1d13ba7a6 src/proxy/mod.rs d75ff3e38affa49f9a8b9d6801454c1449458e5fbf07e08d51aa3f42abebafd5 src/proxy/tests/authority_tests.rs -622d44511b82883a34830d0ae3ea665fd40b58eaa85653f58588db92d55a17c3 src/proxy/types.rs -b09929990cd34db718c6bc82bd7ac9c711cea6dd52c1977febec6d800fbdd991 src/proxy/upstream_helpers.rs +9a4c13efb218a5fe8689db5bd6b66029ca6ec270724d948651f3b18e78c80fba src/proxy/types.rs +5ad8b7821b53804f12b151b2bc39cc586401d9fa71d287d15d1e970b0160d14d src/proxy/upstream_helpers.rs 69f775f6746b4c6d729dc10961dbef54168846f4ce9cf7fe453ab5a2b879c9b8 src/proxy/websocket.rs d05e655ba0b3b322c657aaa9c2cbe7a0181064a896026b5eeaca347c4a0b7831 src/proxy/websocket/handshake.rs b21dc9cf3817dd4e3273ce25887d63d7a772c477b86ca57f8d5b72b8154456e7 src/proxy/websocket/tests.rs @@ -416,8 +405,8 @@ f2f6196632b2fdb2444189624f961edaf5bdfff57f700b0207b57e2491c1daa5 src/server/htt 71899a9b1897fa22ab9e8eb6a670054a6d382bad78714006b9b218d07ba99902 src/server/serve.rs e9e478cf45b88994eaffd115f51764b6b07852ee3c941cafdabb20584d3dabc0 src/server/serve/tests.rs 048f2c7a8ef698a172ba7ed844558f4118b367b2cf340748c5c28da7723d8e85 src/server/tls_runtime.rs -1be88858215d393d4f62f04f36a77ee64ce476be1b642c8f37e059c33423fea7 src/settings.rs -b8b3150abe1c6f61d3f593e169795aae397b578607710ea6fd887b90f37b872e src/settings/tests.rs +576af23edf5a85837925833f4a57c4fc686c4d20e7625f94560e5c6499f6bf0f src/settings.rs +0b63a0b73ddc93be259182f124f46ef59300ad688ad74b509f5f32a29f968566 src/settings/tests.rs 566daf9c0e1a30da2dc18e51090541a85ced3320a0fc00ed1d1de3e2b4da5072 src/stream.rs 46d9f63ce13a634e00f38d36ca3bdb217f2e37f04d75a4ef118e7dac9896a489 src/stream/model.rs 9c59bdb856106c0a74d1f8c156b0dd7289a170322ea556bad19bb8de3bf13d69 src/stream/runtime.rs @@ -457,15 +446,15 @@ a67e58a597a5eeb7efe605ae6e438a8f84ff6a1cedf8cd228141cb95551872a8 src/upstream.r 4aa2420a92d33c50f7027f57ac4eccdc050bdb7e9ec8fa6e0eaa809228b71cd8 src/upstream/client_tests.rs 3a4b097c0d5c0d88fbe881d84bd26a89789f68e4c46ea68b9e4a923dd4977d0b src/upstream/tests.rs e4c1ff8f53112e7cfad101a266355f7e47b82895480db431662f4cc59a1d9702 src/vhost.rs -f5bf21d13cb094706ae42c8b5cb760e12b4cf9c71a559c57ac0e1661b40cc17c src/vhost/model.rs +7529fe4ccf44fc8fc3e24b591c53ff41860e3f168cb227d9bbffb17797c01f38 src/vhost/model.rs 7127e081d884863b21c06f700b54884f90ec04efdfce835591b930f2d210faf6 src/vhost/tests.rs -f0479524d66bfee7a6eed5eea03601630ba82064fb944902deb9166f90fe17cf src/vhost/validation.rs +ff4980f0a091da9ff1722d6b9f6662529cbd7c5e2ac68dcd22a507ce6aaf3011 src/vhost/validation.rs 8d1eff4b24f01d137414ef5419f75dd281879228adb70409645b11b3c78c20e9 src/web_server/config.rs -34417031a2544bcc88ddee81a949da757787f0f1151a85ac9739da93fb9d95e5 src/web_server/config/compile.rs -9c1c8d6eedecb95eadbfb23c3caea562f6f7a995606ef988f25b58c2d03bcdd5 src/web_server/config/model.rs -6191f4d541476c4a3ae296e7dd28bdb9f8a123fc509b47619f6f44519c44d278 src/web_server/config/validation.rs +35471c7ba376365d4044c4cc042f675491453d6e59211255802ce4b386172209 src/web_server/config/compile.rs +c1fef6dfb79275479c15097b211cd5f063ad7e0852a0767b0145cf4f32f751da src/web_server/config/model.rs +f1d3e427c53f8b5be5768d85e69ead746d83647fcd3b355acc98e3f9d5e217e0 src/web_server/config/validation.rs 86c744216d7132d8294a6e90ba9be5fd871646006313d1c62506d40c81db9b12 src/web_server/fastcgi.rs -50a04408a8c2f947f7866542e528f2e07e626ea618be4d9ef3f3848cc0c1f321 src/web_server/fastcgi/protocol.rs +024dc2d6988aa6d8dd440feb8f4bab96cc86f8a68aba0f51451d8248de70e174 src/web_server/fastcgi/protocol.rs 134c4998f6a0aa27e121af1ae3355b7e335488b2ae867ac0a934c58b4eb77191 src/web_server/fastcgi/response.rs 8186363315bd998919c6c783e6f7501528f257a5c0da77c5d60f423e8670db5e src/web_server/filesystem.rs 0aafd7f37c4fe784b047646e4ce5ddcb5fe821231a41ed0a9f519529385288a8 src/web_server/htaccess.rs @@ -475,14 +464,14 @@ f0479524d66bfee7a6eed5eea03601630ba82064fb944902deb9166f90fe17cf src/vhost/vali 80f946570c14c8915fd21bfdb1a84dfb6a14c633ab6060acb828fab4c7c21daa src/web_server/mod.rs 67ab8bef567452f123c4b9b46a942b39c93f1f765c128edca7ee808ff1c5e304 src/web_server/request.rs c5cb561b0f276e8082f904b9446fa5885f6b3c0608f25ea2ef425061e9f7f6b4 src/web_server/response.rs -768fb0efa96fa1c3201c02cd8b9ae867bfa4267581884670012ca959e86c6a7c src/web_server/response/file.rs +e57fb290cbb9f0e292666c9d54e703ef627fafbeb1ebabeabe2f348b25c6cb5c src/web_server/response/file.rs 9aa68251a5f549f4ce3b1bda88d4abb9efc629caf444989381b4117c9488e37b src/web_server/response/headers.rs 2268a6aeed2f565f9791af33e1cd21c56c228c8873b031725b39a6c57184f2d1 src/web_server/routing.rs 400e1c8aa2fe857d96036a64499fbc3de44c1e3a53811c5b25101fb843359792 src/web_server/security.rs 3e0b4e92600a7d5abcec92efed532b3a01e0781cb4f2681daac6d6ae13b0a6e9 src/web_server/serve.rs cf86c4692080723bbdf8f4105e1abfae33d7fcf020d2ad9e13ebae3943bd0cbe src/web_server/tests.rs c62752fe2fa6b74ddc9d94d36f8d191376b1575b15d21fc434c5a5da4c932692 src/web_server/tests/part_01.rs -4d8749d78e2d44dd502da21d35acc3a6192644de0f43c341b993d068e6570ded src/web_server/tests/part_02.rs +167d1627cb562ea7a9afc046b82ab1d51587cd37effac46e9661b05ac99d7f77 src/web_server/tests/part_02.rs e54f44f6ca1ed2c41e620de9195d32c4f8bb6936c3881745316a07160f87b4fa src/web_server/tests/part_03.rs f00743af2cf4a5952caef7a1dcf68e7817b5599a252a9973e1c22045517c0b0e tests/fixtures/argon2id.json 1725c10331745dc04a07675784d385260da7b14567b8dba3cbae5e891eb5dadf tests/http2.rs diff --git a/debian/README.md b/debian/README.md deleted file mode 100644 index 83e8a20..0000000 --- a/debian/README.md +++ /dev/null @@ -1,60 +0,0 @@ -# Debian packaging - -This directory builds the `rustproxy` binary package for RustProxy 0.26.7. -The package installs: - -- `/usr/bin/rust-proxy` -- `/etc/rustproxy/environment` (conffile) -- `rustproxy.service` -- logrotate policy for `/var/log/rustproxy` -- Grafana dashboard under `/usr/share/rustproxy/grafana/` - -The service runs as the unprivileged `rustproxy` system user. `CAP_NET_BIND_SERVICE` -is the only ambient/bounding capability, allowing ports 80/443 without root. The -administration listener is loopback-only by default. systemd and `postinst` both -ensure `/var/lib/rustproxy` and `/var/log/rustproxy` exist with mode `0750`. - -## Build the `.deb` - -Install build prerequisites (including Rust 1.88+), then from the source tree: - -```bash -./debian/build-package.sh -``` - -The script uses the committed `Cargo.lock`, runs `cargo fetch --locked`, invokes -`dpkg-buildpackage -us -uc -b`, and copies generated package artifacts to `dist/`. -If dependencies are pre-fetched/vendored, set `CARGO_NET_OFFLINE=true` for an -offline Cargo build. - -## Repository for rustproxy.linuxiarz.pl - -Install repository tooling: - -```bash -apt install dpkg-dev apt-utils gzip gnupg -``` - -Build the repository: - -```bash -RUSTPROXY_REPO_GPG_KEY='' ./debian/build-repository.sh -``` - -Publish the generated `repository/` directory at the web root of -`https://rustproxy.linuxiarz.pl/`. Export the public repository key separately and -install it on clients as `/usr/share/keyrings/rustproxy.gpg`, then use: - -```text -deb [signed-by=/usr/share/keyrings/rustproxy.gpg] https://rustproxy.linuxiarz.pl stable main -``` - -The repository script emits `Packages`, maximum-gzip `Packages.gz`, `Release`, and, -when a GPG key is configured, `Release.gpg` plus `InRelease`. - -## Logs - -Structured file logging defaults to `/var/log/rustproxy/access.jsonl` when enabled -in RustProxy. Logrotate runs daily, keeps at most three days, compresses immediately -with `gzip -9`, and uses `copytruncate` because RustProxy owns the open log file. -Systemd journal output remains independent of this JSONL rotation. diff --git a/debian/build-package.sh b/debian/build-package.sh deleted file mode 100755 index 411a51f..0000000 --- a/debian/build-package.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -set -eu - -ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) -cd "$ROOT" - -for tool in cargo rustc dpkg-buildpackage; do - command -v "$tool" >/dev/null 2>&1 || { echo "Missing build tool: $tool" >&2; exit 2; } -done - -RUSTC_VERSION=$(rustc --version | awk '{print $2}') -if ! dpkg --compare-versions "$RUSTC_VERSION" ge 1.88; then - echo "RustProxy requires rustc >= 1.88 (found $RUSTC_VERSION)" >&2 - exit 2 -fi - -# Fetch against Cargo.lock before the Debian build. Use CARGO_NET_OFFLINE=true -# when the registry/cache has already been prepared or dependencies are vendored. -cargo fetch --locked - -dpkg-buildpackage -us -uc -b - -mkdir -p dist -find .. -maxdepth 1 -type f \( -name 'rustproxy_0.26.7_*.deb' -o -name 'rustproxy_0.26.7_*.changes' -o -name 'rustproxy_0.26.7_*.buildinfo' \) \ - -exec cp -f {} dist/ \; -echo "Packages copied to $ROOT/dist" diff --git a/debian/build-repository.sh b/debian/build-repository.sh deleted file mode 100755 index 95c468e..0000000 --- a/debian/build-repository.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/sh -set -eu - -ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) -REPO=${1:-"$ROOT/repository"} -DEBS=${2:-"$ROOT/dist"} -ARCH=${RUSTPROXY_REPO_ARCH:-$(dpkg --print-architecture)} -CODENAME=${RUSTPROXY_REPO_CODENAME:-stable} -COMPONENT=${RUSTPROXY_REPO_COMPONENT:-main} - -for tool in dpkg-scanpackages apt-ftparchive gzip; do - command -v "$tool" >/dev/null 2>&1 || { echo "Missing repository tool: $tool" >&2; exit 2; } -done - -POOL="$REPO/pool/$COMPONENT/r/rustproxy" -BINARY="$REPO/dists/$CODENAME/$COMPONENT/binary-$ARCH" -mkdir -p "$POOL" "$BINARY" -find "$DEBS" -maxdepth 1 -type f -name 'rustproxy_*.deb' -exec cp -f {} "$POOL/" \; - -cd "$REPO" -dpkg-scanpackages --arch "$ARCH" "pool/$COMPONENT" /dev/null > "dists/$CODENAME/$COMPONENT/binary-$ARCH/Packages" -gzip -9 -n -c "dists/$CODENAME/$COMPONENT/binary-$ARCH/Packages" > "dists/$CODENAME/$COMPONENT/binary-$ARCH/Packages.gz" -apt-ftparchive \ - -o APT::FTPArchive::Release::Origin=RustProxy \ - -o APT::FTPArchive::Release::Label=RustProxy \ - -o APT::FTPArchive::Release::Suite="$CODENAME" \ - -o APT::FTPArchive::Release::Codename="$CODENAME" \ - -o APT::FTPArchive::Release::Architectures="$ARCH" \ - -o APT::FTPArchive::Release::Components="$COMPONENT" \ - release "dists/$CODENAME" > "dists/$CODENAME/Release" - -if [ -n "${RUSTPROXY_REPO_GPG_KEY:-}" ]; then - command -v gpg >/dev/null 2>&1 || { echo "RUSTPROXY_REPO_GPG_KEY is set but gpg is missing" >&2; exit 2; } - gpg --batch --yes --local-user "$RUSTPROXY_REPO_GPG_KEY" --armor --detach-sign \ - --output "dists/$CODENAME/Release.gpg" "dists/$CODENAME/Release" - gpg --batch --yes --local-user "$RUSTPROXY_REPO_GPG_KEY" --clearsign \ - --output "dists/$CODENAME/InRelease" "dists/$CODENAME/Release" -else - rm -f "dists/$CODENAME/Release.gpg" "dists/$CODENAME/InRelease" - echo "WARNING: repository is unsigned. Set RUSTPROXY_REPO_GPG_KEY for production." >&2 -fi - -echo "Repository ready: $REPO" -echo "Publish this directory as https://rustproxy.linuxiarz.pl/" diff --git a/debian/changelog b/debian/changelog deleted file mode 100644 index 1b2fbd9..0000000 --- a/debian/changelog +++ /dev/null @@ -1,323 +0,0 @@ -rustproxy (0.26.7) stable; urgency=medium - - * Show HOT/COLD cache occupancy against configured limits. - * Preserve compatible backend clients so rotation diagnostics remain continuous. - * Refresh container Certbot/plugin packaging and documentation. - * Keep schema 8 and saved configuration compatibility with 0.26.6. - - -- RustProxy Maintainers Tue, 06 Oct 2026 22:20:00 +0200 - -rustproxy (0.26.6) stable; urgency=medium - - * Fix composed ACL allow semantics for IP ranges and allow-only countries. - * Reset accepted ACME issue forms and keep backend table preferences account-scoped. - * Document NPM migration helper module dependencies. - * Keep schema 8 and saved configuration compatibility with 0.26.5. - - -- RustProxy Maintainers Tue, 06 Oct 2026 14:03:00 +0200 - -rustproxy (0.26.5) stable; urgency=medium - - * Align compact toolbar selects with scaled input heights. - * Route the Streams Add TCP/UDP listener shortcut to Settings -> Listeners. - * Keep schema 8 and saved configuration compatibility with 0.26.4. - - -- RustProxy Maintainers Tue, 06 Oct 2026 11:45:00 +0200 - -rustproxy (0.26.4) stable; urgency=medium - - * Add 404-host draft support and standardize modal Enabled controls. - * Compact toolbar inputs and Overview-card appearance controls. - * Recycle aged backend client pools without waiting for another request. - - -- RustProxy Maintainers Tue, 06 Oct 2026 11:05:00 +0200 - -rustproxy (0.26.2) stable; urgency=medium - - * Attribute persistent protocol errors to configured vhosts using route, Host/authority or SNI. - * Improve the Logs explorer with selectable columns, sticky headers and inline record details. - * Fix mapped client-IP display and protocol-diagnostic keyword search. - - -- RustProxy Maintainers Mon, 05 Oct 2026 17:17:00 +0200 - -rustproxy (0.26.0) stable; urgency=medium - - * Persist malformed HTTP, TLS/QUIC and HTTP/2/HTTP/3 protocol failures through bounded logging sinks. - * Add the authenticated read-only Logs explorer for configured access/error files. - * Keep Live Logs independent from file-backed protocol diagnostics and retain schema 8. - - -- RustProxy Maintainers Mon, 05 Oct 2026 15:38:00 +0200 - -rustproxy (0.25.7) stable; urgency=medium - - * Add fast vhost enable/disable controls and improve the vhost Enabled editor control. - * Add backend-table search, sorting and selectable columns plus themed scrollbars. - * Export missing backend retry/client-lifecycle Prometheus metrics and extend Grafana. - - -- RustProxy Maintainers Mon, 05 Oct 2026 11:42:00 +0200 - -rustproxy (0.25.6) stable; urgency=medium - - * Show upstream client generation, generation requests/age and rotations in the live Backends diagnostics table. - * Reuse the existing event/status snapshot path; no extra polling loop or schema migration is added. - * Retain the bounded backend-client generation and HTTP/1 buffer defaults from 0.25.5. - - -- RustProxy Maintainers Mon, 05 Oct 2026 10:39:00 +0200 - -rustproxy (0.25.5) stable; urgency=medium - - * Align Revision History modal styling with the shared square-corner dashboard dialogs. - * Use trusted Cloudflare CF-IPCountry for country analytics when Cloudflare client-IP mode is active, with GeoIP fallback. - * Expand Prometheus and Grafana with bounded Traffic analytics, Web Server traffic/source visibility and safe User-Agent family metrics. - - -- RustProxy Maintainers Mon, 05 Oct 2026 08:23:00 +0200 - -rustproxy (0.25.4) stable; urgency=medium - - * Add vhost/location HTTP method policy and location-level ACL/country controls. - * Forward hashed request IDs to origins for end-to-end correlation. - * Retain bounded manual-configuration history with a calendar-style dashboard viewer. - - -- RustProxy Release Sun, 04 Oct 2026 22:18:00 +0200 - -rustproxy (0.25.2) stable; urgency=medium - - * Allow consistent encrypted backup creation while the service is running. - * Preserve safe internal Certbot symlinks across backup and restore. - * Recover resumed admin tabs from transient invalid-origin state without relaxing origin checks. - - -- RustProxy Release Sun, 04 Oct 2026 16:26:00 +0200 - -rustproxy (0.25.1) stable; urgency=medium - - * Reorganize Traffic into compact Overview, Clients, Requests and Delivery tabs with donut and bar charts. - * Harden source/release modularity checks while preserving existing runtime configuration compatibility. - - -- RustProxy Release Sat, 03 Oct 2026 22:43:00 +0200 - -rustproxy (0.24.10) stable; urgency=medium - - * Add encrypted Secret Store and password-encrypted full backup/restore. - * Keep ERROR file logging independent and persist its settings as a first-class section. - * Keep response-time history expanded and add an accessible metric information control. - - -- RustProxy Release Sat, 03 Oct 2026 16:41:00 +0200 - -rustproxy (0.24.8) stable; urgency=medium - - * Expand Cache RAM overview occupancy histories for HOT, transient and COLD storage. - * Move RSS/cache accounting guidance behind an information control. - - -- RustProxy Release Sat, 03 Oct 2026 10:30:00 +0200 - -rustproxy (0.24.7) stable; urgency=medium - - * Add configurable transform memory and concurrency budgets with persisted resource presets. - * Keep transform resource tuning fail-open and representation-aware cache compatibility safe. - - -- RustProxy Release Sat, 03 Oct 2026 08:49:00 +0200 - -rustproxy (0.24.6) stable; urgency=medium - - * Persist selected cache presets and add the Recommended COLD policy preset. - * Bound transform and cache background memory/task retention. - - -- RustProxy Release Sat, 03 Oct 2026 08:49:00 +0200 - -rustproxy (0.24.5) stable; urgency=medium - - * Fix empty HTTP/3 request-body forwarding to HTTP/1.1 upstreams, including DELETE. - * Preserve streaming for non-empty H3 request bodies and existing H1/H2 behavior. - - -- RustProxy Release Fri, 02 Oct 2026 23:27:00 +0200 - -rustproxy (0.24.4) stable; urgency=medium - - * Disable Transparent Huge Pages locally for the RustProxy Linux process before Tokio startup. - * Keep host THP policy unchanged and retain existing glibc arena/trim tuning. - - -- RustProxy Release Fri, 02 Oct 2026 15:20:00 +0200 - -rustproxy (0.24.3) stable; urgency=medium - - * Reduce glibc allocator retention and transformation-path temporary allocations. - * Move HTTP/3 enablement to Listeners while retaining dedicated QUIC tuning. - * Hide unsupported process diagnostics dynamically in the dashboard. - - -- RustProxy Release Fri, 02 Oct 2026 09:45:00 +0200 - -rustproxy (0.24.2) stable; urgency=medium - - * Version-only release bump; no functional changes from 0.24.1. - - -- RustProxy Release Thu, 01 Oct 2026 22:11:00 +0200 - -rustproxy (0.24.1) stable; urgency=medium - - * Use shared cross-platform statistics APIs and expose more portable metrics. - * Add authenticated runtime path metadata and platform-aware installed-data discovery. - * Move Logging into Settings while retaining legacy navigation compatibility. - - -- RustProxy Release Thu, 01 Oct 2026 21:00:00 +0200 - -rustproxy (0.24.0) stable; urgency=medium - - * Graceful HTTP/2 GOAWAY/drain shutdown with independent idle, lifetime and drain limits. - * Extract system statistics backends and add BSD platform support plus process platform reporting. - - -- RustProxy Release Thu, 01 Oct 2026 18:46:00 +0200 - -rustproxy (0.23.3) stable; urgency=medium - - * Add opt-in per-vhost legacy WebSocket compatibility for older appliances. - * Align legacy WebSocket Origin/Host and tolerate legacy 101 response framing. - - -- RustProxy Maintainers Thu, 01 Oct 2026 00:00:00 +0000 - -rustproxy (0.23.2) stable; urgency=medium - - * Add configurable live-chart history windows for Cache and Transformation. - * Fix HTTPS administration transport handling for --livelogs and local CLI API calls. - - -- RustProxy Maintainers Thu, 01 Oct 2026 11:36:19 +0200 - -rustproxy (0.23.1) stable; urgency=medium - - * Add collapsible full-width live Cache and Transform activity charts. - * Update package and administration UI identity to 0.23.1. - - -- RustProxy Maintainers Thu, 01 Oct 2026 11:11:00 +0200 - -rustproxy (0.23.0) stable; urgency=medium - - * Add HTTP/1.1 Upgrade: h2c and external certificate hot-deploy/reload support. - - -- RustProxy Maintainers Thu, 01 Oct 2026 08:30:00 +0200 - -rustproxy (0.22.2) stable; urgency=medium - - * Add replay-safe backend failover retry with bounded policy and metrics. - * Correct explicit HTTP/2 upstream request handling and add H2 regression coverage. - * Add vhost retry controls to the administration UI and OpenAPI schema. - - -- RustProxy Maintainers Thu, 01 Oct 2026 07:10:00 +0200 - -rustproxy (0.22.1) stable; urgency=medium - - * Add HTTP/2 RFC 8441 WebSocket transport and opt-in h2c prior-knowledge listeners. - * Add active tunnel inventory/kill administration with audit and H1/H2/H3 metrics. - * Move selective PURGE/BAN workflows into modal UI and fix null-safe operation feedback. - - -- RustProxy Maintainers Wed, 30 Sep 2026 22:45:00 +0200 - -rustproxy (0.22.0) stable; urgency=medium - - * Add cache request collapsing, single-range HTTP 206 reuse, selective PURGE/BAN, - configurable stale-if-error classes and proactive cache refresh. - * Extend the authenticated cache API, dashboard, metrics and regression coverage. - - -- RustProxy Maintainers Wed, 30 Sep 2026 21:00:00 +0200 - -rustproxy (0.21.0) stable; urgency=medium - - * Add sharded Cold Cache with bounded asynchronous garbage collection. - * Implement RFC 5861 stale handling and request max-stale semantics. - * Add per-vhost static-response transformations before cache/compression. - - -- RustProxy Maintainers Tue, 29 Sep 2026 21:25:00 +0200 - -rustproxy (0.20.0) stable; urgency=medium - - * Split Certificates into Installed, Renewal and Generate tabs. - * Improve ACME renewal status and failed-operation messages. - * Show exact private Certbot log directories for certificate failures. - - -- RustProxy Maintainers Tue, 29 Sep 2026 12:14:00 +0200 - -rustproxy (0.19.4) stable; urgency=medium - - * Align Docker-vhost Aliases with neighboring form controls. - * Preserve sub-0.1 KiB/s backend traffic rendering. - * Add cache-domain filtering by effective cache state. - - -- RustProxy Maintainers Tue, 29 Sep 2026 11:30:00 +0200 - -rustproxy (0.19.3) stable; urgency=medium - - * Preserve exact Settings location across re-login and browser refresh. - * Add shared saving state, field-focused validation and unsaved-tab markers. - * Keep certificate import file selections after failed saves. - - -- RustProxy Maintainers Tue, 29 Sep 2026 09:32:00 +0200 - -rustproxy (0.19.2) stable; urgency=medium - - * Improve default-response status labels and Live-log buffering. - * Polish checkbox/alias layout and backend rate formatting. - * Keep local pages non-cacheable and allow guarded vhost-ID renames. - - -- RustProxy Maintainers Mon, 28 Sep 2026 23:26:00 +0200 - -rustproxy (0.19.1) stable; urgency=medium - - * Fix Default responses saves and isolate cache objects by frontend scheme. - * Retain on-demand Live Logs history and polish traffic/checkbox/Docker Advanced UI. - * Remove stale screenshots and update documentation/release contracts. - - -- RustProxy Maintainers Mon, 28 Sep 2026 22:14:00 +0200 - -rustproxy (0.19.0) stable; urgency=medium - - * Persist per-admin Live Logs column visibility in SQLite while keeping full JSON exports. - * Fix disabled backend TLS verification for legacy X.509 certificates and retain detailed upstream diagnostics. - * Remove the duplicate version label from the top-right dashboard toolbar. - - -- RustProxy Maintainers Mon, 28 Sep 2026 14:55:00 +0200 - -rustproxy (0.18.8) stable; urgency=medium - - * Add Docker-vhost alias chips plus redirect, WebSocket and cache controls. - * Add a Docker-agent default ACL profile and remove the Overview codec explainer. - - -- RustProxy Maintainers Mon, 28 Sep 2026 12:43:00 +0200 - -rustproxy (0.18.7) stable; urgency=medium - - * Polish Overview network charts and collapse response-time history by default. - * Align expanded Docker-vhost routing and ACL controls. - - -- RustProxy Maintainers Mon, 28 Sep 2026 12:05:00 +0200 - -rustproxy (0.18.6) stable; urgency=medium - - * Fix compression/protocol telemetry and improve Docker/backend dashboard UX. - * Remove the Open proxy shortcut and make Compact density materially tighter. - - -- RustProxy Maintainers Mon, 28 Sep 2026 10:36:37 +0200 - -rustproxy (0.18.4) stable; urgency=medium - - * Default backend health checks to TCP and streamline Docker vhost/Security UX. - * Move administration audit to an on-demand modal. - - -- RustProxy Maintainers Mon, 28 Sep 2026 09:45:00 +0200 - -rustproxy (0.18.3) stable; urgency=medium - - * Separate Docker vhost/backend Prometheus metric families and collector group. - - -- RustProxy Maintainers Sun, 27 Sep 2026 17:45:00 +0200 - -rustproxy (0.18.2) stable; urgency=medium - - * Add optional Docker-agent discovery and dynamic Docker vhost assignments. - * Remove revision-header exposure and refresh dashboard/settings UX. - - -- RustProxy package maintainer Sun, 27 Sep 2026 15:06:00 +0200 - -rustproxy (0.17.0) stable; urgency=medium - - * Package RustProxy 0.17.0 with a hardened systemd service, log rotation, - Prometheus/Grafana assets and local-response host support. - - -- RustProxy package maintainer Sat, 27 Sep 2026 11:35:00 +0200 diff --git a/debian/control b/debian/control deleted file mode 100644 index 498115a..0000000 --- a/debian/control +++ /dev/null @@ -1,16 +0,0 @@ -Source: rustproxy -Section: net -Priority: optional -Maintainer: RustProxy package maintainer -Build-Depends: debhelper-compat (= 13), cargo, rustc (>= 1.88), pkg-config, libsqlite3-dev -Standards-Version: 4.7.0 -Rules-Requires-Root: no -Homepage: https://rustproxy.linuxiarz.pl - -Package: rustproxy -Architecture: any -Depends: ${shlibs:Depends}, ${misc:Depends}, adduser, ca-certificates, logrotate, gzip -Description: independent Rust reverse proxy with local administration - RustProxy is an independent reverse proxy with HTTP/1.1, HTTP/2, HTTP/3, - WebSocket, TLS, caching, redirects, local response hosts, TCP/UDP streams, - diagnostics and a local administration dashboard. diff --git a/debian/rules b/debian/rules deleted file mode 100755 index 25b97ae..0000000 --- a/debian/rules +++ /dev/null @@ -1,24 +0,0 @@ -#!/usr/bin/make -f - -export DEB_BUILD_MAINT_OPTIONS = hardening=+all -export CARGO_TERM_COLOR = never - -%: - dh $@ - -override_dh_auto_configure: - # Cargo is the authoritative build system; no generated configure step. - -override_dh_auto_build: - cargo build --release --locked - -override_dh_auto_test: -ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) - cargo test --locked -endif - -override_dh_auto_install: - install -D -m0755 target/release/rust-proxy debian/rustproxy/usr/bin/rust-proxy - install -D -m0640 debian/rustproxy.environment debian/rustproxy/etc/rustproxy/environment - install -D -m0644 grafana/rustproxy-overview.json debian/rustproxy/usr/share/rustproxy/grafana/rustproxy-overview.json - install -D -m0644 grafana/README.md debian/rustproxy/usr/share/doc/rustproxy/grafana/README.md diff --git a/debian/rustproxy.environment b/debian/rustproxy.environment deleted file mode 100644 index 5f6f985..0000000 --- a/debian/rustproxy.environment +++ /dev/null @@ -1,7 +0,0 @@ -# RustProxy Debian package defaults. -# systemctl restart rustproxy after changing listener environment values. -RUST_LOG=rust_proxy=info,warn -RUST_PROXY_DATA_DIR=/var/lib/rustproxy -RUST_PROXY_ADMIN_LISTEN=127.0.0.1:9090 -RUST_PROXY_PROXY_LISTEN=0.0.0.0:80 -RUST_PROXY_TLS_LISTEN=0.0.0.0:443 diff --git a/debian/rustproxy.logrotate b/debian/rustproxy.logrotate deleted file mode 100644 index d4aaa60..0000000 --- a/debian/rustproxy.logrotate +++ /dev/null @@ -1,15 +0,0 @@ -/var/log/rustproxy/*.jsonl /var/log/rustproxy/*.log /var/log/rustproxy/vhosts/*.jsonl { - daily - rotate 3 - maxage 3 - missingok - notifempty - compress - compresscmd /usr/bin/gzip - compressext .gz - compressoptions -9 - dateext - dateformat -%Y%m%d - copytruncate - su rustproxy rustproxy -} diff --git a/debian/rustproxy.postinst b/debian/rustproxy.postinst deleted file mode 100755 index 2f38b9e..0000000 --- a/debian/rustproxy.postinst +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/sh -set -e - -if ! getent group rustproxy >/dev/null 2>&1; then - addgroup --system rustproxy >/dev/null -fi -if ! getent passwd rustproxy >/dev/null 2>&1; then - adduser --system --ingroup rustproxy --home /var/lib/rustproxy --no-create-home \ - --disabled-password --shell /usr/sbin/nologin rustproxy >/dev/null -fi -install -d -o rustproxy -g rustproxy -m 0750 /var/lib/rustproxy /var/log/rustproxy - -#DEBHELPER# -exit 0 diff --git a/debian/rustproxy.service b/debian/rustproxy.service deleted file mode 100644 index eabd04f..0000000 --- a/debian/rustproxy.service +++ /dev/null @@ -1,55 +0,0 @@ -[Unit] -Description=RustProxy reverse proxy -Documentation=https://rustproxy.linuxiarz.pl -Wants=network-online.target -After=network-online.target - -[Service] -Type=simple -User=rustproxy -Group=rustproxy -WorkingDirectory=/var/lib/rustproxy -Environment=MALLOC_ARENA_MAX=2 -EnvironmentFile=-/etc/rustproxy/environment -ExecStart=/usr/bin/rust-proxy serve -Restart=on-failure -RestartSec=3s -KillSignal=SIGINT -KillMode=control-group -TimeoutStopSec=120s -UMask=0077 - -# Bind 80/443 without running the service as root. -AmbientCapabilities=CAP_NET_BIND_SERVICE -CapabilityBoundingSet=CAP_NET_BIND_SERVICE -NoNewPrivileges=true - -# Runtime filesystem policy. Diagnostics intentionally retain normal /proc access. -StateDirectory=rustproxy -StateDirectoryMode=0750 -LogsDirectory=rustproxy -LogsDirectoryMode=0750 -RuntimeDirectory=rustproxy -RuntimeDirectoryMode=0750 -ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy -ProtectSystem=strict -ProtectHome=true -PrivateTmp=true -PrivateDevices=true -ProtectKernelTunables=true -ProtectKernelModules=true -ProtectKernelLogs=true -ProtectControlGroups=true -LockPersonality=true -RestrictRealtime=true -RestrictSUIDSGID=true -RestrictNamespaces=true -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallArchitectures=native - -# High enough for many frontend/upstream sockets without removing all limits. -LimitNOFILE=65536 -TasksMax=4096 - -[Install] -WantedBy=multi-user.target diff --git a/debian/rustproxy.tmpfiles b/debian/rustproxy.tmpfiles deleted file mode 100644 index 0ec940f..0000000 --- a/debian/rustproxy.tmpfiles +++ /dev/null @@ -1,2 +0,0 @@ -d /var/lib/rustproxy 0750 rustproxy rustproxy - -d /var/log/rustproxy 0750 rustproxy rustproxy - diff --git a/debian/source/format b/debian/source/format deleted file mode 100644 index 89ae9db..0000000 --- a/debian/source/format +++ /dev/null @@ -1 +0,0 @@ -3.0 (native) diff --git a/dev.sh b/dev.sh index c1bdc21..58fc50b 100755 --- a/dev.sh +++ b/dev.sh @@ -18,7 +18,7 @@ if [[ $# -gt 0 ]]; then shift; fi case "$mode" in help|-h|--help) cat <<'HELP' -RustProxy 0.26.7 +RustProxy 0.27.0 ./dev.sh Build and start proxy + local panel ./dev.sh run [serve flags] Same, with extra server options ./dev.sh admin setup-token Generate/print a one-time setup capability before first login @@ -139,7 +139,7 @@ if [[ "$mode" == "test" ]]; then printf 'Checking all Rust targets before tests...\n' >&2 cargo check --locked --all-targets fi -printf 'Building RustProxy 0.26.7...\n' >&2 +printf 'Building RustProxy 0.27.0...\n' >&2 cargo build --locked BIN="$CARGO_TARGET_DIR/debug/rust-proxy" case "$mode" in diff --git a/docker-agent/model.go b/docker-agent/model.go index 2e88b2b..b309bc0 100644 --- a/docker-agent/model.go +++ b/docker-agent/model.go @@ -1,6 +1,6 @@ package main -const version = "0.26.7" +const version = "0.27.0" type config struct { Listen string diff --git a/docs/API_ACCESS.md b/docs/API_ACCESS.md index ff5f2d2..bc9432a 100644 --- a/docs/API_ACCESS.md +++ b/docs/API_ACCESS.md @@ -1,4 +1,4 @@ -# Administration API access - 0.26.7 +# Administration API access - 0.27.0 ## Sign-in boundary diff --git a/docs/CONTAINER.md b/docs/CONTAINER.md index 75a49c2..88a26da 100644 --- a/docs/CONTAINER.md +++ b/docs/CONTAINER.md @@ -9,7 +9,7 @@ each Docker host, so the proxy container never needs Docker-socket access. See Build locally with a normal OCI builder: ```bash -docker build -t rustproxy:0.26.7 . +docker build -t rustproxy:0.27.0 . ``` Persist `/var/lib/rustproxy`; it contains the SQLite database, certificates and the @@ -22,7 +22,7 @@ docker volume create rustproxy-data docker run --rm -d --name rustproxy \ -p 8080:8080 \ -v rustproxy-data:/var/lib/rustproxy \ - rustproxy:0.26.7 + rustproxy:0.27.0 docker exec rustproxy rust-proxy admin setup-token ``` diff --git a/docs/DOCKER_DISCOVERY.md b/docs/DOCKER_DISCOVERY.md index 2d3ea42..edcd75f 100644 --- a/docs/DOCKER_DISCOVERY.md +++ b/docs/DOCKER_DISCOVERY.md @@ -74,7 +74,7 @@ For each agent configure: - an optional configured frontend certificate to apply to every generated vhost for that agent; - an optional default ACL profile inherited by generated vhosts unless a service selects its own profile. -RustProxy polls each enabled agent according to its configured interval (30 seconds by default, checked by the scheduler in bounded steps). The 5-second Live-view refresh reads only cached RustProxy memory and does not force a Docker request. **Docker vhosts** shows the latest cached observation for every configured agent. +RustProxy polls each enabled agent according to its configured interval (30 seconds by default, checked by the scheduler in bounded steps). The 5-second Live-view refresh reads only cached RustProxy memory and does not force a Docker request. **Docker vhosts** shows the latest cached observation for every configured agent. A failed agent request retains the last successful inventory when available, so a temporary control-plane outage does not withdraw working routes. A successful inventory that omits an already published service keeps its hostname and changes the generated route to 503 until discovery sees the service again. ## Publish a discovered service @@ -90,6 +90,7 @@ For each discovered service you can change the mapping directly in **Docker vhos - **Redirect HTTP to HTTPS**: per-app Force SSL switch. New assignments default on when the agent has a usable plain-HTTP + TLS listener pair; assignments saved before 0.18.8 retain their previous redirect-off behavior until explicitly saved with the new switch; - **WebSockets**: enable or disable classic HTTP/1.1 Upgrade forwarding for this application; - **Cache**: enable or disable normal RustProxy caching for this generated vhost; +- **Compression**: inherit/enable/disable dynamic compression for this published vhost and optionally filter zstd, Brotli, gzip and deflate; selecting Disabled hides/disables the codec selectors without clearing their saved values, and globally disabled codecs stay unavailable; - **Transform**: opt this generated vhost into the global static-response transform engine; it is off by default and still requires global transformation to be enabled; - **Backend health check**: HTTP/TCP/off active-probe mode, path/Host override, interval, timeout, slow threshold, rise/fall counters and accepted HTTP status range. - **Passive Backend Health**: independent opt-in policy, OFF by default, with separate connect/timeout/I/O/HTTP-5xx/slow-response switches and optional passive rise/fall overrides. @@ -123,9 +124,9 @@ Backend selection order is: 4. the agent's preferred/primary detected address when compatible with the binding; 5. another compatible detected host address. -An explicit target that is not compatible with the service's Docker bindings does not silently fall back to another IP; that dynamic vhost is not materialized until the selected address/binding is available. +An explicit target that is not compatible with the service's Docker bindings does not silently fall back to another IP. In 0.27.0 the published hostname remains materialized and returns `503 Service Unavailable` until the selected service/address/binding is available again. Disabling the Docker agent stops discovery but keeps already published hostnames claimed as 503 routes; re-enabling the agent resumes reconciliation. Publication is removed when the administrator explicitly unpublishes the assignment or removes the agent configuration that owns it. -The generated backend is pinned to the selected IP through an address allowlist and uses the matching Docker-published host port. Cache, Transform, WebSockets and HTTP-to-HTTPS redirect are materialized from the per-app switches. If the Docker agent has a frontend certificate selected, that certificate ID is copied to every generated vhost and participates in the normal TLS/SNI certificate validation and ownership rules. The effective ACL profile is the per-app profile when selected, otherwise the agent default profile. Active backend health checks default to TCP. Passive Backend Health is materialized from the Docker assignment separately and defaults to OFF, so discovery refresh/restart does not silently re-enable production-traffic quarantine. The Docker vhosts page exposes the same passive policy as ordinary vhosts. Normal 5xx/timeouts/connect/I/O/slow-response observations remain visible in counters while passive health is OFF. Active checks can be switched between HTTP/TCP/off per service without changing the passive policy. +The generated backend is pinned to the selected IP through an address allowlist and uses the matching Docker-published host port. Cache, Transform, Compression, WebSockets and HTTP-to-HTTPS redirect are materialized from the per-app settings. Compression has inherit/on/off plus per-codec overrides. Global Response codec switches remain the hard availability ceiling and the minimum size remains global. If the Docker agent has a frontend certificate selected, that certificate ID is copied to every generated vhost and participates in the normal TLS/SNI certificate validation and ownership rules. The effective ACL profile is the per-app profile when selected, otherwise the agent default profile. Active backend health checks default to TCP. Passive Backend Health is materialized from the Docker assignment separately and defaults to OFF, so discovery refresh/restart does not silently re-enable production-traffic quarantine. The Docker vhosts page exposes the same passive policy as ordinary vhosts. Normal 5xx/timeouts/connect/I/O/slow-response observations remain visible in counters while passive health is OFF. Active checks can be switched between HTTP/TCP/off per service without changing the passive policy. ## DNS @@ -138,7 +139,7 @@ DNS for Docker vhost names must resolve to the RustProxy frontend/listener that Custom FQDNs and aliases likewise need DNS records pointing at the relevant RustProxy frontend. The Docker-host addresses detected by the agent are backend routing candidates; they are not automatically published to DNS. -RustProxy does not change DNS records itself in 0.22.3. +RustProxy does not change DNS records itself. ## Prometheus metrics Docker discovery has its own Prometheus collector switch, `prometheus.include_docker_vhosts`, enabled by default. It is intentionally separate from `include_vhosts` and `include_backends`. Dynamic Docker routes never appear under ordinary `rust_proxy_vhost_*` or `rust_proxy_backend_*` families. diff --git a/docs/ERROR_LOGGING.md b/docs/ERROR_LOGGING.md index 1d37aa0..e29d9e6 100644 --- a/docs/ERROR_LOGGING.md +++ b/docs/ERROR_LOGGING.md @@ -36,7 +36,7 @@ Error messages from dependencies should still be treated as untrusted diagnostic ## Rotation -RustProxy does not implement file rollover, retention or compression. Use the system `logrotate`. The Debian package configuration in `debian/rustproxy.logrotate` already covers `/var/log/rustproxy/*.log` and uses `copytruncate`, so the default error-log path is included without a RustProxy restart. +RustProxy does not implement file rollover, retention or compression. Use the system `logrotate`. Debian packaging is maintained outside this source tree and ready packages are published at `https://rustproxy.linuxiarz.pl`; package-specific logrotate policy belongs to that packaging repository. ## Stored-log explorer diff --git a/docs/FILE_LOGS.md b/docs/FILE_LOGS.md index 7d82f5e..60dad76 100644 --- a/docs/FILE_LOGS.md +++ b/docs/FILE_LOGS.md @@ -1,6 +1,6 @@ # Stored log explorer -RustProxy 0.26.7 provides an authenticated, read-only **Logs** workspace at `/logs`. The top bar has one **Logs** menu with separate **Stored logs** and **Live Logs** actions; the two data paths remain independent. +RustProxy 0.27.0 provides an authenticated, read-only **Logs** workspace at `/logs`. The top bar has one **Logs** menu with separate **Stored logs** and **Live Logs** actions; the two data paths remain independent. ## Separation from Live Logs diff --git a/docs/INSTALL.md b/docs/INSTALL.md index 8467334..c7c2c70 100644 --- a/docs/INSTALL.md +++ b/docs/INSTALL.md @@ -1,10 +1,12 @@ -# Installing and updating RustProxy 0.26.7 +# Installing and updating RustProxy 0.27.0 The scripts prepare a Linux/systemd installation. This source archive is **not a verified production build**: Rust/Cargo, real CA operations, live systemd startup and rollback against a real Rust database have not been exercised in the packaging environment. Perform the acceptance steps below on an isolated server first. +Ready-to-use Debian packages are published separately at `https://rustproxy.linuxiarz.pl`. The Debian package-build repository and metadata are intentionally maintained outside this source tree. + ## Debian 13+ one-line source install/update ```bash diff --git a/docs/README.md b/docs/README.md index daf1025..fb482c7 100644 --- a/docs/README.md +++ b/docs/README.md @@ -15,6 +15,7 @@ This is the canonical index for the current project documentation. The authentic - [0.25.1 release audit](V0.25.1_AUDIT.md) - historical Traffic/module-split release scope and compiler-regression guards. - [0.25.0 specification audit](V0.25.0_AUDIT.md) - Web Server foundation point-by-point implementation status. - [0.25.0 pre-production security audit](V0.25.0_SECURITY_PREPROD_AUDIT.md) - threat-oriented source/configuration review, fixes made in-session and mandatory runtime security gates. +- [0.27.0 implementation note](V0.27.0_IMPLEMENTATION.md) - compression defaults/scoped policy, persistent Docker publications and visible cache occupancy meter fill. - [0.26.7 implementation note](V0.26.7_IMPLEMENTATION.md) - HOT/COLD occupancy meters, backend rotation continuity and container Certbot packaging. - [0.26.6 implementation note](V0.26.6_IMPLEMENTATION.md) - composed ACL allow semantics, certificate-form reset, backend table preferences and NPM migration helper documentation. - [0.26.5 implementation note](V0.26.5_IMPLEMENTATION.md) - interface-scaled form/select alignment and corrected Streams listener navigation. @@ -67,7 +68,7 @@ This is the canonical index for the current project documentation. The authentic ## Historical or version-labelled context -Version-labelled `V*.md` files are retained as historical implementation/audit records. Their version number describes the audited milestone. The current release implementation note is [V0.26.7_IMPLEMENTATION.md](V0.26.7_IMPLEMENTATION.md); [V0.26.6_IMPLEMENTATION.md](V0.26.6_IMPLEMENTATION.md) is retained as the prior access-policy/administration milestone; [V0.26.5_IMPLEMENTATION.md](V0.26.5_IMPLEMENTATION.md) is retained as the prior interface-scaling/listener-navigation milestone, [V0.26.4_IMPLEMENTATION.md](V0.26.4_IMPLEMENTATION.md) as the prior administration/backend-lifecycle milestone, [V0.26.3_IMPLEMENTATION.md](V0.26.3_IMPLEMENTATION.md) as the prior appearance/UI milestone, [V0.26.2_IMPLEMENTATION.md](V0.26.2_IMPLEMENTATION.md) as the prior Logs/UI milestone and [V0.26.1_IMPLEMENTATION.md](V0.26.1_IMPLEMENTATION.md) as the prior protocol-attribution milestone. The latest retained audit is [V0.25.5_AUDIT.md](V0.25.5_AUDIT.md); older audit files remain historical evidence. +Version-labelled `V*.md` files are retained as historical implementation/audit records. Their version number describes the audited milestone. The current release implementation note is [V0.27.0_IMPLEMENTATION.md](V0.27.0_IMPLEMENTATION.md); [V0.26.7_IMPLEMENTATION.md](V0.26.7_IMPLEMENTATION.md) is retained as the prior cache/backend/container milestone; [V0.26.6_IMPLEMENTATION.md](V0.26.6_IMPLEMENTATION.md) is retained as the prior access-policy/administration milestone; [V0.26.5_IMPLEMENTATION.md](V0.26.5_IMPLEMENTATION.md) is retained as the prior interface-scaling/listener-navigation milestone, [V0.26.4_IMPLEMENTATION.md](V0.26.4_IMPLEMENTATION.md) as the prior administration/backend-lifecycle milestone, [V0.26.3_IMPLEMENTATION.md](V0.26.3_IMPLEMENTATION.md) as the prior appearance/UI milestone, [V0.26.2_IMPLEMENTATION.md](V0.26.2_IMPLEMENTATION.md) as the prior Logs/UI milestone and [V0.26.1_IMPLEMENTATION.md](V0.26.1_IMPLEMENTATION.md) as the prior protocol-attribution milestone. The latest retained audit is [V0.25.5_AUDIT.md](V0.25.5_AUDIT.md); older audit files remain historical evidence. Older context documents such as [INTEGRATIONS_040](INTEGRATIONS_040.md), [MANAGEMENT](MANAGEMENT.md), [SECURITY_AUDIT](SECURITY_AUDIT.md), [ACME_RFC2136](ACME_RFC2136.md) and older version audits remain available for traceability but should not override the current functional/technical documents above. diff --git a/docs/SETTINGS.md b/docs/SETTINGS.md index ebe89a4..0a69c7e 100644 --- a/docs/SETTINGS.md +++ b/docs/SETTINGS.md @@ -31,7 +31,7 @@ this and preserves dirty settings forms across status/language refreshes. "http2_settings":{"idle_timeout_seconds":300, "max_connection_lifetime_seconds":0, "drain_timeout_seconds":10}}} ] }, - "server_header": {"mode":"custom", "value":"RustProxy/v0.20.0"}, + "server_header": {"mode":"custom", "value":"RustProxy"}, "compression": {"gzip":true, "br":true, "zstd":true, "deflate":false, "min_bytes":1024}, "headers": { "request": [{"op":"set", "name":"x-proxy-name", "value":"RustProxy"}], @@ -206,7 +206,7 @@ endpoints are rejected rather than silently widened. ## Server and other client headers -`server_header.mode` is `preserve` (default), `hide`, or `custom`. Custom values are +`server_header.mode` is `preserve`, `hide`, or `custom`. Fresh installations default to `custom` with the exact value `RustProxy`; existing saved installations retain their configured policy. Custom values are nonempty, bounded to 256 bytes and validated against header injection. Preserve means retain the result of origin/global/route rules; it does not add a missing header. Hide/custom take final precedence, including proxy-generated errors. @@ -225,26 +225,34 @@ snapshot; no mixed-version configuration is applied midway through a response. ## Compression -All four flags default false. `min_bytes` defaults to 1024 (valid 32..1048576). -The library's default small-body/content-type predicate is also retained; actual -minimum for a known-size body is at least that default. Unknown-length text bodies -can be streamed without pre-buffering merely to discover their size. +`zstd`, Brotli and gzip default ON; deflate defaults OFF. `min_bytes` defaults to 1024 +(valid 32..1048576). The streaming middleware keeps its default content-type safety +predicate plus the RustProxy minimum-size predicate. Unknown-length eligible bodies can +be streamed without aggregating the complete response merely to discover its size. -Accept-Encoding quality negotiation is delegated to tower-http. Text, JSON, -JavaScript, XML, SVG and wasm are eligible; already encoded, SSE, range, upgrade, -HEAD/204/304 and privacy-sensitive responses are excluded. Authorization and arbitrary -cookie-bearing dynamic responses remain excluded. A cookie-bearing request may be -compressed only when RustProxy is already serving a shared-cache HIT accepted by cache -policy (including the configured static-cookie exception) or a local static Web Server -response. Origin `private`, `no-store`, `no-transform` and `Set-Cookie` exclusions still -win. Cached identity bodies can be streamed through compression on HIT; origin encodings -are passed through without recompression. +RustProxy parses `Accept-Encoding` quality weights before invoking the encoder. Client +`q` values win. When two or more enabled codecs have equal quality, the deterministic +server preference is `zstd -> br -> gzip -> deflate`. An existing `Content-Encoding` is +always passed through and never recompressed. `no-transform`, request ranges/Content-Range, +SSE, upgrades, HEAD/1xx/204/304 and explicitly skipped internal responses remain excluded. +`Cookie`, `Authorization`, `Set-Cookie`, `Cache-Control: private` and `no-store` do not by +themselves disable compression; cacheability and dynamic compression are separate policies. +Applications that place secrets and attacker-controlled reflection in the same compressed +response can disable compression at the vhost or Web Service scope when their threat model +requires BREACH-style mitigation. -Vary: Accept-Encoding is added by compression; content length is removed for the -transformed body. Strong ETags are weakened, and identity-body content digests and -Accept-Ranges are removed. Encoders use their fastest preset; there is no panel -compression-quality slider in this release. Real binary interoperability tests -are still an acceptance requirement, not a result of this packaging session. +The global Response panel selects available codecs and the minimum size. Each ordinary +vhost may inherit, enable or disable dynamic compression and independently inherit/enable/disable +zstd, Brotli, gzip and deflate. Generated Docker vhosts and Web Server services expose the same +per-scope codec filters. When a scope is explicitly Disabled, the dashboard hides and disables +those codec controls without clearing their saved values. Global codec switches remain the hard +ceiling: a local `true` override cannot enable a codec disabled in the global Response panel. +`min_bytes` remains global. + +`Vary: Accept-Encoding` is added when compression is negotiated; content length is removed +for the transformed body. Strong ETags are weakened, and identity-body content digests and +`Accept-Ranges` are removed. Encoders use their fastest preset; there is no panel +compression-quality slider in this release. ## Diagnostics and units @@ -288,7 +296,7 @@ to downgrade. Vhosts have their own backend pool, health/keepalive/affinity controls, ACL and security/custom response headers. See VHOSTS.md. Global Server policy still takes -final precedence. There is no per-vhost compression algorithm override. +final precedence. Per-vhost compression can filter individual globally enabled codecs. The reported `SizeAbove(u16)` compilation error is removed by a custom u64 predicate, not a cast or panic-producing conversion. Compression thresholds retain the full diff --git a/docs/TEST_REPORT.md b/docs/TEST_REPORT.md index 6e56345..7ba53c0 100644 --- a/docs/TEST_REPORT.md +++ b/docs/TEST_REPORT.md @@ -1,26 +1,29 @@ -# Verification report - RustProxy 0.26.7 +# Verification report - RustProxy 0.27.0 ## Scope -RustProxy 0.26.7 is a compatibility-preserving cache observability, backend-client lifecycle and documentation patch on top of 0.26.6. SQLite remains schema 8 and the saved proxy configuration format is unchanged. +RustProxy 0.27.0 changes downstream compression policy, Docker-vhost publication continuity, cache-meter rendering, fresh-install response identity and source-package layout while keeping SQLite schema 8. -The release adds explicit HOT/COLD cache occupancy meters on `/cache` for configured object and byte limits. It also preserves compatible upstream client instances across unrelated active-snapshot rebuilds, preventing generation age, generation request counts and cumulative `Rotations` from being reset by configuration publication. Backend changes that alter origin, address policy, keepalive settings or connect timeout still create fresh clients. The OCI/container documentation now matches the shipped certificate environment: Certbot plus the Cloudflare, OVH and RFC2136 DNS plugins are provided together. The same 0.26.7 source now also hardens cache `Age` ownership and aligns downstream compression with the static-cookie cache exception. +Dynamic response compression defaults to zstd, Brotli and gzip enabled, with deflate opt-in. Client `Accept-Encoding` quality values are authoritative; equal quality uses deterministic `zstd -> br -> gzip -> deflate` server preference. Existing `Content-Encoding`, `no-transform`, range responses/requests, SSE and upgrades remain excluded. Cookie, authorization, `Set-Cookie`, `private` and `no-store` no longer disable compression as blanket rules. + +Ordinary vhosts, generated Docker vhosts and Web Server services can inherit, enable or disable dynamic compression and can independently inherit/enable/disable zstd, Brotli, gzip and deflate. Global **Settings -> Response** codec switches remain the hard availability ceiling and `min_bytes` remains global. A scoped codec cannot activate a codec disabled globally. When scoped compression is explicitly Disabled, the dashboard hides and disables its codec selectors while preserving the stored override values. + +An explicitly published Docker assignment keeps its generated hostname even when its service disappears. A successful inventory without the assigned service materializes an unavailable route that returns HTTP 503 instead of removing the hostname. Agent polling errors retain the previous successful inventory when one exists, and a returning service is reconciled automatically. The cache overview progress elements have explicit WebKit/Chromium and Firefox progress-value styling so their visual fill follows the numeric meter value. + +Fresh installations now default the response `Server` policy to `custom` with the exact value `RustProxy`. Existing stored settings are not rewritten, and a configuration document predating the `server_header` field still deserializes with the historical preserve behavior. Debian package-build metadata is no longer shipped in the main source tree; ready packages are maintained separately at `https://rustproxy.linuxiarz.pl`. ## Regression coverage -Static source contracts require all four `/cache` occupancy meters (HOT objects, HOT bytes, COLD objects and COLD bytes) and their configured-limit inputs. Browser JavaScript syntax is checked with Node. - -The existing upstream-client unit coverage retains age-triggered rotation without user traffic. A new pool regression, `compatible_pool_rebuild_reuses_upstream_clients`, verifies that a compatible rebuild reuses the previous compiled backend/client object so rotation state remains continuous. Source contracts also require the `reusable_with` compatibility check, maintenance calls for normal/WebSocket clients and backend reuse path. These Rust tests require a compiler-enabled release host. - -Cache regressions now require a stored HIT/dashboard object to advance `Age`, while compression regressions require `Age` to survive encoding and require cookie-bearing compression to stay blocked unless the internal cache/static safety marker is present. Existing 0.26.6 `Age` rules stay loadable; response-side Age is tagged as a late wire-only override so the generic response-rule pass cannot influence cache freshness/storage. The bundled compression tester no longer forces `Cache-Control: no-cache` unless `--revalidate` is requested. - -Documentation checks cover the 0.26.7 release note, Reader index, local Markdown links, cache diagnostics and container/ACME provider guidance. Packaging smoke tests verify the 0.26.7 release identity and deterministic source archive contract. +Compression unit coverage checks defaults, q-value negotiation, equal-quality priority, each supported codec, existing-encoding passthrough, scoped per-codec resolution and the revised cookie/auth/cache-privacy policy. Docker unit coverage checks missing published service -> retained 503, failed agent observation -> retained last-known backend and persistence of Docker codec overrides. Settings coverage checks the fresh-install `Server: RustProxy` default and legacy missing-field compatibility. Static/UI contracts require ordinary-vhost, Docker-vhost and Web-Service codec controls to hide/disable when their scope is explicitly OFF without clearing saved values, plus the 503 path, visible cache progress styling, external Debian-packaging separation and reproducible archives without a `debian/` tree. ## Verification status in this workspace +Rust/Cargo is not installed in this workspace. Rust-independent checks pass here; compiler/type/runtime gates remain explicitly open until this source is checked on a Rust-enabled release host. + | Check | Status | |---|---| -| `node --check` for changed administration JavaScript | PASS | +| changed administration JavaScript syntax (`node --check`) | PASS | +| language/OpenAPI JSON parse | PASS | | `python3 scripts/langs_check.py` | PASS | | `python3 scripts/memory_contracts.py` | PASS | | `python3 scripts/web_server_contracts.py` | PASS | @@ -31,14 +34,13 @@ Documentation checks cover the 0.26.7 release note, Reader index, local Markdown | `python3 scripts/docs_check.py` | PASS | | `python3 scripts/release_smoke.py` | PASS | | `node scripts/web_service_ui_test.mjs` | PASS | -| language/OpenAPI JSON parse | PASS | | `go test ./...` in `docker-agent` | PASS | | `python3 scripts/check_source.py` | PASS; explicitly reports Rust parsing/types/runtime as not verified | | `./dev.sh test` | Rust-independent gates PASS; wrapper exits 127 at the Rust stage because Cargo is unavailable | -| `./dev.sh check` | BLOCKED: Rust/Cargo toolchain unavailable in this workspace | -| `cargo fmt --check` | BLOCKED: Rust/Cargo toolchain unavailable in this workspace | -| `cargo clippy --all-targets --all-features -- -D warnings` | BLOCKED: Rust/Cargo toolchain unavailable in this workspace | -| `cargo test --all-targets --all-features` | BLOCKED: Rust/Cargo toolchain unavailable in this workspace | -| complete release build | BLOCKED at Rust compilation: Rust/Cargo toolchain unavailable in this workspace | +| `./dev.sh check` | BLOCKED: Rust/Cargo toolchain unavailable | +| `cargo fmt --check` | BLOCKED: Rust/Cargo toolchain unavailable | +| `cargo clippy --all-targets --all-features -- -D warnings` | BLOCKED: Rust/Cargo toolchain unavailable | +| `cargo test --all-targets --all-features` | BLOCKED: Rust/Cargo toolchain unavailable | +| complete release build | BLOCKED at Rust compilation: Rust/Cargo toolchain unavailable | -The 0.26.7 source archive must not be described as compiler-verified until the Rust-enabled release-host gates pass. Rust-independent checks do not substitute for Rust parsing, type checking, Clippy or runtime tests. +The 0.27.0 source archive must not be described as compiler-verified or production-ready until the Rust-enabled release-host gates pass. Static/source contracts do not substitute for Rust parsing, type checking, Clippy, unit tests or real protocol runtime tests. diff --git a/docs/V0.24.3_AUDIT.md b/docs/V0.24.3_AUDIT.md index 07791cd..57de4b6 100644 --- a/docs/V0.24.3_AUDIT.md +++ b/docs/V0.24.3_AUDIT.md @@ -8,7 +8,7 @@ | Requirement | Source implementation | Status | |---|---|---| -| Bound glibc arena proliferation for managed systemd installs | `deploy/rustproxy.service`, `debian/rustproxy.service` and `scripts/deploy.py::service_unit` set `MALLOC_ARENA_MAX=2`; `/etc/rustproxy/environment` remains the administrator override | implemented in source | +| Bound glibc arena proliferation for managed systemd installs | `deploy/rustproxy.service` and `scripts/deploy.py::service_unit` set `MALLOC_ARENA_MAX=2`; Debian packaging moved to the external packaging repository in 0.27.0, and `/etc/rustproxy/environment` remains the administrator override | implemented in source | | Avoid a duplicate identity transform buffer | `src/transform/mod.rs::decode` returns `Cow<[u8]>`; identity input is borrowed and compressed input owns only the decoded buffer | implemented in source | | Reduce JS/CSS minifier peak allocations | `src/transform/js.rs` and `src/transform/css.rs` iterate with `Peekable` rather than collecting `Vec`, and return the completed `String` allocation with `into_bytes()` | implemented in source | | Release temporary transform buffers earlier | successful changed transforms drop the decoded/collected origin buffers before final response construction | implemented in source | diff --git a/docs/V0.27.0_IMPLEMENTATION.md b/docs/V0.27.0_IMPLEMENTATION.md new file mode 100644 index 0000000..0846c65 --- /dev/null +++ b/docs/V0.27.0_IMPLEMENTATION.md @@ -0,0 +1,27 @@ +# RustProxy 0.27.0 implementation note + +## Scope + +0.27.0 changes downstream compression defaults/negotiation, makes Docker publications persistent across transient service loss, adds scoped compression overrides, and fixes cache occupancy meter rendering. SQLite remains schema 8. Saved configuration changes are additive/defaulted: vhosts and Web Services gain scoped compression/codec overrides and Docker assignments gain nullable compression/codec fields. Fresh installations also default the `Server` header policy to `custom: RustProxy`, while a missing legacy field still deserializes with the previous preserve behavior. + +## Compression + +Global compression defaults to zstd, Brotli and gzip enabled, with deflate disabled and the existing 1024-byte minimum. RustProxy parses `Accept-Encoding` weights before entering tower-http. Client quality values are authoritative; equal qualities use server preference `zstd -> br -> gzip -> deflate`. + +Responses carrying `Cookie`, `Authorization`, `Set-Cookie`, `Cache-Control: private` or `no-store` are no longer rejected merely because of those headers. Compression remains disabled for existing `Content-Encoding`, `no-transform`, request ranges/`Content-Range`, SSE, upgrades, HEAD and non-body statuses. Existing encoded bodies are never recompressed. + +Ordinary vhosts, generated Docker vhosts and Web Server services expose inherit/enable/disable dynamic-compression policy plus individual zstd/Brotli/gzip/deflate overrides. Global Response codec switches remain the hard availability ceiling and the minimum size remains global. A child scope may re-enable a codec disabled by an enclosing scope only when that codec is still enabled globally. In the dashboard, explicitly selecting **Disabled** hides and disables the child codec selectors; their stored values are preserved so changing the scope back to Inherit/Enabled restores the previous choices. + +## Persistent Docker publications + +A Docker assignment is desired configuration, not merely a reflection of the latest inventory. Once published, its hostname remains owned until the administrator unpublishes it or disables/removes the agent. When a successful Docker inventory no longer contains the assigned service, RustProxy compiles an unavailable fallback route with no backend and returns `503 Service Unavailable` plus `Retry-After: 1` instead of withdrawing the hostname and falling through to 404. + +Agent transport failures retain the previous successful inventory when one exists, allowing known working backends to continue routing during a temporary control-plane outage. If no inventory has ever succeeded, published assignments are still materialized as 503 routes. When the same service key becomes routable again, normal reconciliation rebuilds its backend pool automatically; no manual pool action is required. + +## Cache occupancy meters + +The `/cache` JavaScript already calculates occupancy percentages from configured object/byte limits and writes those values to native `` elements. 0.27.0 adds explicit WebKit/Chromium and Firefox progress-track/value styling so the filled portion is visible instead of relying only on `accent-color`. + +## Compatibility and verification + +No SQLite migration is required. Older vhost, Docker assignment and Web Service documents load with inherited compression behavior because all new fields are defaulted. Existing stored `server_header` settings are preserved; documents predating that field keep the historical preserve behavior. Rust compiler/runtime verification remains mandatory on the release host; Rust-independent checks in `docs/TEST_REPORT.md` do not substitute for `cargo fmt`, `cargo check`, Clippy, tests or live protocol acceptance. diff --git a/docs/VHOSTS.md b/docs/VHOSTS.md index d120838..44c36c6 100644 --- a/docs/VHOSTS.md +++ b/docs/VHOSTS.md @@ -337,6 +337,8 @@ remain uneditable. `false`, `preserve` or null security settings otherwise leave origin values unchanged. CSP and Permissions-Policy must suit the application; RustProxy validates header encoding, not the semantic correctness of those policies. +The **Compression** tab inherits the enclosing/global policy by default. It can enable/disable dynamic compression and independently inherit/enable/disable zstd, Brotli, gzip and deflate. Selecting **Disabled** hides and disables the codec selectors while preserving their saved values for a later Inherit/Enabled selection. Global **Settings -> Response** codec switches are the hard availability ceiling, so a vhost cannot activate a codec disabled globally; `min_bytes` also remains global. Client `q` values are honored; equal-quality codecs use `zstd -> br -> gzip -> deflate`, and an existing `Content-Encoding` is never recompressed. + ## Live state, cache and limits The dashboard defaults a newly created vhost to `cache.enabled: false`. When the diff --git a/docs/WEB_SERVER.md b/docs/WEB_SERVER.md index 6e8211f..cb427f0 100644 --- a/docs/WEB_SERVER.md +++ b/docs/WEB_SERVER.md @@ -295,7 +295,7 @@ Web Server dispatch occurs after the existing vhost/location selection and acces - vhost/location custom and security headers; - custom error pages; - access logging and per-vhost Traffic metrics; -- response processing/compression where applicable; +- response processing/compression where applicable; each Web Service can inherit, enable or disable dynamic compression independently of its precompressed `.br`/`.gz` sidecar policy and can filter individual codecs; selecting Disabled hides/disables those codec selectors without clearing their saved values, while globally disabled codecs stay unavailable and the minimum size remains global; - TLS and existing HTTP/1.1, HTTP/2 and HTTP/3 listeners. A local Web Server request does not create a reverse-proxy backend connection. WebSocket upgrades remain unsupported for a Web Server source. diff --git a/grafana/README.md b/grafana/README.md index b8a8dad..2782306 100644 --- a/grafana/README.md +++ b/grafana/README.md @@ -19,7 +19,7 @@ classes, cache outcomes, capture-state gauges and configured-route traffic. Raw are intentionally absent from Prometheus labels. Import the JSON in Grafana and select a Prometheus datasource when prompted. The -dashboard expects RustProxy 0.26.7 metric names and a scrape interval around 15s. +dashboard expects RustProxy 0.27.0 metric names and a scrape interval around 15s. Collectors can be disabled in RustProxy settings; panels for disabled collectors will simply show no series. diff --git a/grafana/rustproxy-overview.json b/grafana/rustproxy-overview.json index abb2c43..7926c1b 100644 --- a/grafana/rustproxy-overview.json +++ b/grafana/rustproxy-overview.json @@ -4529,9 +4529,9 @@ }, "timepicker": {}, "timezone": "browser", - "title": "RustProxy 0.26.7 - Operations", + "title": "RustProxy 0.27.0 - Operations", "uid": "rustproxy-0170", "version": 5, "weekStart": "", - "description": "RustProxy 0.26.7 operations dashboard including backend client lifecycle/retry diagnostics, bounded Traffic analytics, country and User-Agent-family visibility, and built-in Web Server traffic." + "description": "RustProxy 0.27.0 operations dashboard including backend client lifecycle/retry diagnostics, bounded Traffic analytics, country and User-Agent-family visibility, and built-in Web Server traffic." } diff --git a/langs/en_US.json b/langs/en_US.json index a82041a..a161277 100644 --- a/langs/en_US.json +++ b/langs/en_US.json @@ -258,7 +258,7 @@ "serverValue": "Custom Server value", "compression": "Streaming compression", "compressionMin": "Minimum response size (bytes)", - "compressionHelp": "Negotiates Accept-Encoding. Skips private responses, cookies, ranges, SSE and no-transform; existing compressed bodies are passed through.", + "compressionHelp": "Negotiates Accept-Encoding using client q-values and zstd → br → gzip → deflate as the server preference for equal quality. Cookies, Authorization, Set-Cookie, private and no-store responses may be compressed. Existing Content-Encoding, ranges, SSE, upgrades and no-transform are passed through.", "saveResponse": "Apply response settings", "cacheSettings": "Cache", "enableCache": "Enable cache", @@ -491,6 +491,13 @@ "vhCertificateNeedsHosts": "Enter vhost domain names in Details first.", "vhCertificateStaged": "Pair verified and staged. Save this vhost to activate its certificate.", "vhCertificateUploadHint": "Optional upload verifies key match and domain coverage. Private keys are stored in private files, never returned by the API. Save the vhost to activate the selection. Uploads do not save other changes. Listener changes require restart.", + "vhCompression": "Compression", + "vhCompressionHelp": "Compression and each codec inherit by default. A scope can filter globally enabled codecs; it cannot activate a codec disabled in Settings → Response. Minimum size remains global.", + "compressionEnabled": "Dynamic compression", + "compressionZstd": "Zstandard (zstd)", + "compressionBr": "Brotli (br)", + "compressionGzip": "gzip", + "compressionDeflate": "deflate", "vhCache": "Cache", "vhCacheTtl": "Maximum TTL (seconds, blank inherits)", "vhCacheDefault": "Public default TTL (blank inherits)", @@ -1478,6 +1485,8 @@ "dockerForceSsl": "Redirect HTTP to HTTPS", "dockerForceSslUnavailable": "Requires an active plain HTTP listener and one unambiguous TLS listener on this agent.", "dockerWebsockets": "WebSockets", + "dockerCompression": "Compression", + "dockerCompressionHelp": "Inherit, enable or disable compression for this Docker vhost and optionally filter individual globally enabled codecs.", "dockerCache": "Cache", "vhProxyTimeouts": "Proxy timeouts", "vhProxyConnectTimeout": "Proxy connect timeout (s)", @@ -1797,6 +1806,8 @@ "webServiceRewrites": "Rewrite rules", "webServiceRewritesHelp": "One regex rule per line. Use pattern => /target for an internal rewrite or pattern => 301:/target for a redirect.", "webServiceRewritesInvalid": "Rewrite rules must use pattern => /target or pattern => 301:/target (301/302/307/308).", + "webServiceCompression": "Dynamic compression", + "webServiceCompressionHelp": "Inherits the vhost/global policy by default. Individual codecs can be filtered here; globally disabled codecs remain unavailable and minimum size stays global.", "webServicePrecompressed": "Serve precompressed sidecars", "webServicePrecompressedBr": "Brotli (.br)", "webServicePrecompressedGzip": "Gzip (.gz)", diff --git a/langs/pl_pl.json b/langs/pl_pl.json index 264015e..ee72a52 100644 --- a/langs/pl_pl.json +++ b/langs/pl_pl.json @@ -258,7 +258,7 @@ "serverValue": "Własna wartość Server", "compression": "Kompresja strumieniowa", "compressionMin": "Minimalny rozmiar odpowiedzi (bajty)", - "compressionHelp": "Negocjacja Accept-Encoding. Pomija dane prywatne, cookies, zakresy, SSE i no-transform. Nie kompresuje ponownie zakodowanych odpowiedzi.", + "compressionHelp": "Negocjuje Accept-Encoding według q klienta, a przy równym q używa priorytetu zstd → br → gzip → deflate. Cookie, Authorization, Set-Cookie oraz odpowiedzi private i no-store mogą być kompresowane. Istniejący Content-Encoding, zakresy, SSE, upgrade i no-transform są przekazywane bez rekompresji.", "saveResponse": "Zastosuj ustawienia odpowiedzi", "cacheSettings": "Cache", "enableCache": "Włącz cache", @@ -491,6 +491,13 @@ "vhCertificateNeedsHosts": "Najpierw wpisz domeny vhosta w Szczegółach.", "vhCertificateStaged": "Para zweryfikowana i zapisana. Zapisz vhost, aby aktywować certyfikat.", "vhCertificateUploadHint": "Upload sprawdza zgodność klucza i domen. Klucz trafia do prywatnego pliku, nie do API. Zapis vhosta aktywuje wybór. Upload nie zapisuje pozostałych zmian. Zmiany listenerów wymagają restartu.", + "vhCompression": "Kompresja", + "vhCompressionHelp": "Kompresja i każdy kodek domyślnie dziedziczą ustawienia. Na tym poziomie można ograniczyć globalnie włączone kodeki, ale nie można włączyć kodeku wyłączonego w Ustawienia → Odpowiedź. Minimalny rozmiar pozostaje globalny.", + "compressionEnabled": "Kompresja dynamiczna", + "compressionZstd": "Zstandard (zstd)", + "compressionBr": "Brotli (br)", + "compressionGzip": "gzip", + "compressionDeflate": "deflate", "vhCache": "Cache", "vhCacheTtl": "Maks. TTL (sekundy, puste = dziedzicz)", "vhCacheDefault": "Domyślny TTL public (puste = dziedzicz)", @@ -1478,6 +1485,8 @@ "dockerForceSsl": "Przekieruj HTTP do HTTPS", "dockerForceSslUnavailable": "Wymaga aktywnego listenera zwykłego HTTP oraz jednego jednoznacznego listenera TLS dla tego agenta.", "dockerWebsockets": "WebSockety", + "dockerCompression": "Kompresja", + "dockerCompressionHelp": "Dziedzicz, włącz albo wyłącz kompresję dla tego vhosta Docker oraz opcjonalnie ogranicz poszczególne globalnie włączone kodeki.", "dockerCache": "Cache", "vhProxyTimeouts": "Timeouty proxy", "vhProxyConnectTimeout": "Proxy connect timeout (s)", @@ -1797,6 +1806,8 @@ "webServiceRewrites": "Reguły rewrite", "webServiceRewritesHelp": "Jedna reguła regex na linię. Użyj wzorzec => /cel dla rewrite wewnętrznego albo wzorzec => 301:/cel dla przekierowania.", "webServiceRewritesInvalid": "Reguły rewrite muszą mieć format wzorzec => /cel albo wzorzec => 301:/cel (301/302/307/308).", + "webServiceCompression": "Kompresja dynamiczna", + "webServiceCompressionHelp": "Domyślnie dziedziczy politykę vhosta/globalną. Tutaj można ograniczyć poszczególne kodeki; kodeki wyłączone globalnie pozostają niedostępne, a minimalny rozmiar pozostaje globalny.", "webServicePrecompressed": "Serwuj gotowe pliki skompresowane", "webServicePrecompressedBr": "Brotli (.br)", "webServicePrecompressedGzip": "Gzip (.gz)", diff --git a/make_zip.py b/make_zip.py index 57805df..1897766 100755 --- a/make_zip.py +++ b/make_zip.py @@ -12,7 +12,7 @@ import zipfile ROOT = Path(__file__).resolve().parent MANAGED = [ - 'src', 'tests', 'scripts', 'nagios', 'docker-agent', 'migrations', 'examples', 'docs', 'langs', 'deploy', 'debian', 'grafana', + 'src', 'tests', 'scripts', 'nagios', 'docker-agent', 'migrations', 'examples', 'docs', 'langs', 'deploy', 'grafana', '.github', '.cargo', 'Cargo.toml', 'Cargo.lock', 'build.rs', 'rust-toolchain.toml', 'UPDATE_CHECK.toml', 'dev.sh', 'upgrade.sh', 'install.sh', 'install-debian13.sh', 'update.sh', 'README.md', 'ROADMAP.md', 'CHANGELOG.md', 'AGENTS.md', '.env.example', '.gitignore', '.dockerignore', @@ -68,8 +68,6 @@ def release_datetime() -> tuple[int, int, int, int, int, int]: def deterministic_mode(rel: Path) -> int: executable = rel.as_posix() in EXECUTABLE_ROOT or ( rel.parts and rel.parts[0] == 'scripts' and rel.suffix in {'.py', '.sh'} - ) or ( - rel.parts and rel.parts[0] == 'debian' and (rel.suffix in {'.sh'} or rel.name in {'rules', 'rustproxy.postinst'}) ) or ( rel.parts and rel.parts[0] == 'nagios' and (rel.suffix in {'.py', '.sh'} or rel.name.startswith('check_')) ) or ( @@ -88,7 +86,7 @@ def add_file(archive: zipfile.ZipFile, rel: Path, data: bytes, timestamp: tuple[ def main() -> None: parser = argparse.ArgumentParser(description=__doc__) - parser.add_argument('output', nargs='?', type=Path, default=ROOT.parent / 'RustProxy-0.26.7.zip') + parser.add_argument('output', nargs='?', type=Path, default=ROOT.parent / 'RustProxy-0.27.0.zip') output = parser.parse_args().output.resolve() paths = files() checksum = ROOT / 'SHA256SUMS' diff --git a/scripts/check_source.py b/scripts/check_source.py index e940434..af1b1c6 100755 --- a/scripts/check_source.py +++ b/scripts/check_source.py @@ -24,7 +24,7 @@ def read_docker_agent_source() -> str: preflight(root) manifest = tomllib.loads((root / "Cargo.toml").read_text()) -assert manifest["package"]["version"] == "0.26.7" +assert manifest["package"]["version"] == "0.27.0" assert manifest["dependencies"]["quinn"]["version"] == "0.11.12" h3dep = manifest["dependencies"]["h3"] assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"] @@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"] lock_path = root / "Cargo.lock" if lock_path.exists(): lock = lock_path.read_text() - assert 'name = "rust-proxy"\nversion = "0.26.7"' in lock + assert 'name = "rust-proxy"\nversion = "0.27.0"' in lock assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries" for release_doc, marker in { - "README.md": "# RustProxy 0.26.7", - "CHANGELOG.md": "## 0.26.7", - "ROADMAP.md": "## 0.26.7", - "AGENTS.md": "Current source version: 0.26.7.", - "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.26.7", + "README.md": "# RustProxy 0.27.0", + "CHANGELOG.md": "## 0.27.0", + "ROADMAP.md": "## 0.27.0", + "AGENTS.md": "Current source version: 0.27.0.", + "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.27.0", }.items(): assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}" assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable" @@ -73,7 +73,7 @@ for marker in [ ]: assert marker in update_check_source, marker assert 'pub last_error:' not in update_check_source, "update-check errors must not change dashboard/API state" -for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.8_AUDIT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]: +for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.8_AUDIT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json", "grafana/README.md"]: assert (root / name).is_file(), name npm_doc = (root / "docs/NPM_MIGRATION.md").read_text(encoding="utf-8") for marker in ["scripts/migrate_npm_core.py", "scripts/migrate_npm_api.py", '-v "$PWD/scripts:/rustproxy-scripts:ro"', "python /rustproxy-scripts/migrate_npm.py"]: @@ -104,7 +104,7 @@ for path in [root / "make_zip.py", *(root / "scripts").glob("*.py")]: ast.parse(path.read_text(), str(path)) subprocess.run(["bash", "-n", str(root / "dev.sh")], check=True) subprocess.run(["bash", "-n", str(root / "upgrade.sh")], check=True) -for name in ["install.sh", "install-debian13.sh", "update.sh", "debian/build-package.sh", "debian/build-repository.sh", "debian/rustproxy.postinst", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "docker-agent/install.sh"]: +for name in ["install.sh", "install-debian13.sh", "update.sh", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "docker-agent/install.sh"]: subprocess.run(["bash", "-n", str(root / name)], check=True) bootstrap = (root / "install-debian13.sh").read_text() for marker in [ @@ -124,7 +124,6 @@ assert dev.count('cargo generate-lockfile') == 1, "dev.sh must only create Cargo unit = (root / "deploy/rustproxy.service").read_text() assert "LogsDirectory=rustproxy" in unit and "/var/log/rustproxy" in unit assert "Environment=MALLOC_ARENA_MAX=2" in unit -assert "Environment=MALLOC_ARENA_MAX=2" in (root / "debian/rustproxy.service").read_text() assert "Environment=MALLOC_ARENA_MAX=2" in read_deploy_source() assert not re.search(r"\b20\d{2}[-/]\d{1,2}[-/]\d{1,2}\b", (root / "CHANGELOG.md").read_text()), "changelog contains a release date" subprocess.run(["python3", str(root / "scripts/langs_check.py")], check=True) @@ -268,7 +267,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi assert '"StreamMetrics"' in openapi and '"streams"' in openapi -for marker in ['"version": "0.26.7"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']: +for marker in ['"version": "0.27.0"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']: assert marker in openapi, marker for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']: assert marker in openapi, marker @@ -395,7 +394,7 @@ for marker in ['effectiveCacheMemory', 'cacheMemoryHeadroom', 'cachePresetValues for marker in ['selectedTransformPreset', 'transformPresetValues', 'applyTransformPreset', 'updateTransformResourceSizing', 'memory_budget_bytes', 'max_inflight']: assert marker in js, marker assert 'envelope?.config.cache?.enabled === true && cacheToggle.value !== "off"' in vhosts_js -for marker in ['transform: { enabled: false }', 'vhTransform', 'collectTransform']: +for marker in ['transform: { enabled: false }', 'vhTransform', 'collectTransform', 'compression: { enabled: null, gzip: null, br: null, zstd: null, deflate: null }', 'vh-compression-enabled', 'vh-compression-zstd', 'vh-compression-br', 'vh-compression-gzip', 'vh-compression-deflate', 'collectCompression']: assert marker in vhosts_js, marker docker_js = (root / 'src/admin/web/docker.js').read_text() assert 'transform_enabled' in docker_js @@ -406,6 +405,9 @@ for marker in ['cp-hot-entries-meter', 'cp-memory', 'cp-cold-entries-meter', 'cp assert marker in html and marker in cache_panel_js, marker for marker in ['data.settings?.max_entries', 'data.settings?.cold_max_entries', 'data.settings?.cold_max_bytes', 'setMeter(']: assert marker in cache_panel_js, marker +compact_css = css.replace(" ", "") +for marker in ['progress::-webkit-progress-bar', 'progress::-webkit-progress-value', 'progress::-moz-progress-bar', '-webkit-appearance:none']: + assert marker in compact_css, marker transform_panel_js = (root / 'src/admin/web/transform-panel.js').read_text() for marker in ['/api/transform', 'tp-cache-hits', 'transform-reason-list']: assert marker in transform_panel_js, marker @@ -752,21 +754,10 @@ assert 'minimal_welcome' in proxy_source and 'cache-control' in proxy_source make_zip = (root / "make_zip.py").read_text() for marker in ["SOURCE_DATE_EPOCH", "ZipInfo", "deterministic_mode", "compresslevel=9"]: assert marker in make_zip, marker -assert "'debian'" in make_zip and "'grafana'" in make_zip and "'docker-agent'" in make_zip +assert "'debian'" not in make_zip and "'grafana'" in make_zip and "'docker-agent'" in make_zip assert "'UPDATE_CHECK.toml'" in make_zip -# Debian package contracts. -debian_service = (root / 'debian/rustproxy.service').read_text() -for marker in ['User=rustproxy', 'AmbientCapabilities=CAP_NET_BIND_SERVICE', 'StateDirectory=rustproxy', 'LogsDirectory=rustproxy', 'ProtectSystem=strict', 'RUST_PROXY_ADMIN_LISTEN']: - if marker.startswith('RUST_PROXY_'): - assert marker in (root / 'debian/rustproxy.environment').read_text(), marker - else: - assert marker in debian_service, marker -logrotate = (root / 'debian/rustproxy.logrotate').read_text() -for marker in ['daily', 'rotate 3', 'maxage 3', 'compresscmd /usr/bin/gzip', 'compressoptions -9', 'copytruncate', 'su rustproxy rustproxy']: - assert marker in logrotate, marker -repo_script = (root / 'debian/build-repository.sh').read_text() -for marker in ['dpkg-scanpackages', 'apt-ftparchive', 'Packages.gz', 'RUSTPROXY_REPO_GPG_KEY', 'rustproxy.linuxiarz.pl']: - assert marker in repo_script, marker +# Debian packaging is maintained outside this source tree. +assert not (root / 'debian').exists() grafana = json.loads((root / 'grafana/rustproxy-overview.json').read_text()) assert grafana['uid'] == 'rustproxy-0170' and grafana['schemaVersion'] >= 39 expressions = '\n'.join(target.get('expr','') for panel in grafana['panels'] for target in panel.get('targets',[])) @@ -776,7 +767,7 @@ assert any(variable.get('name') == 'traffic_vhost' for variable in grafana['temp assert any(panel.get('title') == 'Traffic analytics and Web Server' for panel in grafana['panels']) assert any(panel.get('title') == 'Traffic capture state' for panel in grafana['panels']) assert any(panel.get('title') == 'Top configured routes' for panel in grafana['panels']) -# 0.19.0 compression/protocol/dashboard UX regressions. +# 0.27.0 compression/protocol/dashboard UX regressions. compression_source = rust_source(root, "src/compression.rs") metrics_source = rust_source(root, "src/metrics.rs") admin_source = rust_source(root, "src/admin/mod.rs") @@ -784,21 +775,61 @@ style_source = (root / "src/admin/web/style.css").read_text() docker_ui = (root / "src/admin/web/docker.js").read_text() for marker in ["pub enum AppliedEncoding", "AppliedEncoding::Gzip", "AppliedEncoding::Brotli", "AppliedEncoding::Zstd", "AppliedEncoding::Deflate"]: assert marker in compression_source, marker -assert "quality_weights_can_select_each_enabled_codec" in compression_source for marker in [ - "pub struct AllowCookie", - 'response.extensions().get::().is_none()', - "cache_safe_cookie_marker_allows_compression_without_weakening_default_guard", + "gzip: true", "br: true", "zstd: true", "deflate: false", + "const PREFERENCE: [Self; 4] = [Self::Zstd, Self::Brotli, Self::Gzip, Self::Deflate]", + "fn preferred_encoding", "pub struct Overrides", "pub fn scoped", "pub fn resolve", + "defaults_enable_modern_compression_without_deflate", + "equal_quality_uses_zstd_then_br_then_gzip_then_deflate", + "quality_weights_win_before_server_priority", + "cookies_authorization_and_private_cache_policy_do_not_disable_compression", + "existing_content_encoding_is_never_recompressed", + "no_transform_range_and_sse_are_not_compressed", "age_header_survives_downstream_compression", ]: assert marker in compression_source, marker +for forbidden in ["pub struct AllowCookie", "private_or_no_transform"]: + assert forbidden not in compression_source, forbidden compression_finalize_source = rust_source(root, "src/proxy/upstream_helpers.rs") for marker in [ - 'exchange.cache_status.load(Ordering::Relaxed) == 1', - 'response.extensions().get::().is_some()', - '.insert(crate::compression::AllowCookie)', + "let global_compression = &snapshot.envelope.config.compression", + "frontend.compression.resolve(global_compression, &compression)", + "service.compression.resolve(global_compression, &compression)", ]: assert marker in compression_finalize_source, marker +assert "AllowCookie" not in compression_finalize_source +openapi_0270 = json.loads((root / "src/admin/openapi.json").read_text()) +compression_override_properties = openapi_0270["components"]["schemas"]["CompressionOverrides"]["properties"] +for prop in ["enabled", "zstd", "br", "gzip", "deflate"]: + assert prop in compression_override_properties, prop +docker_assignment_properties = openapi_0270["components"]["schemas"]["DockerAssignment"]["properties"] +for prop in ["compression_enabled", "compression_zstd", "compression_br", "compression_gzip", "compression_deflate"]: + assert prop in docker_assignment_properties, prop +web_service_ui_0270 = (root / "src/admin/web/web-server.js").read_text() +for marker in [ + 'vh-compression-options', + 'compressionOptions.hidden = disabled', + 'input.disabled = disabled', +]: + assert marker in vhosts_js, marker +for marker in [ + 'const compressionFields = [[labeled("compressionZstd"', + 'field.hidden = disabled; control.disabled = disabled', +]: + assert marker in docker_ui, marker +assert 'id="web-service-compression-options"' in html +for marker in [ + 'function syncCompression()', + '$("web-service-compression-options").hidden = disabled', + '$( `web-service-compression-${name}` ).disabled = disabled', + '$("web-service-compression").addEventListener("change", syncCompression)', +]: + assert marker in web_service_ui_0270, marker +settings_source_0270 = rust_source(root, "src/settings.rs") +config_model_0270 = rust_source(root, "src/config/model.rs") +for marker in ['mode: ServerMode::Custom', 'value: "RustProxy".into()', 'legacy_compat_default']: + assert marker in settings_source_0270, marker +assert 'default = "legacy_server_header_default"' in config_model_0270 headers_source_0267 = rust_source(root, "src/headers.rs") vhost_core_0267 = (root / "src/admin/web/vhosts/core.js").read_text() for marker in [ @@ -833,10 +864,15 @@ assert "dockerOpenApp" in docker_ui and "proxiedUrl(agent, hostname)" in docker_ # 0.19.0 Docker-vhost controls: chip aliases, default agent ACL, redirect/WebSockets/cache. docker_source = rust_source(root, "src/docker.rs") management_ui = (root / "src/admin/web/management.js").read_text() -for marker in ["function aliasEditor(", "host-chip-editor docker-alias-editor", ".docker-force-ssl", ".docker-websockets", ".docker-cache-enabled", ".docker-agent-acl-profile"]: +for marker in ["function aliasEditor(", "host-chip-editor docker-alias-editor", ".docker-force-ssl", ".docker-websockets", ".docker-cache-enabled", ".docker-compression-enabled", ".docker-compression-zstd", ".docker-compression-br", ".docker-compression-gzip", ".docker-compression-deflate", ".docker-agent-acl-profile"]: assert marker in docker_ui, marker -for marker in ['"force_ssl": assignment.force_ssl.unwrap_or(false)', '"websockets": assignment.websockets', '"cache": {"enabled": assignment.cache_enabled}', 'assignment.acl_profile_id.clone().or_else(|| agent.acl_profile_id.clone())']: +for marker in ['"force_ssl": assignment.force_ssl.unwrap_or(false)', '"websockets": assignment.websockets', '"enabled": assignment.compression_enabled', '"zstd": assignment.compression_zstd', '"br": assignment.compression_br', '"gzip": assignment.compression_gzip', '"deflate": assignment.compression_deflate', '"cache": {"enabled": assignment.cache_enabled}', 'assignment.acl_profile_id.clone().or_else(|| agent.acl_profile_id.clone())', 'host.transient_unavailable = target.is_none()', 'inventory: previous_inventory']: assert marker in docker_source, marker +for marker in ["published_assignment_stays_routable_as_503_when_service_is_missing", "failed_agent_observation_with_last_inventory_keeps_backend_materialized", "disabling_agent_stops_discovery_but_keeps_published_hostname_as_503"]: + assert marker in docker_source, marker +route_cache_0270 = rust_source(root, "src/proxy/forward/route_cache.rs") +for marker in ['if route.unavailable', 'StatusCode::SERVICE_UNAVAILABLE', 'published Docker service is currently unavailable', 'retry-after']: + assert marker in route_cache_0270, marker assert "agent.acl_profile_id === profile.id" in management_ui assert 'payload["backend_pool_domains"]' in admin_source and "status.backend_pool_domains" in vhosts_js assert 'body[data-density="compact"]' in style_source and '--ui-control: 22px' in style_source @@ -1285,7 +1321,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log" assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241 assert 'location.pathname === "/logging"' in settings_js_0241 -assert '"RuntimeInformation"' in openapi and '"version": "0.26.7"' in openapi +assert '"RuntimeInformation"' in openapi and '"version": "0.27.0"' in openapi # 0.24.1 compiler and hostname-cardinality regressions. tls_0241 = rust_source(root, "src/tls.rs") @@ -1330,5 +1366,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]: node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"] assert "maxItems" not in node, schema_name -print("PASS: 0.26.7 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.") +print("PASS: 0.27.0 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.") print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.") diff --git a/scripts/deploy_core.py b/scripts/deploy_core.py index 98e62fb..afc6f8c 100755 --- a/scripts/deploy_core.py +++ b/scripts/deploy_core.py @@ -97,7 +97,7 @@ def digest(path: Path) -> str: def fetch_https(url: str, max_bytes: int) -> bytes: if urllib.parse.urlparse(url).scheme != 'https': raise ValueError('GeoIP downloads require HTTPS.') - request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.26.7'}) + request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.27.0'}) with urllib.request.urlopen(request, timeout=30) as response: if urllib.parse.urlparse(response.geturl()).scheme != 'https': raise ValueError('GeoIP download redirected away from HTTPS.') diff --git a/scripts/docs_check.py b/scripts/docs_check.py index db6e3cf..bd39f2f 100755 --- a/scripts/docs_check.py +++ b/scripts/docs_check.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""Rust-independent documentation/Reader consistency checks for the 0.26.7 release.""" +"""Rust-independent documentation/Reader consistency checks for the 0.27.0 release.""" from pathlib import Path import re from rust_source import rust_source @@ -14,6 +14,7 @@ required = [ DOCS / "README.md", DOCS / "WEB_SERVER.md", DOCS / "TODO.md", + DOCS / "V0.27.0_IMPLEMENTATION.md", DOCS / "V0.26.7_IMPLEMENTATION.md", DOCS / "V0.25.5_AUDIT.md", DOCS / "V0.25.4_AUDIT.md", @@ -56,16 +57,16 @@ assert '"/docs/content.json"' in admin readme = (ROOT / "README.md").read_text(encoding="utf-8") roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8") changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8") -assert readme.startswith("# RustProxy 0.26.7") +assert readme.startswith("# RustProxy 0.27.0") assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive" assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme -assert roadmap.startswith("# RustProxy roadmap") and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap +assert roadmap.startswith("# RustProxy roadmap") and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap assert "## 0.24." not in roadmap and "## Web Server follow-up" in roadmap and "docs/ROADMAP_HISTORY.md" in roadmap assert changelog.startswith("# Changelog\n") -for release in ["0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]: +for release in ["0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]: assert f"## {release}" in changelog, release -assert changelog.index("## 0.26.7") < changelog.index("## 0.26.6") < changelog.index("## 0.26.5") < changelog.index("## 0.26.4") < changelog.index("## 0.26.1") < changelog.index("## 0.26.0") < changelog.index("## 0.25.6") < changelog.index("## 0.25.5") +assert changelog.index("## 0.27.0") < changelog.index("## 0.26.7") < changelog.index("## 0.26.6") < changelog.index("## 0.26.5") < changelog.index("## 0.26.4") < changelog.index("## 0.26.1") < changelog.index("## 0.26.0") < changelog.index("## 0.25.6") < changelog.index("## 0.25.5") assert "CHANGELOG_TECHNICAL_ARCHIVE.md" in changelog for developer_only in ["Clean the remaining compiler warnings", "Update package/source/UI/OpenAPI/release identity", "source regressions and update release identity"]: assert developer_only not in changelog, f"developer-only CHANGELOG detail: {developer_only}" diff --git a/scripts/preflight.py b/scripts/preflight.py index f9bca2e..9e81149 100755 --- a/scripts/preflight.py +++ b/scripts/preflight.py @@ -73,12 +73,12 @@ def check(root: Path, repair_known: bool = False) -> list[str]: flat = module.parent.with_suffix(".rs") if flat.is_file(): raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}") - for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "scripts/docs_check.py", "scripts/web_server_contracts.py", "scripts/rust_source.py", "scripts/rust_module_contracts.py", "scripts/source_module_contracts.py", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/deploy_core.py", "scripts/deploy_runtime.py", "scripts/migrate_npm.py", "scripts/migrate_npm_core.py", "scripts/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "grafana/rustproxy-overview.json"]: + for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "scripts/docs_check.py", "scripts/web_server_contracts.py", "scripts/rust_source.py", "scripts/rust_module_contracts.py", "scripts/source_module_contracts.py", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/deploy_core.py", "scripts/deploy_runtime.py", "scripts/migrate_npm.py", "scripts/migrate_npm_core.py", "scripts/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]: if not (root / path).is_file(): - raise ValueError(f"Incomplete RustProxy 0.26.7 source tree: missing {path}") + raise ValueError(f"Incomplete RustProxy 0.27.0 source tree: missing {path}") text = (root / "src/lib.rs").read_text(encoding="utf-8") if '#[path = "auth/mod.rs"]' not in text: - raise ValueError("src/lib.rs is not the 0.26.7 entry point; extract the complete package, not individual files.") + raise ValueError("src/lib.rs is not the 0.27.0 entry point; extract the complete package, not individual files.") return messages diff --git a/scripts/release_smoke.py b/scripts/release_smoke.py index 77bb2e9..44f5d34 100755 --- a/scripts/release_smoke.py +++ b/scripts/release_smoke.py @@ -123,7 +123,7 @@ def upgrade_smoke(tmp: Path) -> None: assert backup.is_dir() assert (backup / "src/obsolete.rs").is_file() assert not (target / "src/obsolete.rs").exists() - assert 'version = "0.26.7"' in (target / "Cargo.toml").read_text(encoding="utf-8") + assert 'version = "0.27.0"' in (target / "Cargo.toml").read_text(encoding="utf-8") assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n" assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n" assert (target / "langs/site.json").is_file() @@ -134,7 +134,7 @@ def upgrade_smoke(tmp: Path) -> None: assert (target / "docker-agent/certificate.go").is_file() assert (target / "docker-agent/server.go").is_file() manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8")) - assert manifest["to_version"] == "0.26.7" + assert manifest["to_version"] == "0.27.0" assert manifest["removed_obsolete_runtime_state"] is True assert not legacy.exists() assert not (backup / "legacy-data").exists() @@ -571,7 +571,7 @@ def source_contract_smoke() -> None: assert marker in admin, marker anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0] assert '"/api/status"' not in anonymous_block - assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.26.7"' in openapi_0241 + assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.27.0"' in openapi_0241 assert 'id="panel-logging"' not in html for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']: assert marker in html, marker @@ -985,7 +985,16 @@ def source_contract_smoke() -> None: vhosts_ui = read_vhosts_js(ROOT) for marker in ['pub enum AppliedEncoding', 'AppliedEncoding::Gzip', 'AppliedEncoding::Brotli', 'AppliedEncoding::Zstd', 'AppliedEncoding::Deflate']: assert marker in compression_source, marker - assert 'quality_weights_can_select_each_enabled_codec' in compression_source + for marker in [ + 'gzip: true', 'br: true', 'zstd: true', 'deflate: false', + 'const PREFERENCE: [Self; 4] = [Self::Zstd, Self::Brotli, Self::Gzip, Self::Deflate]', + 'quality_weights_win_before_server_priority', + 'equal_quality_uses_zstd_then_br_then_gzip_then_deflate', + 'cookies_authorization_and_private_cache_policy_do_not_disable_compression', + 'existing_content_encoding_is_never_recompressed', + ]: + assert marker in compression_source, marker + assert 'AllowCookie' not in compression_source diagnostics_source = rust_source(ROOT, 'src/diagnostics.rs') + rust_source(ROOT, 'src/system_stats/mod.rs') + rust_source(ROOT, 'src/system_stats/linux.rs') for marker in ['pub struct NetworkInterfaceView', 'pub network_interfaces: Vec', 'sysinfo::Networks::new_with_refreshed_list', 'system.network_stats', 'collect_network_systemstat', 'normalize_network_interfaces', 'merge_network_interfaces']: assert marker in diagnostics_source, marker @@ -1003,13 +1012,19 @@ def source_contract_smoke() -> None: assert 'compressionCountersHelp' not in ui_html assert 'sparkline-h1' in (ROOT / 'src/admin/web/index.html').read_text(encoding='utf-8') assert 'body[data-density="compact"]' in style_source and '--ui-control: 22px' in style_source + compact_style_0270 = style_source.replace(' ', '') + for marker in ['progress::-webkit-progress-bar', 'progress::-webkit-progress-value', 'progress::-moz-progress-bar', '-webkit-appearance:none']: + assert marker in compact_style_0270, marker assert 'status.backend_pool_domains' in vhosts_ui and 'payload["backend_pool_domains"]' in admin docker_source = rust_source(ROOT, 'src/docker.rs') management_ui = (ROOT / 'src/admin/web/management.js').read_text(encoding='utf-8') - for marker in ['function aliasEditor(', 'host-chip-editor docker-alias-editor', '.docker-force-ssl', '.docker-websockets', '.docker-cache-enabled', '.docker-passive-enabled', '.docker-passive-5xx', '.docker-agent-acl-profile']: + for marker in ['function aliasEditor(', 'host-chip-editor docker-alias-editor', '.docker-force-ssl', '.docker-websockets', '.docker-cache-enabled', '.docker-compression-enabled', '.docker-compression-zstd', '.docker-compression-br', '.docker-compression-gzip', '.docker-compression-deflate', '.docker-passive-enabled', '.docker-passive-5xx', '.docker-agent-acl-profile']: assert marker in docker_ui, marker - for marker in ['"force_ssl": assignment.force_ssl.unwrap_or(false)', '"websockets": assignment.websockets', '"cache": {"enabled": assignment.cache_enabled}', '"passive_health": assignment.passive_health.clone()', 'assignment.acl_profile_id.clone().or_else(|| agent.acl_profile_id.clone())']: + for marker in ['"force_ssl": assignment.force_ssl.unwrap_or(false)', '"websockets": assignment.websockets', '"enabled": assignment.compression_enabled', '"zstd": assignment.compression_zstd', '"br": assignment.compression_br', '"gzip": assignment.compression_gzip', '"deflate": assignment.compression_deflate', '"cache": {"enabled": assignment.cache_enabled}', '"passive_health": assignment.passive_health.clone()', 'assignment.acl_profile_id.clone().or_else(|| agent.acl_profile_id.clone())', 'host.transient_unavailable = target.is_none()', 'inventory: previous_inventory']: assert marker in docker_source, marker + route_cache_0270 = rust_source(ROOT, 'src/proxy/forward/route_cache.rs') + for marker in ['if route.unavailable', 'StatusCode::SERVICE_UNAVAILABLE', 'published Docker service is currently unavailable', 'retry-after']: + assert marker in route_cache_0270, marker assert 'agent.acl_profile_id === profile.id' in management_ui vhost_source = rust_source(ROOT, 'src/vhost.rs') for marker in ['DEFAULT_PROXY_CONNECT_TIMEOUT_SECONDS: u64 = 10', 'DEFAULT_PROXY_RESPONSE_HEADER_TIMEOUT_SECONDS: u64 = 120', 'DEFAULT_PROXY_READ_TIMEOUT_SECONDS: u64 = 60', 'DEFAULT_PROXY_SEND_TIMEOUT_SECONDS: u64 = 60', 'proxy_timeouts_have_explicit_safe_defaults_but_keep_null_compatibility']: @@ -1028,7 +1043,7 @@ def source_contract_smoke() -> None: assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8") assert '"/api/config/history/restore"' in openapi - for marker in ['"version": "0.26.7"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']: + for marker in ['"version": "0.27.0"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']: assert marker in openapi, marker assert '"software_update"' in openapi and '"update_available"' in openapi for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']: @@ -1116,24 +1131,9 @@ def container_contract_smoke() -> None: assert marker in ignore, marker assert (ROOT / "docs/CONTAINER.md").is_file() -def debian_grafana_contract_smoke() -> None: - control = (ROOT / "debian/control").read_text(encoding="utf-8") - rules = (ROOT / "debian/rules").read_text(encoding="utf-8") - service = (ROOT / "debian/rustproxy.service").read_text(encoding="utf-8") - environment = (ROOT / "debian/rustproxy.environment").read_text(encoding="utf-8") - logrotate = (ROOT / "debian/rustproxy.logrotate").read_text(encoding="utf-8") - postinst = (ROOT / "debian/rustproxy.postinst").read_text(encoding="utf-8") - repo = (ROOT / "debian/build-repository.sh").read_text(encoding="utf-8") +def grafana_contract_smoke() -> None: + assert not (ROOT / "debian").exists(), "Debian packaging belongs to the external packaging repository" dashboard = json.loads((ROOT / "grafana/rustproxy-overview.json").read_text(encoding="utf-8")) - assert "debhelper-compat (= 13)" in control and "cargo" in control and "rustc" in control - assert "cargo build --release --locked" in rules and "cargo test --locked" in rules - for marker in ["User=rustproxy", "Group=rustproxy", "Environment=MALLOC_ARENA_MAX=2", "AmbientCapabilities=CAP_NET_BIND_SERVICE", "StateDirectory=rustproxy", "LogsDirectory=rustproxy", "ProtectSystem=strict", "ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy"]: - assert marker in service, marker - assert "RUST_PROXY_ADMIN_LISTEN=127.0.0.1:9090" in environment - for marker in ["daily", "rotate 3", "maxage 3", "compresscmd /usr/bin/gzip", "compressoptions -9", "copytruncate", "su rustproxy rustproxy"]: - assert marker in logrotate, marker - assert "/var/log/rustproxy" in postinst and "-o rustproxy -g rustproxy" in postinst - assert "rustproxy.linuxiarz.pl" in repo and "dpkg-scanpackages" in repo and "gzip -9 -n" in repo assert dashboard.get("uid") == "rustproxy-0170" queries = json.dumps(dashboard) for marker in ["rust_proxy_process_rss_bytes", "rust_proxy_cache_transient_bytes", "rust_proxy_backend_ewma_latency_seconds", "rust_proxy_certificate_renewal_not_after_timestamp_seconds", "rust_proxy_not_found_hosts_configured", "rust_proxy_http1_requests_total", "rust_proxy_backend_upstream_client_generation_requests", "rust_proxy_backend_upstream_client_generation_age_seconds", "rust_proxy_backend_retry_attempts_total", "rust_proxy_backend_upstream_client_rotations_total", "rust_proxy_docker_backend_upstream_client_generation_requests", "rust_proxy_docker_backend_retry_attempts_total"]: @@ -1181,9 +1181,7 @@ def reproducible_archive_smoke(tmp: Path) -> None: assert "RustProxy/nagios/check_rustproxy_api" in names assert "RustProxy/src/admin/web/host404.js" in names assert "RustProxy/docs/NOT_FOUND_HOSTS.md" in names - assert "RustProxy/debian/control" in names - assert "RustProxy/debian/rustproxy.service" in names - assert "RustProxy/debian/rustproxy.logrotate" in names + assert not any(name.startswith("RustProxy/debian/") for name in names) assert "RustProxy/grafana/rustproxy-overview.json" in names assert "RustProxy/UPDATE_CHECK.toml" in names assert "RustProxy/src/update_check.rs" in names @@ -1208,8 +1206,8 @@ def main() -> None: ui_contract_smoke() source_contract_smoke() container_contract_smoke() - debian_grafana_contract_smoke() - print("PASS: 0.26.7 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.") + grafana_contract_smoke() + print("PASS: 0.27.0 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.") if __name__ == "__main__": diff --git a/scripts/swagger_assets.py b/scripts/swagger_assets.py index ac5d964..e8703d7 100755 --- a/scripts/swagger_assets.py +++ b/scripts/swagger_assets.py @@ -85,7 +85,7 @@ def download(destination: Path) -> None: """TLS verification uses Python's default trust store; never executes a shell.""" started = time.monotonic() opener = build_opener(HttpsRedirects()) - request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.26.7"}) + request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.27.0"}) with opener.open(request, timeout=30) as response, destination.open("wb") as output: length = response.headers.get("Content-Length") if length and int(length) > MAX_ARCHIVE: diff --git a/scripts/upgrade.py b/scripts/upgrade.py index a8d9b94..b74eecb 100755 --- a/scripts/upgrade.py +++ b/scripts/upgrade.py @@ -46,7 +46,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None for name in MANAGED: if (target / name).is_symlink(): raise ValueError(f"Managed target {name} is a symlink; refusing to replace it.") - backup = target / ".upgrade-backup" / ("before-0.26.7-" + uuid.uuid4().hex[:12]) + backup = target / ".upgrade-backup" / ("before-0.27.0-" + uuid.uuid4().hex[:12]) backup.mkdir(parents=True, mode=0o700) installed: list[str] = [] moved: list[str] = [] @@ -84,7 +84,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None remove_legacy = legacy.exists() if remove_legacy and (legacy.is_symlink() or not legacy.is_file()): raise ValueError("Obsolete renewal observation sidecar must be a regular file.") - (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.26.7", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8") + (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.27.0", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8") if remove_legacy: legacy.unlink() except BaseException: @@ -115,7 +115,7 @@ def main() -> None: backup = upgrade(Path(__file__).resolve().parents[1], args.target, stopped=args.stopped, data_dir=data_dir) except (OSError, ValueError) as error: parser.exit(2, f"Upgrade refused or rolled back: {error}\n") - print(f"Installed RustProxy 0.26.7. Previous managed source files: {backup}") + print(f"Installed RustProxy 0.27.0. Previous managed source files: {backup}") print("Preserved data, .env, .git, target and other unmanaged files. No database migration was run.") print(f"Next: cd {args.target}; ./dev.sh test; ./dev.sh") diff --git a/scripts/web_server_contracts.py b/scripts/web_server_contracts.py index 731399d..fd9a2ca 100755 --- a/scripts/web_server_contracts.py +++ b/scripts/web_server_contracts.py @@ -96,7 +96,7 @@ need(web, 'HeaderValue::from_static("no-store")', "builtin_error_response(StatusCode::FORBIDDEN, &method)", "empty_index_can_go_directly_to_directory_listing", - "RustProxy 0.26.7", + "RustProxy 0.27.0", "traversal_and_symlink_escape_are_not_served", "try_files_rewrites_cache_rules_headers_and_downloads_work", "precompressed_sidecars_keep_mime_validators_and_range_semantics", @@ -117,9 +117,12 @@ need(proxy, "finish_headers(", "crate::compression::encode(") assert "crate::web_server::serve(service, &request" not in proxy -assert proxy.index("basic_identity =") < proxy.index("CompiledSource::WebServer(service)") -assert proxy.index("let identity =") < proxy.index("CompiledSource::WebServer(service)") -assert proxy.index("CompiledSource::WebServer(service)") < proxy.index("let (backend, backend_lease, affinity_cookie)") +basic_identity_pos = proxy.index("basic_identity =") +identity_pos = proxy.index("let identity =") +web_source_pos = proxy.index("CompiledSource::WebServer(service)", basic_identity_pos) +assert basic_identity_pos < web_source_pos +assert identity_pos < web_source_pos +assert web_source_pos < proxy.index("let (backend, backend_lease, affinity_cookie)") custom_error_pos = proxy.index("let custom_error =") assert proxy.find("apply_response_rules(", custom_error_pos) > custom_error_pos need(acl, "ambiguous encoded path character", '"/%2e%2e/secret"', '"/a%2fb"', '"/a%5cb"', '"/bad%"') @@ -129,7 +132,7 @@ need(html, 'data-panel="web-server"', 'id="panel-web-server"', 'id="web-service- 'data-web-service-page="mime"', 'data-web-service-page="cache"', 'data-web-service-page="delivery"', 'data-web-service-page="php"', 'data-web-service-page="security"', 'data-web-service-page="htaccess"', 'id="web-service-htaccess-enabled"', 'id="web-service-htaccess-help"', 'id="htaccess-help-dialog"', 'id="web-service-try-files"', - 'id="web-service-cache-rules"', 'id="web-service-precompressed"', 'id="web-service-php-enabled"', + 'id="web-service-cache-rules"', 'id="web-service-precompressed"', 'id="web-service-compression"', 'id="web-service-compression-zstd"', 'id="web-service-compression-br"', 'id="web-service-compression-gzip"', 'id="web-service-compression-deflate"', 'id="web-service-php-enabled"', 'id="web-service-php-pass-authorization"', 'id="web-service-php-body-limit"', 'id="web-service-php-header-limit"', 'id="web-service-php-stderr-limit"', 'id="web-service-php-custom-params"', 'id="web-service-php-values"', 'id="php-help-dialog"', @@ -138,7 +141,7 @@ need(html, 'data-panel="web-server"', 'id="panel-web-server"', 'id="web-service- 'data-logging-settings-tab="format"', 'data-logging-settings-tab="errors"') need(settings_ui, "selectLoggingTab", 'data-logging-settings-page', 'selectLoggingTab("outputs")') need(web_ui, 'saveSection("web-services"', "directory_listing", "web_service_id", "mime_types", "default_mime_type", - "cache_control", "cache_rules", "response_headers", "try_files", "rewrites", "precompressed", + "cache_control", "cache_rules", "response_headers", "try_files", "rewrites", "precompressed", "compression", "download_extensions", "symlink_policy", "php", "htaccess", "hardening", "presetConfig", "phpFrontController", "staticCacheRules", "pass_authorization", "max_request_body_bytes", "max_response_header_bytes", "stderr_log_bytes", "custom_params", "php_values", "syncHtaccess", "htaccess-help-dialog", "php-help-dialog", "parseFastCgiParams", "parsePhpValues", "validatePhpCustomData", "activateTab", "initTabs", "presetChanged", @@ -157,7 +160,11 @@ assert web_service_schema["properties"]["index"]["maxItems"] == 16 assert web_service_schema["properties"]["mime_types"]["maxProperties"] == 64 assert web_service_schema["properties"]["default_mime_type"]["default"] == "application/octet-stream" assert web_service_schema["properties"]["cache_control"]["nullable"] is True -for prop in ["cache_rules", "response_headers", "try_files", "rewrites", "precompressed", "download_extensions", "symlink_policy", "php", "htaccess", "hardening"]: +assert web_service_schema["properties"]["compression"]["$ref"].endswith("/CompressionOverrides") +compression_override_schema = openapi["components"]["schemas"]["CompressionOverrides"] +for prop in ["enabled", "zstd", "br", "gzip", "deflate"]: + assert prop in compression_override_schema["properties"], prop +for prop in ["cache_rules", "response_headers", "try_files", "rewrites", "precompressed", "compression", "download_extensions", "symlink_policy", "php", "htaccess", "hardening"]: assert prop in web_service_schema["properties"], prop assert web_service_schema["properties"]["symlink_policy"]["default"] == "deny" assert web_service_schema["properties"]["php"]["properties"]["enabled"]["default"] is False diff --git a/scripts/web_service_ui_test.mjs b/scripts/web_service_ui_test.mjs index f79429f..b28571a 100644 --- a/scripts/web_service_ui_test.mjs +++ b/scripts/web_service_ui_test.mjs @@ -45,7 +45,7 @@ const ids = [ "web-service-php-connect-timeout","web-service-php-enabled","web-service-php-endpoint","web-service-php-extensions", "web-service-php-request-timeout","web-service-php-pass-authorization","web-service-php-body-limit","web-service-php-header-limit", "web-service-php-stderr-limit","web-service-php-custom-params","web-service-php-values","web-service-php-help", - "web-service-precompressed","web-service-precompressed-br","web-service-precompressed-gzip", + "web-service-compression","web-service-compression-options","web-service-compression-zstd","web-service-compression-br","web-service-compression-gzip","web-service-compression-deflate","web-service-precompressed","web-service-precompressed-br","web-service-precompressed-gzip", "web-service-preset","web-service-preset-apply","web-service-preset-summary","web-service-reset", "web-service-response-headers","web-service-rewrites","web-service-root","web-service-search", "web-service-symlink-policy","web-service-tabs","web-service-try-files" @@ -63,6 +63,8 @@ elements.get("web-service-php-pass-authorization").checked = true; elements.get("web-service-php-body-limit").value = "0"; elements.get("web-service-php-header-limit").value = "65536"; elements.get("web-service-php-stderr-limit").value = "4096"; +elements.get("web-service-compression").value = ""; +for (const name of ["zstd", "br", "gzip", "deflate"]) elements.get(`web-service-compression-${name}`).value = ""; const document = { body: new Element("body"), @@ -100,6 +102,23 @@ vm.createContext(context); vm.runInContext(fs.readFileSync("src/admin/web/drafts.js", "utf8"), context, { filename: "drafts.js" }); vm.runInContext(fs.readFileSync("src/admin/web/web-server.js", "utf8"), context, { filename: "web-server.js" }); +// Explicitly disabling scoped dynamic compression must hide and disable codec +// inheritance controls without erasing their saved selections. +const compressionMode = elements.get("web-service-compression"); +const compressionOptions = elements.get("web-service-compression-options"); +const compressionZstd = elements.get("web-service-compression-zstd"); +compressionZstd.value = "off"; +compressionMode.value = "off"; +compressionMode.dispatch("change"); +if (!compressionOptions.hidden) throw new Error("Disabled Web Service compression did not hide codec overrides"); +for (const name of ["zstd", "br", "gzip", "deflate"]) { + if (!elements.get(`web-service-compression-${name}`).disabled) throw new Error(`Disabled Web Service compression left ${name} override active`); +} +compressionMode.value = "on"; +compressionMode.dispatch("change"); +if (compressionOptions.hidden) throw new Error("Re-enabled Web Service compression did not restore codec overrides"); +if (compressionZstd.value !== "off") throw new Error("Compression visibility toggle erased the saved codec selection"); + const preset = elements.get("web-service-preset"); preset.value = "wordpress"; preset.dispatch("change"); @@ -133,6 +152,8 @@ elements.get("web-service-php-custom-params").value = "APP_ENV = production"; elements.get("web-service-php-values").value = "memory_limit = 256M"; preset.value = "wordpress"; preset.dispatch("change"); +elements.get("web-service-compression").value = "on"; +elements.get("web-service-compression-gzip").value = "off"; await elements.get("web-service-form").dispatch("submit"); if (savedSection?.name !== "web-services" || savedSection.value.length !== 1) throw new Error("WordPress preset save did not persist a Web Service"); const saved = savedSection.value[0]; @@ -140,6 +161,7 @@ if (saved.index.join("\n") !== expectedIndex) throw new Error("Saved WordPress p if (saved.try_files.join("\n") !== expectedTry) throw new Error("Saved WordPress preset lost try_files"); if (!saved.php.enabled) throw new Error("Saved WordPress preset lost PHP-FPM enablement"); if (!saved.precompressed.enabled) throw new Error("Saved WordPress preset lost precompressed enablement"); +if (saved.compression?.enabled !== true || saved.compression?.gzip !== false) throw new Error("Saved WordPress preset lost compression/codec override"); if (saved.php.pass_authorization !== false) throw new Error("Saved WordPress preset lost Authorization forwarding choice"); if (saved.php.max_request_body_bytes !== 1048576 || saved.php.max_response_header_bytes !== 131072 || saved.php.stderr_log_bytes !== 8192) throw new Error("Saved WordPress preset lost advanced FastCGI limits"); if (saved.php.custom_params.APP_ENV !== "production") throw new Error("Saved WordPress preset lost custom FastCGI parameters"); diff --git a/src/admin/documentation/documents.rs b/src/admin/documentation/documents.rs index 3fbcb32..c34e018 100644 --- a/src/admin/documentation/documents.rs +++ b/src/admin/documentation/documents.rs @@ -409,6 +409,7 @@ pub(super) static READER_DOCUMENTS: &[(&str, &str, &str)] = &[ "/docs/V0.25.1_AUDIT.md" )), ), + reader_doc!("docs/V0.27.0_IMPLEMENTATION.md", "technical"), reader_doc!("docs/V0.26.7_IMPLEMENTATION.md", "technical"), reader_doc!("docs/V0.26.6_IMPLEMENTATION.md", "technical"), reader_doc!("docs/V0.26.5_IMPLEMENTATION.md", "technical"), diff --git a/src/admin/openapi.json b/src/admin/openapi.json index 38196d8..d67f536 100644 --- a/src/admin/openapi.json +++ b/src/admin/openapi.json @@ -2,7 +2,7 @@ "openapi": "3.0.3", "info": { "title": "RustProxy Administration API", - "version": "0.26.7", + "version": "0.27.0", "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust." }, "servers": [ @@ -529,6 +529,9 @@ }, "source": { "$ref": "#/components/schemas/Source" + }, + "compression": { + "$ref": "#/components/schemas/CompressionOverrides" } }, "additionalProperties": true, @@ -575,9 +578,7 @@ "$ref": "#/components/schemas/CacheSettings" }, "compression": { - "type": "object", - "properties": {}, - "additionalProperties": true + "$ref": "#/components/schemas/CompressionSettings" }, "headers": { "$ref": "#/components/schemas/HeaderRules" @@ -2418,6 +2419,36 @@ "type": "boolean", "default": false, "description": "Enable the configured static-response transform engine for the generated Docker vhost. Global transform must also be enabled." + }, + "compression_enabled": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Per-published-vhost dynamic compression override. null inherits the enclosing/global policy; true/false enables or disables the scope." + }, + "compression_zstd": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional per-Docker-vhost Zstandard override. null inherits; globally disabled codecs remain unavailable." + }, + "compression_br": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional per-Docker-vhost Brotli override. null inherits; globally disabled codecs remain unavailable." + }, + "compression_gzip": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional per-Docker-vhost gzip override. null inherits; globally disabled codecs remain unavailable." + }, + "compression_deflate": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional per-Docker-vhost deflate override. null inherits; globally disabled codecs remain unavailable." } }, "required": [ @@ -4761,6 +4792,9 @@ } }, "description": "Optional Web Service hardening. This is a bounded deterministic compatibility/security layer, not a generic WAF." + }, + "compression": { + "$ref": "#/components/schemas/CompressionOverrides" } }, "required": [ @@ -5061,6 +5095,73 @@ } }, "additionalProperties": false + }, + "CompressionSettings": { + "type": "object", + "additionalProperties": false, + "properties": { + "gzip": { + "type": "boolean", + "default": true + }, + "br": { + "type": "boolean", + "default": true + }, + "zstd": { + "type": "boolean", + "default": true + }, + "deflate": { + "type": "boolean", + "default": false + }, + "min_bytes": { + "type": "integer", + "format": "uint64", + "minimum": 32, + "maximum": 1048576, + "default": 1024 + } + }, + "description": "Global downstream compression codecs and minimum size. Client q-values win; equal-quality codecs use zstd, then br, gzip and deflate. Existing Content-Encoding is never recompressed." + }, + "CompressionOverrides": { + "type": "object", + "additionalProperties": false, + "properties": { + "enabled": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "null inherits the enclosing policy; true/false explicitly enables or disables dynamic compression at this scope." + }, + "zstd": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional Zstandard override at this scope. null inherits; true is effective only when the codec is enabled globally; false disables it." + }, + "br": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional Brotli override at this scope. null inherits; true is effective only when the codec is enabled globally; false disables it." + }, + "gzip": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional gzip override at this scope. null inherits; true is effective only when the codec is enabled globally; false disables it." + }, + "deflate": { + "type": "boolean", + "nullable": true, + "default": null, + "description": "Optional deflate override at this scope. null inherits; true is effective only when the codec is enabled globally; false disables it." + } + }, + "description": "Scoped dynamic-compression policy. The enabled switch and individual codecs inherit by default; global Response codec switches are the hard availability ceiling and min_bytes remains global." } } }, @@ -5423,7 +5524,7 @@ } } }, - "description": "Sets an HttpOnly SameSite=Strict session cookie. Browser sessions use the configured 7\u201330 day absolute lifetime. Use the panel sign-in page. No bearer token or URL token is accepted.", + "description": "Sets an HttpOnly SameSite=Strict session cookie. Browser sessions use the configured 7–30 day absolute lifetime. Use the panel sign-in page. No bearer token or URL token is accepted.", "security": [], "parameters": [ { diff --git a/src/admin/web/app/settings.js b/src/admin/web/app/settings.js index 4949bd4..0799a12 100644 --- a/src/admin/web/app/settings.js +++ b/src/admin/web/app/settings.js @@ -6,7 +6,7 @@ function renderSettings() { if (!settingsDirty.has("response-form")) { const server = config.server_header || {}, compression = config.compression || {}, diagnostics = config.diagnostic_headers || {}; $("expose-request-id").checked = !!diagnostics.request_id; - $("server-mode").value = server.mode || "preserve"; $("server-value").value = server.value || "RustProxy/v0.26.7"; + $("server-mode").value = server.mode || "custom"; $("server-value").value = server.value || "RustProxy"; for (const name of ["gzip", "br", "zstd", "deflate"]) $(`compress-${name}`).checked = !!compression[name]; $("compress-min").value = compression.min_bytes ?? 1024; syncServerMode(); } diff --git a/src/admin/web/docker.js b/src/admin/web/docker.js index c5fb27c..056ea3d 100644 --- a/src/admin/web/docker.js +++ b/src/admin/web/docker.js @@ -251,7 +251,8 @@ const inline = row.querySelector(".docker-acl-inline")?.checked; return { service_key: row.dataset.key, hostname: row.querySelector(".docker-hostname").value.trim().toLowerCase(), aliases: row._readAliases?.() || [], target_ip: row.querySelector(".docker-target-ip").value || null, - enabled: true, scheme: row.querySelector(".docker-scheme").value, preserve_host: row.querySelector(".docker-preserve-host").checked, force_ssl: row.querySelector(".docker-force-ssl").checked, websockets: row.querySelector(".docker-websockets").checked, cache_enabled: row.querySelector(".docker-cache-enabled").checked, transform_enabled: row.querySelector(".docker-transform-enabled").checked, + enabled: true, scheme: row.querySelector(".docker-scheme").value, preserve_host: row.querySelector(".docker-preserve-host").checked, force_ssl: row.querySelector(".docker-force-ssl").checked, websockets: row.querySelector(".docker-websockets").checked, cache_enabled: row.querySelector(".docker-cache-enabled").checked, transform_enabled: row.querySelector(".docker-transform-enabled").checked, compression_enabled: (() => { const value = row.querySelector(".docker-compression-enabled").value; return value === "" ? null : value === "on"; })(), + compression_zstd: (() => { const value = row.querySelector(".docker-compression-zstd").value; return value === "" ? null : value === "on"; })(), compression_br: (() => { const value = row.querySelector(".docker-compression-br").value; return value === "" ? null : value === "on"; })(), compression_gzip: (() => { const value = row.querySelector(".docker-compression-gzip").value; return value === "" ? null : value === "on"; })(), compression_deflate: (() => { const value = row.querySelector(".docker-compression-deflate").value; return value === "" ? null : value === "on"; })(), acl_profile_id: row.querySelector(".docker-acl-profile")?.value || null, acl: inline ? { default: row.querySelector(".docker-acl-default").value, rules: parseRules(row.querySelector(".docker-acl-rules").value) } : null, proxy_timeouts: { connect_timeout_seconds: Number(row.querySelector(".docker-proxy-connect").value), response_header_timeout_seconds: Number(row.querySelector(".docker-proxy-header").value), read_timeout_seconds: Number(row.querySelector(".docker-proxy-read").value), send_timeout_seconds: Number(row.querySelector(".docker-proxy-send").value) }, health_check: collectHealth(row), passive_health: collectPassiveHealth(row) @@ -274,7 +275,7 @@ const runtime = runtimeFor(agent.id, key), visibility = el("button", "", "quiet docker-view-toggle"); visibility.type = "button"; const syncVisibility = () => { visibility.textContent = t(hiddenVhosts.has(row.dataset.viewKey) ? "dockerUnhideVhost" : "dockerHideVhost"); }; syncVisibility(); visibility.addEventListener("click", () => { const key = row.dataset.viewKey; if (hiddenVhosts.has(key)) hiddenVhosts.delete(key); else hiddenVhosts.add(key); saveHidden(); syncVisibility(); applyViewFilters(); }); const openApp = el("a", t("dockerOpenApp"), "outline docker-open-app"); openApp.target = "_blank"; openApp.rel = "noopener noreferrer"; - const syncOpenApp = hostname => { const url = proxiedUrl(agent, hostname); openApp.href = url || "#"; openApp.hidden = !publish.checked || !url || stale; openApp.title = url || ""; }; + const syncOpenApp = hostname => { const url = proxiedUrl(agent, hostname); openApp.href = url || "#"; openApp.hidden = !publish.checked || !url; openApp.title = url || ""; }; syncOpenApp(legacyHostname(assignment)); const headActions = el("div", undefined, "docker-service-head-actions"); headActions.append(runtimeSummary(runtime, assignment, stale), openApp, visibility); top.append(publishLabel, meta, headActions); row.append(top); @@ -288,8 +289,14 @@ const websockets = input("", "checkbox", "docker-websockets"); websockets.checked = assignment?.websockets !== false; const websocketField = checkboxField("dockerWebsockets", websockets); const cacheEnabled = input("", "checkbox", "docker-cache-enabled"); cacheEnabled.checked = assignment?.cache_enabled === true; const cacheField = checkboxField("dockerCache", cacheEnabled); const transformEnabled = input("", "checkbox", "docker-transform-enabled"); transformEnabled.checked = assignment?.transform_enabled === true; const transformField = checkboxField("dockerTransform", transformEnabled); + const compressionSelect = (className, current) => { const select = el("select", undefined, className); for (const [value, keyName] of [["", "inherit"], ["on", "enabled"], ["off", "notEnabled"]]) { const option = el("option", t(keyName)); option.value = value; select.append(option); } select.value = current === true ? "on" : current === false ? "off" : ""; return select; }; + const compressionEnabled = compressionSelect("docker-compression-enabled", assignment?.compression_enabled); + const compressionZstd = compressionSelect("docker-compression-zstd", assignment?.compression_zstd), compressionBr = compressionSelect("docker-compression-br", assignment?.compression_br), compressionGzip = compressionSelect("docker-compression-gzip", assignment?.compression_gzip), compressionDeflate = compressionSelect("docker-compression-deflate", assignment?.compression_deflate); + const compressionFields = [[labeled("compressionZstd", compressionZstd), compressionZstd], [labeled("compressionBr", compressionBr), compressionBr], [labeled("compressionGzip", compressionGzip), compressionGzip], [labeled("compressionDeflate", compressionDeflate), compressionDeflate]]; + const syncCompressionVisibility = () => { const disabled = compressionEnabled.value === "off"; for (const [field, control] of compressionFields) { field.hidden = disabled; control.disabled = disabled; } }; + compressionEnabled.addEventListener("change", syncCompressionVisibility); syncCompressionVisibility(); const switches = el("div", undefined, "docker-switch-row"); switches.append(preserveLabel, forceSslField, websocketField, cacheField, transformField); - route.append(labeled("dockerHostname", host, t("dockerHostnameHelp").replace("{domain}", agent.base_domain)), aliases.node, labeled("dockerBackendIp", target), labeled("dockerBackendScheme", scheme), switches); + route.append(labeled("dockerHostname", host, t("dockerHostnameHelp").replace("{domain}", agent.base_domain)), aliases.node, labeled("dockerBackendIp", target), labeled("dockerBackendScheme", scheme), labeled("dockerCompression", compressionEnabled, t("dockerCompressionHelp")), ...compressionFields.map(([field]) => field), switches); editor.append(route, aclEditor(assignment, agent), timeoutEditor(assignment), healthEditor(assignment), passiveHealthEditor(assignment)); const actions = el("div", undefined, "docker-service-actions"), apply = el("button", t("dockerApplyService"), "outline docker-apply"); apply.type = "button"; apply.disabled = !publish.checked; apply.addEventListener("click", async () => { apply.disabled = true; try { await saveAssignment(agent.id, row, true); } catch (error) { toast(error.message, true); } finally { if (row.isConnected) apply.disabled = !publish.checked; } }); actions.append(apply); editor.append(actions); row.append(editor); function updateHint() { const targetLabel = target.selectedOptions?.[0]?.textContent || t("dockerBackendIpAuto"), aliasCount = aliases.count(); editorHint.textContent = `${host.value.trim() || technical} → ${scheme.value.toUpperCase()} · ${targetLabel}${aliasCount ? ` · +${aliasCount} ${t("dockerAliasesShort")}` : ""}`; } updateHint(); @@ -312,7 +319,8 @@ const state = obs(agent.id), box = el("article", undefined, "card docker-agent-card"); box.dataset.agentId = agent.id; box.dataset.searchText = `${agent.id} ${agent.name || ""} ${agent.base_domain || ""}`.toLowerCase(); const head = el("div", undefined, "card-heading"), left = el("div"); left.append(el("span", agent.id, "small-label"), el("h2", agent.name)); const badges = el("div", undefined, "entity-actions"), connection = el("span", state?.ok ? t("dockerConnected") : state ? t("dockerError") : t("dockerWaiting"), `pill ${state?.ok ? "live" : ""}`), sec = securityInfo(agent, state); badges.append(el("span", t(sec.key), `pill ${sec.cls}`.trim()), connection); head.append(left, badges); box.append(head); if (!agent.enabled) { box.append(el("p", t("dockerAgentDisabled"), "fine")); target.append(box); continue; } - if (!state?.ok || !state.inventory) { const error = el("div", undefined, "docker-agent-error"); error.append(el("b", t("dockerAgentConnectionFailed")), el("p", state?.error || t("dockerNoObservation"), "fine"), el("small", sec.detail, "fine")); box.append(error); target.append(box); continue; } + if (!state?.ok) { const error = el("div", undefined, "docker-agent-error"); error.append(el("b", t("dockerAgentConnectionFailed")), el("p", state?.error || t("dockerNoObservation"), "fine"), el("small", sec.detail, "fine")); box.append(error); } + if (!state?.inventory) { const rows = el("div", undefined, "docker-service-list"); for (const item of agent.assignments || []) rows.append(assignmentRow(agent, null, null, item, true)); if (!rows.children.length) rows.append(el("p", t("dockerNoPublishedPorts"), "empty")); box.append(rows); target.append(box); continue; } const inv = state.inventory, defaultIp = agent.default_target_ip || agent.target_ip_override || t("dockerTargetAuto"), serviceCount = (inv.services || []).length, overview = el("div", undefined, "docker-agent-overview"); box.dataset.searchText += ` ${inv.hostname || ""}`.toLowerCase(); overview.append(el("span", `${t("dockerHost")}: ${inv.hostname}`), el("span", `${t("dockerServices")}: ${serviceCount}`), el("span", `${t("dockerLastChecked")}: ${checkedAgo(state.checked_at_unix_ms)}`), el("span", `*.${agent.base_domain}`)); box.append(overview); const agentDetails = el("details", undefined, "docker-agent-details"), detailsSummary = el("summary", t("dockerAgentDetails")), summary = el("div", undefined, "docker-agent-summary"); diff --git a/src/admin/web/index.html b/src/admin/web/index.html index d2eb1cc..29766a6 100644 --- a/src/admin/web/index.html +++ b/src/admin/web/index.html @@ -1921,10 +1921,10 @@ id="server-mode"> - +

Diagnostic headers

@@ -1941,9 +1941,7 @@ -

Negotiates Accept-Encoding. Skips private - responses, cookies, ranges, SSE and no-transform; existing compressed bodies are - passed through.

+

Negotiates Accept-Encoding using client q-values and zstd → br → gzip → deflate as the server preference for equal quality. Cookies, Authorization, Set-Cookie, private and no-store responses may be compressed. Existing Content-Encoding, ranges, SSE, upgrades and no-transform are passed through.

@@ -2723,7 +2721,7 @@
-