v0.27.1

scripts/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.27.0"
+assert manifest["package"]["version"] == "0.27.1"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.27.0"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.27.1"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.27.0",
-    "CHANGELOG.md": "## 0.27.0",
-    "ROADMAP.md": "## 0.27.0",
-    "AGENTS.md": "Current source version: 0.27.0.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.27.0",
+    "README.md": "# RustProxy 0.27.1",
+    "CHANGELOG.md": "## 0.27.1",
+    "ROADMAP.md": "## 0.27.1",
+    "AGENTS.md": "Current source version: 0.27.1.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.27.1",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -113,8 +113,12 @@ for marker in [
     'MODE=update',
     'bash update.sh',
     '--prefix "$PREFIX"',
+    'python3-venv',
+    'python3-pip',
+    'certbot',
     'python3-certbot-dns-rfc2136',
     'python3-certbot-dns-cloudflare',
+    'python3-certbot-dns-ovh',
 ]:
     assert marker in bootstrap, marker
 assert 'curl ' not in bootstrap, 'Debian bootstrap must use wget instead of curl'
@@ -136,12 +140,13 @@ assert "USER rustproxy:rustproxy" in dockerfile
 assert 'VOLUME ["/var/lib/rustproxy"]' in dockerfile
 assert "COPY . ." in dockerfile
 for marker in [
-    "python3 -m venv /opt/rustproxy-certbot",
-    "certbot==5.8.0",
-    "certbot-dns-cloudflare==5.8.0",
-    "certbot-dns-ovh==5.8.0",
-    "certbot-dns-rfc2136==5.8.0",
-    "PATH=/opt/rustproxy-certbot/bin:",
+    "python3-venv",
+    "python3-pip",
+    "certbot",
+    "python3-certbot-dns-cloudflare",
+    "python3-certbot-dns-ovh",
+    "python3-certbot-dns-rfc2136",
+    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 ]:
     assert marker in dockerfile, marker
 assert "data" in (root / ".dockerignore").read_text().splitlines()
@@ -157,6 +162,21 @@ for selector in ["config-history-month", "config-history-day", "config-history-c
 assert ".vhost-chart-line" in css and ".host-chip-editor" in css
 assert 'class="vhost-dialog logging-format-dialog"' in html
 assert 'data-panel="streams"' in html and 'id="panel-streams"' in html
+for marker in ['id="vhost-sort"', 'id="vhost-sort-direction"', 'id="docker-vhost-sort"', 'id="docker-vhost-sort-direction"', 'id="redirect-sort"', 'id="redirect-sort-direction"', 'id="notfound-sort"', 'id="notfound-sort-direction"', 'id="stream-sort"', 'id="stream-sort-direction"']:
+    assert marker in html, marker
+preferences_source = (root / "src/admin/preferences.rs").read_text(encoding="utf-8")
+for marker in ['vhost_list_sort', 'docker_vhost_sort', 'redirect_list_sort', 'notfound_list_sort', 'stream_list_sort', 'VHOST_LIST_SORT_COLUMNS', 'DOCKER_VHOST_SORT_COLUMNS', 'REDIRECT_LIST_SORT_COLUMNS', 'NOTFOUND_LIST_SORT_COLUMNS', 'STREAM_LIST_SORT_COLUMNS']:
+    assert marker in preferences_source, marker
+for source_name, markers in {
+    "src/admin/web/vhosts/render.js": ["vhost_list_sort", "vhost_list_descending"],
+    "src/admin/web/docker.js": ["docker_vhost_sort", "docker_vhost_descending", "sortServiceRows"],
+    "src/admin/web/redirects.js": ["redirect_list_sort", "redirect_list_descending"],
+    "src/admin/web/host404.js": ["notfound_list_sort", "notfound_list_descending"],
+    "src/admin/web/streams.js": ["stream_list_sort", "stream_list_descending"],
+}.items():
+    source_text = (root / source_name).read_text(encoding="utf-8")
+    for marker in markers:
+        assert marker in source_text, (source_name, marker)
 assert 'data-panel="docker-vhosts"' in html and 'id="panel-docker-vhosts"' in html
 assert 'id="settings-tab-docker-agents"' in html and 'id="settings-page-docker-agents"' in html
 assert '/assets/docker.js' in html and 'cache-live-toggle' in html
@@ -267,7 +287,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.27.0"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.27.1"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -537,6 +557,15 @@ for marker in ['function selectTab(name, focus = false, persist = true)', 'log_d
 for marker in ['resetIssueFormJob = value.job?.id || null', 'value.status === "ready"', 'resetIssueForm(); resetIssueFormJob = null', 'value.status === "failed"']:
     assert marker in acme_js, marker
 assert 'render(value.job); resetIssueForm();' not in acme_js, "ACME form must not reset before issuance actually succeeds"
+for marker in ['id="acme-runtime-card"', 'id="acme-runtime-message"', 'id="acme-runtime-state"', 'id="acme-runtime-path"']:
+    assert marker in html, marker
+for marker in ['function renderRuntime(value)', 'runtimeAvailable', 'certificateRuntimeUnavailable', 'acme.runtime_checking']:
+    assert marker in acme_js, marker
+assert 'rust-proxy --data-dir ./data admin setup-token' in html
+assert 'rust-proxy --data-dir /var/lib/rustproxy admin setup-token' in html
+login_html_source = (root / "src/admin/web/login.html").read_text(encoding="utf-8")
+assert 'rust-proxy --data-dir ./data admin setup-token' in login_html_source
+assert 'rust-proxy --data-dir /var/lib/rustproxy admin setup-token' in login_html_source
 login_js = (root / "src/admin/web/login.js").read_text()
 assert 'const panelPaths = new Set' in login_js and 'panelPaths.has(location.pathname)' in login_js
 assert '"/404-hosts"' in login_js
@@ -558,6 +587,20 @@ h2_settings_controls = integrations_js.split('function http2SettingsControls', 1
 assert 'listener-h2' not in h2_settings_controls, 'HTTP/2 enablement belongs to the listener editor, not the tuning page'
 h3_settings_controls = integrations_js.split('function http3SettingsControls', 1)[1].split('function addRow', 1)[0]
 assert 'h3Enable' not in h3_settings_controls, 'HTTP/3 enablement belongs to the listener editor, not the tuning page'
+for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'id="about-python-runtime"', 'id="runtime-python"', 'id="acme-runtime-components"']:
+    assert marker in html, marker
+for language in ['langs/en_US.json', 'langs/pl_pl.json']:
+    language_text = (root / language).read_text(encoding='utf-8')
+    assert './dev.sh tls deploy' not in language_text
+    assert '/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy' in language_text
+startup_source = rust_source(root, 'src/main/admin_runtime.rs')
+for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'join("acme-python")', 'certificate_runtime']:
+    assert marker in startup_source, marker
+for document in ['docs/RENEWAL.md', 'docs/INSTALL.md', 'docs/API.md']:
+    document_text = (root / document).read_text(encoding='utf-8')
+    assert './dev.sh tls deploy' not in document_text
+    assert '/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy' in document_text
+assert '"certificate_runtime": state.acme.runtime_view()' in rust_source(root, 'src/admin/status.rs')
 assert 'data-i18n="processDiagnostics">Process<' in html
 for marker in ['function setOptionalMetric', 'setOptionalMetric("process-rss-anon"', 'setOptionalMetric("system-swap"', 'closest(".mini-live-chart").hidden']:
     assert marker in app_js, marker
@@ -565,6 +608,11 @@ for marker in ['/api/certificate-api', 'certificate-api-form', 'certificate-api-
     assert marker in settings_js or marker in html, marker
 db_source = rust_source(root, "src/db.rs")
 acme_source = rust_source(root, "src/acme.rs")
+acme_runtime_source = (root / "src/acme/runtime_env.rs").read_text(encoding="utf-8")
+assert 'runtime_setup_once' in acme_source
+assert 'include!("acme/runtime_env.rs")' in (root / "src/acme.rs").read_text(encoding="utf-8")
+for marker in ['CERTBOT_PACKAGES', 'certbot==5.8.0', 'certbot-dns-cloudflare==5.8.0', 'certbot-dns-ovh==5.8.0', 'certbot-dns-rfc2136==5.8.0', 'join("acme-python")', 'virtualenv>=20,<21', 'system_has_pip', 'distro_certbot_available', 'acme.runtime_python_missing', 'acme.runtime_pip_missing']:
+    assert marker in acme_runtime_source, marker
 main_source = rust_source(root, "src/main.rs")
 logging_source = rust_source(root, "src/logging.rs")
 secret_store_source = rust_source(root, "src/secret_store.rs")
@@ -636,6 +684,7 @@ assert 'load_renewal_observations' not in acme_source and 'renewals.json' not in
 for marker in ['pub kind: &\'static str', 'pub log_directory: String', 'pub(crate) fn certbot_log_directory', 'kind: "issue"', '"renewal-dry-run"']:
     assert marker in acme_source, marker
 assert '"log_directories":log_directories' in admin and 'crate::acme::certbot_log_directory' in admin
+assert '"runtime":state.acme.runtime_view()' in admin
 assert 'let cert_dir = Some(directory.clone());' in main_source, 'certificate directory must remain available after ValidationPolicy construction'
 assert 'accept-remote-admin-risk' in main_source and 'hide = true' in main_source
 for marker in [
@@ -767,7 +816,7 @@ assert any(variable.get('name') == 'traffic_vhost' for variable in grafana['temp
 assert any(panel.get('title') == 'Traffic analytics and Web Server' for panel in grafana['panels'])
 assert any(panel.get('title') == 'Traffic capture state' for panel in grafana['panels'])
 assert any(panel.get('title') == 'Top configured routes' for panel in grafana['panels'])
-# 0.27.0 compression/protocol/dashboard UX regressions.
+# 0.27.1 compression/protocol/dashboard UX regressions.
 compression_source = rust_source(root, "src/compression.rs")
 metrics_source = rust_source(root, "src/metrics.rs")
 admin_source = rust_source(root, "src/admin/mod.rs")
@@ -1324,7 +1373,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.27.0"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.27.1"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1369,5 +1418,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
     node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
     assert "maxItems" not in node, schema_name
 
-print("PASS: 0.27.0 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
+print("PASS: 0.27.1 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

scripts/deploy_core.py

@@ -97,7 +97,7 @@ def digest(path: Path) -> str:
 def fetch_https(url: str, max_bytes: int) -> bytes:
     if urllib.parse.urlparse(url).scheme != 'https':
         raise ValueError('GeoIP downloads require HTTPS.')
-    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.27.0'})
+    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.27.1'})
     with urllib.request.urlopen(request, timeout=30) as response:
         if urllib.parse.urlparse(response.geturl()).scheme != 'https':
             raise ValueError('GeoIP download redirected away from HTTPS.')
@@ -316,7 +316,7 @@ WorkingDirectory={data}
 UMask=0077
 Environment=RUST_LOG=rust_proxy=info,warn
 Environment=MALLOC_ARENA_MAX=2
-Environment=PATH=/opt/rustproxy-certbot/bin:/usr/local/bin:/usr/bin:/bin
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
 EnvironmentFile=-/etc/rustproxy/environment
 ExecStart={args}
 Restart=on-failure

scripts/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.27.0 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.27.1 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -14,6 +14,7 @@ required = [
     DOCS / "README.md",
     DOCS / "WEB_SERVER.md",
     DOCS / "TODO.md",
+    DOCS / "V0.27.1_IMPLEMENTATION.md",
     DOCS / "V0.27.0_IMPLEMENTATION.md",
     DOCS / "V0.26.7_IMPLEMENTATION.md",
     DOCS / "V0.25.5_AUDIT.md",
@@ -57,16 +58,16 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.27.0")
+assert readme.startswith("# RustProxy 0.27.1")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme
-assert roadmap.startswith("# RustProxy roadmap") and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
+assert roadmap.startswith("# RustProxy roadmap") and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
 assert "## 0.24." not in roadmap and "## Web Server follow-up" in roadmap and "docs/ROADMAP_HISTORY.md" in roadmap
 assert changelog.startswith("# Changelog\n")
-for release in ["0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]:
+for release in ["0.27.1", "0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]:
     assert f"## {release}" in changelog, release
-assert changelog.index("## 0.27.0") < changelog.index("## 0.26.7") < changelog.index("## 0.26.6") < changelog.index("## 0.26.5") < changelog.index("## 0.26.4") < changelog.index("## 0.26.1") < changelog.index("## 0.26.0") < changelog.index("## 0.25.6") < changelog.index("## 0.25.5")
+assert changelog.index("## 0.27.1") < changelog.index("## 0.27.0") < changelog.index("## 0.26.7") < changelog.index("## 0.26.6") < changelog.index("## 0.26.5") < changelog.index("## 0.26.4") < changelog.index("## 0.26.1") < changelog.index("## 0.26.0") < changelog.index("## 0.25.6") < changelog.index("## 0.25.5")
 assert "CHANGELOG_TECHNICAL_ARCHIVE.md" in changelog
 for developer_only in ["Clean the remaining compiler warnings", "Update package/source/UI/OpenAPI/release identity", "source regressions and update release identity"]:
     assert developer_only not in changelog, f"developer-only CHANGELOG detail: {developer_only}"

scripts/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "scripts/docs_check.py", "scripts/web_server_contracts.py", "scripts/rust_source.py", "scripts/rust_module_contracts.py", "scripts/source_module_contracts.py", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/deploy_core.py", "scripts/deploy_runtime.py", "scripts/migrate_npm.py", "scripts/migrate_npm_core.py", "scripts/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.27.0 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.27.1 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.27.0 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.27.1 entry point; extract the complete package, not individual files.")
     return messages
 
 

scripts/release_smoke.py

@@ -123,7 +123,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.27.0"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.27.1"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -134,7 +134,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.27.0"
+    assert manifest["to_version"] == "0.27.1"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -403,8 +403,37 @@ def ui_contract_smoke() -> None:
         assert marker in vhosts, marker
     assert 'rustproxy-backend-table-v1' not in vhosts and 'poolTablePreferenceKey' not in vhosts
     assert 'window.rustProxyPreferences.update({' in vhosts and 'backend_table_sort' in vhosts and 'backend_table_descending' in vhosts
+    for marker in ['id="vhost-sort"', 'id="vhost-sort-direction"', 'id="docker-vhost-sort"', 'id="docker-vhost-sort-direction"', 'id="redirect-sort"', 'id="redirect-sort-direction"', 'id="notfound-sort"', 'id="notfound-sort-direction"', 'id="stream-sort"', 'id="stream-sort-direction"']:
+        assert marker in html, marker
+    preferences_source = (ROOT / 'src/admin/preferences.rs').read_text(encoding='utf-8')
+    for marker in ['vhost_list_sort', 'docker_vhost_sort', 'redirect_list_sort', 'notfound_list_sort', 'stream_list_sort']:
+        assert marker in preferences_source, marker
+    assert 'vhost_list_sort' in vhosts and 'vhost_list_descending' in vhosts
+    list_sort_sources = {
+        'docker': (ROOT / 'src/admin/web/docker.js').read_text(encoding='utf-8'),
+        'redirects': (ROOT / 'src/admin/web/redirects.js').read_text(encoding='utf-8'),
+        'notfound': (ROOT / 'src/admin/web/host404.js').read_text(encoding='utf-8'),
+        'streams': (ROOT / 'src/admin/web/streams.js').read_text(encoding='utf-8'),
+    }
+    assert 'docker_vhost_sort' in list_sort_sources['docker'] and 'sortServiceRows' in list_sort_sources['docker']
+    assert 'redirect_list_sort' in list_sort_sources['redirects']
+    assert 'notfound_list_sort' in list_sort_sources['notfound']
+    assert 'stream_list_sort' in list_sort_sources['streams']
     for marker in ['id="pool-search"', 'id="pool-sort"', 'data-pool-column-toggle="vhost"']:
         assert marker in html, marker
+    for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'id="about-python-runtime"', 'id="runtime-python"', 'id="acme-runtime-components"']:
+        assert marker in html, marker
+    for language in ['langs/en_US.json', 'langs/pl_pl.json']:
+        text = (ROOT / language).read_text(encoding='utf-8')
+        assert './dev.sh tls deploy' not in text
+        assert '/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy' in text
+    startup_source = (ROOT / 'src/main/admin_runtime.rs').read_text(encoding='utf-8')
+    for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'join("acme-python")', 'certificate_runtime']:
+        assert marker in startup_source, marker
+    for document in ['docs/RENEWAL.md', 'docs/INSTALL.md', 'docs/API.md']:
+        document_text = (ROOT / document).read_text(encoding='utf-8')
+        assert './dev.sh tls deploy' not in document_text
+        assert '/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy' in document_text
     style = (ROOT / "src/admin/web/style.css").read_text(encoding="utf-8")
     for marker in ['--scrollbar-thumb', '*::-webkit-scrollbar-thumb', '.backend-table-tools', '.vhost-quick-toggle', '.dashboard-widget-toggle', '--toolbar-control-height: min(var(--button-min-height), var(--ui-field-min-height))', 'height: var(--toolbar-control-height)']:
         assert marker in style, marker
@@ -428,6 +457,10 @@ def ui_contract_smoke() -> None:
     assert 'id="certificate-dialog"' not in html and 'id="certificate-close"' not in html
     for marker in ['function selectTab(name, focus = false, persist = true)', 'log_directories', 'certbotLogs', 'value?.kind?.startsWith("renewal")']:
         assert marker in acme_ui, marker
+    for marker in ['id="acme-runtime-card"', 'id="acme-runtime-message"', 'id="acme-runtime-state"', 'id="acme-runtime-path"', 'rust-proxy --data-dir ./data admin setup-token', 'rust-proxy --data-dir /var/lib/rustproxy admin setup-token']:
+        assert marker in html, marker
+    for marker in ['function renderRuntime(value)', 'runtimeAvailable', 'certificateRuntimeUnavailable']:
+        assert marker in acme_ui, marker
     for marker in ['.certificate-operation-card', '.renewal-meta', '#panel-tls .certificate-tabs']:
         assert marker in css, marker
     login = (ROOT / "src/admin/web/login.js").read_text(encoding="utf-8")
@@ -571,7 +604,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.27.0"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.27.1"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -946,6 +979,11 @@ def source_contract_smoke() -> None:
     assert '/Ubuntu%2014.04%20LTS/' in acl and 'repeated_slashes_are_normalized_for_routing' in acl and 'percent_encoded_spaces_are_valid_request_paths' in policies and 'repeated_slashes_route_normally_but_reach_upstream_unchanged' in policies and 'local_location_response_uses_response_rules_without_opening_backend' in policies and 'local_location_response_still_respects_route_acl' in policies
     db_source = rust_source(ROOT, "src/db.rs")
     acme_source = rust_source(ROOT, "src/acme.rs")
+    acme_runtime = (ROOT / "src/acme/runtime_env.rs").read_text(encoding="utf-8")
+    assert 'runtime_setup_once' in acme_source
+    assert 'include!("acme/runtime_env.rs")' in (ROOT / 'src/acme.rs').read_text(encoding='utf-8')
+    for marker in ['CERTBOT_PACKAGES', 'join("acme-python")', 'virtualenv>=20,<21', 'distro_certbot_available', 'acme.runtime_python_missing', 'acme.runtime_pip_missing']:
+        assert marker in acme_runtime, marker
     assert "SCHEMA_VERSION: i64 = 8" in db_source and "certificate_renewals" in db_source and "0004_admin_preferences.sql" in db_source and "0005_certificate_api.sql" in db_source and "0006_certificate_api_credentials.sql" in db_source and "0007_secret_store.sql" in db_source and "0008_config_history.sql" in db_source
     runtime_source = rust_source(ROOT, "src/runtime.rs")
     assert 'replace_as_restore' in db_source and 'config.restore' in db_source and 'source_revision' in db_source
@@ -955,6 +993,8 @@ def source_contract_smoke() -> None:
     for marker in ["pub kind: &'static str", "pub log_directory: String", "pub(crate) fn certbot_log_directory", 'kind: "issue"', '"renewal-dry-run"']:
         assert marker in acme_source, marker
     assert '"log_directories":log_directories' in admin and 'crate::acme::certbot_log_directory' in admin
+    assert '"runtime":state.acme.runtime_view()' in admin
+    assert '"certificate_runtime": state.acme.runtime_view()' in rust_source(ROOT, 'src/admin/status.rs')
     assert "store.load_certificate_renewals().await?" in main and "state.acme.restore_renewals(renewal_observations)" in main
     assert 'accept-remote-admin-risk' in main and 'hide = true' in main
     settings_rust = rust_source(ROOT, 'src/settings.rs')
@@ -1047,7 +1087,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.27.0"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.27.1"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1120,12 +1160,13 @@ def container_contract_smoke() -> None:
         "cargo generate-lockfile",
         "cargo build --locked --release",
         "FROM debian:trixie-slim AS runtime",
-        "python3 -m venv /opt/rustproxy-certbot",
-        "certbot==5.8.0",
-        "certbot-dns-cloudflare==5.8.0",
-        "certbot-dns-ovh==5.8.0",
-        "certbot-dns-rfc2136==5.8.0",
-        "PATH=/opt/rustproxy-certbot/bin:",
+        "python3-venv",
+        "python3-pip",
+        "certbot",
+        "python3-certbot-dns-cloudflare",
+        "python3-certbot-dns-ovh",
+        "python3-certbot-dns-rfc2136",
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
         "USER rustproxy:rustproxy",
         'VOLUME ["/var/lib/rustproxy"]',
     ]:
@@ -1211,7 +1252,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.27.0 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.27.1 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

scripts/swagger_assets.py

@@ -85,7 +85,7 @@ def download(destination: Path) -> None:
     """TLS verification uses Python's default trust store; never executes a shell."""
     started = time.monotonic()
     opener = build_opener(HttpsRedirects())
-    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.27.0"})
+    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.27.1"})
     with opener.open(request, timeout=30) as response, destination.open("wb") as output:
         length = response.headers.get("Content-Length")
         if length and int(length) > MAX_ARCHIVE:

scripts/upgrade.py

@@ -46,7 +46,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
         for name in MANAGED:
             if (target / name).is_symlink():
                 raise ValueError(f"Managed target {name} is a symlink; refusing to replace it.")
-        backup = target / ".upgrade-backup" / ("before-0.27.0-" + uuid.uuid4().hex[:12])
+        backup = target / ".upgrade-backup" / ("before-0.27.1-" + uuid.uuid4().hex[:12])
         backup.mkdir(parents=True, mode=0o700)
         installed: list[str] = []
         moved: list[str] = []
@@ -84,7 +84,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
             remove_legacy = legacy.exists()
             if remove_legacy and (legacy.is_symlink() or not legacy.is_file()):
                 raise ValueError("Obsolete renewal observation sidecar must be a regular file.")
-            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.27.0", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
+            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.27.1", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
             if remove_legacy:
                 legacy.unlink()
         except BaseException:
@@ -115,7 +115,7 @@ def main() -> None:
         backup = upgrade(Path(__file__).resolve().parents[1], args.target, stopped=args.stopped, data_dir=data_dir)
     except (OSError, ValueError) as error:
         parser.exit(2, f"Upgrade refused or rolled back: {error}\n")
-    print(f"Installed RustProxy 0.27.0. Previous managed source files: {backup}")
+    print(f"Installed RustProxy 0.27.1. Previous managed source files: {backup}")
     print("Preserved data, .env, .git, target and other unmanaged files. No database migration was run.")
     print(f"Next: cd {args.target}; ./dev.sh test; ./dev.sh")
 

scripts/web_server_contracts.py

@@ -96,7 +96,7 @@ need(web,
      'HeaderValue::from_static("no-store")',
      "builtin_error_response(StatusCode::FORBIDDEN, &method)",
      "empty_index_can_go_directly_to_directory_listing",
-     "RustProxy <b>0.27.0</b>",
+     "RustProxy <b>0.27.1</b>",
      "traversal_and_symlink_escape_are_not_served",
      "try_files_rewrites_cache_rules_headers_and_downloads_work",
      "precompressed_sidecars_keep_mime_validators_and_range_semantics",