v0.34.10

CHANGELOG.md

@@ -1,6 +1,14 @@
 # Changelog
 
-Release history focused on **features, settings, default behavior, compatibility and fixes**. Changes to internal code structure and preliminary performance experiments are intentionally omitted. Historical descriptions reflect their respective releases; consult the current documentation for the settings available in 0.34.9.
+Release history focused on **features, settings, default behavior, compatibility and fixes**. Changes to internal code structure and preliminary performance experiments are intentionally omitted. Historical descriptions reflect their respective releases; consult the current documentation for the settings available in 0.34.10.
+
+## 0.34.10 — path permission helpers and automatic certificate SNI
+
+- **Permission helper appearance:** keep the original compact ACL code-block styling for both certificate paths and Web Server roots, with a quiet copy action. Account selection and extended guidance are collapsed under **Options and help**; generated commands remain below the path fields.
+- **External certificate files:** replace the fixed example ACL block with commands generated from the entered certificate/key paths, placed below both path fields. The helper resolves symlink targets, removes unsafe write/world-read file permissions, grants directory traversal and adds read access for the `rustproxy` service account. Commands remain operator-run; external-path ownership and private-key checks remain enforced.
+- **Certificate SNI:** inspect the actual public certificate after a path/source change and fill legacy SNI names from DNS SAN entries. Preserve manually entered or cleared values and ignore stale asynchronous results. **Read names from certificate** retries a failed read or explicitly refreshes the field after fixing permissions. Inspection does not read the private key or save configuration.
+- **Web Server:** generate document-root permission commands directly below its path, updating them for input, edits, resets and presets. Include parent traversal, read access to the served tree and default ACLs for new content without granting RustProxy write access. The permission walk does not follow child symlinks. PHP-FPM and systemd/MAC policies remain separately managed.
+- **API and documentation:** add a session-authenticated, CSRF-protected certificate inspection endpoint with matching OpenAPI/access regressions; update English/Polish panel text and filesystem guidance. General administration tokens and certificate-only tokens cannot use the inspection endpoint. Package and lockfile are aligned to **0.34.10**; native Cargo and protocol acceptance are still required for this source candidate.
 
 ## 0.34.9 — experimental TLS post-quantum key exchange (source candidate)