v.34.5_fix_systemd

CHANGELOG.md

@@ -10,6 +10,14 @@ Release history focused on **features, settings, default behavior, compatibility
 
 ## 0.34.5 — Administration UX improvements (source candidate)
 
+- **Linux deployment/package filesystem access:** packaged and manually generated
+  systemd services now use `ProtectHome=read-only` rather than `true` so a
+  Web Server can read `/home` and other external document roots using Unix
+  groups/ACLs without per-host systemd overrides. `ProtectSystem=strict`,
+  the dedicated service account, private state/log paths and certificate
+  ownership/symlink validation remain in place. New DEB/RPM units require a
+  packaging rebuild; no installed service is changed by this source archive.
+
 - **Web Server → Delivery:** separated static-file delivery, dynamic compression/codecs and precompressed `.br`/`.gz` sidecar controls into individually labelled settings groups. Existing options, defaults and configuration keys remain unchanged.
 - **Web Server → PHP-FPM:** grouped profile and endpoint selection, request behavior, timeouts/capacity, and FastCGI/php.ini overrides. Disabled inputs, selectors and textareas now share a clear inactive appearance when PHP is off or controlled by a shared profile.
 - **Streams → Backends:** split backend routing/capacity from health checks. Probe timing and UDP payload fields appear only when a health-check mode is selected; hidden controls retain their values and cannot block form validation.