4.4 KiB
RustProxy 0.29.0 implementation note
RustProxy 0.29.0 adds narrowly scoped redirect, health-check, cache and stored-log controls without changing SQLite schema 9 or Cold Cache format 3. Existing 0.28.2 configuration remains compatible because all new configuration fields are defaulted.
Canonical www/non-www redirect
A vhost can enable www_redirect. The canonical exact DNS name is chosen in the UI from frontend.hosts and persisted as optional www_redirect_target; it defaults to the first hostname for older configurations. RustProxy derives its direct companion (example.com <-> www.example.com), claims that host on the same listeners and returns 308 Permanent Redirect to the canonical name while preserving the request path/query. Wildcard/IP first hosts are rejected for this option. If force_ssl is also enabled, cleartext companion requests redirect directly to the HTTPS canonical URL.
Certificate assignment includes both routing names, but certificate validity is not synthesized: operators must use a certificate whose SANs cover the canonical and companion names.
Custom location redirects
Custom locations have a backend-less redirect action with status 301, 302, 303, 307 or 308, an absolute HTTP(S) target, optional redirect rewrite regex and optional query preservation. The rewrite regex is separate from the location match regex, so a configuration equivalent to an Nginx location followed by rewrite ^/(.*)$ .../$1 permanent can capture the complete request path independently of the location selector.
Capture expansion is allowed in the target path/query but not in the scheme/authority. This prevents client-controlled captures from turning an approved redirect rule into arbitrary-host redirection.
Health-check Host selection
HTTP backend probes already send an HTTP/1.1 Host header. In 0.29.0 an empty health_check.host automatically resolves to the first exact DNS hostname of the vhost. This makes IP-address backends with name-based virtual hosting work without repeating the public hostname in the health settings. An explicitly configured health-check Host remains authoritative; if the vhost has no exact DNS hostname, the existing backend-host fallback remains.
Per-vhost forced cache
cache.unsafe_force is available only in a vhost override and is disabled by default. Matching GET/HEAD request targets may bypass request-side query, Cookie, Authorization and client cache-control exclusions. Protocol-safety exclusions remain active. Cookie and Authorization are added to variant identity for forced objects.
Response policy remains authoritative: responses with Set-Cookie, private, no-store, Vary: *, partial framing and the other normal non-cacheable conditions are not stored. This option is intentionally labelled dangerous and must be enabled per vhost with explicit target prefixes; it is not a global switch.
Rotated gzip logs
Stored Logs discovers logrotate-style .gz siblings of configured combined access/error logs and .jsonl.*.gz rotations in the configured per-vhost directory. Only regular non-symlink files derived from configured locations are eligible. Compressed input and decompressed output are bounded, and only the existing bounded tail is parsed/searched.
Local page status and URL-query regression coverage
The existing static/maintenance page model can serve its HTML body with an explicit status such as 503 Service Unavailable; 0.29.0 adds regression coverage for that operator workflow.
Valid nested URL query parameters are preserved by upstream URI construction. Literal or percent-encoded backslashes remain rejected by the ambiguous-path guard. A quoted curl URL must therefore use normal ?, = and & separators without backslashes.
Verification scope
The release source includes Rust unit/integration regressions for canonical redirects, custom redirect capture/query behavior, automatic health-check Host selection and explicit override precedence, forced-cache request policy and target matching, gzip Stored Logs, maintenance-page 503 and nested URL query preservation. Rust-independent release/source/documentation checks are also retained. See TEST_REPORT.md for the verification actually performed in the packaging environment.
Multiple hostnames on the same vhost (for example suba.local and subb.local) receive identical proxy behavior without implicit redirects.