gru/RustProxy

0 Fork 0

Files

T

2026-10-07 22:22:54 +02:00

52 KiB

Raw Blame History

Historical roadmap archive

Archived during the RustProxy 0.25 documentation cleanup. This file preserves completed historical roadmap entries. The active roadmap is ../ROADMAP.md; unresolved work is tracked in TODO.md.

RustProxy roadmap

0.25.0

Current direction: 0.24.10 -> 0.25.0

Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
Add Reverse Proxy / Web Server source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
Add GET, HEAD, MIME, Content-Length, streaming, index lookup, directory slash redirect and optional directory listing.
Add metadata-based ETag/Last-Modified, conditional 304, single Range/If-Range, 206 and 416.
Enforce decoded-path validation and document-root confinement; Unix traversal uses openat + O_NOFOLLOW and does not serve symlinks.
Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
Clean 0.25 README/Docs/CHANGELOG release material so current user-facing changes are separated from historical audits.
Add an authenticated /docs Markdown Reader with a separate API/OpenAPI tab, canonical docs index, 0.25 specification audit and open-work TODO.
Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test plus live H1/H2/H3/static-file acceptance on the release host.

0.24.10

Current direction: 0.24.9 -> 0.24.10

Make Error File a first-class revisioned configuration section and persist enabled/path/format across database reopen.
Remove the redundant Error File help sentence while retaining JSON/RAW controls and live apply.
Keep response-time history permanently expanded and add an accessible information popover matching Process.
Extend UI/API/source regressions and update release identity to 0.24.10.
Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test and browser acceptance on the release host.

0.24.9

Current direction: 0.24.8 -> 0.24.9

Add the encrypted Secret Store and migrate ACME Cloudflare/OVH/RFC2136 credentials away from persistent plaintext files.
Add password-encrypted full backup/restore with manifest validation, integrity checks, staging and rollback-safe activation.
Add the optional bounded asynchronous ERROR file sink with JSON/RAW formats, shared secret redaction and external logrotate integration.
Extend offline source/release contracts and update release identity to 0.24.9.
Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test and end-to-end backup/restore/error-log acceptance on the release host.

0.24.8

Current direction: 0.24.7 -> 0.24.8

Expand Cache RAM overview history with HOT usage/limit and transient total/fill/COLD queue/COLD I/O series.
Add COLD storage occupancy history without mixing disk bytes into process RAM.
Move the RSS/cache accounting caveat behind an accessible information control.
Extend offline UI/release contracts and update release identity to 0.24.8.
Run compiler-enabled ./dev.sh check / ./dev.sh test and browser/live-cache acceptance on the release host.

0.24.7

Current direction: 0.24.6 -> 0.24.7

Make the transform temporary-memory budget configurable and persisted with the normal SQLite-backed transform settings.
Add a process-wide maximum concurrent transformation limit with fail-open pressure behavior.
Add persisted RAM saver / Recommended / Performance / Uber performance resource presets while keeping transform types/extensions independent.
Add UI budget safety warnings and manual-edit -> Custom preset behavior.
Expose live transform RAM/concurrency, process/cache RAM accounting and COLD disk occupancy in the dashboard.
Clean externally reported cache/CSS compiler warnings without lint suppression.
Rotate cache compatibility identity for global transform representation/eligibility changes but not resource-only capacity metadata.
Extend OpenAPI, SQLite persistence, memory-contract and release/source regressions and update release identity to 0.24.7.
Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test and sustained RSS/heap acceptance for every resource preset on the release host.

0.24.6

Current direction: 0.24.5 -> 0.24.6

Persist selected HOT/COLD cache preset intent in the SQLite-backed configuration and restore it in Settings.
Add a Recommended COLD policy preset without overriding disk capacity/path choices.
Bound transform aggregation/decompression/concurrency memory and remove avoidable JSON/HTML/CSS allocation churn.
Bound stale revalidation, proactive refresh scheduling, COLD cleanup selection/concurrency and delete fallback tasks.
Audit the remaining long-lived/background workers for queue/task cardinality and cancellation ownership.
Add Rust-independent memory contract regression checks and update release identity to 0.24.6.
Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test and sustained RSS/heap acceptance on the release host.

0.24.5

Current direction: 0.24.4 -> 0.24.5

Resolve unknown-length, actually empty HTTP/3 bodies before HTTP/1.1 upstream framing.
Preserve streaming for non-empty H3 bodies and declared Content-Length requests.
Add source-level regression coverage for DELETE and other body-capable methods.
Bound HOT by allocation-aware admission, enforce max_object_bytes during fill, and add a separately bounded transient/COLD-queue memory model.
Preserve HOT -> COLD ownership semantics while charging demoted payloads until persistence drops them; expose logical/allocated/transient telemetry.
Make global cache disable authoritative over vhost overrides and remove the artificial 1 GiB HOT/object ceiling.
Add host/cgroup-aware conservative/recommended/performance cache presets and non-blocking memory/headroom warnings in Settings.
Update source/package/UI/OpenAPI identity and offline release checks to 0.24.5.
Run compiler-enabled ./dev.sh check / ./dev.sh test, the H1/H2/H3 method matrix, and cache RSS/HOT/COLD stress acceptance on the release host.

0.24.4

Current direction: 0.24.3 -> 0.24.4

Make the Linux THP mitigation process-local with PR_SET_THP_DISABLE before Tokio worker creation.
Preserve the existing glibc arena limit and allocator-trim behavior.
Add source/release regression coverage for THP opt-out ordering and release identity.
Run compiler-enabled ./dev.sh check / ./dev.sh test, release build and a sustained production RSS comparison with host THP returned to its normal policy.

0.24.3

Current direction: 0.24.2 -> 0.24.3

Reduce Linux/glibc arena retention by adding MALLOC_ARENA_MAX=2 to managed systemd units.
Remove redundant identity-body and JavaScript/CSS transformation allocations; release successful-transform temporaries earlier and trim large glibc transform churn at a bounded cadence.
Move HTTP/3 enablement to listener editing while keeping HTTP/3 tuning under HTTP connections.
Rename Proxy Process to Process and hide unsupported platform diagnostics dynamically.
Remove the stale unreferenced per-BSD parser source from the release archive.
Update source/package/UI/OpenAPI identity and Rust-independent release gates to 0.24.3.
Run compiler-enabled ./dev.sh check / ./dev.sh test, release build and sustained cache/transform RSS acceptance on the release host.

0.24.2

Current direction: 0.24.1 -> 0.24.2

Bump package/source/UI/OpenAPI release identity to 0.24.2 without functional changes.

0.24.1

Current direction: 0.24.0 -> 0.24.1

Replace the duplicated BSD statistics implementation with shared cross-platform library APIs.
Preserve Linux-specific /proc/cgroup diagnostics as additive compatibility fields.
Populate additional portable system/process metrics exposed by the selected libraries where available.
Expose low-risk runtime metadata through the authenticated status API, including the resolved data/database path.
Make CLI installed-data discovery use Linux and BSD/OPNsense conventions without hardcoding the path in the browser.
Move Logging into Settings and retain legacy /logging navigation compatibility.
Fix the release-host compiler error in portable uptime sampling and remove the stale H2 import warning.
Remove artificial hostname-count ceilings from certificate bindings/issuance and hostname-list configuration while retaining syntax, payload and resource-safety bounds.
Update source/package/UI/OpenAPI identity and source-side regression contracts to 0.24.1.
Generate and commit a resolver-produced Cargo.lock, then run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on the release host.
Run native FreeBSD/OpenBSD/NetBSD diagnostics acceptance and final H2/H3/WebSocket/proxy-statistics regression.

See the 0.24.1 specification audit.

0.24.0

Current direction: 0.23.3 -> 0.24.0

Graceful H2 idle retirement with activity/stream recheck, GOAWAY and bounded drain.
Independent H2 maximum connection lifetime and drain timeout settings.
Settings API/UI/OpenAPI contracts for all three H2 lifecycle limits.
Extract system statistics into platform backends without changing Linux metric semantics.
Add FreeBSD/OpenBSD/NetBSD native best-effort sampling and explicit unsupported/null metrics.
Surface platform in Proxy Process and Prometheus metadata.
Update source/package/UI identity and source-side regression contracts to 0.24.0.

See the 0.24.0 specification audit.

0.23.3

Current direction: 0.23.2 -> 0.23.3

Add opt-in per-vhost legacy WebSocket compatibility without changing ordinary HTTP behavior.
Force legacy-mode upstream WebSocket handshakes to HTTP/1.1 and force legacy WebSocket Host to the configured backend authority and align Origin with it.
Tolerate old 101 response framing while keeping the WebSocket accept proof and subprotocol validation strict.
Add dashboard/OpenAPI/language-pack controls and source regressions.
Update package/source identity and Rust-independent release gates to 0.23.3.
Run compiler-enabled ./dev.sh check / ./dev.sh test, release build and live iLO4/legacy WebSocket acceptance on the release host.

See the 0.23.3 specification audit.

0.23.2

Current direction: 0.23.1 -> 0.23.2

Let Cache and Transformation live charts retain 60, 120, 300 or 600 samples without changing the 3-second polling cadence.
Persist each chart history-window choice locally in the browser and keep history memory bounded.
Fix local CLI administration transport detection so HTTPS administration no longer traps --livelogs in a 308 reconnect loop.
Pin local CLI HTTPS to certificates from the private RustProxy certificate directory and reuse the transport for config/TLS CLI calls.
Update package/source identity and Rust-independent release gates to 0.23.2.
Run compiler-enabled ./dev.sh check / ./dev.sh test, release build and live HTTPS --livelogs acceptance on the release host.

See the 0.23.2 specification audit.

0.23.1

Current direction: 0.23.0 -> 0.23.1

Add default-collapsed, full-width live activity charts to the Cache and Transform workspaces.
Plot selected-scope Cache HIT/MISS/BYPASS rates from runtime counters without adding proxy-path work.
Plot selected-scope Transform applied/cache-HIT/skipped/error rates from the existing runtime metrics endpoint.
Reuse the dashboard SVG/chart styling, live 3-second refresh and language-pack model.
Update package/source identity and Rust-independent release gates to 0.23.1.
Run compiler-enabled ./dev.sh check / ./dev.sh test, release build and browser acceptance with sustained Cache/Transform traffic on the release host.

See the 0.23.1 specification audit.

0.23.0

Current direction: 0.22.3 -> 0.23.0

Add scoped external certificate API authentication with Key ID + Bearer Token, hash-only storage, rotation/revoke/status and last-used metadata.
Restrict the external credential to certificate deploy/reload and require HTTPS outside loopback.
Add Settings → Certificate API UX and preserve direct production binary commands for local deploy/reload.
Add rust-proxy --livelogs with a bounded live stream, interactive structured filters, detailed request inspection and explicit lag reporting.
Split Settings → Cache into General, Resilience, Cold cache and Static & diagnostics sub-tabs without changing the atomic cache settings document.
Run compiler-enabled rust-proxy/Cargo check, tests and release build plus live token-auth certificate rotation and sustained high-rate live-log acceptance on the release host.
Upstream mTLS/client certificate remains deliberately deferred.

See the 0.23.0 specification audit.

0.22.3

Current direction: 0.22.2 -> 0.22.3

Add HTTP/1.1 Upgrade: h2c on opt-in cleartext H2 listeners while preserving prior-knowledge h2c.
Validate Upgrade/HTTP2-Settings and reject malformed or body-bearing bootstrap requests before 101.
Reconstruct the initiating H1 request as HTTP/2 stream 1 and retain the normal Hyper H2 path for later streams.
Add dedicated certificate hot reload without mutating desired configuration or revision.
Add external certificate deployment for Certbot/manual issuers with immutable generation staging and atomic multi-vhost switch by certificate id.
Add API/CLI/panel support plus audit/OpenAPI/documentation for certificate reload/deploy.
Run compiler-enabled ./dev.sh check / ./dev.sh test, release build and live H1 -> h2c Upgrade -> H2 plus TLS/H2/H3 certificate-rotation acceptance on the release host.
Upstream mTLS/client certificate remains deliberately deferred.

See the 0.22.3 specification audit.

0.22.2

Current direction: 0.22.1 -> 0.22.2

Add replay-safe failover retry with bounded policy and observability.
Correct explicit HTTP/2 upstream request versioning and retain h2c prior-knowledge regression coverage.
Add per-backend maximum concurrent proxy exchanges with bounded queue timeout / 503 behavior and metrics.
Add detailed upstream failure classification plus last failure and health ejection/recovery timestamps.
Consolidate backend operations data in the existing dashboard table: health, active/limit, requests/errors, latency, traffic, last failure and last recovery.
Parse and expose public-certificate issuer/SAN/validity/remaining-days/expiry status plus renewal status/last attempt/error.
Add a distinct maximum TCP connection/socket limit per backend; request concurrency is implemented but is intentionally not presented as a socket limit.
Run compiler-enabled ./dev.sh check / ./dev.sh test and live H1/H2/H3 plus H2 -> proxy -> H2 acceptance on the release host.

See the 0.22.2 specification audit.

0.22.1

Current direction: 0.22.0 -> 0.22.1

Move selective PURGE/BAN and active BAN management into dedicated Cache modals with inline operation feedback.
Add per-vhost RFC 8441 HTTP/2 WebSocket Extended CONNECT beside RFC 9220.
Bridge H2 RFC 8441 WebSockets to H1 upstreams and preserve Extended CONNECT to explicit H2 upstreams.
Add opt-in cleartext HTTP/2 prior-knowledge (h2c) listeners.
Add stable active-tunnel inventory, per-tunnel kill, operator reason and audit logging.
Split WebSocket tunnel statistics by H1 / H2 RFC 8441 / H3 RFC 9220 on the main dashboard and Prometheus.
Preserve the 0.22.0 cache feature set and Accept-Ranges policy.
Update 0.22.1 source/package identity and Rust-independent release gates.
Run the compiler-enabled ./dev.sh check / ./dev.sh test gate plus live H1/H2/H3/h2c/RFC8441 acceptance on the release host.

See the 0.22.1 specification audit.

0.21.0

Current direction: 0.20.0 -> 0.21.0

Shard Cold Cache storage and add bounded asynchronous GC plus selective cleanup.
Add RFC 5861 stale windows, request max-stale, correct request max-age=N, and correct revalidation-directive semantics.
Add the extensible decode -> transform -> canonical cache -> encode stage with transformed lengths/validators, strict no-transform, HEAD/fill safety and canonical Vary: Accept-Encoding handling.
Add global, per-vhost and Docker-discovery transformation controls and administration UI/API coverage.
Make Passive Backend Health explicit opt-in for ordinary and Docker vhosts while preserving independent active health checks and unconditional observability.
Keep route cache override tri-state and expose effective route/cache/transform diagnostics.
Close 0.21.0 with the current conservative JS/CSS transformers; defer parser-backed replacements to a later development cycle.
Release-host gate: run Rust 1.88+ fmt/check/test/clippy/release-build and live H1/H2/H3/cache/compression/restart acceptance before deployment.
Finish release polish: backend timing header rename, human-readable uptime, transformed Live traffic series, Docker Passive Backend Health layout fix, warning cleanup and cache module split.
Keep package/source identity and OpenAPI at 0.21.0 and package the completed feature scope as the 0.21.0 release source.

See the 0.21.0 specification audit.

0.20.0

Current direction: 0.19.4 -> 0.20.0

Split Certificates into Installed / Renewal / Generate tabs.
Move generation/import into the tabbed workspace and keep existing certificate actions compatible.
Improve ACME/renewal status readability and display exact Certbot log locations on failures.
Update package/source identity, OpenAPI and release checks to 0.20.0.

0.19.4

Current direction: 0.19.3 -> 0.19.4

Normalize Docker-vhost Aliases field geometry with neighboring inputs and remove the extra inherited label spacing.
Retain 0.0 KiB/s idle and <0.1 KiB/s positive low-rate backend traffic formatting with release regression coverage.
Add Cache domain-table filtering by resolved cache-enabled state without changing aggregate cache statistics.
Update package/source identity, OpenAPI and release checks to 0.19.4.

0.19.3

Current direction: 0.19.2 -> 0.19.3

Preserve the exact panel and Settings tab through session expiry/re-login without shell flicker.
Canonicalize /configuration into persistent Settings tab routing.
Add shared save-button busy state and field-focused validation feedback.
Preserve certificate import file selections after failed saves.
Add per-Settings-tab unsaved-change indicators, including Manual config.
Add persisted dark/light administrator theme selection and consolidate theme-sensitive CSS tokens.
Keep Live Logs column selection compact with standard checkboxes and no internal scrollbars.
Add a fail-soft embedded-config release checker with hourly default cadence and CLI/environment overrides.
Keep the release checker compiler-compatible by mapping boxed HTTP body collection failures explicitly into anyhow::Error.
Reduce the footer to API latency/dropped logs and fix the last broad Live Logs checkbox sizing override.
Update package/source identity, OpenAPI and release checks to 0.19.3.

0.19.2

Current direction: 0.19.1 -> 0.19.2

Restore administration-backend local-listener risk detection for startup-locked listeners and loopback aliases; make vhost discard restore the persisted draft baseline.
Use descriptive status names for default responses.
Add an on-demand 4096-entry live log buffer that lasts until the log window closes.
Align inline checkboxes and reduce Docker-vhost alias editor height.
Render idle backend traffic as 0.0 KiB/s and positive sub-0.1 KiB/s traffic as <0.1 KiB/s.
Remove cache diagnostics/validators from locally generated placeholder/default pages and enforce no-store.
Allow safe vhost-ID rename with collision protection and operator warning.
Update package/source identity, OpenAPI and release checks to 0.19.2.

0.19.1

Current direction: 0.19.0 -> 0.19.1

Repair Default responses section serialization/server routing.
Isolate cache objects by frontend scheme.
Keep a 256-entry live log window with 4096 retained entries available on demand.
Polish backend traffic units, checkbox/column UI and Docker-vhost Advanced layout/alias spacing.
Remove stale screenshots and index historical/version-labelled documentation.
Restore source-package test files/fixtures required by the release gates.
Update package/source identity, OpenAPI and release checks to 0.19.1.

0.19.0

Current direction: 0.18.8 -> 0.19.0

Persist per-admin Live Logs column visibility in SQLite without affecting JSON export or proxy configuration revisions.
Remove the duplicate top-right version badge.
Carry the legacy X.509 tls_verify=false compatibility fix and expanded upstream diagnostics into the release.
Add schema-v4 migration, administration API coverage and update package/source identity to 0.19.0.

0.18.8

Current direction: 0.18.7 -> 0.18.8

Use hostname-style chips for Docker-vhost aliases.
Add per-app HTTP-to-HTTPS redirect, WebSocket and cache switches for Docker vhosts.
Add an agent-level default ACL-profile selector without removing per-app ACL overrides/inline rules.
Remove the compression-codec explainer from Overview.
Update package/source identity, API schema and release checks to 0.18.8.

0.18.7

Current direction: 0.18.6 -> 0.18.7

Keep Response time history collapsed by default without stopping its live samples.
Make per-interface RX/TX charts visually consistent with the aggregate network history.
Fix expanded Docker-vhost route/ACL field alignment from the 0.18.6 UI.
Update package/source identity and release checks to 0.18.7.

0.18.6

Current direction: 0.18.5 -> 0.18.6

Add network-throughput diagnostics split by non-loopback host interface.
Re-audit compression counters and add q-weighted negotiation coverage for all four supported codecs.
Polish Docker-agent settings alignment and spacing around listener selection / Add agent.
Update package/source identity and release checks to 0.18.6.

0.18.5

Current direction: 0.18.4 -> 0.18.5

Make compression counters track the codec actually applied by RustProxy and add independent per-codec regression coverage.
Split the Overview request-rate chart into total, HTTP/1.1, HTTP/2 and HTTP/3 series.
Add a proxied-app launcher to Docker vhosts and show their domains beside generated backend-pool IDs.
Remove the global Open proxy shortcut.
Make Compact density clearly tighter than Dense.
Give proxy timeout controls explicit safe defaults instead of blank inherited values.
Replace Docker-agent listener CSV entry with the named-listener picker and tighten the agent status-row UX.
Update package/source identity and release checks to 0.18.5.

0.18.4

Current direction: 0.18.3 -> 0.18.4

Make TCP the default backend health-check mode without rewriting existing explicit HTTP/off configuration.
Make Docker vhosts summary-first so large container inventories do not render every routing/ACL/timeout/health control at once.
Simplify Settings -> Security with progressive disclosure for credential and host-policy editing.
Move Administration audit to a dedicated on-demand modal.
Update package/source identity and release checks to 0.18.4.

0.18.3

Current direction: 0.18.2 -> 0.18.3

Export Docker vhosts/backends under dedicated Prometheus metric families rather than ordinary vhost/backend families.
Add a separate live Docker-vhosts metric-group switch in Prometheus settings.
Cover Docker vhost traffic/duration and backend health/latency/probe/runtime observations with bounded labels.
Add regression checks for ordinary-vs-Docker metric isolation.
Add configurable separate access-log files per vhost and preserve bounded asynchronous sink behavior.
Lock startup-owned HTTP/HTTPS/admin binds while keeping non-startup listeners editable.
Polish compact UI, 404 response statuses, redirect summaries, global TLS cipher visibility and managed-certificate lifecycle UX.
Default WebSocket proxying to HTTP/1.1 Upgrade and make RFC 9220 HTTP/3 Extended CONNECT an explicit experimental vhost opt-in.

0.18.2

Current direction: 0.18.1 -> 0.18.2

Serve the standalone Docker agent over HTTPS by default using a persistent self-signed ECDSA certificate.
Add SHA-256 certificate pinning for self-signed Docker agents while retaining normal public-CA validation when no pin is configured.
Add per-service Docker backend health-check settings backed by the normal bounded backend health machinery.
Show Docker backend health/runtime diagnostics and agent TLS/observation state in the Docker vhosts UX.

0.18.1

Current direction: 0.18.0 -> 0.18.1

Add a standalone, token-authenticated Docker discovery agent that reports only running containers with non-loopback published TCP ports.
Add multi-agent endpoint/token/base-domain/listener/default-IP settings and keep observed Docker inventory separate from desired persisted assignments.
Detect multiple usable Docker-host addresses and preserve every public Docker bind for each discovered service.
Add a Docker vhosts panel with short names, arbitrary FQDNs, aliases and per-service backend-IP selection; reconcile assignments into dynamic ephemeral vhosts without revision writes.
Move the cache Live toggle to the right edge of the cache action toolbar.
Remove all dedicated X-Rust-Proxy-Revision handling; it is no longer generated, stripped, protected or migrated.
Replace production password recovery help with the installed rust-proxy admin reset-password command.

0.17.0

Current direction: 0.16.1 -> 0.17.0

Add Debian/systemd/logrotate packaging and local APT-repository generation.
Export all currently implemented bounded process/OS diagnostics and extend safe Prometheus coverage for backend, GeoIP, certificate renewal, stream and logging state.
Add explicit trusted-CIDR Prometheus scraping without a token and preserve actual-peer-only ACL evaluation.
Ship a Grafana operations dashboard.
Add dedicated certificate/listener-aware local-response / 404 hosts and a dashboard editor.
Keep the built-in welcome placeholder no-store and strip optional response metadata.
Match Redirect source-domain editing UX to Vhost hostname chips.

0.16.1

Current direction: 0.16.0 -> 0.16.1

Keep revision CAS as an internal concurrency mechanism but stop showing revision numbers in successful configuration-save feedback.
Preserve all 0.16.0 proxy/cache/H3/admin/UX behavior and bump release identity to 0.16.1.

0.16.0

Keep the main vhost backend as an internal fallback separate from Custom locations, with legacy synthetic-root normalization.
Preserve the reserved administration session cookie only for an explicitly allowed, TLS-protected self-admin reverse-proxy route; ordinary upstreams remain isolated.
Complete backend WebSocket takeover before HTTP/3 Extended CONNECT success and add phase/error/reset/upstream diagnostics to access logs.
Split process-memory and cache-memory reporting into RSS categories plus hot/transient fill/cold-queue/cold-I/O gauges while retaining the existing allocator-release paths.

0.15.1

Current direction: 0.15.0 -> 0.15.1

Repair EN/PL Custom locations/help translations and reject misplaced language-pack keys in release checks.
Rework visual header-rule editing and add a live effective-behavior preview to each location.
Expand in-panel location documentation with structured sections and common examples.
Add combined HIT/MISS/BYPASS activity and Proxy process CPU/RSS charts.

0.15.0

Current direction: 0.14.0 -> 0.15.0

Add Nginx-style Custom location matching, rewrite and local-response controls with inline documentation and a visual header-rule builder.
Add reusable Nagios/Icinga API checks for control-plane latency, backend availability/latency and dropped-work counters.
Move per-vhost timing/Cloudflare diagnostics to the main frontend configuration and add source IP to live logs.
Add dashboard history charts for RAM cache, network throughput and response latency plus compact API/footer diagnostics.
Add separate idle-age and total-hot-residency cold-cache policies.
Remove the runtime renewal-observation JSON importer and quarantine obsolete state only during a stopped source upgrade.
Accept repeated literal path separators by normalizing them for routing/ACL decisions while preserving the original backend target.

0.14.0

Current direction: 0.13.2 -> 0.14.0

Accept explicitly allowlisted browser-facing administration DNS authorities behind a trusted reverse proxy without requiring the internal admin port.
Keep direct IP/localhost administration access on the configured admin port and derive same-origin/cookie security from trusted external proxy metadata.
Implement RFC 9220 WebSocket Extended CONNECT over HTTP/3 without a side-channel transport or HTTP/1.1 bootstrap fields on the client-facing H3 request.
Move the H3 stack to hpx-h3 2.5.19 with integrated Quinn transport and advertise Extended CONNECT support.
Rename the requested dashboard sections/actions in EN/PL and update release contracts/documentation.

0.13.2

Current direction: 0.13.1 -> 0.13.2

Honor a valid administrator session on direct panel refresh and revalidate stale browser-history login documents.
Force hot-cache handoff to enabled cold storage during managed updates and provide a longer controlled-stop budget.
Store automatic-renewal observations in SQLite schema v3 and restore them before the administration listener starts, with one-time legacy JSON import.
Move the raw configuration document editor under Settings -> Manual config while preserving /configuration as a compatibility alias.
Update documentation, OpenAPI, language help, offline regressions and release identity.

0.13.1

Current direction: 0.13.0 -> 0.13.1

Extend administrator browser sessions to a configurable absolute 7–30 day lifetime, default 30 days.
Keep password change, logout and revoke-all as immediate session invalidation boundaries.
Allow deliberate local-listener backends, including port 9090, only behind explicit per-backend risk acceptance while retaining private/special-address policy.
Add panel confirmation, OpenAPI fields, EN/PL strings, documentation and regressions.

0.13.0

Current direction: 0.12.1 -> 0.13.0

Add first-class redirect hosts and dashboard navigation.
Support scheme/path matching, URL/host/path targets, 301/302/303/307/308, path/query and redirect-cache controls.
Share named listeners and certificate inventory with redirects while rejecting conflicting frontend ownership.
Default backend HTTPS tls_verify to false when omitted; keep explicit opt-in verification.
Compact certificate inventory cards, render DNS SANs as vhost-style badges and inspect legacy/manual public PEM files when stored coverage metadata is absent.
Update OpenAPI, docs, translations, regressions and release identity.

0.12.1

Current direction: 0.12.0 -> 0.12.1

Split ordinary configuration writes into revisioned section endpoints and retain atomic full-document publication for intentional multi-section changes.
Stop unrelated control-plane saves from rotating cache compatibility identity.
Preserve dashboard subpage routing across browser refresh/back-forward navigation.
Add independently selectable cold-cache idle/LRU/shutdown persistence policies.
Flush hot cache objects to cold storage during graceful shutdown and release RAM after bulk demotion where the allocator supports it.
Expose certificate DNS SubjectAltName coverage separately from configured SNI bindings.
Improve HTTPS backend TLS validation guidance while preserving secure-by-default omitted configuration and the explicit debug preset.
Update OpenAPI, regression checks and release identity to 0.12.1.
Compile and execute the Rust test suite on a Rust 1.88+ staging host.

0.12.0

Current direction: 0.11.5 -> 0.12.0

Move Layer-4 TCP/UDP stream management out of Settings into a dedicated main-navigation page directly below Vhosts.
Give Streams the vhost-style searchable card + modal workflow with explicit active-versus-desired restart state.
Add fixed-cardinality per-stream connection/session, reject, error, byte and UDP packet telemetry without database work on the data path.
Add browser-session RX/TX rate charts derived from monotonic backend stream counters.
Restyle named listener bind addresses with the same chip interaction used for vhost hostnames.
Extend offline source/release regression gates for Streams navigation, authenticated assets, UI contracts and L4 metrics source invariants.
Stop successful unsafe methods from globally purging otherwise unrelated cached GET objects.
Use Host + URL as the logical primary cache identity and response Vary for representation variants instead of hashing unrelated request headers/backend members.
Share cache objects across backend-pool members and GET/HEAD requests.
Preserve resident age through 304 revalidation and hot/cold movement; persist the additional cold metadata in format 2.
Add variant-schema safety and cache regression coverage for the new behavior.
Make Force SSL require a real HTTP ingress and choose port 443 deterministically when several TLS ports are selected.
Add a graphical ACL-profile rule editor and resilient bulk-rule import with exact line errors.
Hide RustProxy cache diagnostics when a vhost explicitly disables cache.
Distinguish disabled vhost pools from unhealthy backends in the dashboard.
Add per-vhost client-IP forwarding control without weakening RustProxy ACL/GeoIP/rate-limit/Tinyauth identity.
Add a compact vhost search/filter for large installations.
Keep the checked-in Cargo lockfile stable and correct the Quinn manifest version to the resolved release.
Make the standard JSONL log directory writable under the hardened systemd service.
Accept HTTP/2/H3 :authority on the HTTPS administration panel without requiring a duplicate legacy Host header.
Reject ambiguous requests where legacy Host conflicts with protocol-native authority, while preserving strict HTTP/1.x origin-server semantics.
Add administration H2 authority and /healthz regression tests.
Add per-vhost Force SSL with an HTTP 308 redirect to the configured TLS frontend while preserving path/query.
Preserve NPM ssl_forced in the SQLite migrator as RustProxy Force SSL with usable HTTP+HTTPS listener bindings.
Fix managed update/rollback health checks for persisted administration HTTPS and changed admin bind/Host policy.
Add a dry-run-first SQLite migration tool for Nginx Proxy Manager proxy-host names and backends, with generic RustProxy TLS certificate fallback and manual-review warnings for unsupported NPM features.
Add offline migration-planner and HTTPS health-target regression coverage.
Add reusable ACL Profiles with country allow/block and IP/CIDR policy, attachable per vhost while retaining cumulative inline vhost and route ACL controls.
Add chip-style hostname editing and leading *. wildcard domains with exact-host and longest-wildcard precedence.
Add compact browser-session request-rate charts to vhost cards with progressive lifetime compaction.
Add the built-in HTTP 401 error page and treat benign post-upgrade WebSocket closes as normal tunnel completion.
Redirect plaintext requests arriving on the HTTPS administration socket and accept valid DNS Host values when no explicit admin hostname allowlist is configured.
Allow one named frontend listener policy to bind up to 16 explicit local addresses while forbidding wildcard binds in multi-address mode.
Align the Logging format builder with the Vhost configuration modal and reposition its field-configuration action.
Make source ZIP generation deterministic and verify reproducibility in release smoke tests.
Add bounded hot RAM and optional persistent cold disk cache tiers with asynchronous demotion/promotion, restart recovery, integrity metadata and separate hot/cold statistics.
Add cold-tier settings for path, disk/object budgets and idle demotion time while preserving global hot RAM limits.
Add structured-log format presets plus a visual field selector/renamer with JSON preview and advanced raw mapping fallback.
Normalize Logging sink cards to the shared application card styling instead of release-specific fieldset CSS.
Add baseline multi-stage Docker/OCI packaging with an unprivileged runtime user and persistent data volume.
Document browser hard-reload cache revalidation semantics and expose the exact request revalidation reasons in the cache inspector.
Redesign vhost cards around listener/protocol/certificate/cache identity plus live pool health, requests, active exchanges, errors, latency and traffic rate.
Add bounded structured JSON access-log sinks for JSONL files, Logstash TCP and Loki HTTP(S), with configurable field mapping/static fields and sink counters.
Expand cache object inspection with body bytes, resident bytes, overhead and aggregate stored-object memory counters.
Add optional X-Cache-Resident-Age and expose resident age for stored HITs.
Add administration HTTPS using the application-managed default certificate or a selected certificate, with restart-aware persisted bind address and hostname allow list.
Permit non-loopback administration binding when HTTPS is enabled; keep plain remote HTTP behind the legacy explicit risk gate.
Add global TLS protocol/cipher policy plus per-vhost TLS 1.2/1.3 and cipher overrides for TCP TLS. HTTP/3 vhosts inherit the global TLS 1.3 policy.
Make Settings tabs fill the available width and add dedicated Administration/TLS policy pages plus a separate Logging navigation page.
Enable shared cache by default while keeping explicit vhost/route disable controls.
Implement fresh conditional HIT for If-None-Match / If-Modified-Since.
Implement backend validator revalidation and cached-body reuse on backend 304.
Treat request/response no-cache as validation semantics rather than no-store; preserve no-store as hard exclusion.
Retain stale validators for bounded revalidation without stale serving.
Raise maximum object configuration to 1 GiB and remove eager object-sized fill allocation.
Add diagnostics, real-binary smoke scenarios, unit regressions and 0.8.1 release documentation.
Per-vhost H2/H3 frontend opt-outs next to named-listener selection, capability-gated by Settings listeners.
Global static-cookie cache defaults for common assets, visible global/per-vhost controls and response-side privacy guards.
Listener editor uses page scrolling without a nested scrollbar.
Per-vhost fixed-window request rate limiting with burst allowance.
Per-country rate overrides and block/allow-only country access rules backed by verified install-time GeoIP data.
Cloudflare client IP mode gated by direct-peer Cloudflare CIDRs.
Per-vhost H2/H3 frontend opt-outs and Server-Timing diagnostics.
Named listener selection in vhosts; listening IP/ports managed in Settings.
Health-check off disables active and passive classification.
HTTPS-by-IP backend debugging defaults and warnings.
Global static-cookie cache defaults plus per-vhost inheritance/overrides with response privacy guards.
Corrected cache Age calculation.
Updated deployment regressions, docs and 0.8.0 release identity.
Release CLI can generate the one-time setup token before first server start.
Explicit two-flag risk gate for wildcard remote administration binding.
Numeric Host validation for the wildcard panel; DNS hostnames remain rejected.
Linux/systemd install defaults enable 80/443; explicit --no-https opt-out.
Updated deployment regressions, docs and 0.7.3 release identity.
Build/check/test the Rust binary and exercise remote-panel/systemd behavior live.
Explicit release identity, without overwriting the 0.7.1 artifact.
Swagger asset default independent of environment presence/Cargo config lookup.
Embedded assets prepared by our build, without an adapter's old-version fallback.
Offline local ZIP, bounded member validation, optional SHA-256 and safe caching.
Executable build-helper regressions and updated build/migration instructions.
Build/check/test real Rust and render the actual upstream Swagger distribution.
Per-location visual proxy-request and client-response header rules.
Minimal anonymous login document and filtered extensible language bundle.
Exact default-deny admin route/method policy including private assets and docs.
Protected OpenAPI/Swagger, cookie session and CSRF-confirmed mutations.
Generic public discovery/errors and cross-tab UI revocation cleanup.
Source audit, access probe and regression tests with explicit execution limits.
Compile and run router/proxy tests, inspect real Swagger rendering, and run the anonymous probe against the built release before production acceptance.
Scheduled renewal for HTTP-01, Cloudflare, OVH and RFC2136 managed profiles.
Validated revisioned hot certificate publication with unchanged/failure safety.
Per-certificate opt-out, manual check, dry run, next/last/expiry observations.
Separate install/update scripts; isolated service, full data backup and rollback.
Vhost Basic Auth with bounded Argon2id checks and optional credential forwarding.
Per-vhost WebSocket toggle and graphical cumulative CIDR ACL editing.
Visual prefix locations with pool exclusion for dedicated origins.
Neutral welcome page, opt-in protocol fixture, shared square modal/Settings style.
Independent proxy and local administrator control plane; no Docker dependency.
SQLite documents, revision CAS, immutable snapshots, audit and private backups.
Accounts, bounded sessions, setup capability, origin/CSRF protections.
Host/path routes, aliases, explicit private-origin permission and CIDR ACLs.
Streaming bodies and full-exchange limits; bounded logs, SSE and Prometheus.
Public TLS/SNI, verified HTTPS upstreams, guarded DNS, HTTP/2 and WebSocket source.
Whole-source upgrade, legacy auth-module repair and rollback on copy failure.
Persist public HTTP/HTTPS bind addresses and ports, including 80/443 presets.
Distinguish active listeners, desired listeners and startup defaults; show restart pending.
Allow remote origins on ordinary 80/443 without allowing local listener loops.
RAM cache with TTL/Age, entry/object/byte limits, LRU eviction and route bypass.
Bounded streaming fills; do not publish partial, failed, oversized or trailer bodies.
Privacy exclusions, conservative Vary identity and ACL-before-cache ordering.
Optional X-Cache, X-Cache-Hits and Cache-Status; counters and authenticated purge.
Invalidate old fill generations on purge, config publication and successful unsafe methods.
Streaming gzip, Brotli, Zstandard and deflate negotiation with privacy/no-transform safeguards.
Preserve/hide/custom Server policy; client-response and upstream-request header editors.
Denser responsive dashboard; original logo retained.
OS/process CPU, RAM/RSS, load, descriptors, threads, network, cgroup and cache diagnostics.
Compile-time language discovery from langs/*.json; metadata, fallback and RTL.
Extra language files survive managed source updates.
Log filtering by host/path/cache outcome and bounded JSON export.
Unit and real-binary integration test source; 49 simulated-API frontend checks.
Example unprivileged systemd service with low-port capability.
Remove reported compression threshold type mismatch without narrowing or panic conversion.
Explicit frontend IP/port/TLS ownership inside a vhost; actual-destination isolation.
Multiple backend members, weights, backup and drain modes.
Weighted round-robin, least active exchanges, least traffic, adaptive and IP hash.
Connection keepalive/reuse limits and timers, not a Keepalived/VRRP integration.
Bounded TCP/HTTP health checks, slow-response exclusion, fall/rise and recovery.
Opaque cookie/IP affinity; compatible edit continuity, safe cache bypass.
Full-exchange backend leases; no automatic replay of failed writes.
Per-vhost response/security headers, TLS-only HSTS and explicit preload policy.
HTTP/2 TLS preference retains HTTP/1.1 for clients and HTTPS origins.
Vhost editor, atomic legacy migration, health/traffic/latency dashboard and API metrics.
All new user-facing text in discovered language packs; logo unchanged.
Rust regression and real-binary acceptance test source; 63 simulated-API UI checks.
Complete source update, examples, migration documentation and evidence report.
Split oversized status JSON expansion instead of masking it with a larger recursion limit.
Optional per-vhost certificate upload/selection with bounded private staging and validated SNI mappings.
Independent vhost cache behavior, inherited defaults and shared resident/object ceilings.
Selective cache invalidation by vhost, promoted from Cache evolution; invalidate pending fills too.
Compact manager list and tabbed vhost dialog, visual header rules and live health/latency.
Dashboard density presets and top alignment, without redesigning the logo.
Separate modal/docked live logs with persistent controls, vhost filters, pause and scoped export.
Global/vhost error pages, maintenance/static response and direct-IP/unknown-host behavior.
Security shortcut within Settings; new labels remain in discoverable language packs.
Python-only random-data mock origin for cache, health, delay, compression and error-page development.
Regression test source for new runtime policies; executed frontend/helper checks in TEST_REPORT.md.
Canonical Forwarded/X-Forwarded-For/X-Real-IP with explicit bounded proxy trust; keep destination-IP routing independent.
Per-vhost Tinyauth auth subrequest, sanitized identity headers, restricted login redirects and fail-closed handling before cache/static/upgrades.
Separate certificate inventory tab with upload, per-vhost selection and metadata-only read API; leave ACME as future work.
Named multiple-IP listeners, descriptive scope, reusable vhost references and explicit legacy-route permission.
HTTP/3 UDP adapter using Quinn/h3 with TLS 1.3, same SNI/policy pipeline, Alt-Svc, requested limits and bounded drain; retain TCP H2/H1.
Request ID/revision off by default, independent per-vhost controls, optional mock-origin removal and effective per-vhost Server policy.
Actual frontend socket in cache identity; streaming-safe empty request detection for H2/H3.
Toast above active modal backdrop, including browser top-layer/inertness handling.
Python fake-auth peer plus Rust regression sources for auth, headers, extra-frontend cache, listeners and real QUIC/TCP.
Dedicated bounded cache panel: resident objects/bytes, per-domain effectiveness, TTL/Age/hits, reasons and vhost filters.
Remove the reserved administrator cookie before cache eligibility; preserve application-cookie privacy.
Handle empty terminating DATA frames and expose fixed X-Cache-Reason / Cache-Status detail diagnostics.
Replace special mock-origin hiding with explicit revision controls; keep general header rules.
Default HTTP/3 for TLS while persisting explicit opt-out and TCP fallbacks.
Diagnose overlapping sockets with addresses, ownership, protocol/limit differences and remedies.
Classify unavailable/invalid/timed-out upstreams as 503/502/504 respectively.
Basic Let's Encrypt DNS-01/RFC2136 job and library-import workflow through Certbot; private TSIG/account state and staging-first consent.
Offline adapter tests, browser fixtures and Rust regression sources; unchanged brand assets.
Vhosts-only runtime/UI and one-way legacy import preserving path/backend and IP ownership.
HTTP-01 active-job/domain-scoped challenge serving with private webroot storage.
Certbot Cloudflare and OVH API DNS-01 adapters alongside RFC2136.
Unified provider/import dialog, masked credentials, explicit consent and issuer metadata.
Dedicated opt-in Prometheus endpoint, scrape CIDRs and environment-token authentication.
Application/admin/listener/vhost/backend/cache/system collectors and exchange histograms.
Functional Settings tabs with preserved dirty fields, keyboard navigation and no Security sidebar.
Offline provider regressions, simulated-API UI checks and unexecuted Rust acceptance tests.
Validate real HTTP-01, Cloudflare/OVH/RFC2136 DNS updates, CA issuance, cancellation cleanup and certificate hot-deployment.
Add the managed renewal scheduler and audited validated deployment source.
Verify real renewal/publication and add external expiry alerts, revocation/account lifecycle.
Resolve and retain Cargo.lock; run check, test and all real-binary suites.
Verify real Tinyauth integration, revocation, trusted forwarding and independent HTTP/3 client interoperability.
Run an independent RFC 9114/QUIC conformance suite, malformed-stream/load tests and actual TLS/UDP production deployment checks.
Execute vhost isolation/weighted balancing/health/recovery/keepalive/affinity acceptance against a real Rust binary.
Verify compression output with independent Brotli/Zstandard decoders.
Run real TLS/HTTP2/WebSocket/cache concurrency, cancellation and graceful-drain tests.
Benchmark HIT/MISS/streaming RSS and CPU under slow clients and origin failures.
Fuzz malformed HTTP/cache directives and language-pack validation.
Exercise real non-root 80/443 bindings and systemd service confinement.
Verify native browser HTTP/CSP/cookie enforcement (navigation blocked in this environment).
Validate the dedicated scrape endpoint/token with a real Prometheus server and production network policy.
X-Cache-Resident-Age - implemented in 0.9.0

Optional module follow-ups

Docker discovery

Implemented in 0.18.1 through the standalone docker-agent/ provider boundary. Future work can add provider-side filters, mTLS and DNS-provider automation; the core remains useful without Docker and never opens the Docker socket itself.

Cache evolution

Conditional revalidation is implemented. Stale-while-revalidate/stale-if-error, request collapsing, tag-based invalidation and richer per-route policy remain open. Persistent hot/cold storage is implemented in 0.10.0. Selective invalidation by vhost is implemented in 0.3.0; the domain/object inspector in 0.5.0; tags are not. No VCL engine, distributed cache, ESI or Varnish-protocol compatibility is implemented.

Operations

Container/OCI packaging is implemented in 0.10.0. Certificate alerting/revocation and account lifecycle, reproducible releases, performance baselines and cross-platform diagnostics remain open. Remote HTTPS administration is implemented in 0.9.0; loopback remains the default and plain remote HTTP remains explicitly risk-gated.

52 KiB Raw Blame History Unescape Escape