v0.25.1

README.md

@@ -1,9 +1,9 @@
-# RustProxy 0.25.0
+# RustProxy 0.25.1
 
 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.25.0 release source.**
+**0.25.1 release source.**
 
 ## Layer-4 streams
 
@@ -11,27 +11,13 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
-## What changed in 0.25.0
+## What changed in 0.25.1
 
-- Add reusable **Web Services** configured independently from vhosts. Each service owns its document root, optional ordered index-file list and directory-listing policy.
-- Let the main vhost source and every custom location choose **Reverse Proxy** or **Web Server**, with Web Server locations referencing an existing Web Service instead of duplicating filesystem settings. A single vhost can mix static files and reverse-proxied applications.
-- Add static `GET`/`HEAD`, MIME types, `Content-Length`, streaming file bodies, index lookup, directory slash redirects and optional escaped directory listings.
-- Add HTTP validators (`ETag`, `Last-Modified`, `If-None-Match`, `If-Modified-Since`) plus one-range `Range`/`If-Range` handling with `206` and `416`.
-- Confine local files to the configured document root with decoded-path validation and race-resistant Unix `openat`; symlinks are denied by default, with an explicit Linux-only static mode that follows only targets verified inside the root.
-- Keep ACL/authentication, headers, security headers, custom error pages, compression and H1/H2/H3 transport in the existing vhost pipeline. The Web Server adds no second URL router, error-page subsystem or object cache.
-- Add the **Web Server** dashboard workspace, API/OpenAPI schema, Polish/English UI strings, regression tests and dedicated operator documentation.
-- Add Web Service MIME overrides, a fallback MIME type and optional `Cache-Control`; keep static data in filesystem/OS page cache instead of duplicating it into the reverse-proxy object cache.
-- Expand Web Services with ordered `try_files`, internal/redirect rewrite rules, per-extension/MIME cache policy, fixed source headers, precompressed `.br`/`.gz` sidecars, forced-download extensions, Linux inside-root symlink policy and bounded FastCGI/PHP-FPM execution. PHP-FPM configuration supports Unix/loopback-TCP endpoint syntax, Authorization forwarding control, streaming body/header/stderr limits, trusted custom FastCGI parameters and validated `PHP_VALUE` overrides. Organize these settings into General, Routing, .htaccess, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs using the same compact sticky modal-tab pattern as the Vhost editor.
-- Fix repeated directory-listing refreshes, keep index-before-listing behavior per directory, and expose vhost-wide Web Server request/active/error/EWMA/traffic statistics.
-- Split **Settings -> Logging** into Outputs, JSON format and Error log subsections in the same in-card sub-tab layout as Cache and accept route/cache/transform effective fields in custom JSON mappings.
-- Add bounded per-vhost **Traffic** analytics with top countries, User-Agents, effective client IPs, paths, routes, methods, status classes and cache outcomes plus donut charts for the main dimensions. User-Agent capture is enabled by default; country capture/GeoIP lookup is explicit and disabled by default unless a country ACL/rate-limit already requires GeoIP.
-- Keep Web Service lists stable across fast dashboard refreshes and return the normal customizable `403` page when a directory has neither an index nor directory listing.
-- Add a bounded migration-oriented `.htaccess` compatibility layer with common rewrite/front-controller, index/listing, MIME, header, Expires and PHP `AddHandler` support; compile files on Web Service Apply, fail closed on unsupported access/handler directives, and never expose `.ht*` control files.
-- Add one-shot Web Service presets for Static/SPA/PHP and common CMS/framework deployments (WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop, Downloads) plus optional hardening for high-confidence attack probes/sensitive files and response fingerprint headers.
-- Add automatic RSS relief without vhost reloads: periodically ask glibc to return already-free pages and trim only idle HOT cache objects above a configurable waterline, while keeping active objects and bounded upstream keep-alive pools intact.
-- Add an authenticated **Docs Reader** at `/docs` for bundled project Markdown, with the OpenAPI/Swagger interface kept in a separate **API** tab.
+- Reorganize **Traffic** into Overview, Clients, Requests and Delivery sub-tabs so per-vhost analytics stay compact without a long page scroll. Render all bounded traffic dimensions as charts: donuts for low-cardinality distributions and horizontal bars for User-Agent, client IP, path, route and byte-volume rankings.
+- Keep the Rust source-tree 500-line ceiling as a release contract, isolate unit tests from implementation files and strengthen split-module regression checks for dangling attributes/imports. Split the Docker Agent and oversized dashboard source bundles into bounded source modules while preserving the existing browser asset URLs.
+- Fix the first Web Server module split regressions around `htaccess`, `server_protocol`, `anyhow::Context` and dangling derive boundaries; compiler-enabled `cargo check` remains a release-host gate when the packaging workspace lacks Rust.
 
-See [Web Server](docs/WEB_SERVER.md) for configuration and security details, [documentation index](docs/README.md) for the current documentation set, and [0.25 specification audit](docs/V0.25.0_AUDIT.md) for point-by-point release status. Open follow-up work is tracked separately in [TODO](docs/TODO.md).
+See [Web Server](docs/WEB_SERVER.md) for configuration and security details, [documentation index](docs/README.md) for the current documentation set, and [0.25.1 release audit](docs/V0.25.1_AUDIT.md) for point-by-point release status. Open follow-up work is tracked separately in [TODO](docs/TODO.md).
 
 ## Documentation
 
@@ -39,7 +25,8 @@ See [Web Server](docs/WEB_SERVER.md) for configuration and security details, [do
 - [docs/README.md](docs/README.md) - canonical documentation index.
 - [docs/WEB_SERVER.md](docs/WEB_SERVER.md) - Web Server configuration, HTTP behavior and filesystem security.
 - [docs/PHP_FPM.md](docs/PHP_FPM.md) - implemented FastCGI/PHP-FPM integration, safety model and runtime requirements.
-- [docs/V0.25.0_AUDIT.md](docs/V0.25.0_AUDIT.md) - mapping of the 0.25 specification to implementation and release gates.
+- [docs/V0.25.1_AUDIT.md](docs/V0.25.1_AUDIT.md) - 0.25.1 Traffic/modularization release audit and compiler gate.
+- [docs/V0.25.0_AUDIT.md](docs/V0.25.0_AUDIT.md) - Web Server foundation specification audit.
 - [docs/TEST_REPORT.md](docs/TEST_REPORT.md) - verification results and environment limitations.
 - [docs/TODO.md](docs/TODO.md) - unresolved follow-up only.
 
@@ -104,7 +91,7 @@ CARGO_BUILD_JOBS=1 CARGO_PROFILE_RELEASE_LTO=false \
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS=8 cargo build --release --locked
 ```
 
-The 0.25.0 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
+The 0.25.1 source archive preserves the resolved `Cargo.lock` supplied with the source tree and
 updates only this package's own version entry. This packaging environment has no Cargo, so the
 dependency graph was not re-resolved here. On the compiler-enabled deployment host, run the
 locked check/test/release gates below and retain the verified lockfile. `dev.sh` can generate a
@@ -321,10 +308,10 @@ language JSON files survive the update; shipped files replace their old names,
 whose previous bytes remain in the backup. Unknown custom source edits are not
 merged. Do not overlay individual source files onto an old tree.
 
-RustProxy 0.25.0 keeps the existing SQLite schema version 7. Web Services and vhost/location
+RustProxy 0.25.1 keeps the existing SQLite schema version 7. Web Services and vhost/location
 source selection are stored in the normal revisioned configuration document, so no separate
 database migration is required; omitted source fields still default to Reverse Proxy. Once a
-0.25.0 configuration containing the new fields is saved, an older binary may reject unknown
+0.25.1 configuration containing the new fields is saved, an older binary may reject unknown
 configuration fields. Roll back using the pre-upgrade data backup as well as the old source,
 not just the binary.
 
@@ -342,7 +329,7 @@ python3 scripts/release_smoke.py
 # Runs those checks first, then the Rust suite when Cargo is available:
 bash dev.sh test
 # Source-only package, with no Git checkout required:
-python3 make_zip.py /tmp/RustProxy-0.25.0.zip
+python3 make_zip.py /tmp/RustProxy-0.25.1.zip
 ```
 
 ## New management and test-origin guide