v0.34.5

CHANGELOG.md

@@ -6,7 +6,20 @@
 
 # Changelog
 
-Release history focused on **features, settings, default behavior, compatibility and fixes**. Changes to internal code structure and preliminary performance experiments are intentionally omitted. Historical descriptions reflect their respective releases; consult the current documentation for the settings available in 0.34.4.
+Release history focused on **features, settings, default behavior, compatibility and fixes**. Changes to internal code structure and preliminary performance experiments are intentionally omitted. Historical descriptions reflect their respective releases; consult the current documentation for the settings available in 0.34.5.
+
+## 0.34.5 — Administration UX improvements (source candidate)
+
+- **Web Server → Delivery:** separated static-file delivery, dynamic compression/codecs and precompressed `.br`/`.gz` sidecar controls into individually labelled settings groups. Existing options, defaults and configuration keys remain unchanged.
+- **Web Server → PHP-FPM:** grouped profile and endpoint selection, request behavior, timeouts/capacity, and FastCGI/php.ini overrides. Disabled inputs, selectors and textareas now share a clear inactive appearance when PHP is off or controlled by a shared profile.
+- **Streams → Backends:** split backend routing/capacity from health checks. Probe timing and UDP payload fields appear only when a health-check mode is selected; hidden controls retain their values and cannot block form validation.
+- **Redirects and 404 hosts:** separated identity/domains from frontend listener and certificate selection, with more consistent checkbox alignment and spacing.
+- **Vhost → Transform:** the file-extension override checkbox now sits directly above its textarea, separated from format selectors. The three similar Vhost cache overrides (static extensions, bypass prefixes and unsafe force targets) are stacked consistently; disabled overrides no longer appear editable. Existing saved field names and policy behavior remain unchanged.
+- **Vhost access:** relocated the inline IP/CIDR ACL editor to **Security → Traffic policy**, alongside reusable ACL profiles. **Authentication** now contains Basic Auth and Tinyauth alone. An inline ACL remains an independent, cumulative restriction (it cannot be bypassed by a profile allow).
+- **Web Server presets:** the two hardening checkboxes appear together below preset selection/action rather than beside them. **Settings → Appearance → Data refresh** shows the master refresh checkbox on its own line, with four equally sized refresh selectors in a balanced two-column grid (one column on mobile).
+- **Settings → System information:** removed the dedicated RustProxy process block from this screen while preserving **Statistics source** with the host details. Status/metrics API fields and backend monitoring are unchanged.
+- **Corner-style consistency:** additional Vhost dependent-field groups, cache/legend and metric-info controls, selected admin cards and the self-contained authenticated documentation page follow the saved Square/Subtle/Rounded/Extra corner preference. Circular status indicators/spinners remain circular by design; Original retains its legacy styling.
+- Updated English and Polish labels, documentation and UI regression checks. This is a UI-only release; it does not change backend execution or configuration semantics. Native Rust builds and target-system acceptance remain required.
 
 ## 0.34.4 — Multi-profile ACLs, certificate override and mobile Docker details (source candidate)
 
@@ -14,6 +27,8 @@ Release history focused on **features, settings, default behavior, compatibility
 - Docker agent details now wrap certificate SHA-256 fingerprints on narrow screens.
 - Ordinary Vhosts and Docker publications may attach up to eight reusable ACL profiles. Legacy `acl_profile_id` remains loadable; new assignments use `acl_profile_ids`. Among selected profiles, an explicit IP deny or blocked country always denies, explicit IP/country allows are unioned, and unmatched defaults must all permit access. Single-profile behavior is unchanged. Inline Vhost/location/global controls are still additional (AND) restrictions, not bypassed. Docker assignments override inherited agent profiles when they select their own profiles.
 - `allow_certificate_mismatch` permits a deliberate, confirmed exception per named certificate assignment on an ordinary Vhost or Docker publication. TLS identity/key checks remain intact. Only explicitly selected hostname/certificate pairs skip RustProxy DNS SAN binding verification. Client hostname validation still fails/warns for a mismatched certificate; do not use as a permanent replacement for a matching certificate.
+- Refined Vhost editor layout: separate **SSL certificates** (selection and explicit mismatch consent) from **SSL settings** (TLS policy), and split Traffic policy into ACL, method, IP/country/User-Agent rate limits. Vhost security now separates HSTS, response headers and User-Agent blocking; Custom location access, balancing controls and WebSocket settings have their own groups. Checkbox/button alignment was adjusted in toolbars, dialogs and configuration cards; ordinary UI surface corners follow the selected dashboard rounding style where previously fixed. Backend settings and API semantics are unchanged.
+- Docker publication editor shows the certificate/domain mismatch consent immediately below **Backend host IP**, with a small vertical gap.
 - The source release needs native Rust compilation and target-system acceptance tests before production use.
 
 ## 0.34.3 — QUIC socket buffering, live HTTP/3 settings and cache outcome mix (source candidate)