v0.28.1

README.md

@@ -1,9 +1,9 @@
-# RustProxy 0.28.0
+# RustProxy 0.28.1
 
 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.28.0 release source.**
+**0.28.1 release source.**
 
 ## Layer-4 streams
 
@@ -11,18 +11,17 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
-## What changed in 0.28.0
+## What changed in 0.28.1
 
-- Add an authenticated **Download now** action for GeoIP and move managed sources to direct per-file URLs. CSV mode uses separate IPv4/IPv6 files; MMDB mode accepts one native MaxMind DB for both families. Publisher SHA-256 URLs are optional per file, while size/format validation, staging, atomic publication and hot reload remain mandatory. Country ACLs, country rate limits, access-log country capture, Prometheus status and administration status use the new database without restarting proxy traffic.
-- Make active listener state easier to scan in Settings: each active HTTP/HTTPS bind is rendered as a separate endpoint card with explicit active protocol badges (`H1`, `H2`, `H2C`, `H3/UDP`) derived from the running listener configuration.
-- Add a configurable cache response `Via` value, enabled by default as `Via: RustProxy` and disableable from Cache settings. Existing upstream `Via` values are preserved and RustProxy appends its own value.
-- Stop full cache purges for request-bypass edits and response-only cache diagnostic/Via header changes. Settings that can change stored representations or compatibility still rotate the cache revision and invalidate incompatible objects.
-- Fix the vhost Security request/response header-rule layout so the Delete control is separated from the first Operation selector.
-- Report the completed ACME Python/Certbot runtime check through the normal INFO log instead of printing a speculative `checking/preparing` line in the startup banner.
-- Retain the 0.27.3 maintenance fixes for restore ownership, production/development data directories, automatic GeoIP updates, explicit listener override semantics, strict WebSocket 101 framing, fail-soft release checks and scaled sidebar layout.
-- Keep SQLite schema 8 and COLD on-disk format 3 unchanged; the new `cache.via_header` field is defaulted for older saved configurations.
+- Add an explicit **External files (absolute paths)** certificate mode for operator-managed PEM pairs such as `/etc/letsencrypt/live/example.com/fullchain.pem` and `privkey.pem`. RustProxy resolves Certbot-style `live/` symlinks on every reload, validates the resulting pair and publishes it atomically for new TLS/H2/H3 handshakes without copying the files into `<data-dir>/certs`.
+- Keep the existing `POST /api/certificates/{certificate_id}/reload` contract for renewal wrappers. A Certbot/acme.sh hook may renew files in place and then call the targeted reload endpoint; the saved configuration revision is unchanged.
+- Preserve the safer managed-file mode for simple filenames inside `<data-dir>/certs`, reject mixed managed/external pairs, and keep upload/deploy endpoints from accepting arbitrary host filesystem paths in their request bodies.
+- Clarify all certificate-source UI text in English and Polish: ACME tabs state that RustProxy/Certbot owns the generated files, Import explains that browser-selected PEMs are copied into RustProxy storage, and Existing files explains the managed-directory versus external-path modes.
+- Exclude externally referenced certificate material from RustProxy backups. The absolute paths remain in configuration and must exist or be mounted separately after restore.
+- Retain all 0.28.0 GeoIP, listener protocol-badge, cache Via/invalidation, Security-editor and ACME runtime-reporting improvements.
+- Keep SQLite schema 8 and COLD on-disk format 3 unchanged.
 
-0.28.0 retains the 0.27.3 HTTP/3 cache and maintenance work plus earlier administration/proxy behavior. Historical details are in [CHANGELOG.md](CHANGELOG.md).
+0.28.1 is configuration-compatible with 0.28.0; no database migration is required. Historical details are in [CHANGELOG.md](CHANGELOG.md).
 
 ### Historical 0.26.7 release notes
 
@@ -90,7 +89,7 @@ Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost
 - Replace backend sort text (`A-Z` / `Z-A`) with direction arrows (`↑` / `↓`).
 - Keep SQLite schema 8 and the saved proxy configuration format unchanged; upgrading from 0.26.1 requires no data migration.
 
-The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.28.0 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md).
+The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.28.1 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md).
 
 ## Documentation
 
@@ -181,7 +180,7 @@ CARGO_BUILD_JOBS=1 CARGO_PROFILE_RELEASE_LTO=false \
 
 Package-build metadata remains outside this source tree and is maintained with the official package repositories above.
 
-The 0.28.0 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
+The 0.28.1 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
 updates only this package's own version entry. This packaging environment has no Cargo, so the
 dependency graph was not re-resolved here. On the compiler-enabled deployment host, run the
 locked check/test/release gates below and retain the verified lockfile. `dev.sh` can generate a
@@ -437,7 +436,7 @@ python3 tools/checks/release_smoke.py
 # Runs those checks first, then the Rust suite when Cargo is available:
 bash dev.sh test
 # Source-only package, with no Git checkout required:
-python3 make_zip.py /tmp/RustProxy-0.28.0.zip
+python3 make_zip.py /tmp/RustProxy-0.28.1.zip
 ```
 
 ## New management and test-origin guide