RustProxy/CHANGELOG.md

Changelog

Operator-facing release history. Historical engineering notes are kept in docs/CHANGELOG_TECHNICAL_ARCHIVE.md.

0.32.1

• Restore Overview proportions from 0.31.9 by removing 0.32.0's desktop minimum heights. Increase compact metric typography so labels, values and captions remain readable at 90% UI scaling without large empty bottoms.
• Unify Overview inter-card gaps with the same --ui-gap density spacing used by the rest of the Dashboard, instead of distinct gaps for dashboard density options.
• Retain the six desktop columns, responsive layouts, permanent chart legends, optional Stream cards and saved Appearance preferences. Add focused layout regression coverage. No changes to proxy transport, persisted data, API or saved settings schema.
• Replace oversized Appearance Stream card help bubbles with localized native title tooltips, retain assistive descriptions on the buttons, remove tooltip-specific CSS and prevent widget-grid overflow on narrow screens. No preference or API changes.

0.32.0

• Extend Stream TCP/UDP listeners with explicit per-host backend pools (up to 32), legacy single-upstream fallback, stable backend IDs, weight, enabled, drain, session caps and weighted Round Robin / Least Connections or Sessions selection. Keep TCP/UDP affinity for each session and release backend gauges via RAII.
• Add optional TCP Connect and conservative UDP response-matched probes with configurable interval, timeout and rise/fall, globally bounded concurrency and cancellation. Never label an unverified UDP connect as Healthy.
• Add bounded per-backend observations to existing status/SSE and opt-in detailed Prometheus metrics; preserve global include_streams, stream-level basic counters and traffic direction meanings.
• Extend existing Appearance dashboard card visibility/order with four opt-in Stream cards. Reuse account preferences, existing status updates, translations, style/responsive layout and in-memory browser charts. Migrate older 12-widget layouts to hidden Stream cards.
• Update Streams editor, OpenAPI, Settings documentation and regression coverage. No new public routes, scheduler or database format. Backend changes remain restart-required. Cargo and live TCP/UDP integration gate remain open until verified.

0.32.0 Overview layout and Vhosts hint correction

• Restore permanent inline secondary labels and legends on the main Overview tiles, without hover/focus tooltip behavior or extra keyboard stops. The follow-up restores the original six desktop columns (not four), with taller tiles for their descriptions; retain responsive grid and dashboard density options. Stream traffic uses the existing RX/TX chart with an inline colored legend.
• Keep hover/focus help in Settings -> Appearance unchanged; dashboard card visibility, preferences and polling are not modified.
• Remove the redundant Controls whether this vhost accepts traffic helper text in the Vhost add/edit form. Keep the enabled checkbox, state badge and enabled behavior unchanged.

0.32.0 Appearance / Stream editor hotfix

• Make the four Stream Overview card toggles authoritative even without active or configured listeners; render a neutral no-data state instead of silently hiding a user-enabled card. Preserve opt-in defaults, cached status rendering, existing polling and all legacy widgets.
• Move Appearance Stream card descriptions into hover/focus tooltips (with aria-describedby) without changing ordering, control behavior or keyboard accessibility.
• Remove only the redundant enable-control helper hint from the Stream editor. Label detailed metrics precisely: Stream null means default disabled; backend null uses the parent Stream setting; global Prometheus include_streams remains the export gate.
• Bundle scripts/start_stream_backends.sh, scripts/test_stream_tcp.py and scripts/test_stream_udp.py directly under scripts/ and update test instructions.

0.32.0 follow-up fixes

• Correct the Appearance/Overview visibility synchronization: immediately apply the newly saved (rather than stale) hidden-widget list, repaint cached Stream totals after an opt-in and on return to Overview, without an extra request, rate sample or timer. A subsequent hotfix removes the no-Stream visibility restriction in favor of an explicit neutral state.
• Show secondary Overview-card details as focus/hover tips on pointer devices while retaining on-screen details on touch devices; keyboard focus is supported.
• Rename the atomic reserve call from deprecated fetch_update to try_update without changing the capacity logic or memory ordering.
• Include independent mock-backed TCP and UDP black-box test scripts, executable against configured RustProxy listeners, plus harness-only selftests.

0.31.9

• Add per-credential View settings, Edit settings and Regenerate token actions to Settings → Certificate API. Read and edit return non-secret metadata only; Key ID remains stable, and editing comment/certificate allowlist/deploy permission does not rotate the existing bearer token.
• Add administrator-only GET /api/certificate-api/{key_id}, PATCH /api/certificate-api/{key_id} and POST /api/certificate-api/{key_id}/regenerate. Regeneration atomically updates only the stored hash and rotation/usage timestamps, preserving the grant and showing the new random secret only in the regeneration response. The old secret becomes invalid immediately.
• Keep existing login/session/CSRF protections and external Certificate API authorization strictly limited to targeted reload and explicit deploy permissions. Include OpenAPI, English/Polish UI strings and regression tests for secret non-disclosure and token invalidation.
• No database schema or proxy transport change. Cargo/runtime acceptance remains required on a Rust 1.99+ build host.

0.31.8

• Consolidate 28 numbered Rust unit-test fragments into seven existing tests.rs suites (Admin, Balance, Config, Web Server and three Cache suites). Preserve the tests, remove obsolete fragment directories, and exempt Rust test sources (not production modules) from the 500-line check. Fix the test fixture's relative login-keys.json include path. No runtime functionality changes.
• Fix Docker VHosts startup status: a missing first observation is WAITING, not a connection failure. Read cached agent status when opening the page (including with Live view off) and briefly retry while the first background check is pending. Display an error only after a failed agent check; omit the configured certificate SHA-256 from generic failure details because it is not a diagnosed failure cause. A configured pin alone does not mark the agent connected. Keep agent polling, certificate validation, manual refresh and persisted settings unchanged.
• Add server-side Stored Logs sorting by visible columns, including numeric and discovered nested fields; preserve sorting over the complete bounded scan before pagination. Column and direction persist with account preferences, with no SQLite schema change.
• Add matching dark HTML built-in pages for HTTP 200, 400, 408, 410, 413, 500 and 502. Align the remaining generic HTML status template with the established RustProxy appearance. Preserve administrator-configured responses, status codes, protocol headers and bodyless responses.
• Reduce long-lived GeoIP CSV allocations by storing exactly sized boxed range slices and 34-byte network-order IPv6 records instead of 48-byte u128-aligned records; retain equivalent ordered range search.
• Avoid duplicating a single uniquely-owned transformed response frame when filling HOT cache, provided its allocation capacity is known and tightly bounded; preserve the copying fallback for stream/fragmented or shared bodies, HOT accounting and HTTP content unchanged.
• Keep existing cache/transport limits and persisted configuration format. Build, Rust tests, live deployment and memory comparisons still require verification with the supported toolchain.

0.31.7

• Allow intentionally pruned historical release audits and implementation notes in the 0.31.7 source archive. Update preflight, documentation/source contract checks, and the embedded Reader registry to require actual runtime/compiled documents instead. Remove stale documentation links, update Reader integration assertions, and add a regression check that still rejects missing embedded documents or runtime modules. No runtime configuration, storage format or UI behavior changed.

• Refine revision history dialogs: place Full JSON comparison directly below Restore revision, allow long change lists to scroll without overflowing the modal, and use the standard dialog border for JSON comparison. No revision data, restore logic or API changes.

• Group Global User-Agent blocklist, Global custom headers and Client response under a new Settings → Rules & headers tab with three sub-tabs, using the existing persistent Settings forms. Security continues to own session and hostname access controls.

• Introduce validated per-vhost User-Agent request limits: up to 64 case-insensitive substring/* patterns, each with its own request count, window and burst. First matching UA rule overrides country/default limits and is scoped per vhost and client IP; user agents without a match retain the existing limiter. Settings remain optional and older saved configs load unchanged.

• Show only changed configuration fields in the revision preview, with ID-stable array paths. Move full before/after JSON into a separate on-demand modal. Revision restore and retention remain unchanged.

• Add spacing between the HTTP/2 and HTTP/3 listener tuning links. Collapse ACL profile Attached to by default without hiding its contents or changing profile attachment rules.

• Correct update.sh retention cleanup (mtime-sort key was previously included in the removal path) and retain two installed releases, including the active release. Preserve three private stopped-service backups for rollback. Preserve Cargo fingerprints, compiled deps and executables; only expired incremental build state may be removed, after a successful update and only while Cargo's profile lock is available.

• Confirm managed-update marker is created before systemctl stop and read on shutdown, triggering best-effort HOT→COLD persistence even when cold_on_shutdown=false if cold storage is enabled. Add completion diagnostics counting successful persisted objects (including zero), not merely attempted writes; no claim of a successful runtime flush without testing.

• Retain SQLite schema 9, COLD format 3 and existing H3/mobile fixes. Compiler/live upgrade acceptance pending.

0.31.6

• Preserve logo click as the original href="/" full-page navigation. For H3 to HTTP/1.1 backend forwarding, complete empty GET/HEAD receive streams through a bounded first-frame probe before forwarding. Hyper already special-cases GET/HEAD H1 encoding; this change targets H3 receive-half lifecycle, not assumed chunked GET framing. Also bound H3 GET/HEAD cache and 404 preflight so a missing FIN cannot indefinitely prevent navigation; rewind/replay any nonempty body unchanged.
• Do not abort all in-flight H3 responses when the H3 accept loop fails; stop accepting and drain the active request tasks within the normal grace bound.
• Persist H3 pre-header peer cancels as status-0 diagnostic events rather than HTTP 400. For interrupted responses record phase, QUIC stream ID, method, query-free path, response status, sent byte count and redacted failure reason; preserve non-cancellation per-stream error reset behavior. Log start/completion/interruption of root-document GET / with a stream ID and response status in service INFO/WARN logs.
• Add H3 navigation regression tests and iPhone reproduction checklist. Retain the 0.31.5 Stored Logs mobile layout, HOT/COLD cache preservation and administrator Origin protections. Rust build and real iOS testing are still required.

0.31.5

• Make the Stored Logs explorer responsive: compact, keyboard-expandable record cards and readable parsed fields on narrow screens; keep user-selected columns accessible without widening the whole page. Desktop table behavior remains available.

• Do not persist a synthetic HTTP 400 for a QUIC peer cancelling an incomplete H3 request with H3_REQUEST_CANCELLED/H3_NO_ERROR on refresh. Preserve real HTTP/3 protocol-error logging and avoid a second internal reset after identified peer cancellation. The related white-page symptom still needs live browser/QUIC validation.

• Preserve HOT/COLD cache compatibility identity when per-vhost HTTP/2 or HTTP/3 enablement changes; these are frontend protocol switches, not cached-response representation changes. No cache schema migration.

• Clarify that the optional public panel HTTPS origin pins the external scheme/authority for Origin/CSRF validation with a trusted reverse proxy, while additional allowed DNS hostnames only expand the strict Host allowlist. Add source/Rust regression cases and a browser-width layout smoke test; compiler and live wire acceptance are still required.

• Give repeated-value analysis its own Stored Logs tab and move the rotation-consolidation option to a compact top-right control. Preserve the browser-local consolidation choice.

• Fingerprint panel, login and documentation JS/CSS asset filenames with a random 16-hex build identifier independent of the application version. Reject legacy JS/CSS URLs (404), retaining unversioned JSON/SVG; enforce exact fingerprints and preserve the existing HTML cache-header behavior. No SQLite/API changes.

• Remember the Stored Logs consolidation toggle per browser with localStorage, preserving the existing default and avoiding API/database changes.

• Add global and per-vhost User-Agent blocklists with bounded, case-insensitive substring/wildcard matching before upstream connection. Existing configurations remain valid and the feature is disabled by default.

• Make Traffic values copyable for faster investigation and blocklist preparation.

• Add repeated-value aggregation to Stored Logs for User-Agent, client IP and arbitrary parsed fields, with bounded result/cardinality limits.

• Let Stored Logs consolidate an active per-vhost JSONL file and its gzip rotations into one logical source. Preserve individual file metadata/source IDs and existing combined access/error behavior.

• Update English/Polish UI, OpenAPI and release documentation. SQLite schema 9 is unchanged; Rust/Cargo verification remains outstanding in this environment.

0.31.4

• Correct the administration panel's handling of intermittent auth.invalid_origin with optional explicit HTTPS administration.public_origin when behind a trusted reverse proxy. Allow a bounded, HTTPS-first multi-hop forwarded-proto chain without trusting arbitrary forwarding headers.
• Use a single public panel URL: automatically include its hostname in the panel's effective Host allowlist. Keep allowed_hosts as optional additional DNS entries in an advanced section and deduplicate legacy repeated values on edit/save without an automatic database migration.
• Preserve strict Host, forwarded-Host, Origin, Fetch Metadata, CSRF and trusted-proxy checks; keep public proxy routes and SQLite schema unchanged.
• Add configuration and HTTP guard simulations, Rust source regression tests, English/Polish form labels and operator documentation. Rust/Cargo build and live mobile acceptance are still outstanding.

0.31.3

• Prevent duplicate session requests after BFCache/tab restoration; suspend SSE/polling until session validation finishes, then resume once. Replace automatic resume reload loops with a visible, localized retry screen and preserve the startup recovery limit until initialization is complete.
• Return a readable 403 document for invalid-Origin dashboard navigations; continue rejecting cross-origin API requests and cross-site fetches. Add redacted, bounded server diagnostics for rejected Origin checks and security regressions.
• Keep proxy routing, cookies/CSRF, local administration policy, SQLite schema 9 and user configuration unchanged. Rust/Cargo and real mobile reverse-proxy acceptance remain required.

0.31.2

• Refresh core runtime, security, TLS certificate generation, database, Swagger UI and monitoring libraries for current stable versions. Keep persisted data, cache format, configuration, panel behavior, HTTP/3 and proxy routing compatible.
• Move the build toolchain baseline to Rust 1.99. This dependency refresh must pass compilation, runtime and integration checks before production deployment.

0.31.1

• Make mobile and reverse-proxied panel reloads reliable by loading the dashboard JavaScript as one ordered resource, waiting for its initialization before fetching settings, and showing a recoverable error if essential resources are unavailable. Preserve the loading indicator and preferences.
• Version panel JavaScript and CSS URLs to prevent mixing assets from different releases in intermediate caches. No configuration, API, or proxy traffic changes.

0.31.0

• Harden BAN/PURGE with scheme/host/vhost isolation, unambiguous headers and bounded background cache-maintenance workers (shared with authenticated admin purge/invalidation); audit BAN-rule removals before mutation. Add a localized curl-examples tooltip to Settings → Cache. See the 0.31.0 API and panel security review for assessed controls and remaining runtime security gates.

• Add browser-negotiated Zstd/Brotli/gzip compression for panel HTML and static assets, configurable under Settings → Administration without an extra environment variable; cached representations and Vary: Accept-Encoding work with or without a reverse proxy (subject to forwarded headers).

• Add strictly opt-in, IP/CIDR-gated HTTP PURGE (exact URL) and BAN (lazy URL prefix) on public vhost listeners, using the existing invalidation engine, ACL/rate limits, audit and CIDR validation. Empty allowlist keeps the feature disabled; no DB or cache-format migration.

• Align the System information manual Refresh control directly next to the API badge.

• Make the authenticated panel visible during initialization: replace the previous fully hidden body with an accessible loading indicator, a delayed reload action and an explicit startup-failure state. Paint the Overview shell before slow preferences/config/status requests complete.

• Place Refresh now beside the Overview title at the far right, including on narrow mobile screens. Serve panel HTML/assets using the new configurable negotiated codec policy, with an uncompressed fallback. No new endpoint, API change or proxy traffic change.

• Add per-administrator Refresh preferences under Settings → Appearance, including Live enable/disable and supported intervals for status/SSE (1/2/5/10 s), Traffic/Cache (0/3/5/10/30 s), and system information (0/15/30/60/300 s). Reset and manual refresh remain available, even when automatic updates are off.

• Replace duplicated dashboard timers with one coordinator for SSE, fallback polling, Traffic, Cache, Transform, Docker, ACME, tunnel diagnostics and editor-draft presentation. Poll only active views, prevent overlapping requests, abort stale views, pause when hidden and stop on logout.

• Keep the full authenticated status API for compatibility; add a compact live-only status view and a separate authenticated /api/system-info. SSE snapshots exclude full configuration and expensive system diagnostics. SSE interval is per client and does not affect other sessions.

• Update English and Polish UI labels, OpenAPI, documentation and release checks. No database schema, cache format or proxy data-plane changes.

0.30.1

• Fix protocol chart legend dots for HTTP and WebSocket (H1/H2/H3) so their colors always follow the configured line palette.
• Remove ACME mode and certificate Python diagnostics from About; provide Settings -> System information with live OS/process/hardware information, existing runtime/data paths, and actual selected Python/pip/Certbot versions.
• Use the existing sysinfo library for cross-platform OS/kernel identification instead of Linux-only parsers. Read bounded Python pyvenv.cfg and installed pip/Certbot .dist-info metadata without launching diagnostic subprocesses; report missing or ambiguous versions as unavailable. Improve Windows .exe tool discovery. Keep application settings, SQLite schema 9 and Cold Cache format 3 compatible.

0.30.0

• Place per-backend health-check editing in the vhost Health tab with a selector containing only monitored backends. Keep independent edits when switching, and preserve overrides while health monitoring is disabled. Existing vhost JSON stays compatible.
• Improve long-running memory behavior further: reclaim expired cache PURGE-generation metadata, avoid per-request allocations for repeated analytics labels, reuse JSON access-event serialization with Loki, and remove redundant buffers from local directory listings. Keep all outputs/configuration semantics unchanged. See memory stress verification; Rust runtime/RSS acceptance is still required.
• Share one JSONL serialization between file and Logstash sinks. Limit in-memory directory inventories while scanning historical per-vhost logs and gzip rotations, rather than collecting all matching files before truncation.
• Keep SQLite schema 9 and Cold Cache format 3 unchanged. Rust build, long-duration RSS/heap measurements and real traffic tests remain mandatory before production acceptance.

0.29.7

• Introduce per-backend health_check_enabled (default true) and optional per-backend health_check override (default null): both active probes and passive health ejection can be switched off without disabling a path-pinned backend. Add UI, status and validation.

• Add cache diagnostic policy expose_only_hits (global default false; vhost null inherits) with global and vhost controls, keeping Via separate and cache hits visible while MISS/BYPASS remain unadvertised when opted in.

• Warn when active Web Services use one PHP-FPM socket with different dynamic PHP_VALUE/PHP_ADMIN_VALUE directives. Provide instructions for dedicated PHP-FPM pools; RustProxy cannot reset worker-scoped INI state inside a reused shared FPM worker.

• Preserve schema 9, Cold format 3 and existing configuration defaults.

• Extend PHP-FPM help in both Web Service settings and reusable PHP profiles with concrete parameter/value syntax, limits, privilege distinctions, WordPress/Roundcube examples and dedicated-pool guidance. Align PHP/PATH_INFO switches and attach consistent info tooltips.

• Add opt-in vhost pages.intercept_statuses so selected application-origin HTTP error bodies are replaced by vhost/global/built-in RustProxy error pages, with preserved application status, no-store, and higher-priority named internal fallbacks. Keep old configs disabled and add regression coverage, localization and OpenAPI documentation.

• Move the shared PHP profile syntax/safety help button below the profile list and Add profile action, separated by a horizontal rule. Remove an unnecessary mutable Web Server response binding. Ensure the outer observer never silently replaces reverse-proxy or Web Server/PHP origin errors with global pages when interception is disabled; origin codes remain unchanged even when the replacement page has its own status override.

0.29.6

• Fix PHP-FPM response truncation with gzip, Brotli, Zstd and deflate in native Web Server mode: fuse the FastCGI response stream so compression can safely poll after EOF without a Tokio worker panic.
• Route WARN and ERROR diagnostics (including bounded PHP-FPM stderr and Rust panic-hook events) to the configured error file when enabled; otherwise use console/systemd. Remove duplicate stderr entries while file logging works; fall back to stderr if the file cannot be written or the bounded queue is full.
• Add FastCGI EOF/compression and dynamic diagnostic-routing regression tests. No schema, cache-format or saved-configuration changes.

0.29.5

• Fix Roundcube 1.7 static asset delivery: a valid static.php/... PHP PATH_INFO target executes directly, before the Web Service's try_files fallback can mistakenly route it to index.php and return HTML instead of CSS/JavaScript.
• Apply Web Service hardening and .htaccess restrictions to the resolved PHP script, not just the full virtual URL.
• Test the actual FastCGI params for Roundcube static assets and verify opt-in PATH_INFO behavior with the front-controller fallback preserved when disabled.
• Retain the 0.29.4 shared PHP-FPM profile manager, Web Server cache/transform fixes, SQLite schema 9 and existing saved configuration.

0.29.4

• Expose the existing shared PHP-FPM profile manager directly beside New Web Service in the Web Server toolbar, without removing the shortcut in the service editor.
• Add named, shared PHP-FPM configuration profiles that Web Services can attach or detach without modifying their local PHP settings, with a profile-management modal and revisioned API support.
• Apply the vhost cache and transformation pipeline to Web Server local-file/PHP routes, with fresh-hit reuse, vhost response rules, response-side privacy protection and bounded GET/HEAD request-body probing.
• Supply the validated HTTP authority in FastCGI HTTP_HOST, including authority-only HTTP/2 and HTTP/3 requests used by WordPress.
• Retain SQLite schema 9, Cold Cache format 3 and saved-configuration compatibility with 0.29.3.

0.29.3

• Fix internal error fallback on empty GET/HEAD requests over HTTP/2 and HTTP/3 with unknown body length; safely probe truly empty bodies without replaying nonempty or unbounded payloads.
• Preserve the final status and response body of the internal fallback target, including its own 404 HTML, without overwriting it with RustProxy's global error page; warn when a named fallback location is missing.
• Retain SQLite schema 9, Cold Cache format 3 and saved-configuration compatibility with 0.29.2.

0.29.2

• Debian install/update now deploys managed logrotate policy (14 daily rotations, 100 MB max, compressed, copytruncate) and repairs the shell PATH profile on upgrade.

• Fix Web Server vhosts returning 503 because backend transient_unavailable was applied to the main filesystem/PHP route. The main Web Server source does not consult or compile unused backends; enabled reverse-proxy Custom Locations still use the configured backend pool.

• Remove the three error-fallback Prometheus metrics without changing internal fallback routing.

• Add validated, operator-managed PHP_ADMIN_VALUE support for shared trusted PHP-FPM endpoints.

• Expose service-scoped PHP response counts, response-header latency and concurrency gauges in Prometheus, alongside Web Server status and latency counters.

• Keep FastCGI reserved parameter protections and PHP PATH_INFO support.

0.29.1

• Add Nginx-style internal error fallback routing for vhost sources and Custom locations, including internal-only named locations, configurable 403/404/500/502/503/504 interception, original request target/context preservation, validation-time cycle rejection and a runtime depth guard.
• Intercept configured upstream/local errors before finalization or cache storage, then process fallback targets through normal ACL, header, compression, cache and response handling.
• Add streaming multipart Range support with at most 16 byte ranges per request while retaining existing single-range behavior.
• Add optional PHP-FPM PATH_INFO support that securely separates an existing script path from trailing path information.
• Keep SQLite schema 9, saved-configuration compatibility and Cold Cache format 3 unchanged.

0.29.0

• Group vhost hostnames and WWW redirect controls in Frontends. Each exact domain shows both redirect directions as selectable source → destination cards, even while redirects are off. Implicit www. targets are supported without adding an extra hostname. Other aliases continue serving the same application without cross-domain redirects; wildcard targets are excluded.

• Add one-click per-vhost canonical www/non-www redirection. The first exact DNS hostname is canonical and its companion hostname redirects permanently while retaining the request target; Force SSL and canonicalization collapse into one redirect where possible.

• Add a dedicated Custom location Redirect action with configurable permanent/temporary status, absolute HTTP(S) target, optional capture rewrite regex and query preservation.

• Default HTTP health-check Host to the first exact vhost DNS hostname when no explicit health-check Host override is configured.

• Add an opt-in per-vhost forced-cache target list for narrowly scoped URLs that must be cacheable despite request query/Cookie/Authorization/client-cache directives. Response Set-Cookie, private, no-store and other response-side safety exclusions still block storage, and credential/cookie values remain representation variants.

• Read bounded logrotate .gz access/error/per-vhost log rotations from Stored Logs without accepting arbitrary filesystem paths or unbounded decompression.

• Cover static maintenance HTML returned with an explicit status such as 503 Service Unavailable.

• Preserve valid nested-URL query strings end to end and retain rejection of literal/encoded backslashes and other ambiguous path encodings.

• Keep SQLite schema 9, saved-configuration compatibility and Cold Cache format 3 unchanged.

0.28.2

• Harden external certificate-file loading for Certbot/system-managed PEMs without requiring an exact chmod. POSIX ACL read access and group-readable private keys are supported; private keys still reject world-read and all external certificate/key files reject group/world-write.
• Validate the configured external path and the resolved Certbot target through root/RustProxy-owned non-writable parent directories, while allowing root-owned sticky ancestors such as /tmp.
• Make Certificate API credentials least-privilege: new tokens are reload-only by default, require an explicit certificate-ID allowlist, cannot call global reload, and need an explicit opt-in for deploy permission. Existing credentials migrate to reload-only broad access until rotated.
• Add SQLite schema 9 for per-token Certificate API grants; the saved proxy configuration and COLD cache format remain unchanged.
• Add explicit read-only systemd access declarations for /etc/letsencrypt and /etc/ssl and document POSIX ACL setup, including directory traversal-only grants.
• Improve English/Polish certificate UI help so external file ownership, ACL, parent-directory and reload-token requirements are visible where the paths/tokens are configured.

0.28.1

• Add manual certificate support for absolute external certificate/key paths, including /etc/letsencrypt/live/... pairs. Certbot-style symlinks are resolved again on every reload so an external renewal can be hot-published without copying files into RustProxy storage.
• Keep POST /api/certificates/{certificate_id}/reload revision-stable for Certbot/acme.sh wrapper hooks and reject use of the deploy endpoint against an ID configured with external file paths.
• Preserve the legacy/simple filename mode for <data-dir>/certs, reject mixed relative/absolute pairs, and leave upload/deploy request bodies path-free.
• Exclude externally referenced PEM material from RustProxy backups; only their configured absolute paths are retained, so the external files/mounts must be restored separately.
• Clarify certificate source/storage behavior in English and Polish across ACME, Import and Existing-files UI modes.
• Keep SQLite schema 8 and COLD format 3 unchanged.

0.28.0

• Add a manual GeoIP Download now action and replace the fragile release/checksum-base coupling with direct source URLs. CSV mode accepts separate IPv4/IPv6 files; MMDB mode accepts one native MaxMind DB for both families. Publisher SHA-256 URLs are optional per file; size/format validation, staging, the updater lock, atomic publication and hot reload remain mandatory.
• Improve active-listener visibility in Settings by rendering HTTP/HTTPS binds as distinct endpoint cards and showing the active H1, H2, H2C and H3/UDP protocol badges per listener.
• Remove the speculative Python/Certbot checking/preparing line from the startup banner; log the final detected ACME runtime state at INFO after the asynchronous check completes.
• Add a configurable cache Via response header, enabled by default with value RustProxy, while preserving any upstream Via chain.
• Avoid full cache invalidation when only cache bypass rules or response-only cache diagnostic/Via headers change; representation-affecting settings still invalidate incompatible cache entries.
• Fix the vhost Security header-rule editor layout so Delete no longer collides with the first Operation selector.
• Keep SQLite schema 8 and COLD format 3 unchanged; older configurations gain the default cache.via_header through serde defaults.

0.27.3

• Preserve the existing data-directory UID/GID across backup restore, including restores executed as root.

• Make /var/lib/rustproxy the production CLI data-directory default while retaining ./data in dev.sh.

• Add enabled-by-default automatic GeoIP updates with configurable HTTPS release/checksum sources, 256 MiB default file limit, 24-hour default interval, immediate first-start attempt, publisher SHA-256 verification, streaming staging, live reload and serialization with manual upgrades.

• Fix explicit startup listener overrides so --proxy-listen/--tls-listen replace the canonical saved HTTP/HTTPS bind instead of retaining the old :80/:443 listener alongside it.

• Accept strict WebSocket 101 responses with absent Content-Length or Content-Length: 0; reject positive Content-Length and any Transfer-Encoding without requiring legacy mode.

• Make release-version checking strictly best-effort and start it only after listener binding succeeds; DNS/update-server failures no longer interfere with startup diagnostics.

• Keep the sidebar runtime/footer block at the viewport bottom when interface scale is reduced.

• Fix managed Certbot validation and execution: Certbot 5.8.0 is a console-script application and does not provide certbot.__main__, so python -m certbot incorrectly failed validation. Managed ACME now executes the final acme-python/bin/certbot entry point directly; 0.27.3 creates/rebuilds the environment at its final path so the console-script shebang is valid.

• Improve managed ACME bootstrap on systems with Python/pip but restricted venv/PEP 668 behavior: keep installation private, retry the application-local virtualenv bootstrap safely when required, and report whether failure happened during environment creation, pip preparation, Certbot installation or validation.

• Separate application-coupled Python scripts into scripts/runtime, scripts/build, scripts/deploy and scripts/migration; move QA/dev/audit helpers to tools/ and platform-specific OPNsense/RouterOS helpers to integrations/, with all entry points and release checks updated.

• Fix HTTP/3 HEAD cache handling by running the same bounded empty-request-body probe used for GET; HTTP/2 and HTTP/3 now apply the same cache semantics instead of treating an unpolled H3 body stream as request_body.

• Reduce persistent COLD-cache index RAM by dropping per-entry HeaderMap/validator copies, removing the duplicate key, and storing the SHA-256 digest as 32 bytes. Existing .json/.body files remain format-compatible; headers and validators are validated and loaded only when a COLD object is actually read.

• Reduce rate-limit RAM and stale-IP retention by grouping client buckets under one vhost string, sweeping expired fixed-window buckets during requests and periodic maintenance, and shrinking sparse hash tables before allocator trimming. Active fixed-window behavior and the 65,536-client hard bound are unchanged.

• Exclude rebuildable acme-python and acme_python managed runtime directories from backups.

• Confirm response compression remains streaming, uses CompressionLevel::Fastest, and does not aggregate complete response bodies; memory use scales with concurrently compressed responses rather than retained cache objects.

• Promote https://rustproxy.linuxiarz.pl/ (DEB/RPM) and https://rustproxy-opn.linuxiarz.pl/ (OPNsense plugin) as the official documented installation/update paths; keep Debian source build/update as an optional path.

• Keep SQLite schema 8, saved configuration compatibility and the COLD on-disk format unchanged.

0.27.2

• Fix managed ACME issuance/renewal after the 0.27.1 private-Python change: Certbot is now launched through the final managed interpreter (acme-python/bin/python -m certbot) instead of the pip console script whose absolute shebang still referenced the temporary acme-python.installing path after the atomic directory rename.
• Validate managed Certbot through the same module-based launch path, so already-created 0.27.1 environments recover immediately after upgrade without deleting or rebuilding /var/lib/rustproxy/acme-python.
• Keep the distribution Certbot fallback unchanged for systems where the managed environment cannot be used.
• Keep SQLite schema 8 and the saved configuration format unchanged.

0.27.1

• Show ready-to-run first-administrator setup-token commands instead of requiring a $DATA_DIR placeholder substitution.
• Move Certbot automation to a RustProxy-managed Python environment under the application data directory, initialized automatically with venv/pip and an app-local virtualenv bootstrap when needed.
• Retain distribution Certbot as a fallback when available and expose managed/system/unavailable runtime state in the Certificates panel, including explicit missing-Python/pip diagnostics for minimal systems such as OPNsense.
• Add account-scoped column and direction sorting to vhosts, Docker vhosts, redirects, 404 hosts and streams with feature-specific columns; Redirects and 404 hosts use the same search/sort/action toolbar layout as Vhosts.
• Replace the development-only Certbot hook example with the installed production binary plus explicit data directory, and expose the official source/package repositories plus Python/pip/Certbot runtime state in the startup banner and About/runtime views.
• Keep SQLite schema 8; administrator sort preferences are additive/defaulted and require no migration.

0.27.0

• Enable downstream response compression by default for zstd, Brotli and gzip; keep deflate opt-in. Client q-values remain authoritative and equal-quality encodings use zstd -> br -> gzip -> deflate priority. Existing Content-Encoding is passed through unchanged.
• Compress eligible authenticated/cookie/private/no-store responses instead of broadly excluding them. Explicit no-transform, ranges, SSE, upgrades and already encoded responses remain uncompressed by RustProxy.
• Add inherit/enable/disable dynamic-compression controls plus per-scope zstd/Brotli/gzip/deflate filters to ordinary vhosts and Web Server services. Docker vhosts use a deliberately simpler single Compression checkbox and always use the codec set/priorities from global Response settings. Global Response settings remain the hard codec ceiling and own the minimum size.
• Keep every explicitly published Docker hostname routed until it is explicitly unpublished. Missing services return 503 Service Unavailable; temporary agent failures reuse the last successful inventory when present, and returning services are reattached automatically.
• Fix HOT/COLD cache progress meters so their configured-limit fill is visible in Chromium/WebKit and Firefox.
• Make fresh installations emit Server: RustProxy by default while preserving existing saved/legacy behavior.
• Remove Debian package-build metadata from the main source tree; ready Debian packages are maintained separately at https://rustproxy.linuxiarz.pl.
• Keep SQLite schema 8; the new compression override fields are defaulted/additive and require no database migration.

0.26.7

• Add HOT and COLD cache occupancy progress bars on /cache for configured object and byte limits, with explicit percentage/limit details.
• Verify cache Age progression on stored HITs and retain 0.26.6 compatibility for existing custom Age rules. Response-side Age rules are deferred to the final wire stage so they cannot alter internal freshness/storage. Successful validator revalidation still legitimately restarts HTTP freshness age while X-Cache-Resident-Age continues to grow.
• Restore downstream compression for cookie-bearing responses only when RustProxy is serving a shared-cache HIT already accepted by cache policy or a local static Web Server response; privacy-sensitive dynamic/cookie responses remain excluded.
• Keep Content-Encoding/Vary: Accept-Encoding negotiation for gzip, Brotli, Zstandard and deflate, and make the bundled compression tester stop forcing Cache-Control: no-cache unless explicitly requested.
• Preserve compatible backend upstream clients across unrelated active-snapshot rebuilds so generation age, generation request count and rotation totals do not reset spuriously.
• Keep age-based and request-count upstream client recycling active while making long-running rotation diagnostics reliable.
• Update the OCI image to ship Certbot with the supported Cloudflare, OVH and RFC2136 DNS plugins in one pinned Python environment, and refresh container/install documentation.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.6.

0.26.6

• Persist and reapply backend diagnostics column and sorting preferences as account-scoped user preferences.
• Reset the certificate-creation form after an ACME issuance job succeeds; failed jobs keep non-secret values for correction.
• Fix ACL evaluation so explicit IP allow ranges and allow-only countries can independently satisfy the same default=deny policy while explicit denies continue to take precedence.
• Rework the ACL profile editor around two readable policy modes: block by default + allow country/IP exceptions and allow by default + block country/IP exceptions, with a live OR-policy preview and a retained custom mode for mixed rules.
• Refresh dynamic ACL editor translations after the language bundle loads or the user changes language, preventing raw keys such as aclProfileNew or aclProfilePreviewBlocksAll from appearing in the UI.
• Accept single IPv4/IPv6 host addresses in ACL rules without requiring users to type /32 or /128; CIDR input remains supported.
• Document migrate_npm.py sibling-module requirements and correct the container migration example.
• Detect Linux runtime type in Process diagnostics and make LXC uptime/load container-aware while leaving VM/host and other environments on the existing statistics path.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.5.

0.26.5

• Keep compact toolbar selects and neighboring inputs on one interface-scaled control box so filters such as Stored Logs no longer render mismatched heights.
• Make Streams -> Add TCP/UDP listener navigate to Settings -> Listeners instead of opening the Stream editor.
• Keep SQLite schema 8 and the saved proxy configuration format unchanged; no migration is required from 0.26.4.

0.26.4

• Add 404-host editors to the session draft dock so unfinished 404 forms can be minimized, switched away from and restored like Web Server, Vhost, Redirect and Stream drafts.
• Complete Polish Button style translations and align compact toolbar search/filter inputs with the selected button height.
• Standardize modal Enabled controls for 404 hosts, Redirects and Streams on the vhost state-control presentation.
• Replace the Overview-card checkbox list in Appearance with compact responsive visibility/reorder tiles.
• Make age-based upstream client recycling run from backend maintenance even without traffic, fixing idle backends that could remain at rotation count 0 for hours.
• Keep SQLite schema 8 and the saved proxy configuration format unchanged; no migration is required from 0.26.3.

0.26.3

• Make the Settings -> Appearance interface scale global across the authenticated administration UI, including dialogs, overlays and other top-level surfaces, and extend the selectable range from 80-125% to 70-125%. Form fields also receive a bounded proportional size adjustment so they track the selected scale more visibly.
• Reduce padding and typography in the Overview telemetry cards so the dashboard stays compact at wide resolutions while retaining the existing responsive layout.
• Expand chart presets from four to eight: Default, Soft, Technical, High contrast, Neon, Monochrome, Warm and Cool.
• Make chart presets alter the full presentation palette: line colors, chart surfaces, grid treatment, line weight/caps and contrast now change together across overview diagnostics, vhost/stream charts and Traffic donut/bar charts.
• Restyle the session draft dock as a square-corner RustProxy panel with ordinary panel surfaces, thin separators and compact rows instead of a rounded blurred floating card.
• Let the draft dock collapse to a single title bar and show the age of each suspended editor draft, while keeping drafts session-only and independently restorable/discardable.
• Add a Settings search field that filters settings categories by their translated label and page content without rebuilding forms or discarding unsaved values.
• Add color-palette selectors beside chart presets so the visual character of each chart theme is visible before/while selecting it.
• Add independent Normal/Compact/Ultra compact density controls for tables/logs and for Overview telemetry cards; these are separate from the global 70-125% interface scale.
• Make the Overview telemetry row configurable per administrator: cards can be hidden, restored and reordered without changing runtime telemetry collection.
• Add per-section Appearance reset actions for Interface, Charts, Tables/Logs and Dashboard, while retaining the full Appearance reset and preserving unrelated account-scoped preferences.
• Add an account-scoped Button style preference: Normal keeps the refreshed control sizing, while Compact restores the smaller source-style button dimensions without changing global interface scale. Apply it consistently to generated vhost actions and tabs inside dialogs.
• Keep appearance data in the existing account-scoped administrator preference JSON; SQLite schema 8 and the saved proxy configuration format are unchanged, so no data migration is required from 0.26.2.

0.26.2

• Add a bottom-right draft dock for unfinished Web Server, Vhost, Redirect and Stream editors. Closing a dirty editor minimizes its exact in-session state instead of leaving stale modal state or blocking a new editor; drafts can be restored or discarded independently.

• Add Settings -> Appearance with account-scoped theme, automatic/explicit language, 80-125% interface scale, 12/24-hour time display and chart-style presets. These preferences are stored in the existing administrator preferences row.

• Apply the selected time format across dashboard timestamps and make expanded Stored Logs records more compact for long entries.

• Combine Stored Logs and Live Logs under one top-bar Logs menu.

• Replace the Stored Logs filter matrix with an optional source selector plus a single field-query search supporting field:value, explicit AND, ! negation, quoted values, wildcards and numeric comparisons.

• Build selectable Stored Logs columns dynamically from JSON fields instead of fixed matched_by/SNI protocol columns; saved account preferences can retain discovered fields.

• Parse RAW error-log lines into timestamp, level, target, message and detectable key=value fields, while preserving the original raw line.

• Show parsed field/value details for a selected record with raw JSON available on demand, and move the column picker to the upper-right table toolbar.

• Remove the configured-file inventory while retaining an optional source selector; bounded searches scan configured sources together by default or one selected source on demand.

• Replace backend sort-direction text with ↑/↓ symbols.

• Keep SQLite schema 8 and the existing saved proxy configuration format; no data migration is required from 0.26.1.

0.26.1

• Route low-level protocol errors to per-vhost persistent logs when a vhost can be safely resolved from HTTP authority/Host or TLS SNI; unknown, malformed and non-attributable traffic remains in _unmatched.jsonl.
• Add sni, authority, matched_by, reason and error diagnostics to stored protocol-error records while keeping the 0.26.0 compatibility fields.
• Keep protocol-error persistence independent from the Live Logs memory buffer.
• Improve Logs Explorer with selectable saved columns, a sticky table header, highlighted selection and inline JSON record details.
• Collapse the configured-file inventory by default, repair mapped client_ip display and extend keyword filtering to protocol diagnostics.
• Keep schema 8 and the existing saved proxy configuration format.

0.26.0

• Add persistent protocol-error traffic records for malformed HTTP, TLS ClientHello/handshake failures and timeouts, HTTP/2/HTTP/3 protocol failures, invalid h2c bootstraps and rejected connection/stream limits. These records use the existing bounded external logging queue and do not enter the Live Logs memory ring.
• Add a built-in read-only Logs explorer at /logs, reachable from the top bar and Settings -> Logging, with source, text, event, status-class, client-IP and vhost filters plus bounded pagination and JSON record inspection.
• Keep the stored-log explorer independent from Live Logs: it reads only configured access/error files, including existing files when file logging is currently disabled.
• Harden local log-file access with regular-file checks and O_NOFOLLOW on Unix; the browser API never accepts an arbitrary filesystem path and enforces bounded bytes, lines, sources, offsets and page sizes.
• Extend structured access-log fields with event, protocol_error, error_detail, local_addr and tls_sni so protocol failures can be distinguished from ordinary request records.
• Keep SQLite schema 8 and the existing saved configuration format; no data migration is required from 0.25.7.

0.25.7

• Add one-click vhost enable/disable actions and make the vhost editor Enabled control clearly stand out with an explicit state indicator.
• Add search, sorting and selectable columns to the main Backends diagnostics table; visible columns and sort order are saved in the existing account-scoped administration preferences.
• Theme dashboard scrollbars for dark and light modes.
• Add ordinary/Docker Prometheus metrics for backend retry attempts/successes and upstream-client generation, generation request count, generation age and rotations.
• Add Grafana panels for ordinary and Docker backend client lifecycle, retries and rotations.
• Keep SQLite schema 8 and the existing configuration format; no migration is required from 0.25.6.

0.25.6

• Show upstream Hyper client generation, request budget progress, generation age and rotation count in the live Backends diagnostics table, sourced from the same /api/events status snapshots as the existing backend metrics.
• Retain the configurable backend client generation recycling and HTTP/1 buffer ceiling introduced in 0.25.5.
• Keep SQLite schema 8 and the existing configuration format; no migration is required from 0.25.5.

0.25.5

• Bound long-lived backend Hyper client generations with configurable request-count and age recycling, add a configurable upstream HTTP/1 read-buffer ceiling, and expose per-backend rotation diagnostics without reloading vhosts or purging cache.
• Expand Prometheus/Grafana coverage with bounded Traffic analytics for countries, fixed User-Agent families, methods, status classes, cache outcomes, routes and serving source; add explicit built-in Web Server inventory/source metrics while keeping raw IPs, paths and full User-Agent values out of Prometheus labels.
• Add an About dialog in the dashboard top bar with project author, open-source notice and source repository link; rename the top-bar Docs action to Documentation.
• Replace the always-expanded mobile dashboard navigation with a compact on-demand Menu control that closes after section selection, Escape or an outside click; desktop navigation is unchanged.
• Make the Revision History modal use the same square-corner dialog styling as the rest of the dashboard and remove its duplicated modal/backdrop CSS.
• For vhosts using verified Cloudflare client-IP mode, use trusted CF-IPCountry for country analytics/logging and country rules, falling back to local GeoIP when the header is absent or invalid.
• Keep SQLite schema 8 and the existing configuration format; no database migration is required from 0.25.4.

0.25.4

• Add restore from retained configuration history. An older retained document is validated and saved as a new revision instead of rewinding or overwriting history.
• Protect restore with the current-revision compare-and-swap, administrator session and CSRF controls, and record the source/new revision in administration audit.
• Keep SQLite schema 8 and the 512-revision retention limit; no database migration is required from 0.25.3.

0.25.3

• Add vhost and Custom-location HTTP method allow/block policies, with location-level reusable ACL profiles, inline IP ACLs and country access rules enforced before origin work.
• Forward a per-request SHA-256 X-Request-ID to backends and keep the same identifier in diagnostics and access logs for end-to-end correlation.
• Retain the newest 512 manual-configuration revisions and add a calendar-style dashboard history modal with revision metadata and path-level change previews.
• Migrate the embedded SQLite schema from 7 to 8 for configuration-history retention while preserving existing configuration automatically.

0.25.2

• Allow password-encrypted full backups while RustProxy is running by using a consistent SQLite snapshot and a private staged copy of durable filesystem state; restore remains offline and atomic.
• Preserve validated internal relative symlinks in backup/restore, including Certbot live/ links into archive/, while rejecting absolute, escaping and dangling links. Version-1 backup archives remain restorable.
• Recover a restored/resumed authenticated dashboard tab from a transient auth.invalid_origin response with one bounded same-origin reload; server-side Host, Origin, request-marker and CSRF validation remain unchanged.

0.25.1

• Reorganize Traffic into compact Overview, Clients, Requests and Delivery sub-tabs and visualize all bounded analytics dimensions with donut or horizontal bar charts instead of requiring a long page scroll.

0.25.0

• Add reusable Web Services with document root, ordered index files and optional directory listing in the new Web Server dashboard section.
• Allow vhosts and custom locations to choose Reverse Proxy or Web Server, reuse one Web Service across multiple vhosts and mix static/proxy routing in one vhost.
• Add static GET/HEAD, streaming responses, MIME/length headers, index/redirect/listing behavior, HTTP validators and single-range requests (206/416).
• Enforce document-root confinement, reject ambiguous/encoded traversal and prevent symlink escape on Unix by refusing to follow symlinks.
• Reuse the existing vhost ACL/authentication/header/error/TLS/H1/H2/H3 pipeline without adding a second router, error-page subsystem or object cache.
• Add an authenticated Docs Reader alongside the API/OpenAPI view, with a canonical documentation index, 0.25 audit and separate TODO.
• Align Web Server directory listings and Web Service cards with the RustProxy panel UI, make index files optional for listing-only services, clarify Web Server vhosts in backend summaries and show a dedicated validation error when Reverse Proxy has no backend.
• Fix Web Service card rendering and authenticated-panel refresh behavior so a UI startup error cannot be mistaken for an expired login session; also render an already-loaded configuration when the Web Server UI module registers, removing intermittent blank Web Service lists after fast page refreshes.
• Fix Web Server vhost dashboards so status, request/active/error counters, EWMA latency and traffic are populated from vhost-wide metrics even when no reverse-proxy backend pool exists.
• Fix repeated directory-listing requests so refreshing a directory does not reuse an exhausted directory offset; keep per-directory index lookup ahead of listing fallback.
• Add Web Service MIME overrides, a configurable fallback MIME type and an optional default Cache-Control policy while retaining vhost/location response-header overrides and the OS page cache instead of a second static object cache.
• Expand Web Service configuration into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs; add try_files, internal/redirect rewrites, ordered extension/MIME cache rules, fixed response headers, precompressed sidecars and forced-download extensions.
• Add bounded FastCGI/PHP-FPM execution over local Unix sockets or loopback TCP with configurable executable extensions, timeouts and concurrency; support index.php/front-controller routing and never expose PHP source when PHP-FPM is unavailable. Extend PHP-FPM configuration with explicit TCP/Unix syntax help, Authorization forwarding control, a streaming request-body limit, bounded response headers/stderr, trusted custom FastCGI parameters and validated PHP_VALUE overrides.
• Add bounded .htaccess migration compatibility for common RewriteRule/RewriteCond front controllers, DirectoryIndex/Indexes, AddType, response Header, Expires and PHP AddHandler directives, with recursive compile-time scanning, strict mode, fail-closed handling of unsupported access/handler directives and protected .ht* files.
• Add one-shot Web Service presets for Static, SPA, PHP, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads plus optional per-service hardening that blocks high-confidence exploit probes/sensitive files and strips common implementation fingerprint headers.
• Add an explicit Web Service symlink policy: deny by default, with a Linux-only static-files mode that follows links only when the opened target remains inside the configured document root.
• Split Settings -> Logging into Outputs, JSON format and Error log subsections inside the same card/sub-tab layout as Cache, and allow route, cache_effective_enabled and transform_effective_enabled in custom JSON log mappings.
• Add user_agent and optional country structured access-log fields. Country capture is disabled by default so GeoIP lookup is not added to the normal request path unless explicitly enabled or already required by country access/rate-limit policy.
• Add a bounded per-vhost Traffic dashboard with top countries, User-Agents, effective client IPs, paths, routes, methods, status classes and cache outcomes plus aggregate request/error/byte/latency counters; add donut charts for countries, User-Agents, client IPs, methods, status classes and cache outcomes.
• Use the standard generic/customizable 403 error-page pipeline when a Web Server directory has no matching index and directory listing is disabled instead of returning an implementation-specific diagnostic string.
• Reduce sustained-traffic RSS retention without configuration reloads by periodically releasing already-free glibc pages and automatically trimming only sufficiently idle HOT cache entries above a configurable target waterline.
• Harden production defaults and FastCGI boundaries: keep the one-line/bootstrap reference admin listener on loopback unless plain remote HTTP is explicitly opted into, never pass client Proxy as CGI HTTP_PROXY, reject informational FastCGI statuses, discard application-supplied response framing/hop-by-hop headers, reject symlinked .htaccess control files, use owner-only Debian service umask defaults, and prevent local .env files from entering source release archives.
• Fix CMS preset selection so choosing a non-Custom Web Service preset immediately fills and saves its generated index, try_files, PHP, delivery and cache settings without requiring a separate Apply click.

0.24.10

• Persist Error File enabled/path/format through the existing revisioned Logging configuration while retaining compatibility with older logging API payloads.
• Keep response-time history permanently visible and add an accessible explanation of the cumulative mean metric.

0.24.9

• Add a central encrypted Secret Store and migrate ACME DNS-provider credentials away from persistent plaintext storage.
• Add password-encrypted full backup/restore with authenticated encryption, integrity validation, staging and rollback-safe activation.
• Add an optional ERROR-only JSON/RAW file sink with bounded asynchronous writes, secret redaction and logrotate integration.
• Harden the built-in release checker on FreeBSD/OPNsense and other Unix platforms with system CA bundle support and bounded redirects.

0.24.8

• Expand Cache RAM diagnostics with HOT usage/limit, transient cache RAM breakdown and COLD storage occupancy.
• Move the long RSS/cache accounting explanation behind an accessible information control while keeping COLD disk usage separate from process RAM.

0.24.7

• Make transform temporary-memory and concurrency ceilings configurable, preserving safe defaults for existing installations.
• Add persisted RAM saver, Recommended, Performance and Uber performance transform resource presets without changing transformation semantics.
• Add safety warnings and live resource accounting for transform RAM/slots, cache RAM and COLD disk occupancy.
• Include transformation representation/eligibility settings in cache compatibility identity while excluding resource-only capacity settings.

0.24.6

• Persist selected HOT/COLD cache preset identities and restore them in Settings.
• Add a Recommended COLD policy preset while preserving operator-selected disk path and capacity.
• Bound transformation buffers/decompression and background cache work to prevent unbounded memory/task growth.
• Bound stale revalidation, proactive refresh, COLD cleanup and delete fallback work.

0.24.5

• Fix empty, length-unknown HTTP/3 request forwarding to HTTP/1.1 origins while keeping non-empty bodies streaming.
• Harden HOT/COLD cache memory admission with allocation-aware HOT limits and separate transient/COLD-queue RAM budgets.
• Expose HOT logical/allocated/transient memory and pressure counters.
• Make global cache disable authoritative over per-vhost settings and remove the artificial 1 GiB HOT/object ceiling.
• Add host/cgroup-aware cache memory presets and safety/headroom guidance in Settings.

0.24.4

• Reduce Linux RSS amplification by disabling Transparent Huge Pages only for the RustProxy process, without changing the host-wide THP policy.

0.24.3

• Add per-certificate reload for manual/file-backed certificate IDs and scoped Certificate API authorization.
• Allow multiple Certificate API keys with comments, individual revocation and revoke-all while storing only token hashes.
• Add Linux allocator tuning and reduce avoidable transformation allocations to improve long-running RSS behavior.
• Move HTTP/2 lifecycle tuning to listeners, align HTTP/3 tuning, and keep compatibility fallback for older configuration.
• Improve dashboard process/platform diagnostics and remove stale platform-specific source from release output.

0.24.2

• Version-only release bump from 0.24.1; no functional, configuration or protocol changes.

0.24.1

• Restore portable network-interface discovery/RX/TX counters and add broader portable system/process diagnostics.
• Expose authenticated runtime metadata for platform, statistics source and resolved data/database paths.
• Make local CLI data-directory discovery support Linux and BSD/OPNsense conventions.
• Move Logging into Settings -> Logging while retaining legacy /logging navigation compatibility.

0.24.0

• Replace abrupt downstream H2 idle termination with a GOAWAY-based graceful shutdown that rechecks current activity and waits for accepted streams.
• Add independent H2 idle timeout, maximum connection lifetime and drain timeout settings; lifetime may be disabled with 0.
• Bound H2 draining so stalled streams cannot keep a retiring connection open indefinitely.
• Keep H2 Extended CONNECT/WebSocket streams under the same active-stream accounting and graceful drain path.
• Extract system statistics into platform backends while preserving Linux metric names, units and behavior; add native FreeBSD/OpenBSD/NetBSD sampling where available and explicit nulls otherwise.
• Add runtime platform to Proxy Process and Prometheus platform info.
• Expose H2 lifecycle controls through Settings and the administration API.
• Reorganize Settings -> HTTP connections into HTTP/2 and HTTP/3 sub-tabs; move listener-scoped H3/QUIC enablement and limits out of the Listeners editor while preserving restart semantics and the existing listener configuration model.

0.23.3

• Make external certificate deployment convergent: create missing manual certificate ids, rotate existing manual ids, no-op identical RustProxy-owned generations, and keep managed ACME ids protected from external ownership.
• Make the OPNsense os-acme-client hook reconcile on every run so RustProxy remains the source of truth and deleted/drifted external certificate entries self-heal.
• Add per-vhost Enable WebSocket legacy support for older appliance/embedded WebSocket implementations.
• Force legacy-mode WebSocket upstream handshakes to HTTP/1.1 and force the WebSocket Host to the configured backend authority and align Origin to the matching backend scheme + authority.
• Tolerate legacy 101 Switching Protocols response framing while keeping Sec-WebSocket-Accept and subprotocol validation strict.

0.23.2

• Add selectable 60/120/300/600-sample history windows to the Cache and Transformation live charts, with bounded per-workspace browser persistence.
• Fix rust-proxy --livelogs on HTTPS administration listeners by detecting the HTTP 308 redirect and reconnecting over TLS instead of looping.
• Pin local CLI HTTPS to leaf certificates present in the private data-dir/certs directory and reuse the HTTP/HTTPS-aware client for config and certificate CLI API calls.

0.23.1

• Add default-collapsed, full-width live activity charts to the Cache and Transform workspaces.
• Plot Cache HIT/MISS/BYPASS rates for the selected scope using deltas from the existing cache runtime counters.
• Plot Transform applied/cache-HIT/skipped/error rates for the selected scope using the existing transform metrics endpoint.
• Reuse the administration dashboard SVG/grid/legend visual language, keep the existing 3-second live refresh, and add English/Polish language-pack labels.

0.23.0

• Bound inactive inbound HTTP/2 connections to five minutes so idle TLS/H2 sessions cannot accumulate indefinitely toward the process connection limit; export rust_proxy_http2_active_connections for direct diagnosis.
• Account hot-cache response-body backing allocation capacity rather than only visible body length, preventing BytesMut growth slack from bypassing the configured RAM budget and under-reporting resident cache memory.
• Add a scoped external Certificate API credential managed from a new Settings → Certificate API tab. RustProxy stores only the token hash plus a non-secret Key ID; the cleartext token is returned only on rotation.
• Allow the scoped Key ID + Bearer Token only on POST /api/certificates/deploy and POST /api/certificates/reload, require HTTPS for non-loopback token use, track last use, support immediate revoke, and retain normal administrator-session/CSRF access as an alternative.
• Keep production certificate operations available directly from the installed binary (rust-proxy tls deploy / rust-proxy tls reload) without requiring dev.sh.
• Add rust-proxy --livelogs: an interactive varnishlog-style all-vhost live access stream with structured filters (host, vhost, backend, route, client, method, transport, cache, status classes, path prefix, errors and slow requests), pause/resume, per-request JSON inspection and detailed error/WebSocket/H3/cache fields.
• Back live logs with a bounded non-blocking broadcast stream and authenticated SSE endpoint; slow consumers receive an explicit gap event with the dropped-entry count instead of silent loss.
• Additional historical details for this release are retained in the technical archive.

0.22.3

• Add downstream HTTP/1.1 Upgrade: h2c on listeners that explicitly enable cleartext HTTP/2, preserving the existing prior-knowledge path and rejecting malformed/body-bearing upgrade attempts before protocol switch.
• Add authenticated POST /api/certificates/reload and tls reload to re-read configured public certificate/key files and hot-publish a fresh TLS/H2/H3 snapshot without changing the desired configuration revision.
• Add tls deploy --id ... --cert ... --key ... and authenticated POST /api/certificates/deploy for externally issued local certificates such as Certbot. The CLI performs bounded local reads while the running service owns pair/SAN validation, immutable generation staging, revision-CAS publication and rollback on failure, avoiding root-owned staged PEMs when Certbot hooks run as root.
• Keep all vhosts assigned to one manual certificate id synchronized during external rotation; reject RustProxy-managed ACME ids to avoid dual renewal ownership and report the administration-TLS restart caveat explicitly.
• Add Certificates-panel reload controls and certificate audit events.

0.22.2

• Add bounded replay-safe backend failover retry for body-free GET/HEAD/OPTIONS requests, including retry policy controls, passive-health integration, logs and per-backend retry counters.
• Correct explicit HTTP/2 upstream requests and h2c prior-knowledge forwarding.
• Add per-backend request-concurrency limits with bounded capacity waiting, 503 rejection and capacity/queue-timeout metrics. This limits full proxy exchanges, not TCP socket count.
• Add detailed upstream failure classes, last failure detail/timestamp, and backend health ejection/recovery timestamps to runtime diagnostics and Prometheus.
• Expand the backend administration table with concurrency capacity, last failure and last recovery columns.
• Parse public X.509 leaf metadata for issuer, SANs, validity, remaining days and expiry warning state, and surface ACME renewal status/last attempt/error in certificate inventory.

0.22.1

• Vhost UX: replaced separate WebSocket/H2 RFC 8441/H3 RFC 9220 checkboxes with one transport selector; H2/H3 modes keep HTTP/1.1 Upgrade as an explicit fallback and unavailable transports are disabled from listener capabilities.
• UI polish: replaced the overview TLS listener tile with compact HTTP protocol and WebSocket protocol mini charts; Target and Cache key/tags cells remain copyable with full values.
• Keep the overview metrics in one shared stats grid so the WebSocket/H2/H3/TLS row uses exactly the same card geometry as the primary metrics, without a transport-specific dashboard layout. Make Cache Target and Cache key / tags cells copy their full untruncated value on click/keyboard activation.
• Polish the 0.22.1 administration UI: move Active tunnels into the WebSocket dashboard card, flatten the H1/H2/H3 tunnel breakdown to match the standard transport-card styling, and align Cache modal close actions with the vhost modal header pattern.
• Move selective cache PURGE/BAN and the active BAN list into dedicated Cache modals, keep their launch actions beside Purge selected scope, and use null-safe inline operation feedback consistent with login errors.
• Add opt-in RFC 8441 WebSocket Extended CONNECT for HTTP/2, with per-vhost controls beside RFC 9220, listener-scoped SETTINGS advertisement, H2-to-H1 bridging, explicit H2 upstream forwarding, cancellation/idle timeout and transport-specific metrics.
• Add opt-in cleartext HTTP/2 prior-knowledge (h2c) listeners. Legacy HTTP/1.1 Upgrade: h2c remains deliberately unsupported because the current Hyper integration cannot safely reconstruct the required HTTP/2 stream 1 bootstrap.
• Add stable active-tunnel IDs, authenticated tunnel inventory/kill API, operator-supplied close reasons, audit records, RX/TX/duration metadata and an administration modal.
• Additional historical details for this release are retained in the technical archive.

0.22.0

• Add per-cache-key request collapsing for foreground MISS/fill traffic with bounded wait, configurable timeout fallback, cancellation-safe leader release and collapse metrics.
• Add single Range: bytes=... handling from complete cached objects, including 206, 416, Content-Range, Accept-Ranges and If-Range; multipart/unsupported ranges remain origin pass-through and are not cached as separate objects.
• Extend stale-if-error with configurable transport failure classes and an explicit 5xx status allowlist while preserving the previous default behavior.
• Add bounded proactive cache refresh with pre-expiry scheduling, deterministic sampling, concurrency limits and reuse of the existing validator revalidation path.
• Add selective cache PURGE by exact URL, prefix, tag, regex or cache key, including query/Vary handling, RAM + Cold Cache invalidation and a publication barrier preventing pre-PURGE fills from republishing stale data.
• Add lazy BAN rules with lookup-time enforcement, bounded rule count/TTL, incremental garbage collection, rule deletion and metrics.
• Add authenticated administration API and Cache panel controls for PURGE/BAN, broad-operation confirmation, per-object Purge URL actions, BAN listing/removal and audit entries.

0.21.0

• Fix browser refresh on the dedicated Transform route by serving the dashboard document at /transform.
• Add a dedicated Transform administration workspace with global/per-vhost runtime counters for applied/skipped/error transformations, transformed cache HITs, byte savings, reduction, transform time, kind breakdown and bounded skip reasons.
• Add a transformed-response series to Live traffic (fresh transformations plus transformed cache HITs) and render Core state uptime in compact human-readable units.
• Rename the proxy-owned backend timing diagnostic to X-RustProxy-Backend-Time; the legacy lookalike X-Rust-Proxy-Backend-Time is stripped but is no longer emitted.
• Persist transformed-representation metadata through hot/Cold Cache, mark transformed objects in the Cache dashboard, and append transformed to standardized RFC 9211 Cache-Status diagnostics; origin X-Cache-Status lookalikes are stripped rather than emitted.
• Shard Cold Cache storage and add bounded asynchronous garbage collection plus selective manual cleanup.
• Add RFC 5861 stale windows, request max-stale, age-aware request max-age=N, and correct must-revalidate / proxy-revalidate behavior while preserving s-maxage priority.
• Harden transformed cache fills so transformed Content-Length is authoritative, incomplete streams cannot publish partial objects, and canonical transformed identity representations do not fragment on origin Vary: Accept-Encoding.
• Additional historical details for this release are retained in the technical archive.

0.20.0

• Rebuild Certificates into Installed / Renewal / Generate tabs using the same accessible keyboard tab pattern as Settings.
• Keep certificate issuance, PEM import and existing-file registration inline in the Generate tab; successful imports and edits return to Installed.
• Add explicit ACME operation state cards and include the exact private Certbot log directory in failed issuance/renewal messages.
• Expose per-managed-certificate Certbot log directories from the authenticated ACME status endpoint so persisted renewal failures remain actionable after refresh/restart.
• Rework renewal entries into readable cards with provider/environment, last check, next check, expiry and grouped actions.

0.19.4

• Preserve backend traffic display semantics: idle renders as 0.0 KiB/s, and positive rates below 0.1 KiB/s render as <0.1 KiB/s in both backend rows and aggregate vhost traffic.
• Add a presentation filter to Cache -> Domains and effectiveness with All / Cache enabled / Cache disabled choices, using each vhost's resolved cache settings while leaving aggregate statistics unchanged.

0.19.3

• Simplify the dashboard footer to API latency and dropped-log count, and add a fail-soft built-in release checker using embedded UPDATE_CHECK.toml defaults. The checker reads the official Cargo manifest immediately and then hourly, exposes a newer-version link in the footer, and never performs automatic upgrades.
• Allow runtime release-check overrides through --update-repository-url, --update-version-url and --update-check-interval-secs (plus matching RUST_PROXY_* environment variables); interval 0 disables checks.
• Add an account-scoped light/dark administration theme stored in the existing SQLite admin_preferences document; dark remains the default and the last authenticated choice is cached locally only to avoid login/dashboard first-paint theme flicker.
• Additional historical details for this release are retained in the technical archive.

0.19.2

• Restore the vhost local-listener risk control for administration backends when the administration socket is startup-locked or otherwise reported only by live status; treat localhost, 127.0.0.0/8 and ::1 as equivalent loopback forms for the same administration port.
• Make Discard changes reload the persisted vhost being edited instead of replacing the editor with a new blank/default vhost.
• Add descriptive HTTP reason phrases to the default-response status selectors and headings.
• Add a temporary, continuously updated 4096-entry Live-log buffer that resets when the log window closes.
• Stop backend traffic EWMA tails on an idle sampling window, show idle consistently as 0.0 KiB/s, and render positive sub-0.1 KiB/s traffic as <0.1 KiB/s instead of a rounded zero.
• Additional historical details for this release are retained in the technical archive.

0.19.1

• Add frontend scheme to the primary cache hash so otherwise identical HTTP and HTTPS requests cannot reuse one object.
• Retain 4096 completed access-log entries while keeping the 256-entry live window; add one-shot on-demand history loading and document the API limit.
• Render backend traffic with KiB/s as the minimum unit, simplify the Live Logs column picker, align generic checkboxes and move Docker-vhost Advanced switches beside Backend protocol on desktop; remove the redundant alias help line.

0.19.0

• Persist per-administrator Live Logs column visibility in SQLite schema v4 without changing the revisioned proxy configuration; JSON export remains complete regardless of visible columns.
• Add authenticated GET/PUT /api/preferences endpoints for dashboard-only account preferences, protected by the existing session/CSRF control-plane guards.
• Retain the full disabled-verification legacy X.509 fix and expanded upstream connector diagnostics introduced during the 0.18.8 follow-up.

0.18.8

• Make backend tls_verify=false a complete certificate-authentication bypass instead of delegating TLS CertificateVerify to webpki. This restores compatibility with legacy appliance certificates such as X.509 v1 while keeping TLS encryption and all backend address/DNS/loop protections in force; tls_verify=true is unchanged.
• Expand upstream connection diagnostics with the full nested Hyper/rustls/io error chain, backend/TLS context, 2 KiB UTF-8-safe detail storage and warning-level journal entries for connect failures.
• Replace Docker-vhost alias comma input with hostname-style chips for add/remove/paste workflows.
• Add per-Docker-vhost HTTP-to-HTTPS redirect, WebSocket and cache controls; new compatible assignments default HTTP-to-HTTPS redirect on while legacy assignments retain their prior redirect-off behavior until explicitly saved.
• Add a Docker-agent default ACL-profile selector. Generated Docker vhosts inherit it unless the application selects its own ACL profile; existing per-app inline ACL configuration is unchanged.
• Additional historical details for this release are retained in the technical archive.

0.18.7

• Collapse Response time history by default on the Overview dashboard while keeping live sampling active.

0.18.6

• Add bounded per-interface RX/TX diagnostics from /proc/net/dev to the administration status payload and render separate live interface histories without adding per-interface Prometheus labels.
• Clarify compression negotiation and make dashboard counters track the codec actually selected per response.

0.18.5

• Add an explicit HTTP/1.1 request counter and render total + HTTP/1.1 + HTTP/2 + HTTP/3 request-rate series on the Overview chart.
• Add an Open app action to published Docker vhosts, using the assigned frontend listener and expanded proxied hostname.
• Label Docker-generated pools in the Backends view with their primary proxied domain.
• Remove the global Open proxy shortcut from the page header.
• Make Compact density materially tighter than Dense across cards, controls, tables, Docker rows and charts.
• Default vhost/Docker proxy timeout controls to explicit 10/120/60/60-second connect/header/read/send limits instead of blank inherited values.
• Additional historical details for this release are retained in the technical archive.

0.18.4

• Default backend health checks to TCP for newly created or otherwise defaulted ordinary and Docker vhosts; explicit existing HTTP/off health modes are preserved.
• Replace the dense Docker-vhost service editor with summary-first rows. Publish state, service identity, backend runtime health and Hide/Show stay visible; routing, ACL, timeouts and health tuning are expanded only for the selected service.
• Collapse secondary Docker-agent inventory metadata behind Agent details while keeping host, service count, last observation and base domain immediately visible.
• Rework Settings -> Security into focused account/session and host-policy cards with on-demand password and policy editors.
• Move Administration audit into a dedicated modal and stop fetching audit entries merely by opening the Security settings tab.

0.18.3

• Add Docker-vhost search plus persistent per-browser Hide/Show Hidden view controls, and allow each Docker agent to select a configured frontend certificate inherited by its generated vhosts.
• Keep Docker inventory polling driven by each agent's configured 5..3600 second interval; the 5-second dashboard refresh reads cached observations only.
• Move redirect HTTP/2 and HTTP/3 toggles below listener selection and keep Cache Updated + Live together at the right side of the toolbar.
• Add an Open-in-browser action beside each vhost Enabled state; wildcard-only hosts open the wildcard base domain, while mixed host lists prefer the first non-wildcard name.
• Restore the documented HTTP/1.1 backend default for newly created ordinary and Docker vhosts: preserve the public Host; existing explicit backend settings are not rewritten.
• Write HTTP/1 upstream header names in conventional title case for compatibility with legacy/custom origins that incorrectly treat header names as case-sensitive; HTTP/2 is unaffected.
• Additional historical details for this release are retained in the technical archive.

0.18.2

• Secure Docker-agent transport by default with a persistent self-signed ECDSA certificate and SHA-256 certificate pinning in RustProxy; public-CA HTTPS remains available without a pin and plain HTTP is compatibility-only.
• Add certificate lifecycle handling, hardened systemd state storage and installer fingerprint output for the standalone Docker agent.
• Enable per-Docker-vhost HTTP/TCP backend health checks using the same bounded backend-pool health machinery as ordinary vhosts, with live checking/up/down, latency, probe, request, active and error diagnostics in Docker vhosts.
• Rework Docker-agent and Docker-vhost UX around connection security, last observation, detected addresses, route controls and collapsible health-check tuning while retaining per-agent domains, aliases and per-service IP selection.

0.18.1

• Extend the Docker agent inventory with all usable host addresses (interfaces, routed address, public lookup and optional advertised address) and preserve every published binding per service.
• Add per-service Docker backend-IP selection, per-agent default backend IP, arbitrary FQDNs and multiple aliases while retaining short-name expansion below each agent's own base domain.
• Support many Docker agents with independent domains such as docker1.lab.local and docker2.lab.local, plus operator-controlled custom domains.
• Remove all special X-Rust-Proxy-Revision response-header behavior; the name is no longer inserted, stripped, protected or accepted as a legacy diagnostic setting.
• Keep cache-Live placement, production password recovery and Settings navigation improvements from 0.18.0.

0.18.0

• Add a standalone Go Docker discovery agent with a hardened systemd unit, token authentication, published TCP-port inventory and host/public-IP detection.
• Add per-agent Docker configuration, in-memory observations and dynamic Docker vhosts with operator-controlled service/subdomain assignments.
• Add Docker vhost/admin UI and OpenAPI endpoints for cached observations and explicit refresh.
• Move the cache Live toggle to the action-toolbar edge.
• Remove configurable X-Rust-Proxy-Revision response exposure and always strip the header.
• Use the installed rust-proxy admin reset-password command in production recovery guidance.

0.17.0

• Add Debian packaging assets, a hardened systemd unit, rustproxy service user/state/log directories, three-day maximum-gzip log rotation, local .deb build tooling and signed APT-repository generation suitable for rustproxy.linuxiarz.pl.
• Expand Prometheus coverage across all current bounded process/OS diagnostics plus GeoIP, certificate renewal, backend health-probe detail, stream, logging and frontend inventory metrics; add explicit token-free scraping for trusted actual-peer CIDRs.
• Add a Grafana operations dashboard under grafana/.
• Add dedicated listener/certificate-aware local-response / 404 hosts with built-in placeholder, empty/status-only and custom-HTML modes.
• Keep the default RustProxy is running placeholder uncacheable and intentionally free of optional proxy/cache/backend/diagnostic/security/compression headers.
• Reuse vhost-style hostname chips for Redirect source domains.

0.16.1

• Remove internal configuration revision numbers from successful save feedback in dashboard editors/manual configuration while retaining revision-based CAS and stale-write protection internally.

0.16.0

• Decouple Custom locations from the main vhost backend fallback. Unmatched paths now use the main pool even when custom rules exist; untouched legacy synthetic root routes are normalized automatically.
• Fix same-process public administration login by allowing rustproxy_session across only a guarded HTTPS self-admin backend that directly targets the configured administration listener and whose public host is explicitly allowed.
• Make RFC 9220 bootstrap wait for the backend HTTP/1.1 upgrade before downstream H3 success, and extend access logging with transport/WebSocket phase/error/reset/upstream status diagnostics.
• Add cache transient-memory gauges and procfs RSS/data/swap breakdowns to the dashboard and Prometheus. Existing allocator trimming/release behavior is unchanged; no new transient-memory throttle is introduced.
• Reorganize the Vhost editor around clearer backend cards, Authentication subcards and compact protocol controls. New vhosts select standard HTTP :80 plus HTTPS :443 together when available; Redirects reuse the same listener selector; disabled vhost cache hides its subordinate controls and new vhost drafts default cache to off.
• Show the local-listener risk acceptance only when the entered backend URL directly targets the configured administration listener. Add protected opt-in X-RustProxy-Backend and X-RustProxy-Backend-Time response diagnostics for selected member identity and origin response-header latency.

0.15.1

• Fix Custom locations English/Polish translation loading in the administration UI.
• Make visual header rules easier to edit with numbered cards, clear field grouping, empty-state guidance and localized help.
• Add a live per-location behavior preview for matching, action, rewrite, cache, ACL and header rules, and reorganize the inline documentation with common examples.
• Add one live three-series HIT/MISS/BYPASS activity chart to the RAM cache card and CPU/RSS history charts to the Proxy process card.

0.15.0

• Expand vhost Custom locations with Nginx-style exact/prefix/^~/regex/regex-insensitive matching, upstream path preserve/strip/replace/regex rewrites and backend-free custom responses.
• Replace the location header JSON-only workflow with a visual request/response header builder, keep Advanced JSON as an escape hatch, add in-panel documentation and reorganize the location editor into compact functional sections.
• Add nagios/ API checks for administration response time, unavailable/checking backends, backend latency and dropped logging/cold-cache work, with reusable protected session cookies and Nagios performance data.
• Move per-vhost Server-Timing and verified Cloudflare client-IP diagnostics into the main frontend/details configuration.
• Add compact dashboard history charts for RAM-cache residency, network RX/TX and mean response latency, plus administration API RTT and low-priority queue/drop information in the footer.
• Add independent cold-cache age policy controls: demote by time since last access, by total hot-tier residency, by LRU pressure and on graceful shutdown.
• Additional historical details for this release are retained in the technical archive.

0.14.0

• Fix administration reverse-proxy Host/Origin handling: explicit DNS allowlist entries describe the external authority instead of the private admin socket port; direct IP/localhost access remains bound to the actual admin port.
• Trust forwarded administration host/scheme only from loopback or configured trusted proxy peers, use the external scheme for Origin/CSRF checks, and set/clear Secure session cookies consistently behind HTTPS termination.
• Implement RFC 9220 WebSocket over HTTP/3 Extended CONNECT, including SETTINGS_ENABLE_CONNECT_PROTOCOL, :protocol=websocket validation, HTTP/1.1 backend Upgrade translation, downstream 200 bootstrap, bidirectional H3 DATA transport and FIN/reset cancellation handling.
• Replace the separate h3/h3-quinn pair with hpx-h3 2.5.19 and its integrated Quinn feature to expose the RFC 9220 protocol extension through the HTTP/3 stack.

0.13.2

• Fix authenticated dashboard refresh/back-forward session restoration so valid cookies are honored on every panel document route instead of briefly rendering the login shell.
• Make managed software updates force a bounded hot-to-cold cache handoff whenever the cold tier is enabled, independent of the ordinary cold_on_shutdown preference, and extend the managed systemd stop budget.
• Persist non-secret automatic-certificate-renewal observations in SQLite schema v3, preload them before administration listeners are exposed, and import the older certs/renewals.json sidecar once for upgrade continuity.
• Move the raw full-document editor from primary navigation into Settings -> Manual config while retaining /configuration as a compatibility browser route.

0.13.1

• Make administrator browser sessions configurable from 7 to 30 days (30 days by default), replacing the previous short browser lifetime/idle behavior while preserving explicit logout/password/revoke invalidation.
• Refresh authenticated cookies only to the remaining absolute server-side expiry so session persistence cannot become an unbounded sliding session.
• Add per-backend accept_local_listener_risk with a dashboard confirmation and validation path for deliberate local-listener targets such as 127.0.0.1:9090; allow_private and special-address protections remain independent.

0.13.0

• Add first-class redirect hosts with dedicated dashboard navigation, named listeners/certificates, exact/prefix and scheme matching, URL/host/path targets, 301/302/303/307/308, path/query policies and redirect cache controls.
• Resolve redirect traffic locally before proxy routes while preserving listener ownership and global host ACLs.
• Change omitted backend tls_verify to default false and update UI/API/documentation accordingly.
• Compact TLS certificate cards: show DNS SAN coverage as the same policy-style badges used on vhosts, collapse bindings/files/assigned-vhost details, and inspect older/manual public PEM files when persisted coverage metadata is missing.

0.12.1

• Add revisioned per-section configuration PUT endpoints and move ordinary dashboard forms to them, retaining full-document updates only where multiple sections must publish atomically.
• Decouple cache compatibility from the SQLite configuration revision so logging, administration, TLS inventory, metrics and other unrelated saves do not purge hot/cold objects.
• Add explicit dashboard subpage routes plus History API navigation so browser refresh preserves the selected panel.
• Add independent cold-tier policies for idle objects, LRU evictions and graceful shutdown, reduce the cold-write body queue, flush remaining hot objects before process exit, and trim released allocator memory on glibc/Linux.
• Expose certificate DNS SubjectAltName coverage separately from active SNI bindings for uploaded and ACME-managed certificates.
• Preserve secure-by-default backend TLS verification when omitted; keep the explicit debug-origin verification bypass and improve corrective validation/help text.

0.12.0

• Move raw TCP/UDP stream management from Settings to a dedicated Streams main-navigation page directly below Vhosts.
• Add vhost-style searchable stream cards and a modal editor with Details, Listener & upstream, and Limits tabs plus an explicit Add TCP/UDP listener action.
• Add fixed-cardinality runtime telemetry per active stream: connections/sessions, completed sessions, active sessions, rejects, errors, RX/TX bytes and UDP packet counters.
• Add per-stream live RX/TX rate charts in the dashboard while keeping desired stream changes visibly pending until the process restarts and the listener is actually active.
• Change named HTTP/HTTPS listener bind-address editing from a textarea to chip-style addresses matching the Vhost hostname interaction, preserving existing multi-address validation.
• Keep stream forwarding as raw Layer 4 with no HTTP vhost, ACL, cache, headers, compression or authentication envelope.
• Additional historical details for this release are retained in the technical archive.

0.11.5

• Accept percent-encoded spaces (%20) in otherwise unambiguous request paths while preserving rejection of encoded separators, double-decoding hazards, controls and dot-segment ambiguity.
• Avoid the h3-quinn 0.0.10 stop_sending() panic path when an HTTP/3 request body is dropped while a receive read is pending.
• Add raw layer-4 TCP/UDP stream hosts on dedicated listeners with bounded TCP connections / UDP client sessions and restart-bound configuration in the admin panel.
• Add a Debian 13+ source bootstrap that installs build dependencies and Rust, clones/builds the repository and installs the systemd service with the explicitly requested public admin profile.
• Match Varnish built-in request-method behavior for the shared cache: GET/HEAD participate in lookup while successful POST/PUT/PATCH/DELETE/OPTIONS/TRACE requests no longer trigger an implicit global purge.
• Replace the conservative per-request-header/backend-member cache identity with a Varnish-style Host + URL primary identity, isolated by RustProxy vhost/config scope, and use response Vary as the secondary representation selector.
• Additional historical details for this release are retained in the technical archive.

0.11.4

• Fix Force SSL frontend validation and messaging: require an actual non-TLS listener for the incoming redirect, prefer HTTPS port 443 when multiple TLS listeners are selected, and reject only ambiguous non-standard HTTPS target ports.
• Add a visual reusable ACL-profile rule editor with add/remove/action/CIDR rows. Keep bulk paste/import as an advanced path, normalize invisible Unicode whitespace and report malformed rules with their source line.
• When a vhost disables cache, strip and suppress RustProxy X-Cache, X-Cache-Hits, Cache-Status, X-Cache-Reason and X-Cache-Resident-Age diagnostics for that response.
• Render backend pools belonging to disabled vhosts as muted Disabled rows in the main dashboard instead of classifying them as unavailable.

0.11.3

• Add per-vhost control over forwarding the effective client IP to the application. Disabling it removes Forwarded, X-Forwarded-For and X-Real-IP only on the backend request; ACLs, GeoIP, rate limiting and Tinyauth continue to use the real client identity.
• Add a compact Vhost search/filter for vhost IDs, hostnames/wildcards and backend IDs/URLs.
• Fix JSONL access logging under the hardened systemd unit by provisioning /var/log/rustproxy as a writable service log directory while keeping ProtectSystem=strict.

0.11.2

• Fix administration HTTPS access negotiated over HTTP/2. The admin guard now derives the effective authority from H2/H3 :authority (via the request URI) when no legacy Host header is present.
• Preserve strict HTTP/1.x Host handling and reject conflicting HTTP/2 Host versus :authority values to avoid ambiguous authority validation.
• Add per-vhost Force SSL beside frontend selection. Cleartext requests receive a non-cacheable HTTP 308 to the same hostname/path/query on the vhost's unique selected TLS port; ambiguous multi-port TLS selections are rejected.
• Map NPM ssl_forced (and migrator --force-https) to RustProxy force_ssl, retaining HTTP+HTTPS listener bindings when available instead of importing forced hosts as TLS-only.

0.11.1

• Fix release update health checks when the administration panel uses persisted HTTPS or a persisted bind different from the install-time CLI address. The check now resolves the active admin listener/scheme from config.sqlite3 and honors the admin Host allowlist.
• Add a standard-library-only Nginx Proxy Manager SQLite migrator. It reads proxy_host, creates RustProxy vhosts/backends, preserves wildcard names/WebSocket/enabled/H2 intent, uses the RustProxy default certificate for imported TLS hosts unless a named certificate is selected, and keeps unsupported NPM policy/custom-config items as explicit review warnings.
• Make NPM migration dry-run by default, emit npm-migration-plan.json, detect hostname conflicts, split source records above RustProxy's 16-host limit and use revisioned authenticated API writes only with explicit --apply.

0.11.0

• Add reusable ACL Profiles with optional IP/CIDR ACL and country allow/block rules. Vhost profile, inline vhost ACL and route ACL enforcement remains cumulative.
• Add an ACL Profiles navigation page and per-vhost profile selection without removing individual vhost policy controls.
• Add chip-style hostname editing and validated leading *. wildcard domains. Exact hosts win before the longest matching wildcard on the same listener.
• Add compact browser-session request-rate history charts to vhost cards, with progressive compaction of older samples.
• Add the built-in HTTP 401 page and classify normal WebSocket tunnel EOF/reset/abort/broken-pipe termination after a successful 101 upgrade as websocket_closed rather than a body/proxy error.
• Redirect plaintext requests received on the HTTPS administration socket to HTTPS while keeping application content unavailable over plaintext. Permit valid DNS Host values when the HTTPS admin hostname allowlist is empty; explicit allowlists remain strict.
• Additional historical details for this release are retained in the technical archive.

0.10.0

• Add an optional persistent cold cache tier under the private data directory. Hot LRU/idle objects demote through a bounded asynchronous queue; fresh cold hits are SHA-256 checked and promoted back into the bounded RAM tier.
• Add hot/cold object, byte, promotion, demotion, cold-hit, eviction/error and queue-drop observability to the Cache API, panel and Prometheus output.
• Add cold-tier path, byte/object budgets and idle demotion settings; purge/config publication invalidates both tiers and startup rebuilds the same-revision cold index.
• Add structured-log Standard, Nginx-style, ECS-style and Minimal presets plus a visual field picker/renamer with JSON preview; preserve advanced raw JSON mappings.
• Reuse the shared application card component for Logging sinks and remove release-specific fieldset border styling.
• Additional historical details for this release are retained in the technical archive.

0.9.0

• Redesign the vhost list as readable cards with listener/protocol/TLS/cache identity and live pool health, request, active, error, latency and traffic metrics.
• Add bounded asynchronous structured access-log sinks for JSONL files, Logstash TCP and Loki HTTP(S), with configurable JSON field mapping/static fields and sink delivery/drop/error counters.
• Expand cache object inspection with body bytes, resident bytes and metadata overhead; add optional X-Cache-Resident-Age.
• Add administration HTTPS with either the application-managed default certificate or a selected inventory certificate. Persisted non-loopback administration binds are accepted when HTTPS is enabled.
• Keep loopback HTTP as the default and retain the explicit legacy risk gate for plain remote HTTP. Secure session cookies are marked Secure on HTTPS administration.
• Add global TLS 1.2/1.3 and rustls cipher-suite policy plus per-vhost TCP TLS overrides. HTTP/3 vhosts must use the global TLS 1.3 policy.
• Additional historical details for this release are retained in the technical archive.

0.8.1

• Enable the shared RAM cache by default.
• Replace blanket conditional-request bypass with local conditional HITs for fresh If-None-Match / If-Modified-Since requests.
• Add validator-based backend revalidation: request no-cache, freshness constraints and legacy Pragma: no-cache can revalidate a stored representation; backend 304 refreshes metadata and reuses the cached body.
• Keep request no-store as a hard bypass. Allow response Cache-Control: no-cache with ETag/Last-Modified to be stored only for mandatory validation; no-store and private still forbid shared storage.
• Retain expired validator-bearing objects for a bounded one-hour revalidation keep window without stale delivery.
• Raise the configurable object ceiling from 8 MiB to 1 GiB, still bounded by the global 1 GiB resident budget.
• Additional historical details for this release are retained in the technical archive.

0.8.0

• Global static-cache defaults now include common image, stylesheet/script, font, media and download extensions, with request Cookie ignored for matching assets by default. The global and per-vhost controls are visible in the cache UI; Set-Cookie, private/no-store and Vary: Cookie still prevent shared caching.
• HTTP/2 and HTTP/3 are per-vhost frontend opt-outs next to listener selection. Controls are enabled only when a selected named listener supports the protocol; TLS H2 ALPN is narrowed by SNI per vhost.
• Settings -> Listeners uses normal page scrolling instead of an extra nested scrollbar.
• Add per-vhost request throttling with graphical request/window/burst controls, country-specific limits and country block/allow-only policies. Return built-in HTML 429/403 responses while preserving custom error-page overrides.
• Download the PDDL sapics/ip-location-db user-country IPv4/IPv6 data during first installation over HTTPS and verify publisher SHA-256 checksums; expose load status without exposing client data.
• Verify the installed GeoIP database against current publisher SHA-256 files on every managed update and download only stale/missing assets before downtime.
• Additional historical details for this release are retained in the technical archive.

0.7.3

• Generate the one-time administrator setup token from the release CLI even before the first server start; retain the rule that it is invalid after setup completes.
• Add explicit remote-panel opt-in for 0.0.0.0/::, requiring both --allow-remote-admin; keep plain-HTTP risk visible.
• Make Linux/systemd install defaults listen on HTTP 80 and HTTPS 443; add --no-https for explicit HTTP-only installation.
• Hotfix backend HTTPS-by-IP with optional tls_server_name: TLS SNI and hostname verification may use a DNS name while the validated TCP target stays pinned to the configured backend URL.
• Add an explicit per-backend tls_verify switch, secure by default. Administrators may turn verification off for an HTTPS origin without weakening DNS/address/self-loop policy. Add matching 503/504 HTML gateway pages while preserving custom-page overrides.

0.7.2

• Publish a distinct patch release; keep both previous 0.7.1 deliveries historical.
• Remove the independently downloading utoipa-swagger-ui adapter and embed the prepared JS/CSS directly, for debug and release. Existing admin guards stay in place.
• Prepare assets with the existing Python 3.10+ tool requirement, now also needed for direct Cargo builds. Support absolute local tag ZIPs, optional archive SHA-256, bounded exact-member reads, validated download caching and retained license notices.
• Resolve build input paths from CARGO_MANIFEST_DIR, track local sources and outputs, and report missing tools/assets explicitly instead of silently changing UI versions.
• Additional historical details for this release are retained in the technical archive.

0.7.1

• Add visual request/response header editing to each custom vhost location, with set/append/remove, validation, isolation and synchronized optional JSON.
• Split anonymous sign-in from the operational document and module/language bundles. Remove the login tagline; preserve the original brand and compact square style.
• Reduce public health to status and auth discovery to setup_required only. Make the public allowlist exact by method and path; private/unknown requests are denied before body/query extraction, including method mismatches and aliases.
• Keep Origin/Host/CSRF/session guards; reject duplicate CSRF/marker headers and hide login/setup JSON parser details. Clear UI data across tabs and on revocation.
• Add authenticated /docs and OpenAPI with pinned, build-embedded Swagger UI, same-session authorization, read-only execution by default and CSRF-confirmed writes.
• Replace updater reliance on a public version with local MainPID/executable checks.
• Additional historical details for this release are retained in the technical archive.

0.7.0

• Renew managed ACME profiles automatically with shared worker bounds, jitter, backoff, private observations and validated CAS hot deployment; expose opt-out, check-now and dry-run controls. Keep previous certificates active on failure.
• Add install.sh/update.sh for Linux/systemd, root-owned release switching, stopped full-data backups and code/data rollback on failed startup/version checks.
• Add per-vhost Basic Auth with Argon2id-only storage, optional verified upstream credentials and cumulative graphical IP ACLs. Keep protected content out of cache.
• Add WebSocket toggles and graphical custom path locations, including explicit exclusion of dedicated path origins from normal pool/sticky selections.
• Replace the sample welcome page with neutral information, make the protocol fixture opt-in, unify square modal and Settings-tab styling, preserve branding.

0.6.0

• Replace separate legacy routes with vhosts and a one-way, validated compatibility importer; preserve path-pinned origins, ACLs and existing listener scope.
• Add HTTP-01 webroot domain validation, Cloudflare DNS-01 and OVH DNS-01 alongside RFC2136 using private Certbot workers.
• Unify certificate creation/import in a provider-picker modal; record optional issuer metadata in the library and keep secrets outside exported configuration.
• Add an independently configurable Prometheus endpoint with actual-peer CIDRs, optional environment-sourced bearer token, bounded scrapes and collector switches.
• Export application/admin/listener/vhost/backend/cache/system data and full-exchange vhost histograms with bounded configured labels.
• Split Settings into functional switching cards; preserve dirty values, keyboard access and translation discovery; remove Security and legacy routing sidebar entries.
• Additional historical details for this release are retained in the technical archive.

0.5.0

• Add a compact dedicated cache panel with vhost/domain counters, object pagination, TTL/Age/hits, memory/fill diagnostics and authenticated selective purge.
• Fix reserved administrator-cookie ordering and empty terminating DATA frames; emit fixed cache decision reasons without exposing request secrets.
• Replace special X-Mock-Origin hiding with the explicit global/vhost revision switch; ordinary response rules still handle arbitrary removable headers.
• Default HTTP/3 on TLS bindings, retain explicit null opt-outs, and explain overlapping sockets with ownership and concrete protocol/limit differences.
• Return 503 for upstream connection/unavailability, 502 for invalid responses and 504 for header timeouts; generated errors use no-store.
• Add basic asynchronous Certbot DNS-01/RFC2136 issuance, staging-first consent, private TSIG/account profiles, output validation and explicit library import. No automatic renewal scheduler or real CA validation is claimed.

0.4.0

• Rebuild standard Forwarded and X-Forwarded metadata at an explicit trusted-proxy boundary; use verified client IP for ACL/affinity, never for destination routing.
• Add per-vhost Tinyauth subrequests, identity header allowlists, safe same-login-origin redirects and fail-closed checks before origin/static/cache/WebSocket use.
• Move certificate upload into an independent inventory; assign certificates by ID per vhost and expose metadata-only inventory reads. ACME is not implemented.
• Add named multiple-IP listeners with descriptive scope, opt-in legacy routes, reusable vhost references and actual/desired plans.
• Add Quinn/h3-based HTTP/3 UDP transport, TLS 1.3/SNI, Alt-Svc, per-endpoint connection and per-connection stream/idle limits, shared proxy policies and bounded shutdown. Preserve TCP HTTP/2 plus HTTP/1.1.
• Hide request-ID/revision headers by default; add individual overrides and optional mock-origin stripping. Apply effective Server policy across all response paths, including extra sockets.
• Additional historical details for this release are retained in the technical archive.

0.3.0

• Add optional per-vhost certificate inventory selection and PEM file upload. Validate key/certificate pairing and names, write private immutable files, and activate only through the existing revisioned configuration update.
• Add per-vhost cache overrides and selective invalidation, including stale in-flight fill cancellation while leaving other host entries intact.
• Add administrator-authored, bounded global/vhost error pages, static vhost and missing-path responses, direct-IP and unknown-host responses. Retain ACL checks, HEAD handling and authentication challenges; never execute HTML in the admin UI.
• Move access logs into a separate modal/docked viewer with fixed filters, vhost identity, pause, scoped search/status/method/cache controls and JSON export.
• Add a compact vhost list, tabbed dialog, live health/latency summaries and visual per-host response/request headers; keep the original logo and favicon.
• Add density preferences and a Settings shortcut to Security.
• Additional historical details for this release are retained in the technical archive.

0.2.0

• Support compression size thresholds above 64 KiB without truncation.
• Add IP/port/TLS-bound virtual hosts with frontend(s), backend pool and path policies.
• Enforce real accepted destination matching; isolate legacy routes from extra sockets.
• Add weighted round-robin, least-connections, least-traffic, adaptive and IP hashing.
• Add bounded TCP/HTTP health checks, separate passive failures, recovery and slow start.
• Add connection keepalive controls, backup members, drain and opaque cookie/IP affinity.
• Additional historical details for this release are retained in the technical archive.

0.1.0

• Persisted public listener addresses/ports, 80/443 presets, startup defaults and restart status.
• Bounded streaming shared RAM cache, TTL/Age, LRU, privacy/Vary protections, per-route bypass, optional HIT/MISS headers and audited purge.
• Streaming gzip, Brotli, Zstandard and deflate controls, final Server policy and a global client-response header editor.
• Compact dashboard with system/process/cache diagnostics, log filters and export.
• Allow ordinary remote-origin 80/443 while guarding local proxy/admin listener targets.
• Additional historical details for this release are retained in the technical archive.

0.0.6

• Detect mixed source layouts and preserve the known legacy auth file; refuse to delete unrecognized local changes.
• Support interactive username input for admin init.
• Replace managed source directories with rollback on copy failure rather than encouraging overlay extraction.
• DNS and HTTPS manual backends with per-backend pools, bounded DNS workers, validated DNS answers, optional CIDR allowlists and additional PEM trust anchors.
• rustls public TLS listener, persistent development default certificate, exact SNI bindings, local generate/import commands and explicit hot reload.
• Additional historical details for this release are retained in the technical archive.

0.0.2

• Introduced RustProxy naming, administrator setup, Argon2id passwords, sessions, CSRF checks, login throttling, password recovery and credential revocation.
• Added host/route ACLs, generic request/response header policies, administration audit, SSE dashboard updates and security controls in the bilingual panel.
• Added an additive SQLite migration, offline validation and online database backup.

0.0.1

• Initial manual-backend HTTP/1.1 proxy, streaming and keep-alive.
• SQLite configuration, dynamic host/alias/path routing and local token control plane.
• English/Polish interface, bounded access log, counters, CLI, demo backend and dev.sh.