RustProxy/ROADMAP.md

# RustProxy roadmap

## 0.31.7 - UA-specific throttling and managed update housekeeping (runtime acceptance pending)

- [x] Group global UA blocking, headers and response controls in a tabbed Settings page.
- [x] Add per-vhost UA rate-limit overrides with separate bounded counters.
- [x] Show leaf-level revision diffs, with optional full JSON comparison dialog.
- [x] Space apart listener protocol buttons and collapse ACL attachments by default.
- [x] Fix release retention path deletion; preserve two releases; limit Cargo cleanup to expired incremental state.
- [x] Verify update marker and forced HOT→COLD shutdown code path, and add completion logging.
- [ ] Compile and test with Rust/Cargo; run real update/rollback and browser/UI tests on a controlled host.

## 0.31.6 - H3 iOS navigation hardening (runtime acceptance pending)

- Finish live Safari/Chrome iPhone logo-navigation and repeated-refresh acceptance over H3 after Rust compilation.
- Collect matching `http3_*` diagnostic records and navigation/asset response records; verify the new top-level GET is not interrupted when old SSE/API streams cancel.

## 0.31.5 - User-Agent blocking and consolidated log analysis

- [x] Add bounded global and per-vhost User-Agent blocklists and enforce them before upstream contact.
- [x] Add one-click copy for Traffic values used during investigation.
- [x] Add repeated-value aggregation for arbitrary parsed Stored Logs fields.
- [x] Consolidate active and rotated gzip per-vhost logs into one logical source on demand.
- [x] Update OpenAPI, translations, documentation and Rust-independent regression checks.
- [ ] Resolve Cargo dependencies, compile/test Rust and perform real browser/proxy acceptance before production deployment.

## 0.31.4 - Administration-only public HTTPS Origin with one-field configuration

- [x] Add explicit HTTPS `administration.public_origin` and restrict its use to trusted reverse-proxy peers for panel requests.
- [x] Derive the pinned DNS hostname for the effective Host allowlist without duplicating it in saved `allowed_hosts`.
- [x] Keep additional allowed DNS hostnames in an advanced panel field and remove redundant legacy duplicates on edit/save.
- [x] Preserve strict Origin, CSRF, trusted proxy, forwarded Host and HTTPS-first header checks and the opt-in self-admin session-cookie boundary.
- [x] Add panel settings UI, translations, API schema, Rust source regressions and Node simulations without changing public proxy forwarding.
- [ ] Resolve Cargo dependencies, compile and test Rust, and perform real mobile/reverse-proxy acceptance before production deployment.

## 0.31.3 - Mobile session recovery and Origin diagnostics

- [x] Reproduce the overlapping resume-session checks, reload-loop marker reset and early SSE restart using the 0.31.2 source in a deterministic JavaScript simulation.
- [x] Coalesce page visibility/BFCache session verification, defer background requests until revalidated and offer a visible retry on failure without weakening Origin enforcement.
- [x] Display a safe 403 HTML message for invalid-Origin dashboard navigation and provide credential-redacted rejection diagnostics.
- [ ] Pass Rust/Cargo compile/clippy/test gates and live mobile Safari/Chrome reverse-proxy verification; diagnose the original 403 trigger using the logs.

## 0.31.2 - Dependency updates

- [x] Prepare stable dependency-family and code API migrations, preserving existing wire/configuration/SQLite formats.
- [ ] Resolve and commit an actual Cargo.lock using Rust 1.99; run format, clippy, tests and release builds.
- [ ] Confirm HTTP/3/QUIC, TLS, SQLite migration/restore, auth, compression, panel and cache BAN/PURGE in real integration tests.

## 0.31.1 - Mobile panel loading stability

- [x] Load dashboard modules as one ordered JavaScript resource and wait for document/module readiness before session initialization.
- [x] Version dashboard JS/CSS requests; show a recoverable startup error on missing modules.

## 0.31.0 - Panel refresh orchestration

- [x] Centralize authenticated polling with source IDs, view lifecycle, hidden-tab pause, abort, in-flight protection and cleanup.
- [x] Separate compact live telemetry from infrequent cached system diagnostics; allow per-client SSE pacing and reconnect-only fallback.
- [x] Add per-account refresh preferences, reset/manual actions, language packs, endpoint contracts and regression tests.
- [ ] Compile/test on Rust toolchain and perform real multi-session SSE, latency and long-running browser acceptance before production release.

## 0.30.1 - Protocol legend and system information

- [x] Color the H1/H2/H3 legend dots consistently with their themed chart strokes.
- [x] Remove ACME/Python runtime details from About and provide a read-only System information settings tab.
- [x] Read available ACME Python/pip/Certbot version metadata and OS/hardware/process details with existing libraries, without subprocesses for information gathering or new configuration fields.
- [ ] Compile and run Rust tests, verify OS/kernel and metadata-based ACME versions on Linux, BSD, macOS and Windows, and perform live UI/status checks before production acceptance.

## 0.30.0 - Per-backend Health editor and logging resource review

- [x] Provide an intuitive Health-tab backend selector restricted to monitored members, with independently editable TCP/HTTP policies.
- [x] Deduplicate file/Logstash JSONL serialization; cap Stored Logs directory scan retention during enumeration; review long-lived queues and other memory-heavy facilities.
- [x] Preserve vhost wire schema, SQLite schema 9 and Cold Cache format 3.

## 0.29.7 - Backend health scoping, PHP-FPM isolation and HIT-only cache diagnostics

- [x] Support per-backend active/passive health monitoring disablement and independent health-check settings.
- [x] Expose optional global and vhost-level cache HIT-only diagnostic headers.
- [x] Identify unsafe PHP-FPM shared-socket directive differences and document dedicated pool migration for Roundcube/WordPress.
- [x] Preserve existing settings and schema 9/Cold format 3.
- [ ] Compile the Rust code, execute runtime tests, and verify WordPress/Roundcube against separate live PHP-FPM pools before production deployment.

## 0.29.6 - FastCGI compression EOF and diagnostic routing

- [x] Fuse FastCGI response streams so compressors may safely probe the end of a PHP-FPM response multiple times.
- [x] Route WARN/ERROR diagnostics and panic-hook events to the configured error file, or stderr when the file is disabled/unavailable.
- [x] Add source tests for repeated EOF polling, gzip output, and live error-log settings changes.
- [ ] Run Cargo tests and reproduce the Roundcube gzip request against a built 0.29.6 binary before production deployment.
- [x] Retain schema 9, Cold Cache format 3 and 0.29.x saved-configuration compatibility.

## 0.29.5 - Roundcube PHP PATH_INFO routing

- Resolve PHP `PATH_INFO` on an existing script before `try_files` falls back to the front controller, while preserving normal URL and script security checks.
- Verify FastCGI parameters from an actual mock PHP-FPM exchange in Rust integration tests when Cargo is available.
- Retain schema 9, Cold Cache format 3 and all previous PHP-FPM profile UI and vhost-cache behavior.

## 0.29.4 - Shared PHP-FPM profiles and local Web Server processing

Current direction: 0.29.3 -> 0.29.4

- [x] Add reusable PHP-FPM profiles attachable to individual Web Services, keeping their local settings on detach.
- [x] Apply RustProxy cache and response transformations for Web Server files and PHP-FPM responses.
- [x] Supply FastCGI `HTTP_HOST` from request authority for HTTP/2 and HTTP/3 WordPress requests.
- [x] Add source/UI regression coverage for new configuration and response behavior.
- [ ] Run the Rust compiler/test suite and verify PHP-FPM, cache and transformations end-to-end before production use.
- [x] Keep SQLite schema 9 and Cold Cache format 3 unchanged.

## 0.29.3 - HTTP/2 and HTTP/3 internal fallback stabilization

Current direction: 0.29.2 -> 0.29.3

- [x] Allow empty GET/HEAD bodies with unknown length hints to enter the internal error fallback path.
- [x] Preserve the final internal fallback response, including the fallback backend's HTML on HTTP 404.
- [x] Add Rust regression tests for fallback dispatch, request-body safety and error-page precedence.
- [ ] Run Rust unit tests, build and end-to-end HTTP/2/HTTP/3 fallback acceptance on a compiler-equipped machine.
- [x] Preserve SQLite schema 9 and Cold Cache format 3 without configuration migrations.

## 0.29.2 - PHP-FPM operator controls and observability

- [x] Add bounded, operator-only PHP_ADMIN_VALUE INI overrides per Web Service.
- [x] Show admin overrides in the Web Service UI/API, reusing existing location-to-service routing.
- [x] Track PHP responses by status class, response-header latency and free concurrency slots in Prometheus.
- [ ] Verify FastCGI integration and full Rust test suite on a host with a compiler and PHP-FPM.
- [ ] Consider per-location PHP override profiles and PHP-FPM connect/write/read phase metrics.

## 0.29.1 - Internal error routing, multipart ranges and PHP PATH_INFO

Current direction: 0.29.0 -> 0.29.1

- [x] Add configurable internal error fallbacks for the main vhost source and Custom locations.
- [x] Preserve original method, URI, query string and request context during internal fallback dispatch.
- [x] Reject fallback cycles at validation time and cap runtime fallback depth.
- [x] Intercept configured errors before final response/cache handling and run the target through normal route processing.
- [x] Add bounded Prometheus counters for triggered, successful and failed error fallbacks.
- [x] Support fixed fallback status codes 403/404/500/502/503/504.
- [x] Add streaming multipart byte-range responses with a bounded range count.
- [x] Add opt-in secure PHP PATH_INFO splitting for PHP-FPM.
- [x] Keep SQLite schema 9 and Cold Cache format 3 unchanged.

## 0.29.0 - Redirect, health-host, forced-cache and rotated-log controls

Current direction: 0.28.2 -> 0.29.0

- [x] Add one-checkbox canonical www/non-www redirects per vhost.
- [x] Add first-class Custom location redirects with capture-based rewrite targets and query preservation.
- [x] Default HTTP health-check Host to the first exact vhost hostname while keeping the manual field as an override.
- [x] Add explicit per-vhost forced-cache targets with response privacy protections retained.
- [x] Read bounded logrotate gzip rotations in Stored Logs.
- [x] Verify local/static HTML pages can intentionally return statuses such as 503.
- [x] Preserve valid nested URL query parameters while retaining ambiguous-backslash rejection.
- [x] Keep SQLite schema 9 and Cold Cache format 3 unchanged.

## 0.28.2 - External certificate hardening and least-privilege reload API

Current direction: 0.28.1 -> 0.28.2

- [x] Accept POSIX ACL-based read access for external certificate keys without requiring one exact chmod value.
- [x] Reject unsafe world-readable private keys, group/world-writable external PEMs and untrusted/writable external-path parent directories.
- [x] Validate both configured Certbot `live/` paths and their resolved `archive/` targets while keeping hot reload behavior.
- [x] Scope Certificate API credentials to explicit certificate IDs, default new tokens to reload-only, block global reload for tokens and make deploy an explicit permission.
- [x] Migrate existing Certificate API credentials to reload-only compatibility grants and move SQLite to schema 9.
- [x] Document read-only systemd access plus POSIX ACL examples for `/etc/letsencrypt` and `/etc/ssl` in English and Polish.
- [x] Keep the saved proxy configuration format and COLD format 3 unchanged.

## 0.28.1 - External certificate paths and certificate-source clarity

Current direction: 0.28.0 -> 0.28.1

- [x] Allow manual certificate entries to reference an absolute external certificate path and absolute external private-key path.
- [x] Resolve Certbot-style `live/` symlinks on every reload while preserving bounded PEM parsing, regular-file checks and private-key permission checks.
- [x] Keep targeted certificate reload revision-stable so renewal wrappers can call `POST /api/certificates/{certificate_id}/reload` after renewing external files.
- [x] Preserve managed `<data-dir>/certs` filenames and reject mixed managed/external pairs.
- [x] Exclude external certificate material from RustProxy backups while retaining the configured absolute paths.
- [x] Clarify certificate-source, storage and path expectations in English/Polish UI text and operator documentation.
- [x] Keep SQLite schema 8 and COLD format 3 unchanged.

## 0.28.0 - GeoIP control, listener clarity and cache policy refinement

Current direction: 0.27.3 -> 0.28.0

- [x] Add on-demand GeoIP refresh through the authenticated administration UI and reuse the automatic updater pipeline.
- [x] Hot-swap validated GeoIP databases so subsequent country ACL/rate-limit/logging lookups use the new data without a process restart.
- [x] Use direct GeoIP file URLs with optional per-file SHA-256 verification and support either separate IPv4/IPv6 CSV ranges or one native MaxMind MMDB database.
- [x] Present active listeners as readable HTTP/HTTPS endpoint cards with explicit H3/UDP state.
- [x] Add configurable `Via: RustProxy` cache response metadata while preserving upstream Via values.
- [x] Preserve cache objects across bypass and response-only diagnostic/Via setting changes.
- [x] Separate vhost Security header-rule Delete controls from the Operation selector.
- [x] Keep SQLite schema 8 and COLD format 3 unchanged.

## 0.27.3 - HTTP/3 cache parity and bounded memory retention

Current direction: 0.27.2 -> 0.27.3

- [x] Make body-less `HEAD` cache eligibility consistent between HTTP/2 and HTTP/3.
- [x] Reduce persistent COLD-index RAM while preserving the existing on-disk cache format and cache behavior.
- [x] Reclaim expired rate-limit client buckets and avoid duplicating the vhost name for every tracked IP.
- [x] Confirm downstream compression remains streaming and does not retain complete response bodies in memory.
- [x] Exclude rebuildable managed Certbot Python environments from backups.
- [x] Document DEB/RPM and OPNsense repositories as the official installation paths; keep Debian source builds optional.
- [x] Separate application-coupled scripts from QA/dev/audit tooling and external platform integrations while preserving all entry points.
- [x] Keep SQLite schema 8 and saved configuration compatibility with 0.27.2.

## 0.27.2 - Managed ACME renewal repair

Current direction: 0.27.1 -> 0.27.2

- Make the managed Certbot runtime independent of pip console-script shebang relocation.
- Reuse existing 0.27.1 `acme-python` environments without operator cleanup.
- Preserve the system Certbot fallback and schema/config compatibility.

## 0.27.1 - Portable certificate runtime and list sorting

Current direction: 0.27.0 -> 0.27.1

- [x] Show complete default and standard-service setup-token commands during first-administrator onboarding.
- [x] Initialize the Certbot Python environment under the RustProxy data directory with app-owned `venv`/`pip` state and a local `virtualenv` bootstrap when stdlib `venv` is unavailable.
- [x] Fall back to distribution Certbot binaries when usable and report missing Python/pip or setup failures in the Certificates panel.
- [x] Add account-scoped column + direction sorting for vhosts, Docker vhosts, redirects, 404 hosts and streams; keep Redirects/404 toolbar placement identical to Vhosts.
- [x] Use the installed production binary in the Certbot hook example and expose official source/package repository links plus Python/pip/Certbot runtime state in application information.
- [x] Keep SQLite schema 8 and additive/defaulted administrator-preference compatibility.

## 0.27.0 - Compression policy and persistent Docker publications

Current direction: 0.26.7 -> 0.27.0

- [x] Enable zstd/Brotli/gzip downstream compression by default, keep deflate opt-in, honor client q-values and use deterministic `zstd -> br -> gzip -> deflate` tie priority.
- [x] Allow authenticated/cookie/private/no-store responses to compress while retaining explicit no-transform/range/SSE/upgrade/existing-encoding exclusions.
- [x] Add inherited dynamic-compression overrides and per-scope codec filters for ordinary vhosts and Web Server services under the global codec ceiling; keep Docker publications intentionally simple with one Compression on/off checkbox using the global codec set.
- [x] Default fresh installations to `Server: RustProxy` without rewriting existing saved policies.
- [x] Remove Debian package-build metadata from this source tree; packaging is maintained separately at `rustproxy.linuxiarz.pl`.
- [x] Keep published Docker hostnames materialized while a service is missing, return 503 until it returns, and reuse last-known inventory during temporary agent communication failures.
- [x] Render cache occupancy progress fill consistently across Chromium/WebKit and Firefox.
- [x] Keep SQLite schema 8 and additive/defaulted saved configuration compatibility with 0.26.x.

## 0.26.7 - Cache occupancy and backend rotation continuity

Current direction: 0.26.6 -> 0.26.7

- [x] Show HOT/COLD cache occupancy progress against configured entry and byte limits on `/cache`.
- [x] Preserve compatible upstream client generations across unrelated runtime snapshot rebuilds so rotation age/counters remain continuous.
- [x] Keep request-count and age-based backend client recycling covered by tests and visible diagnostics.
- [x] Refresh container documentation and include all supported Certbot DNS plugins in the shipped OCI image.
- [x] Review current installation/cache/backend lifecycle documentation for stale behavior statements.
- [x] Keep existing 0.26.6 custom `Age` rules loadable while isolating response-side Age overrides from cache freshness/storage semantics.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.6.

## 0.26.6 - Access-policy composition and administration fixes

Current direction: 0.26.5 -> 0.26.6

- [x] Keep backend table visible columns, sort key and sort direction synchronized with account-scoped user preferences.
- [x] Clear the certificate-issuance form after the ACME issuance job succeeds while preserving non-secret values after failed jobs.
- [x] Document the sibling Python modules required by `scripts/migration/migrate_npm.py` and fix the container helper example.
- [x] Treat explicit IP allows and allow-only countries as alternative allow sources inside one ACL policy scope, with explicit denies taking precedence and separate scopes remaining cumulative.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.5.

## 0.26.5 - Scaled controls and listener navigation

Current direction: 0.26.4 -> 0.26.5

- [x] Keep compact toolbar selects and inputs on the same interface-scaled control height.
- [x] Reuse the interface-scale field variables for ordinary form controls so inputs/selects resize consistently with the UI scale setting.
- [x] Route the Streams **Add TCP/UDP listener** shortcut to Settings -> Listeners instead of opening a Stream editor.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.4.

## 0.26.4 - Administration consistency and backend rotation reliability

Current direction: 0.26.3 -> 0.26.4

- [x] Add 404-host forms to the session-only draft workflow.
- [x] Complete Polish translations for the Button style appearance setting.
- [x] Align toolbar search/filter input height with the active button style.
- [x] Reuse the vhost Enabled control styling in 404 hosts, Redirects and Streams.
- [x] Replace the Overview-card checkbox list with compact visibility/reorder tiles.
- [x] Run age-based backend client recycling independently of request arrival.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.3.

## 0.26.3 - Administration appearance and draft workflow polish

Current direction: 0.26.2 -> 0.26.3

- [x] Make interface scaling global across navigation, workspace, dialogs, overlays and the draft dock; extend the range to 70-125% and make form-control sizing respond more visibly across that range.
- [x] Make Overview telemetry cards denser without changing responsive breakpoints.
- [x] Expand chart themes to eight full-palette presets affecting colors, surfaces, grid and line treatment.
- [x] Restyle the draft dock as a square-corner RustProxy panel without rounded/glass styling.
- [x] Add a collapse-to-bar state and per-draft age indicator to the session-only draft dock.
- [x] Add Settings search without rebuilding forms, preserving unsaved values while categories are filtered.
- [x] Add chart-style palette previews beside the eight chart presets.
- [x] Add independent Normal/Compact/Ultra table-log density and Overview dashboard density preferences.
- [x] Add per-account Overview card visibility and ordering controls.
- [x] Add per-section Appearance resets plus a full Appearance reset while keeping unrelated account preferences intact.
- [x] Add an account-scoped Normal/Compact button-style selector, with Compact matching the smaller source-style control dimensions independently from global scale, including generated vhost actions and modal tabs.
- [x] Retain sticky Settings category navigation and unsaved-category indicators.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.2.

## 0.26.2 - Unified logs search and dynamic fields

Completed direction: 0.26.1 -> 0.26.2

- [x] Add independent in-session editor drafts for Web Server, Vhosts, Redirects and Streams, with minimize/restore/discard actions in a bottom-right dock.
- [x] Consolidate theme/language/display controls under **Settings -> Appearance**, replace density modes with an interface-scale slider and persist appearance choices in administrator preferences.
- [x] Add 12/24-hour timestamp formatting, chart presentation presets and a denser expanded Stored Logs record view.

- [x] Merge Stored Logs and Live Logs into one top-bar Logs menu.
- [x] Replace fixed Stored Logs filters with one bounded field-query syntax supporting AND, negation, quotes, wildcards and numeric comparisons.
- [x] Discover selectable Stored Logs columns from parsed record fields and keep arbitrary safe field choices in account preferences.
- [x] Parse the built-in RAW error-log line format into basic structured fields while retaining the raw record.
- [x] Remove the configured-file inventory/source selector from the Logs workspace and keep bounded all-source scanning by default.
- [x] Move Stored Logs column configuration to the table toolbar and use arrow symbols for backend sort direction.

## 0.26.1 - Vhost-aware protocol diagnostics and Logs Explorer UX

Current direction: 0.26.0 -> 0.26.1

- Attribute persistent protocol errors through one shared vhost resolver using routed vhost, authority/Host and SNI in that order.
- Keep unresolved traffic in `_unmatched.jsonl` and keep low-level protocol errors out of Live Logs.
- Add bounded protocol diagnostic identity fields for Stored Logs filtering and inspection.
- Add selectable Stored Logs columns, sticky headers, highlighted selection and inline details.
- Hide configured-file inventory by default and repair mapped client-IP/search behavior.
- Preserve schema 8 and the existing saved proxy configuration format.

## 0.26.0 - Persistent protocol diagnostics and stored-log explorer

Completed direction: 0.25.7 -> 0.26.0

- [x] Persist malformed HTTP, TLS/QUIC handshake failures, HTTP/2/HTTP/3 protocol failures, invalid h2c attempts and connection-limit rejects through the existing bounded logging sink.
- [x] Keep low-level protocol failures out of the Live Logs memory ring so hostile scans cannot displace ordinary live request history.
- [x] Add a local read-only **Logs** explorer with bounded server-side filtering and pagination over configured access/error files.
- [x] Prevent arbitrary-path browsing and symlink following; enumerate only paths derived from active RustProxy logging configuration.
- [x] Add `/logs` dashboard navigation plus a Logging-settings launcher while retaining the existing Live Logs dialog unchanged.
- [x] Keep schema 8 and configuration compatibility with 0.25.7.

## 0.25.7 - Vhost operations and backend observability

Current direction: 0.25.6 -> 0.25.7

- [x] Add a fast vhost enable/disable action to the vhost cards using the existing revisioned save path.
- [x] Add backend-table search, sorting and account-scoped persisted column visibility preferences to the main dashboard.
- [x] Style scrollbars for dark and light dashboard themes.
- [x] Export retry and upstream-client lifecycle metrics for ordinary and Docker backends.
- [x] Add Grafana panels for backend client generation, age, retry activity and rotations.
- [x] Make the vhost editor Enabled control visually distinct from ordinary settings.

## 0.25.6 - Backend memory diagnostics visibility

Current direction: 0.25.5 -> 0.25.6

- [x] Show upstream client generation, current-generation request count, generation age and total rotations in the main Backends diagnostics table.
- [x] Reuse the existing `/api/events` status snapshot refresh path; do not add a second diagnostics polling loop.
- [x] Keep the 0.25.5 client-generation recycling defaults and configuration compatibility unchanged.

## 0.25.5 - Traffic country consistency and Revision History styling

Current direction: 0.25.4 -> 0.25.5

- [x] Use trusted `CF-IPCountry` when verified Cloudflare client-IP mode is active, with local GeoIP fallback for missing/invalid country headers.
- [x] Keep country analytics, retained country logging and country policy evaluation on the same verified country source.
- [x] Align the Revision History dialog with the shared square-corner modal styling and remove duplicated history-only dialog CSS.
- [x] Add Cloudflare-country trust regression coverage and release/source-contract checks.
- [x] Extend Prometheus with a live Traffic analytics collector, fixed-cardinality User-Agent/method/source families, country/top-route views and built-in Web Server inventory/source metrics.
- [x] Extend the bundled Grafana dashboard with a Traffic vhost filter, Web Server request rate, countries, User-Agent families, serving sources, methods, status classes, cache outcomes, capture-state gauges and configured routes.
- [x] Bound backend Hyper client lifetime with configurable request/age recycling and an upstream HTTP/1 buffer ceiling so sustained traffic can release pool/TLS high-water allocations without a vhost save.

## 0.25.4 - Configuration history restore

Current direction: 0.25.3 -> 0.25.4

- [x] Restore an older retained configuration through the normal validation and hot-publish path.
- [x] Save restore as a new revision without deleting or rewinding existing history.
- [x] Require current-revision CAS plus administrator session/CSRF and audit restore source/new revision.
- [x] Add restore action and confirmation to the existing revision-history modal.

## 0.25.3 - Request policy, correlation and configuration history

Current direction: 0.25.2 -> 0.25.3

- [x] Add per-vhost HTTP method allow/block policy.
- [x] Add per-location HTTP method policy, reusable ACL profile, inline IP ACL and country allow/block policy.
- [x] Enforce host and location policies before upstream selection/connection.
- [x] Generate one SHA-256 request ID per exchange and forward it unchanged to the backend as `X-Request-ID`.
- [x] Persist bounded manual-configuration revision history in SQLite schema 8.
- [x] Add a calendar/day revision-history modal with change preview in the existing dashboard style.

## 0.25.2 - Live backup and resumed-session hardening

Current direction: 0.25.1 -> 0.25.2

- [x] Allow encrypted full-backup creation while RustProxy owns the data-directory process lock.
- [x] Snapshot SQLite consistently and stage durable files before archive encryption.
- [x] Preserve only validated relative symlinks that resolve inside the staged data tree, including Certbot `live` -> `archive` links.
- [x] Keep restore offline, validated, staged and atomically activated.
- [x] Recover transient invalid-origin state in restored/resumed admin tabs with a one-shot same-origin reload, without weakening server Host/Origin/CSRF checks.

## 0.25.1 - Traffic UX and source modularization

Current direction: 0.25.0 -> 0.25.1

- [x] Split Traffic into Overview, Clients, Requests and Delivery sub-tabs.
- [x] Chart every bounded Traffic dimension with donut or horizontal bar visualizations suited to the data shape.
- [x] Keep every Rust source file at or below 500 lines and keep unit tests outside implementation files.
- [x] Split oversized dashboard source bundles and the Docker Agent into bounded source modules while preserving behavior and URLs.
- [x] Guard the Web Server split against dangling attributes and missing `htaccess`, `server_protocol` and `anyhow::Context` imports.

## 0.25.0 - Web Server foundation

Current direction: 0.24.10 -> 0.25.0

- [x] Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
- [x] Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
- [x] Add `Reverse Proxy` / `Web Server` source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
- [x] Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
- [x] Add `GET`, `HEAD`, MIME, `Content-Length`, streaming, index lookup, directory slash redirect and optional directory listing.
- [x] Add repeatable per-request directory listing, per-directory index-before-listing behavior, Web Service MIME overrides/default MIME and a default static `Cache-Control` policy.
- [x] Organize Web Service editing into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs.
- [x] Add Web Service `try_files`, internal/redirect regex rewrites, ordered per-extension/MIME Cache-Control rules, fixed response headers, precompressed `.br`/`.gz` delivery and forced-download extensions.
- [x] Add bounded FastCGI/PHP-FPM execution over Unix sockets or loopback TCP with `index.php`/front-controller routing and no source fallback on upstream failure; expose advanced bounded limits, Authorization forwarding, custom FastCGI parameters and controlled `PHP_VALUE` overrides with in-panel syntax documentation.
- [x] Add explicit symlink policy: deny by default, with Linux-only inside-root following for static files; PHP-FPM remains restricted to deny.
- [x] Add a bounded `.htaccess` compatibility layer for common Apache migration rules, including rewrite conditions/rules, directory index/listing, MIME, headers, Expires and PHP AddHandler integration, with a dashboard documentation modal and fail-closed security-sensitive directives.
- [x] Add one-shot Web Service presets for Static, SPA, PHP generic, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads, with optional deterministic hardening for common exploit probes/sensitive paths and fingerprint-header stripping.
- [x] Expose vhost-wide request/active/error/EWMA/traffic metrics for Web Server-only vhosts and fix custom logging mappings for route/cache/transform effective fields.
- [x] Add bounded per-vhost Traffic analytics, User-Agent logging and opt-in country/GeoIP logging with top-dimension views, effective-client-IP rankings and donut charts for the main dimensions.
- [x] Keep Web Service dashboard rendering stable when configuration loads before the deferred Web Server UI module and use the existing generic/custom 403 error-page pipeline when directory listing is disabled.
- [x] Add automatic allocator release and idle HOT-cache waterline trimming so sustained traffic does not require a vhost save/reload to return reclaimable RSS.
- [x] Add metadata-based `ETag`/`Last-Modified`, conditional `304`, single `Range`/`If-Range`, `206` and `416`.
- [x] Enforce decoded-path validation and document-root confinement; Unix traversal uses `openat` + `O_NOFOLLOW` and does not serve symlinks.
- [x] Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
- [x] Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
- [x] Clean README/Docs/CHANGELOG/ROADMAP material, add a canonical docs index, authenticated Markdown Reader, 0.25 specification audit and open-work TODO.
- [ ] Run compiler-enabled `./dev.sh fmt`, `./dev.sh check`, `./dev.sh test` plus live H1/H2/H3/static-file acceptance on the release host.

## Web Server follow-up

Future Web Server work must retain the 0.25 split between reusable **Web Service** configuration and vhost/location source selection.

- Multipart byte ranges if operational demand justifies them.
- Named locations without introducing a second URL router.
- Opt-in PHP `PATH_INFO` script/path splitting with an unambiguous confinement rule.
- Race-resistant filesystem confinement for non-Unix targets before enabling local file serving there.
- Real PHP-FPM release-host acceptance over Unix socket and loopback TCP.

See [`docs/TODO.md`](docs/TODO.md) for unresolved work and release acceptance, and [`docs/ROADMAP_HISTORY.md`](docs/ROADMAP_HISTORY.md) for completed historical milestones.