v0.24.9

scripts/acme_provider.py

@@ -28,7 +28,7 @@ ALGORITHMS = {"HMAC-SHA256", "HMAC-SHA384", "HMAC-SHA512"}
 MAX_INPUT = 16384
 MAX_PEM = 131072
 PROVIDERS = {"http01", "cloudflare", "ovh", "rfc2136"}
-SECRET_FIELDS = {"key_secret", "api_token", "application_key", "application_secret", "consumer_key"}
+SECRET_FIELDS = {"key_secret", "api_token", "application_key", "application_secret", "consumer_key", "credential_ini_b64"}
 COMMON_FIELDS = {"provider", "certificate_id", "email", "domains", "environment", "agree_tos", "confirm_production", "propagation_seconds"}
 PROVIDER_FIELDS = {
     "http01": set(),
@@ -226,29 +226,33 @@ def issue(raw: dict, certificate_directory: Path, executable: str | None = None)
             raise AcmeError("acme.profile_busy") from None
         for folder in ["config", "work", "logs"]:
             private_directory(work / folder)
-        # Keep credentials for this lineage's renewal. Replace atomically; never
-        # follow an existing credential-file symlink or put secrets in SQLite.
+        # DNS credentials are supplied by RustProxy's encrypted Secret Store.
+        # Certbot needs a file path, but the plaintext file exists only while the
+        # provider command runs and is deleted before this worker returns.
         credential_file = work / (value["provider"] + ".ini")
         if value["provider"] == "http01":
             webroot = certificate_directory / "acme-http01"
             for path in (webroot, webroot / ".well-known", webroot / ".well-known" / "acme-challenge"):
                 private_directory(path)
         else:
-            temporary = work / ("credentials-" + uuid.uuid4().hex)
-            write_new(temporary, credentials(value))
-            os.replace(temporary, credential_file)
-        profile = {k: v for k, v in value.items() if k not in SECRET_FIELDS}
-        temporary = work / ("profile-" + uuid.uuid4().hex)
-        write_new(temporary, json.dumps(profile).encode())
-        os.replace(temporary, work / "profile.json")
-        args = certbot_command(value, work, credential_file, executable)
+            credential_file.unlink(missing_ok=True)
+            write_new(credential_file, credentials(value))
         try:
-            result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
-                                    stderr=subprocess.DEVNULL, timeout=1200 + value["propagation_seconds"], check=False)
-        except subprocess.TimeoutExpired:
-            raise AcmeError("acme.provider_timeout") from None
-        if result.returncode:
-            raise AcmeError("acme.certbot_failed_check_private_log")
+            profile = {k: v for k, v in value.items() if k not in SECRET_FIELDS}
+            temporary = work / ("profile-" + uuid.uuid4().hex)
+            write_new(temporary, json.dumps(profile).encode())
+            os.replace(temporary, work / "profile.json")
+            args = certbot_command(value, work, credential_file, executable)
+            try:
+                result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                        stderr=subprocess.DEVNULL, timeout=1200 + value["propagation_seconds"], check=False)
+            except subprocess.TimeoutExpired:
+                raise AcmeError("acme.provider_timeout") from None
+            if result.returncode:
+                raise AcmeError("acme.certbot_failed_check_private_log")
+        finally:
+            if value["provider"] != "http01":
+                credential_file.unlink(missing_ok=True)
         cert = read_generated(work, "fullchain.pem")
         key = read_generated(work, "privkey.pem")
         # Immutable copies allow validation/publication without changing the
@@ -313,7 +317,7 @@ def certificate_dates(pem: bytes, executable: str | None = None) -> dict:
 
 
 def renewal_request(raw: object) -> dict:
-    if not isinstance(raw, dict) or set(raw) - {"action", "certificate_id", "provider", "environment", "cert_file", "key_file", "dry_run"}:
+    if not isinstance(raw, dict) or set(raw) - {"action", "certificate_id", "provider", "environment", "cert_file", "key_file", "dry_run", "credential_ini_b64"}:
         raise AcmeError("acme.invalid_renewal_request")
     if raw.get("action") != "renew" or raw.get("provider") not in PROVIDERS or raw.get("environment") not in DIRECTORIES:
         raise AcmeError("acme.invalid_renewal_request")
@@ -325,7 +329,20 @@ def renewal_request(raw: object) -> dict:
             raise AcmeError("acme.invalid_renewal_request")
     if type(raw.get("dry_run", False)) is not bool:
         raise AcmeError("acme.invalid_renewal_request")
-    return dict(raw, dry_run=raw.get("dry_run", False))
+    if raw["provider"] != "http01":
+        encoded = raw.get("credential_ini_b64")
+        try:
+            credential_ini = base64.b64decode(encoded, validate=True) if isinstance(encoded, str) else b""
+        except (ValueError, TypeError):
+            credential_ini = b""
+        if not credential_ini or len(credential_ini) > 65536 or b"\x00" in credential_ini:
+            raise AcmeError("acme.invalid_api_credential")
+    else:
+        credential_ini = b""
+    value = dict(raw, dry_run=raw.get("dry_run", False))
+    value["credential_ini"] = credential_ini
+    value.pop("credential_ini_b64", None)
+    return value
 
 
 def renew(raw: dict, certificate_directory: Path, executable: str | None = None) -> dict:
@@ -367,30 +384,37 @@ def renew(raw: dict, certificate_directory: Path, executable: str | None = None)
         if not isinstance(names, list) or not 1 <= len(names) <= 16:
             raise AcmeError("acme.invalid_domains")
         names = [domain(n, wildcard=value["provider"] != "http01") for n in names]
-        # This exact renewal file must have been created by the original issuance.
+        # The renewal config persists, but provider credentials do not. Recreate
+        # the exact path referenced by Certbot only for this invocation.
         read_private(work / "config" / "renewal" / "rustproxy.conf", 65536)
+        credential_file = work / (value["provider"] + ".ini")
         if value["provider"] != "http01":
-            read_private(work / (value["provider"] + ".ini"))
+            credential_file.unlink(missing_ok=True)
+            write_new(credential_file, value["credential_ini"])
         else:
             for path in [certificate_directory / "acme-http01", certificate_directory / "acme-http01" / ".well-known",
                          certificate_directory / "acme-http01" / ".well-known" / "acme-challenge"]:
                 private_directory(path)
-        installed_cert = read_private(certificate_directory / value["cert_file"], MAX_PEM)
-        installed_key = read_private(certificate_directory / value["key_file"], MAX_PEM)
-        # Check dependencies/installed PEM before invoking a CA operation.
-        old_dates = certificate_dates(installed_cert)
-        args = [executable, "renew", "--cert-name", "rustproxy", "--non-interactive",
-                "--no-random-sleep-on-renew", "--no-directory-hooks",
-                "--config-dir", str(work / "config"), "--work-dir", str(work / "work"), "--logs-dir", str(work / "logs")]
-        if value["dry_run"]:
-            args.append("--dry-run")
         try:
-            result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
-                                    stderr=subprocess.DEVNULL, timeout=2100, check=False)
-        except subprocess.TimeoutExpired:
-            raise AcmeError("acme.provider_timeout") from None
-        if result.returncode:
-            raise AcmeError("acme.certbot_failed_check_private_log")
+            installed_cert = read_private(certificate_directory / value["cert_file"], MAX_PEM)
+            installed_key = read_private(certificate_directory / value["key_file"], MAX_PEM)
+            # Check dependencies/installed PEM before invoking a CA operation.
+            old_dates = certificate_dates(installed_cert)
+            args = [executable, "renew", "--cert-name", "rustproxy", "--non-interactive",
+                    "--no-random-sleep-on-renew", "--no-directory-hooks",
+                    "--config-dir", str(work / "config"), "--work-dir", str(work / "work"), "--logs-dir", str(work / "logs")]
+            if value["dry_run"]:
+                args.append("--dry-run")
+            try:
+                result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                        stderr=subprocess.DEVNULL, timeout=2100, check=False)
+            except subprocess.TimeoutExpired:
+                raise AcmeError("acme.provider_timeout") from None
+            if result.returncode:
+                raise AcmeError("acme.certbot_failed_check_private_log")
+        finally:
+            if value["provider"] != "http01":
+                credential_file.unlink(missing_ok=True)
         output = {k: value[k] for k in ("provider", "certificate_id", "environment")}
         output.update(domains=names, changed=False, staged=False, dry_run=value["dry_run"], **old_dates)
         if value["dry_run"]:

scripts/backup.py

@@ -1,9 +1,11 @@
 #!/usr/bin/env python3
-"""Create a private, consistent SQLite backup, including a live database in WAL mode.
-This does not copy source code or accept arbitrary SQL. Restore instructions are in docs/MIGRATION.md.
+"""Legacy SQLite snapshot helper retained for offline release tests.
+
+Operator backups must use `rust-proxy backup create`, which includes the encrypted
+Secret Store key material and all durable data. This script is not a supported
+backup/restore interface after the Secret Store migration.
 """
 from __future__ import annotations
-import argparse
 import hashlib
 import json
 import os
@@ -85,14 +87,10 @@ def backup(data_dir: Path, destination: Path) -> Path:
 
 
 def main() -> None:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--data-dir", type=Path, default=Path("data"))
-    parser.add_argument("destination", type=Path, help="new directory; existing destinations are never overwritten")
-    args = parser.parse_args()
-    try:
-        print(f"Private SQLite and certificate backup created: {backup(args.data_dir, args.destination)}")
-    except (OSError, ValueError, sqlite3.Error, RuntimeError) as error:
-        parser.exit(1, f"Backup failed: {error}\nA partially-created destination must be inspected before reuse.\n")
+    raise SystemExit(
+        "scripts/backup.py is retired for operator backups. "
+        "Use: rust-proxy --data-dir <data-dir> backup create --output <backup.rpb>"
+    )
 
 
 if __name__ == "__main__":

scripts/check_source.py

@@ -16,7 +16,7 @@ def read_cache_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.24.8"
+assert manifest["package"]["version"] == "0.24.9"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -24,14 +24,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.24.8"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.24.9"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.24.8",
-    "CHANGELOG.md": "## 0.24.8",
-    "ROADMAP.md": "## 0.24.8",
-    "AGENTS.md": "Current source version: 0.24.8.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.8",
+    "README.md": "# RustProxy 0.24.9",
+    "CHANGELOG.md": "## 0.24.9",
+    "ROADMAP.md": "## 0.24.9",
+    "AGENTS.md": "Current source version: 0.24.9.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.9",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -53,6 +53,18 @@ for marker in [
     assert marker in update_check_source, marker
 assert 'update version document is too large or incomplete: {error}' in update_check_source
 assert '.context("update version document is too large or incomplete")' not in update_check_source
+for marker in [
+    'tracing::error!(',
+    'MAX_REDIRECTS: usize = 5',
+    'SSL_CERT_FILE',
+    'CURL_CA_BUNDLE',
+    '/usr/local/share/certs/ca-root-nss.crt',
+    'response.status().is_redirection()',
+    'redirect_target(&current, location)',
+    'update version redirect must not downgrade HTTPS to HTTP',
+]:
+    assert marker in update_check_source, marker
+assert 'pub last_error:' not in update_check_source, "update-check errors must not change dashboard/API state"
 for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.8_AUDIT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
     assert (root / name).is_file(), name
 for path in (root / "examples").glob("*.json"):
@@ -200,7 +212,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.24.8"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.24.9"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -486,6 +498,28 @@ db_source = (root / "src/db.rs").read_text()
 acme_source = (root / "src/acme.rs").read_text()
 main_source = (root / "src/main.rs").read_text()
 logging_source = (root / "src/logging.rs").read_text()
+secret_store_source = (root / "src/secret_store.rs").read_text()
+backup_source = (root / "src/backup.rs").read_text()
+config_source = (root / "src/config.rs").read_text()
+acme_worker_source = (root / "scripts/acme_provider.py").read_text()
+for feature_marker in [
+    "AES_256_GCM", "master.key", "O_NOFOLLOW", "migrate_acme_credentials",
+    "secret_store", "SecretMetadata",
+]:
+    assert feature_marker in secret_store_source or feature_marker in db_source, feature_marker
+for feature_marker in [
+    "Argon2", "RPROXYB1", "RPROXYA1", "backup create", "secret-store-key.enc",
+    "validate_backup_version", "stage",
+]:
+    assert feature_marker in backup_source or feature_marker in main_source, feature_marker
+for feature_marker in [
+    "ErrorLogSettings", "ERROR_LOG_QUEUE", "RedactingStderr", "open_error_file",
+    "ErrorLogLayer", "ERROR",
+]:
+    assert feature_marker in logging_source, feature_marker
+assert "pub error_log: crate::logging::ErrorLogSettings" in config_source
+assert "credential_ini_b64" in acme_source and "credential_ini_b64" in acme_worker_source
+assert "finally:" in acme_worker_source and "credential_file.unlink" in acme_worker_source
 for marker in ['certificate_api_credentials', 'upsert_certificate_api_credential', 'revoke_certificate_api_credential', 'verify_certificate_api_credential', '0005_certificate_api.sql', '0006_certificate_api_credentials.sql']:
     assert marker in db_source, marker
 for marker in ['/api/certificate-api', 'certificate_api_credentials', 'certificate_api_operation', '/api/live-logs', 'CertificateApiBearer']:
@@ -509,7 +543,7 @@ assert 'Ok(line) if command_tx.send(line).is_ok()' not in main_source, 'do not m
 assert 'Ok(line) => {' in main_source and 'command_tx.send(line).is_err()' in main_source
 for marker in ['LIVE_STREAM_CAPACITY', 'broadcast::Sender<LogEntry>', 'pub fn subscribe']:
     assert marker in logging_source, marker
-assert 'SCHEMA_VERSION: i64 = 6' in db_source and 'certificate_renewals' in db_source and '0004_admin_preferences.sql' in db_source and '0005_certificate_api.sql' in db_source and '0006_certificate_api_credentials.sql' in db_source
+assert 'SCHEMA_VERSION: i64 = 7' in db_source and 'certificate_renewals' in db_source and '0004_admin_preferences.sql' in db_source and '0005_certificate_api.sql' in db_source and '0006_certificate_api_credentials.sql' in db_source and '0007_secret_store.sql' in db_source
 assert 'load_renewal_observations' not in acme_source and 'renewals.json' not in acme_source
 for marker in ['pub kind: &\'static str', 'pub log_directory: String', 'pub(crate) fn certbot_log_directory', 'kind: "issue"', '"renewal-dry-run"']:
     assert marker in acme_source, marker
@@ -1002,12 +1036,13 @@ connection.executescript((root / "migrations/0003_certificate_renewals.sql").rea
 connection.executescript((root / "migrations/0004_admin_preferences.sql").read_text())
 connection.executescript((root / "migrations/0005_certificate_api.sql").read_text())
 connection.executescript((root / "migrations/0006_certificate_api_credentials.sql").read_text())
-connection.execute("PRAGMA user_version = 6")
+connection.executescript((root / "migrations/0007_secret_store.sql").read_text())
+connection.execute("PRAGMA user_version = 7")
 assert connection.execute("PRAGMA quick_check").fetchone()[0] == "ok"
 assert connection.execute("SELECT COUNT(*) FROM auth_throttle WHERE id=1").fetchone()[0] == 1
 assert connection.execute("SELECT COUNT(*) FROM certificate_renewals").fetchone()[0] == 0
 assert connection.execute("SELECT COUNT(*) FROM admin_preferences").fetchone()[0] == 0
-assert connection.execute("PRAGMA user_version").fetchone()[0] == 6
+assert connection.execute("PRAGMA user_version").fetchone()[0] == 7
 connection.close()
 for marker_0223 in [
     '"/api/certificates/reload"', 'certificate_reload',
@@ -1083,7 +1118,7 @@ assert 'id="process-platform"' in html and 'd.platform' in app_js
 assert 'id="panel-logging"' not in html
 assert 'id="settings-tab-logging"' in html and 'id="settings-page-logging"' in html and 'id="logging-form"' in html
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.24.8"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.24.9"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = (root / "src/tls.rs").read_text()
@@ -1128,5 +1163,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
     node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
     assert "maxItems" not in node, schema_name
 
-print("PASS: 0.24.8 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v6 migrations.")
+print("PASS: 0.24.9 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v7 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

scripts/deploy.py

@@ -97,7 +97,7 @@ def digest(path: Path) -> str:
 def fetch_https(url: str, max_bytes: int) -> bytes:
     if urllib.parse.urlparse(url).scheme != 'https':
         raise ValueError('GeoIP downloads require HTTPS.')
-    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.8'})
+    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.9'})
     with urllib.request.urlopen(request, timeout=30) as response:
         if urllib.parse.urlparse(response.geturl()).scheme != 'https':
             raise ValueError('GeoIP download redirected away from HTTPS.')

scripts/preflight.py

@@ -33,10 +33,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/management.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/migrate_npm.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.24.8 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.24.9 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.24.8 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.24.9 entry point; extract the complete package, not individual files.")
     return messages
 
 

scripts/release_smoke.py

@@ -50,15 +50,16 @@ def sql_and_backup_smoke(tmp: Path) -> None:
         )
         connection.execute("PRAGMA user_version = 3")
         connection.commit()
-        # Simulate additive startup migrations through the current schema-v6.
+        # Simulate additive startup migrations through the current schema-v7.
         connection.executescript((ROOT / "migrations/0004_admin_preferences.sql").read_text(encoding="utf-8"))
         connection.executescript((ROOT / "migrations/0005_certificate_api.sql").read_text(encoding="utf-8"))
         connection.executescript((ROOT / "migrations/0006_certificate_api_credentials.sql").read_text(encoding="utf-8"))
+        connection.executescript((ROOT / "migrations/0007_secret_store.sql").read_text(encoding="utf-8"))
         connection.execute(
             "INSERT INTO admin_preferences(administrator_id,document) VALUES(1,?)",
             (json.dumps({"live_log_columns": ["time", "status"]}),),
         )
-        connection.execute("PRAGMA user_version = 6")
+        connection.execute("PRAGMA user_version = 7")
         connection.commit()
         assert connection.execute("PRAGMA quick_check").fetchone()[0] == "ok"
         tables = {
@@ -67,7 +68,7 @@ def sql_and_backup_smoke(tmp: Path) -> None:
                 "SELECT name FROM sqlite_master WHERE type='table'"
             )
         }
-        for table in ("configuration", "administrator", "admin_sessions", "admin_audit", "auth_throttle", "certificate_renewals", "admin_preferences", "certificate_api_credential", "certificate_api_credentials"):
+        for table in ("configuration", "administrator", "admin_sessions", "admin_audit", "auth_throttle", "certificate_renewals", "admin_preferences", "certificate_api_credential", "certificate_api_credentials", "secret_store"):
             assert table in tables, table
     finally:
         connection.close()
@@ -78,7 +79,7 @@ def sql_and_backup_smoke(tmp: Path) -> None:
     assert copied.is_file()
     metadata = json.loads((destination / "backup.json").read_text(encoding="utf-8"))
     assert metadata["project"] == "RustProxy"
-    assert metadata["schema"] == 6
+    assert metadata["schema"] == 7
     assert metadata["configuration_revision"] == 4
     restored = sqlite3.connect(copied)
     try:
@@ -113,13 +114,13 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.24.8"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.24.9"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
     assert (target / "docker-agent/main.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.24.8"
+    assert manifest["to_version"] == "0.24.9"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -428,6 +429,16 @@ def source_contract_smoke() -> None:
     main = (ROOT / "src/main.rs").read_text(encoding="utf-8")
     server = (ROOT / "src/server.rs").read_text(encoding="utf-8")
     logging = (ROOT / "src/logging.rs").read_text(encoding="utf-8")
+    secret_store = (ROOT / "src/secret_store.rs").read_text(encoding="utf-8")
+    backup = (ROOT / "src/backup.rs").read_text(encoding="utf-8")
+    acme_worker = (ROOT / "scripts/acme_provider.py").read_text(encoding="utf-8")
+    for feature_marker in ["AES_256_GCM", "master.key", "O_NOFOLLOW", "migrate_acme_credentials"]:
+        assert feature_marker in secret_store, feature_marker
+    for feature_marker in ["Argon2", "RPROXYB1", "secret-store-key.enc", "validate_backup_version"]:
+        assert feature_marker in backup, feature_marker
+    for feature_marker in ["ErrorLogSettings", "ERROR_LOG_QUEUE", "RedactingStderr", "open_error_file", "ErrorLogLayer"]:
+        assert feature_marker in logging, feature_marker
+    assert "credential_ini_b64" in acme_worker and "credential_file.unlink" in acme_worker
     cache = read_cache_source()
     settings = (ROOT / "src/settings.rs").read_text(encoding="utf-8")
     websocket = (ROOT / "src/proxy/websocket.rs").read_text(encoding="utf-8")
@@ -495,7 +506,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.8"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.9"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"']:
         assert marker in html, marker
@@ -550,6 +561,9 @@ def source_contract_smoke() -> None:
         assert marker in update_check, marker
     assert 'update version document is too large or incomplete: {error}' in update_check
     assert '.context("update version document is too large or incomplete")' not in update_check
+    for marker in ['tracing::error!(', 'MAX_REDIRECTS: usize = 5', 'SSL_CERT_FILE', 'CURL_CA_BUNDLE', '/usr/local/share/certs/ca-root-nss.crt', 'response.status().is_redirection()', 'redirect_target(&current, location)']:
+        assert marker in update_check, marker
+    assert 'pub last_error:' not in update_check
     for marker in ['RUST_PROXY_UPDATE_REPOSITORY_URL', 'RUST_PROXY_UPDATE_VERSION_URL', 'RUST_PROXY_UPDATE_CHECK_INTERVAL_SECS', 'state.start_update_check(update_check);']:
         assert marker in main, marker
     assert 'pub software_update: Arc<crate::update_check::SharedStatus>' in runtime
@@ -867,7 +881,7 @@ def source_contract_smoke() -> None:
     assert '/Ubuntu%2014.04%20LTS/' in acl and 'repeated_slashes_are_normalized_for_routing' in acl and 'percent_encoded_spaces_are_valid_request_paths' in policies and 'repeated_slashes_route_normally_but_reach_upstream_unchanged' in policies and 'local_location_response_uses_response_rules_without_opening_backend' in policies and 'local_location_response_still_respects_route_acl' in policies
     db_source = (ROOT / "src/db.rs").read_text(encoding="utf-8")
     acme_source = (ROOT / "src/acme.rs").read_text(encoding="utf-8")
-    assert "SCHEMA_VERSION: i64 = 6" in db_source and "certificate_renewals" in db_source and "0004_admin_preferences.sql" in db_source and "0005_certificate_api.sql" in db_source and "0006_certificate_api_credentials.sql" in db_source
+    assert "SCHEMA_VERSION: i64 = 7" in db_source and "certificate_renewals" in db_source and "0004_admin_preferences.sql" in db_source and "0005_certificate_api.sql" in db_source and "0006_certificate_api_credentials.sql" in db_source and "0007_secret_store.sql" in db_source
     assert "load_renewal_observations" not in acme_source and "renewals.json" not in acme_source
     for marker in ["pub kind: &'static str", "pub log_directory: String", "pub(crate) fn certbot_log_directory", 'kind: "issue"', '"renewal-dry-run"']:
         assert marker in acme_source, marker
@@ -936,7 +950,7 @@ def source_contract_smoke() -> None:
     assert "removed_obsolete_runtime_state" in upgrade_source and "legacy-data" not in upgrade_source and "certs_dir.is_symlink()" in upgrade_source
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
-    for marker in ['"version": "0.24.8"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.24.9"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1084,7 +1098,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     debian_grafana_contract_smoke()
-    print("PASS: 0.24.8 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.24.9 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

scripts/routeros-oci-build/README.md

@@ -76,10 +76,10 @@ ENV_FILE=scripts/routeros-oci-build/.env \
   bash scripts/routeros-oci-build/build-routeros-oci.sh push
 ```
 
-With RustProxy version `0.24.8` and the defaults this publishes:
+With RustProxy version `0.24.9` and the defaults this publishes:
 
 ```text
-zot.example.net/network/rustproxy:0.24.8
+zot.example.net/network/rustproxy:0.24.9
 zot.example.net/network/rustproxy:latest
 zot.example.net/network/rustproxy:routeros
 ```

scripts/swagger_assets.py

@@ -85,7 +85,7 @@ def download(destination: Path) -> None:
     """TLS verification uses Python's default trust store; never executes a shell."""
     started = time.monotonic()
     opener = build_opener(HttpsRedirects())
-    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.8"})
+    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.9"})
     with opener.open(request, timeout=30) as response, destination.open("wb") as output:
         length = response.headers.get("Content-Length")
         if length and int(length) > MAX_ARCHIVE:

scripts/upgrade.py

@@ -46,7 +46,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
         for name in MANAGED:
             if (target / name).is_symlink():
                 raise ValueError(f"Managed target {name} is a symlink; refusing to replace it.")
-        backup = target / ".upgrade-backup" / ("before-0.24.8-" + uuid.uuid4().hex[:12])
+        backup = target / ".upgrade-backup" / ("before-0.24.9-" + uuid.uuid4().hex[:12])
         backup.mkdir(parents=True, mode=0o700)
         installed: list[str] = []
         moved: list[str] = []
@@ -84,7 +84,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
             remove_legacy = legacy.exists()
             if remove_legacy and (legacy.is_symlink() or not legacy.is_file()):
                 raise ValueError("Obsolete renewal observation sidecar must be a regular file.")
-            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.8", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
+            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.9", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
             if remove_legacy:
                 legacy.unlink()
         except BaseException:
@@ -115,7 +115,7 @@ def main() -> None:
         backup = upgrade(Path(__file__).resolve().parents[1], args.target, stopped=args.stopped, data_dir=data_dir)
     except (OSError, ValueError) as error:
         parser.exit(2, f"Upgrade refused or rolled back: {error}\n")
-    print(f"Installed RustProxy 0.24.8. Previous managed source files: {backup}")
+    print(f"Installed RustProxy 0.24.9. Previous managed source files: {backup}")
     print("Preserved data, .env, .git, target and other unmanaged files. No database migration was run.")
     print(f"Next: cd {args.target}; ./dev.sh test; ./dev.sh")