v0.28.1

CHANGELOG.md

@@ -4,6 +4,15 @@
 > test-only changes and packaging implementation notes were moved to
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.28.1
+
+- Add manual certificate support for absolute external certificate/key paths, including `/etc/letsencrypt/live/...` pairs. Certbot-style symlinks are resolved again on every reload so an external renewal can be hot-published without copying files into RustProxy storage.
+- Keep `POST /api/certificates/{certificate_id}/reload` revision-stable for Certbot/acme.sh wrapper hooks and reject use of the deploy endpoint against an ID configured with external file paths.
+- Preserve the legacy/simple filename mode for `<data-dir>/certs`, reject mixed relative/absolute pairs, and leave upload/deploy request bodies path-free.
+- Exclude externally referenced PEM material from RustProxy backups; only their configured absolute paths are retained, so the external files/mounts must be restored separately.
+- Clarify certificate source/storage behavior in English and Polish across ACME, Import and Existing-files UI modes.
+- Keep SQLite schema 8 and COLD format 3 unchanged.
+
 ## 0.28.0
 
 - Add a manual GeoIP **Download now** action and replace the fragile release/checksum-base coupling with direct source URLs. CSV mode accepts separate IPv4/IPv6 files; MMDB mode accepts one native MaxMind DB for both families. Publisher SHA-256 URLs are optional per file; size/format validation, staging, the updater lock, atomic publication and hot reload remain mandatory.