v0.24.9

README.md

@@ -1,9 +1,9 @@
-# RustProxy 0.24.8
+# RustProxy 0.24.9
 
 Independent Rust reverse proxy with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.24.8 release source.**
+**0.24.9 release source.**
 
 ## Layer-4 streams
 
@@ -11,6 +11,13 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
+## What changed in 0.24.9
+
+- Add a central encrypted Secret Store backed by SQLite ciphertext and a private local master key, with migration of Cloudflare, OVH and RFC2136 ACME credentials away from persistent plaintext files.
+- Add password-encrypted full backup/restore with Argon2id-derived backup keys, authenticated AES-256-GCM encryption, explicit manifests/checksums, private staging and rollback-safe data-directory activation.
+- Add an optional ERROR-only file sink integrated with the existing tracing pipeline, supporting JSON/RAW output, bounded asynchronous writes, secret redaction and external `logrotate` rotation.
+- Update package/source/UI/OpenAPI/release identity to 0.24.9.
+
 ## What changed in 0.24.8
 
 - Expand the overview **Cache RAM** block with live HOT RAM occupancy against its configured limit, transient cache RAM history split into fill / COLD queue / COLD I/O, and COLD storage occupancy against its disk budget.
@@ -631,8 +638,14 @@ default used when bootstrapping listeners.
 The release checker reads its compile-time defaults from repository-root `UPDATE_CHECK.toml`,
 which is embedded in the final binary. It checks the configured `Cargo.toml` URL immediately
 on startup and then every 3600 seconds by default. A failed request is ignored until the next
-interval; it never blocks startup or proxy traffic and it never installs updates. Operators may
-override the embedded values with global CLI options or equivalent environment variables:
+interval; it never blocks startup or proxy traffic and it never installs updates. On Unix-like
+systems the checker keeps its bundled public roots and also imports certificates from
+`SSL_CERT_FILE`, `CURL_CA_BUNDLE` and common Linux/BSD CA bundles, including the
+FreeBSD/OPNsense `ca_root_nss` path. It follows at most five credential-free HTTP(S)
+redirects and never downgrades an HTTPS check to HTTP. Failed checks stay invisible in the dashboard, preserving the existing footer
+behavior, but are emitted as application `ERROR` events so the optional error-file sink can
+capture them. Operators may override the embedded values with global CLI options or equivalent
+environment variables:
 
 ```text
 --update-repository-url         RUST_PROXY_UPDATE_REPOSITORY_URL
@@ -766,7 +779,8 @@ old server and extract this archive into a separate, non-nested directory. From
 the new source directory:
 
 ```bash
-python3 scripts/backup.py --data-dir /actual/RustProxy/data /private/backup-before-0.13.2
+rust-proxy --data-dir /actual/RustProxy/data backup create \
+  --output /private/rustproxy-before-upgrade.rpb
 bash upgrade.sh /actual/RustProxy --stopped
 # Also pass --data-dir /actual/private/data when it is external.
 cd /actual/RustProxy
@@ -774,6 +788,11 @@ bash dev.sh test
 bash dev.sh
 ```
 
+The supported operator backup is the password-encrypted `rust-proxy backup create`
+command. `scripts/backup.py` is retained only as an offline release-test helper and
+must not be used as a Secret Store backup. See
+[Secret Store and encrypted backup/restore](docs/SECRET_STORE_BACKUP.md).
+
 `.env`, data, unmanaged files and previous managed sources are preserved. Extra
 language JSON files survive the update; shipped files replace their old names,
 whose previous bytes remain in the backup. Unknown custom source edits are not