RustProxy/ROADMAP.md

RustProxy roadmap

0.25.0 - Web Server foundation

Current direction: 0.24.10 -> 0.25.0

• Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
• Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
• Add Reverse Proxy / Web Server source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
• Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
• Add GET, HEAD, MIME, Content-Length, streaming, index lookup, directory slash redirect and optional directory listing.
• Add repeatable per-request directory listing, per-directory index-before-listing behavior, Web Service MIME overrides/default MIME and a default static Cache-Control policy.
• Organize Web Service editing into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs.
• Add Web Service try_files, internal/redirect regex rewrites, ordered per-extension/MIME Cache-Control rules, fixed response headers, precompressed .br/.gz delivery and forced-download extensions.
• Add bounded FastCGI/PHP-FPM execution over Unix sockets or loopback TCP with index.php/front-controller routing and no source fallback on upstream failure; expose advanced bounded limits, Authorization forwarding, custom FastCGI parameters and controlled PHP_VALUE overrides with in-panel syntax documentation.
• Add explicit symlink policy: deny by default, with Linux-only inside-root following for static files; PHP-FPM remains restricted to deny.
• Add a bounded .htaccess compatibility layer for common Apache migration rules, including rewrite conditions/rules, directory index/listing, MIME, headers, Expires and PHP AddHandler integration, with a dashboard documentation modal and fail-closed security-sensitive directives.
• Add one-shot Web Service presets for Static, SPA, PHP generic, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads, with optional deterministic hardening for common exploit probes/sensitive paths and fingerprint-header stripping.
• Expose vhost-wide request/active/error/EWMA/traffic metrics for Web Server-only vhosts and fix custom logging mappings for route/cache/transform effective fields.
• Add bounded per-vhost Traffic analytics, User-Agent logging and opt-in country/GeoIP logging with top-dimension views, effective-client-IP rankings and donut charts for the main dimensions.
• Keep Web Service dashboard rendering stable when configuration loads before the deferred Web Server UI module and use the existing generic/custom 403 error-page pipeline when directory listing is disabled.
• Add automatic allocator release and idle HOT-cache waterline trimming so sustained traffic does not require a vhost save/reload to return reclaimable RSS.
• Add metadata-based ETag/Last-Modified, conditional 304, single Range/If-Range, 206 and 416.
• Enforce decoded-path validation and document-root confinement; Unix traversal uses openat + O_NOFOLLOW and does not serve symlinks.
• Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
• Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
• Clean README/Docs/CHANGELOG/ROADMAP material, add a canonical docs index, authenticated Markdown Reader, 0.25 specification audit and open-work TODO.
• Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test plus live H1/H2/H3/static-file acceptance on the release host.

Web Server follow-up

Future Web Server work must retain the 0.25 split between reusable Web Service configuration and vhost/location source selection.

• Multipart byte ranges if operational demand justifies them.
• Named locations without introducing a second URL router.
• Opt-in PHP PATH_INFO script/path splitting with an unambiguous confinement rule.
• Race-resistant filesystem confinement for non-Unix targets before enabling local file serving there.
• Real PHP-FPM release-host acceptance over Unix socket and loopback TCP.

See docs/TODO.md for unresolved work and release acceptance, and docs/ROADMAP_HISTORY.md for completed historical milestones.