v0.28.1

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.28.0"
+assert manifest["package"]["version"] == "0.28.1"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.28.0"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.28.1"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.28.0",
-    "CHANGELOG.md": "## 0.28.0",
-    "ROADMAP.md": "## 0.28.0",
-    "AGENTS.md": "Current source version: 0.28.0.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.28.0",
+    "README.md": "# RustProxy 0.28.1",
+    "CHANGELOG.md": "## 0.28.1",
+    "ROADMAP.md": "## 0.28.1",
+    "AGENTS.md": "Current source version: 0.28.1.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.28.1",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -284,7 +284,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.28.0"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.28.1"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -589,7 +589,8 @@ for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linu
 for language in ['langs/en_US.json', 'langs/pl_pl.json']:
     language_text = (root / language).read_text(encoding='utf-8')
     assert './dev.sh tls deploy' not in language_text
-    assert 'rust-proxy --data-dir /var/lib/rustproxy tls deploy' in language_text
+    assert '/api/certificates/{certificate_id}/reload' in language_text
+    assert '/etc/letsencrypt/live/example.com/fullchain.pem' in language_text
 startup_source = rust_source(root, 'src/main/admin_runtime.rs')
 for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/']:
     assert marker in startup_source, marker
@@ -1393,7 +1394,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.28.0"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.28.1"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1479,7 +1480,7 @@ for marker_0273 in ['geoip-form', 'geoip_updates', '268435456', '86400']:
     assert marker_0273 in settings_web_0273 or marker_0273 in html, marker_0273
 assert '"geoip"' in openapi and 'GeoIpUpdateSettings' in openapi
 
-# 0.28.0 operator controls and cache-policy regressions.
+# 0.28.0 retained operator controls and cache-policy regressions.
 geoip_tests_0280 = (root / "src/geoip/update_tests.rs").read_text()
 cache_settings_0280 = (root / "src/cache/model/settings.rs").read_text()
 cache_entry_0280 = (root / "src/cache/model/entry.rs").read_text()
@@ -1515,5 +1516,33 @@ assert 'listener-active-item' in runtime_web_0280 and 'listener-active-feature'
 assert 'cache-via-enabled' in cache_web_0280 and 'via_header:' in cache_web_0280
 assert 'location-header-direction location-header-editor' in vhost_core_0280
 
-print("PASS: 0.28.0 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
+# 0.28.1 external certificate paths and certificate-source UX.
+tls_types_0281 = (root / "src/tls/types.rs").read_text()
+tls_server_0281 = (root / "src/tls/server_config.rs").read_text()
+tls_tests_0281 = (root / "src/tls/tests.rs").read_text()
+backup_snapshot_0281 = (root / "src/backup/snapshot.rs").read_text()
+certificate_admin_0281 = (root / "src/admin/certificates.rs").read_text()
+for marker_0281 in [
+    'pub fn certificate_files_are_external',
+    'cert_external == key_external',
+    'fs::canonicalize(value)',
+    'Certbot\'s live/ entries are symlinks',
+    'read_configured_pem',
+    'external private key may be owner/group-readable',
+]:
+    assert marker_0281 in tls_types_0281, marker_0281
+assert 'certificate_files_are_external(cert, key)?;' in tls_server_0281
+assert 'external_absolute_paths_follow_certbot_style_symlinks_on_each_reload' in tls_tests_0281
+assert 'certificate_files_are_external(' in backup_snapshot_0281 and 'External certificate material is intentionally outside' in backup_snapshot_0281
+assert 'uses external file paths; renew those files in place and call the certificate reload endpoint instead of deploy' in certificate_admin_0281
+for marker_0281 in [
+    'id="certificate-file-source"',
+    'certificateSourceManaged',
+    'certificateSourceExternal',
+    '/etc/letsencrypt/live/example.com/fullchain.pem',
+]:
+    assert marker_0281 in html or marker_0281 in runtime_web_0280 or marker_0281 in (root / 'langs/en_US.json').read_text(), marker_0281
+assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
+
+print("PASS: 0.28.1 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")