v0.34.16

README.md

@@ -1,7 +1,14 @@
-# RustProxy 0.34.15
+# RustProxy 0.34.16
 
 RustProxy combines a reverse proxy, static/PHP web server, certificate management and traffic monitoring in one service with a browser administration panel. It supports several domains and backends without requiring a separate proxy configuration language.
 
+## Changes in 0.34.16
+
+- Separated **identity provider** from **integration method** in Vhost Authentication: Tinyauth, Authelia or authentik can use Forward Auth or OIDC; Pocket ID and compatible custom providers use OIDC. HTTP Basic remains its own method. The `authentication` field stores the pair, with legacy Vhost JSON still supported.
+- Added optional OIDC Authorization Code + PKCE for a central HTTPS identity provider used by applications on unrelated domains.
+- OIDC uses discovery, optional internal IdP routing, JWKS signature validation, nonce/state checks, encrypted host-only sessions and an application-host callback at `/_rustproxy/oidc/callback`. Other authentication integrations are unchanged.
+- This is a source candidate; Rust build and real IdP integration tests are required before production deployment. An IdP also needs an OIDC client registered with the exact HTTPS application callback; ordinary Forward Auth configuration is not enough.
+
 ## Changes in 0.34.15
 
 - Added **Authelia** and **authentik** as separate, disabled-by-default Vhost authentication methods alongside existing Tinyauth and HTTP Basic Auth. Each Vhost selects at most one provider; older Vhost JSON imports keep their settings.
@@ -20,7 +27,7 @@ RustProxy combines a reverse proxy, static/PHP web server, certificate managemen
 | Reverse proxy | HTTP/HTTPS origins, HTTP/1.1 and HTTP/2 upstream modes, health checks, load balancing, connection reuse, WebSockets, path-based routing, retries and error fallbacks |
 | Frontends | HTTP, HTTPS, HTTP/2, optional HTTP/3 (QUIC), named listeners, domain and wildcard routing, redirects, TLS certificates |
 | Web Server | Static content, downloads, directory/index policy, rewrite and `try_files`, selected `.htaccess` rules, optional PHP-FPM, application presets |
-| Access | IP/CIDR and DNS/DDNS rules, country restrictions, reusable ACLs, rate limits, method rules, Basic Auth, Tinyauth, Authelia and authentik, security headers |
+| Access | IP/CIDR and DNS/DDNS rules, country restrictions, reusable ACLs, rate limits, method rules, Basic Auth, Tinyauth/Authelia/authentik via Forward Auth, and optional OIDC with Authelia/authentik/Pocket ID/compatible providers, security headers |
 | Delivery | Optional shared HOT/RAM and COLD/disk cache, cache invalidation, compression, response transformations, static-file optimizations |
 | Integrations | Docker discovery via separate agents, TCP/UDP Streams, ACME certificate providers, Prometheus, Grafana/Nagios examples and administration API |
 | Operations | Dashboard presets, traffic analytics, live/stored logs, configuration history, encrypted backups and certificate reloads |