v0.32.2
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
bb025dcf44
commit
b0f211555a
74 files changed
+6089
-556
No files matched your search
+21
-1
@@ -397,6 +397,26 @@ and rust_proxy_http3_requests_total. See source `metrics.rs` for exact HELP/type
|
||||
contracts and INTEGRATIONS_040.md for configuration examples.
|
||||
|
||||
|
||||
## 0.32.3 Overview registry and compatible upstream modes
|
||||
|
||||
The backend `protocol` wire values are `http1` (default), `auto`, `http2`
|
||||
(legacy HTTPS H2/H1 ALPN fallback or cleartext H2C) and new `h2` (strict
|
||||
HTTPS H2 or cleartext H2C). Old `http2` configurations are not rewritten.
|
||||
See [Vhosts](VHOSTS.md).
|
||||
|
||||
The authenticated `/api/preferences` Dashboard card ID lists are backed by a
|
||||
shared server/frontend registry with **49** IDs: the original 16, fourteen
|
||||
optional HTTP backend cards, twelve optional performance charts and seven existing
|
||||
full-width panels (live traffic, system, connections, cache, process, network,
|
||||
backend diagnostics). OpenAPI `dashboard_widgets` and
|
||||
`dashboard_hidden_widgets` enum, `maxItems` and defaults reflect that registry.
|
||||
Existing saved card order is retained. New performance charts are opt-in,
|
||||
while previously displayed full-width sections remain visible by default.
|
||||
Unknown saved IDs are ignored rather than failing a whole profile.
|
||||
The visual editor offers a default-layout preview and a confirmed Reset layout,
|
||||
both using the existing per-account preference endpoint.
|
||||
No new routes, tokens or permissions are introduced.
|
||||
|
||||
## 0.22.3 certificate hot reload and external deployment
|
||||
|
||||
`POST /api/certificates/reload` is an administrator-session-only, Origin/CSRF-protected control-plane
|
||||
@@ -622,6 +642,6 @@ The revisioned `/api/config` vhost rate-limit object accepts optional `user_agen
|
||||
|
||||
`GET /api/status` retains `streams.active`, `streams.desired`, `streams.restart_required` and `streams.metrics`. Each active Stream metric view includes `backends[]` for health/active information and optional detailed counters. `/api/status?view=live` and the existing authenticated SSE snapshots carry the same backend observations inside `streams.metrics` without a separate polling source. Backend status is `unverified`, `checking`, `healthy`, `unhealthy` or `disabled`.
|
||||
|
||||
`GET`/`PUT /api/preferences` continue to own `dashboard_widgets` and `dashboard_hidden_widgets` (now 16 supported IDs, adding `stream_overview`, `stream_traffic`, `stream_sessions`, `stream_backend_health`). Legacy accounts have their missing Stream widget IDs appended **hidden**. Preferences affect only Dashboard presentation, not proxy configuration or metrics export. No new endpoint or permission was introduced.
|
||||
In the 0.32.0 Stream addition, `GET`/`PUT /api/preferences` own `dashboard_widgets` and `dashboard_hidden_widgets` (at that stage 16 supported IDs, adding `stream_overview`, `stream_traffic`, `stream_sessions`, `stream_backend_health`). Legacy accounts have their missing Stream widget IDs appended **hidden**. Preferences affect only Dashboard presentation, not proxy configuration or metrics export. No new endpoint or permission was introduced.
|
||||
|
||||
Detailed backend metrics default to off in v0.32.0; per-Stream `metrics_enabled` sets the inherited value for its backends, and explicit per-backend `metrics_enabled` overrides it. Basic per-Stream counters remain available regardless of these flags.
|
||||
@@ -1,5 +1,20 @@
|
||||
# Deployment and configuration migration history
|
||||
|
||||
## 0.32.2 -> 0.32.3 upstream protocol and Dashboard compatibility
|
||||
|
||||
No database or backend JSON rewrite is required. In 0.32.2 an HTTPS origin
|
||||
saved as `"protocol": "http2"` could negotiate HTTP/1.1 via TLS ALPN. The same
|
||||
value **still** permits H2/H1 over TLS in 0.32.3 and still uses H2C on plaintext
|
||||
HTTP. To enforce HTTP/2 only, explicitly select new `"protocol": "h2"`.
|
||||
Existing `http1` and `auto` values, HTTP/1.1 WebSocket Upgrade, configured
|
||||
keepalive and pool settings retain their meaning.
|
||||
|
||||
The dashboard registry grows to 24 IDs. Eight HTTP backend cards are optional,
|
||||
hidden by default for all accounts until enabled; old ordering and hide/show
|
||||
preferences survive. These use existing status data with no extra background
|
||||
polling or schema migration. Verify live behavior and WebSocket negotiation on
|
||||
a Rust-enabled staging environment before deployment.
|
||||
|
||||
## 0.28.1 -> 0.28.2
|
||||
|
||||
SQLite schema 8 is upgraded automatically to schema 9. The additive migration creates `certificate_api_grants`. Existing Certificate API credentials become reload-only compatibility credentials covering all certificate IDs (`*`); rotate them in **Settings -> Certificate API** to replace the wildcard with explicit certificate IDs. New credentials require 1-32 explicit certificate IDs and are reload-only unless deploy permission is enabled.
|
||||
|
||||
@@ -540,3 +540,70 @@ PROMETHEUS.md for immediate revocation, restart rules and scrape configuration.
|
||||
## Stream Dashboard cards (0.32.0)
|
||||
|
||||
Under **Settings → Appearance → Dashboard layout**, the existing Show/Hide and Up/Down card controls now include Stream overview, traffic, sessions and backend health. They are opt-in and account-scoped, saved through the existing `/api/preferences` flow. Legacy 12-card orders migrate in memory with all four Stream cards hidden. They use the existing status/SSE stream and stop computing their charts while hidden; no backend monitoring or listener settings are changed when toggled. An explicitly enabled Stream card stays on Overview and shows a neutral no-data state when no Stream is active. Overview details and chart legends stay visible inside the cards (without hover tooltips). Appearance Stream card descriptions use browser-native `title` hints on hover, with the same localized descriptions available to assistive technology through `aria-description` on the visibility buttons; they no longer add floating boxes or horizontal scrolling.
|
||||
|
||||
## Full Overview layout and additional metrics (0.32.3)
|
||||
|
||||
Open **Overview -> Arrange cards visually** (or **Settings -> Appearance -> Dashboard layout -> Visual layout editor**) to change **all 49** dashboard blocks: 30 previous tiles, 12 new optional charts, three large live charts, three diagnostic panels and the backend table. Drag tiles/sections, use arrow buttons for keyboard access, or hide and re-enable individual blocks. Large sections retain their own original charts, controls and live data after being moved. The responsive six-column desktop view scales to narrower widths. Visibility and order are account-scoped; they never alter backend behavior.
|
||||
|
||||
**Default view** loads the factory order and visibility into the editor **without saving**; **Save layout** applies it. **Reset layout** asks for confirmation, then persists the same default order and visibility in one preferences write. **Cancel** preserves the current layout. All 12 added charts are hidden until explicitly enabled and use a maximum of 30 status samples without additional HTTP polling. They cover process CPU/RSS/file descriptors, connections, WebSocket tunnels, TLS handshake failure and request-error rates, cache HIT share and HOT RAM usage, incoming HTTP/2 request share, mean response duration, and unhealthy backends. Unknown and first-delta measurements show `-`; response time is a mean, not a percentile, and HTTP/2 share is **frontend** traffic rather than negotiated upstream ALPN.
|
||||
|
||||
## HTTP backend Overview cards (0.32.3)
|
||||
|
||||
**Settings -> Appearance -> Dashboard layout** now contains fourteen opt-in
|
||||
HTTP origin cards: **Backend health**, **Active backend requests**, **Backend
|
||||
errors**, **Health probe RTT**, **Backend traffic**, **Configured backend
|
||||
modes**, **Backend request rate**, **Backend capacity**, **HTTP 5xx**, **Backend
|
||||
timeouts**, **Upstream connection errors**, **Backend retries**, **Backend
|
||||
queue pressure**, and **Backend connection pools**. All are hidden by default on new and migrated administrator profiles;
|
||||
card visibility and ordering use existing per-account `/api/preferences` fields.
|
||||
They do not affect routing, health checks, upstream keep-alive or listeners.
|
||||
|
||||
The cards reuse `backend_pools` already included in the live status payload:
|
||||
|
||||
- Health separates up/down/checking and draining/disabled members. Active
|
||||
requests is a sum of in-flight pool member exchanges, not open TCP sockets.
|
||||
- Errors show lifetime member error counts and a sampled errors/s graph. Traffic
|
||||
uses the positive differences of per-member in/out byte counters; resets and
|
||||
newly added backend members cannot generate an artificial rate spike.
|
||||
- Health probe RTT is the mean last observed healthy probe time, **not** client
|
||||
end-to-end latency. It shows no data when health probes are unavailable.
|
||||
- Configured backend modes distinguish saved `http1`, `auto`, compatible `http2`
|
||||
and strict `h2` values, and count H2C cleartext members. This is **not an observed
|
||||
H1/H2 negotiation rate**: TLS ALPN can select H1 for Auto and compatible HTTP/2.
|
||||
- Backend request rate uses started-request counter deltas, with per-member
|
||||
baselines after a restart or config change. Backend capacity compares active
|
||||
requests against finite per-member concurrency limits; unlimited members are
|
||||
excluded and a neutral state is shown when no such limit is configured.
|
||||
|
||||
The six additional diagnostics use pre-existing `backend_pools.members` counters:
|
||||
HTTP 5xx responses, all timeout classes, combined connect/DNS/TLS/I/O failures,
|
||||
retry attempts and successes from the existing safe retry policy, queue timeouts
|
||||
and capacity rejections, and Hyper client-generation rotations and age. Rotations
|
||||
are **not TLS handshake counts**. Rates are based on per-member positive counter
|
||||
differences; newly added or reset members cannot create arbitrary spikes.
|
||||
|
||||
To arrange the actual Overview cards visually, click **Arrange cards visually**
|
||||
on Overview or **Visual layout editor** in Settings -> Appearance -> Dashboard
|
||||
layout. The modal displays copies of the existing telemetry cards; drag to
|
||||
reorder, or use the move arrows for keyboard-only input. Hide/show tiles in
|
||||
the modal and select **Save layout** once to persist order and visibility in
|
||||
the existing `dashboard_widgets` and `dashboard_hidden_widgets` preferences.
|
||||
Cancel/Escape discards the draft. The existing Appearance visibility and move
|
||||
buttons remain available. No extra API endpoint, refresh loop, or database
|
||||
migration is needed.
|
||||
|
||||
TLS ALPN selects H2 or H1 only when opening a **new TLS connection**, not for
|
||||
each request. Hyper already pools reusable connections per compiled backend;
|
||||
subsequent requests share the negotiated connection (H2 multiplexing when
|
||||
possible). Existing bounded pool recycling (`pool_recycle_requests` and
|
||||
`pool_recycle_seconds`), configured idle timeouts, and reopening failed
|
||||
connections naturally re-evaluate TLS capabilities. A backend-global protocol
|
||||
cache or scheduled H2 probe would be unsafe for origins with multiple DNS/peer
|
||||
capabilities and would add network work. No traffic replay/downgrade on
|
||||
post-request errors was added; strict H2, H2C, H1 and WebSocket separation
|
||||
remain intact.
|
||||
|
||||
The sample charts are browser-local, bounded and reset on a changed config
|
||||
revision, logout or source unavailability. They are not computed while hidden.
|
||||
No additional polling, SQLite schema migration or new administrator endpoint
|
||||
is introduced. Existing Stream widgets remain independent.
|
||||
@@ -1,45 +0,0 @@
|
||||
# Verification report - RustProxy 0.32.2
|
||||
|
||||
## Scope
|
||||
|
||||
Source-based patch on the supplied 0.32.1 archive. The Web Server's cache
|
||||
revalidation now mirrors the existing Reverse Proxy's 304 handling for local
|
||||
files, while preserving original browser conditionals, cache policy and cached
|
||||
transformed representations. No backend, PHP-FPM, API or SQLite schema change.
|
||||
|
||||
## Regression cases added (Rust, execution pending)
|
||||
|
||||
- F5-style `Cache-Control: max-age=0` and hard-refresh `no-cache` preserve body
|
||||
and advance `X-Cache-Hits` when local origin returns 304.
|
||||
- Browser `If-None-Match` produces downstream 304 only when the client's validator
|
||||
matches the public stored representation, not merely the origin's validator.
|
||||
- Unrelated client validators cannot incorrectly validate the stored body.
|
||||
- `HEAD` and single-range conditional refresh reuse the validated full body.
|
||||
- A changed asset (different on-disk ETag) returns 200 rather than a false 304.
|
||||
- Newly private origin revalidation metadata cannot remain in shared storage.
|
||||
|
||||
## Results and limitations
|
||||
|
||||
- Python static/structural checks via `./dev.sh test`: **PASS** (including
|
||||
version, full source preflight, cache regression contracts, HTTP/cache,
|
||||
security, documentation, schema-v9/upgrade and release smoke contracts).
|
||||
- All **24 Node.js UI simulations** configured in `./dev.sh test`: **PASS**.
|
||||
Three existing fixture assumptions were aligned with current unindented
|
||||
functions/version (`backend_cache_0297_ui_test.mjs`,
|
||||
`backend_health_0300_ui_test.mjs`, `security_logs_0315_ui_test.mjs`);
|
||||
the production panel logic is unchanged.
|
||||
- Python load-tool selftest against a Python peer: **PASS**; not a RustProxy
|
||||
server test or a memory profile of the proxy.
|
||||
- `./dev.sh check`: **unavailable (exit 127)**; Rust/Cargo is not installed.
|
||||
- `./dev.sh test`: **pre-Cargo checks PASS; entire command exits 127** because
|
||||
Rust/Cargo is not installed, so no Rust tests executed.
|
||||
- Rust `cargo check --locked --all-targets`: **not run, Cargo unavailable**.
|
||||
- Rust `cargo test --locked --all-targets`: **not run, Cargo unavailable**.
|
||||
- Real SQLite schema migration/update on an installed instance: **not run**;
|
||||
only source/upgrade contracts were checked.
|
||||
- Actual RustProxy process, HTTP/1.1, HTTP/2, HTTP/3, PHP-FPM/WordPress and
|
||||
browser DevTools reproduction: **not run** in this source-only environment.
|
||||
|
||||
**Production acceptance remains open.** Run `./dev.sh check`, `./dev.sh test`
|
||||
and repeat browser-refresh/GET comparisons on a Rust 1.99+ build host before
|
||||
rolling the release out. The patched source is delivered, not a tested binary.
|
||||
+22
-3
@@ -239,9 +239,28 @@ Disabling reuse sets the idle pool limit to zero and disables keepalive probes.
|
||||
limit is not a separate per-backend active-request cap; global connection/exchange bounds
|
||||
still apply. HTTP health probes use separate no-reuse HTTP/1.1 connections.
|
||||
|
||||
`http2` over HTTPS prefers h2 but keeps HTTP/1.1 ALPN compatibility. Over plaintext,
|
||||
`http2` remains explicit prior-knowledge h2c with no retry-based downgrade. `auto`
|
||||
over HTTP is HTTP/1.1. `http2`/`auto` require `preserve_host: false` to keep origin
|
||||
Backend upstream `protocol` has four modes:
|
||||
|
||||
| UI mode | Serialized value | Backend behavior |
|
||||
|---|---|---|
|
||||
| **HTTP/1.1** | `http1` | HTTP/1.1 only over HTTPS or HTTP; default for new backends |
|
||||
| **Auto** | `auto` | HTTPS: prefer H2 and negotiate H1 fallback with ALPN before sending a request; HTTP: H1 only, without H2C probing |
|
||||
| **HTTP/2 compatible** | `http2` | **Unchanged 0.32.2 behavior**: HTTPS offers H2/H1 via ALPN; plaintext HTTP uses H2C prior knowledge (no H1 downgrade on HTTP) |
|
||||
| **H2 only** | `h2` | HTTPS: require H2 via ALPN; reject H1-only peers. HTTP: prior-knowledge H2C, no fallback |
|
||||
|
||||
**0.32.2 -> 0.32.3 compatibility:** saved `"protocol": "http2"` retains its existing
|
||||
HTTPS ALPN fallback and cleartext H2C behavior. No conversion, migration or
|
||||
administrator action is needed to preserve the old selection. Choose the new
|
||||
`"protocol": "h2"` only when H2 must be enforced. The editor describes the
|
||||
transport for the selected backend URL; a descriptive notice next to compatible
|
||||
HTTPS `http2` is informational, not a migration warning.
|
||||
|
||||
HTTPS Auto negotiation selects the wire protocol **before sending the request**.
|
||||
RustProxy does not replay an ambiguous failed POST/PATCH/DELETE through H1, and
|
||||
does not interpret backend 4xx/5xx responses as a reason to switch protocols.
|
||||
Existing pool reuse, keep-alive, client generation rotation and the independent
|
||||
HTTP/1.1 WebSocket Upgrade / H2 Extended CONNECT paths are retained.
|
||||
HTTP health probes continue to use HTTP/1.1; H2C-only peers can use TCP probes. `http2`/`h2`/`auto` require `preserve_host: false` to keep origin
|
||||
URI/authority/TLS identity consistent. HTTPS backend certificate verification is disabled when `tls_verify` is omitted. Enable `tls_verify: true` when origin identity must be validated; for IP-based origins use a DNS `tls_server_name` present in the certificate and provide `tls_ca_pem` when the issuer is private.
|
||||
|
||||
## Scheduling
|
||||
|
||||
Reference in new issue
Block a user