v0.27.3

README.md

@@ -1,9 +1,9 @@
-# RustProxy 0.27.2
+# RustProxy 0.27.3
 
 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.27.2 release source.**
+**0.27.3 release source.**
 
 ## Layer-4 streams
 
@@ -11,14 +11,18 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
-## What changed in 0.27.2
+## What changed in 0.27.3
 
-- Fix ACME issuance and renewal with the RustProxy-managed Python environment introduced in 0.27.1.
-- Run managed Certbot through the final venv interpreter (`acme-python/bin/python -m certbot`) instead of the pip console script whose shebang still points at the temporary `acme-python.installing` directory after the atomic rename.
-- Validate the managed runtime through the same module launch path, so an existing 0.27.1 `acme-python` directory starts working immediately after upgrade; no manual venv deletion/rebuild is required.
-- Keep the distribution Certbot fallback, SQLite schema 8 and saved configuration format unchanged.
+- Treat body-less `HEAD` requests consistently on HTTP/2 and HTTP/3 cache paths. HTTP/3 `HEAD` now gets the same bounded empty-body probe as `GET`, preventing false `request_body` bypasses.
+- Reduce COLD-cache RAM usage without changing the on-disk cache format: response headers and validators are loaded only on an actual COLD read, SHA-256 digests are stored as 32-byte values in the in-memory index, and the duplicate cache key is removed from each COLD entry.
+- Reduce rate-limit/IP memory retention by storing each vhost name once, reclaiming expired client buckets during traffic and periodic maintenance, and shrinking sparse hash tables before the existing allocator trim runs.
+- Exclude the rebuildable managed Certbot environments `acme-python` and `acme_python` from application backups.
+- Keep response compression streaming with no full-body aggregation. Compression uses the fastest codec level and keeps only per-active-response encoder state, so it is not a long-lived cache-like RAM owner.
+- Make the DEB/RPM and OPNsense package repositories the documented official installation paths; Debian source builds remain available as an optional path.
+- Separate application-coupled scripts (`scripts/`) from developer/operator helpers (`tools/`) and external platform integrations (`integrations/`) without changing runtime behavior.
+- Keep SQLite schema 8, the COLD on-disk format and the saved configuration format unchanged.
 
-0.27.2 retains the 0.27.1 first-admin, managed-runtime UI and route-list sorting changes plus the 0.27.0 proxy/compression and Docker-publication behavior. Historical details are in [CHANGELOG.md](CHANGELOG.md).
+0.27.3 retains the 0.27.2 managed-ACME repair and earlier administration/proxy behavior. Historical details are in [CHANGELOG.md](CHANGELOG.md).
 
 ### Historical 0.26.7 release notes
 
@@ -36,7 +40,7 @@ Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost
 - Keep backend diagnostics visible-column selection, sort key and sort direction synchronized with the account-scoped administrator preferences whenever preferences are loaded or updated.
 - Clear the ACME certificate-creation form after the issuance job finishes successfully, so successful certificates do not leave stale values while failed jobs keep the non-secret form values available for correction.
 - Compose explicit IP allows and **Allow only** countries as alternatives inside one ACL policy scope. Explicit IP denies and blocked countries still win, and profile/vhost/location scopes remain cumulative. This makes `default=deny` support private CIDRs **or** selected countries as intended.
-- Document the sibling `migrate_npm_core.py` and `migrate_npm_api.py` modules required by `scripts/migrate_npm.py`, and fix the container example to mount the complete `scripts` directory.
+- Document the sibling `migrate_npm_core.py` and `migrate_npm_api.py` modules required by `scripts/migration/migrate_npm.py`, and fix the container example to mount the dedicated `scripts/migration` directory.
 - Detect the Linux runtime environment in Process diagnostics. LXC reports `Linux / LXC` and overrides system uptime with PID 1 age plus load average from the container-visible `/proc/loadavg`; VM/host/Docker and other Linux environments keep the existing host statistics path.
 - Keep SQLite schema 8 and the saved proxy configuration format unchanged; upgrading from 0.26.5 requires no data migration.
 
@@ -86,7 +90,7 @@ Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost
 - Replace backend sort text (`A-Z` / `Z-A`) with direction arrows (`↑` / `↓`).
 - Keep SQLite schema 8 and the saved proxy configuration format unchanged; upgrading from 0.26.1 requires no data migration.
 
-The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.27.2 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md).
+The detailed 0.25.5 implementation audit remains available as historical baseline evidence. Current 0.27.3 verification status is maintained in [docs/TEST_REPORT.md](docs/TEST_REPORT.md).
 
 ## Documentation
 
@@ -118,9 +122,19 @@ Read [installation and update](docs/INSTALL.md), [host access and locations](doc
 Examples are disposable full configurations: applying one replaces, not merges,
 an existing document.
 
-## Requirements and first build
+## Installation and source build
 
-### Debian 13+ one-line install/update
+### Official package repositories
+
+The preferred installation/update path is the project-maintained package repositories:
+
+- **DEB/RPM packages:** `https://rustproxy.linuxiarz.pl/`
+- **OPNsense plugin:** `https://rustproxy-opn.linuxiarz.pl/`
+
+Use the repository instructions appropriate for the target operating system. Building on Debian is
+kept as an optional source/development path rather than the primary installation method.
+
+### Optional: Debian 13+ one-line source install/update
 
 The bootstrap installs the compiler/build dependencies and Rust, clones this repository and
 builds the locked release. With no argument it runs in `auto` mode: a host without a managed
@@ -164,9 +178,9 @@ CARGO_BUILD_JOBS=1 CARGO_PROFILE_RELEASE_LTO=false \
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS=8 cargo build --release --locked
 ```
 
-Ready Debian packages are published separately at `https://rustproxy.linuxiarz.pl`; Debian package-build metadata is intentionally not shipped in this source tree.
+Package-build metadata remains outside this source tree and is maintained with the official package repositories above.
 
-The 0.27.2 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
+The 0.27.3 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
 updates only this package's own version entry. This packaging environment has no Cargo, so the
 dependency graph was not re-resolved here. On the compiler-enabled deployment host, run the
 locked check/test/release gates below and retain the verified lockfile. `dev.sh` can generate a
@@ -381,7 +395,7 @@ bash dev.sh
 ```
 
 The supported operator backup is the password-encrypted `rust-proxy backup create`
-command. `scripts/backup.py` is retained only as an offline release-test helper and
+command. `tools/legacy/backup.py` is retained only as an offline release-test helper and
 must not be used as a Secret Store backup. See
 [Secret Store and encrypted backup/restore](docs/SECRET_STORE_BACKUP.md).
 
@@ -398,6 +412,16 @@ behavior when omitted. Once a 0.25.3 configuration containing the new fields is
 binary may reject unknown configuration fields. Roll back using the pre-upgrade data backup as
 well as the old source, not just the binary.
 
+## Source helper layout
+
+`script` responsibilities are intentionally separated:
+
+- `scripts/runtime`, `scripts/build`, `scripts/deploy`, `scripts/migration` are coupled to application/build/deployment behavior;
+- `tools/checks`, `tools/dev`, `tools/audit`, `tools/legacy` are auxiliary tools and are not needed by the running proxy;
+- `integrations/` contains external platform helpers such as OPNsense ACME and RouterOS OCI tooling.
+
+See `scripts/README.md`, `tools/README.md` and `integrations/README.md`.
+
 ## Documentation and checks
 
 [documentation index](docs/README.md), [API](docs/API.md), [architecture](docs/ARCHITECTURE.md),
@@ -407,12 +431,12 @@ well as the old source, not just the binary.
 
 ```bash
 # Rust-independent checks:
-python3 scripts/check_source.py
-python3 scripts/release_smoke.py
+python3 tools/checks/check_source.py
+python3 tools/checks/release_smoke.py
 # Runs those checks first, then the Rust suite when Cargo is available:
 bash dev.sh test
 # Source-only package, with no Git checkout required:
-python3 make_zip.py /tmp/RustProxy-0.27.2.zip
+python3 make_zip.py /tmp/RustProxy-0.27.3.zip
 ```
 
 ## New management and test-origin guide