v0.27.0

README.md

@@ -1,9 +1,9 @@
-# RustProxy 0.26.7
+# RustProxy 0.27.0
 
 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.26.7 release source.**
+**0.27.0 release source.**
 
 ## Layer-4 streams
 
@@ -11,7 +11,18 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
-## What changed in 0.26.7
+## What changed in 0.27.0
+
+- Enable downstream compression by default with `zstd`, Brotli and gzip codecs; deflate remains opt-in. Honor client `q` values first and use deterministic `zstd -> br -> gzip -> deflate` server preference when quality is equal. Existing `Content-Encoding` is never recompressed.
+- Stop treating authentication/cookie/cache-privacy headers as blanket compression blockers. `Cookie`, `Authorization`, `Set-Cookie`, `private` and `no-store` may be compressed; `no-transform`, ranges, SSE, upgrades and already encoded responses remain excluded.
+- Add dynamic compression inheritance/overrides to ordinary vhosts, generated Docker vhosts and Web Server services, including per-scope codec filters. Global Response settings remain the hard codec ceiling and own the minimum size. When a scope explicitly disables compression, its codec selectors are hidden/disabled without erasing the saved overrides.
+- Keep an explicitly published Docker vhost routed until the administrator unpublishes it. A missing container/service now keeps the hostname and returns `503 Service Unavailable`; an agent transport failure reuses the last successful inventory when available, and service return is reconciled automatically.
+- Make `/cache` occupancy meters render their filled portion consistently in Chromium/WebKit and Firefox instead of relying only on native `accent-color`.
+- Keep SQLite schema 8. New saved compression fields are additive/defaulted, so older 0.26.x documents continue to load. Fresh installations default the `Server` response header to exactly `RustProxy`.
+
+0.27.0 retains the 0.26.7 cache/backend/container fixes below.
+
+### Retained 0.26.7 release notes
 
 - Show explicit HOT and COLD cache occupancy progress on `/cache`, including object-count and byte/disk limits from Cache settings plus percentage usage.
 - Preserve compatible upstream client pools across unrelated active-snapshot rebuilds so generation age, request count and `Rotations` diagnostics do not restart at zero unless the backend connection policy actually changes.
@@ -77,7 +88,7 @@ Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost
 - Replace backend sort text (`A-Z` / `Z-A`) with direction arrows (`↑` / `↓`).
 - Keep SQLite schema 8 and the saved proxy configuration format unchanged; upgrading from 0.26.1 requires no data migration.
 
-The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.26.7 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md).
+The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.27.0 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md).
 
 ## Documentation
 
@@ -155,7 +166,9 @@ CARGO_BUILD_JOBS=1 CARGO_PROFILE_RELEASE_LTO=false \
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS=8 cargo build --release --locked
 ```
 
-The 0.26.7 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
+Ready Debian packages are published separately at `https://rustproxy.linuxiarz.pl`; Debian package-build metadata is intentionally not shipped in this source tree.
+
+The 0.27.0 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
 updates only this package's own version entry. This packaging environment has no Cargo, so the
 dependency graph was not re-resolved here. On the compiler-enabled deployment host, run the
 locked check/test/release gates below and retain the verified lockfile. `dev.sh` can generate a
@@ -308,16 +321,18 @@ Purge is authenticated, CSRF-protected, audited and invalidates both tiers plus
 fills. See [cache behavior and limits](docs/CACHE.md) and
 [cache diagnostics](docs/CACHE_DIAGNOSTICS.md).
 
-Response compression is streamed and negotiated with `Accept-Encoding`; enabled
-algorithms are gzip, Brotli, Zstandard and deflate, and the selected algorithm is
-reported in `Content-Encoding` with `Vary: Accept-Encoding`. Compression is disabled
-by default and must be enabled in Settings. Privacy-sensitive, ranged, upgraded,
-pre-encoded and `no-transform` responses are excluded. Cookie-bearing requests are
-also excluded unless the response is an already accepted shared-cache HIT or a local
-static Web Server response. Strong ETags are weakened after transformation, and
-obsolete content digests are removed. Server policy is applied after generic response
-rules. Protected framing/identity headers and cache-owned `Age` cannot be edited
-through generic rules.
+Response compression is streamed and negotiated with `Accept-Encoding`; zstd, Brotli
+and gzip default ON while deflate defaults OFF, and equal client quality uses
+`zstd -> br -> gzip -> deflate` server preference. The selected algorithm is reported
+in `Content-Encoding` with `Vary: Accept-Encoding`. Existing `Content-Encoding`, ranges,
+SSE, upgrades and `no-transform` are passed through without recompression. Cookie,
+Authorization, Set-Cookie, private and no-store headers do not by themselves disable
+dynamic compression. Ordinary vhosts, Docker publications and Web Server services may
+inherit/enable/disable compression and individual codecs; explicitly disabling a scope
+hides/disables its codec selectors in the dashboard while preserving their saved values.
+Strong ETags are weakened after transformation, and obsolete content digests are removed.
+Server policy is applied after generic response rules. Protected framing/identity headers
+and cache-owned `Age` cannot be edited through generic rules.
 
 With the separate demo enabled, `/cache-demo` returns an explicitly public 30-second
 object. Enable cache and X-Cache in Settings, then issue this twice without cookies:
@@ -398,7 +413,7 @@ python3 scripts/release_smoke.py
 # Runs those checks first, then the Rust suite when Cargo is available:
 bash dev.sh test
 # Source-only package, with no Git checkout required:
-python3 make_zip.py /tmp/RustProxy-0.26.7.zip
+python3 make_zip.py /tmp/RustProxy-0.27.0.zip
 ```
 
 ## New management and test-origin guide