47 lines
4.1 KiB
Markdown
47 lines
4.1 KiB
Markdown
# RustProxy 0.26.6 implementation note
|
|
|
|
## Scope
|
|
|
|
0.26.6 is a compatibility-preserving access-policy and administration workflow patch on top of 0.26.5. SQLite remains schema 8 and the saved proxy configuration document is unchanged.
|
|
|
|
## Backend table preferences
|
|
|
|
The backend diagnostics table continues to store visible columns, sort key and descending/ascending direction in the account-scoped administrator preferences. The shared preference application path now reapplies those values to the backend table whenever preferences are loaded or updated, instead of relying only on initial page activation.
|
|
|
|
## Certificate creation workflow
|
|
|
|
After `/api/acme/issue` accepts an issuance request, the UI remembers that job ID. The form is reset only when polling reports that same issue job as `ready`; a failed job cancels the pending reset so non-secret fields remain available for correction. Transient provider secrets continue to be cleared after submission for security. The submitted job remains visible in the ACME status UI.
|
|
|
|
## NPM migration helper
|
|
|
|
`scripts/migrate_npm.py` imports sibling modules `scripts/migrate_npm_core.py` and `scripts/migrate_npm_api.py`. They use the Python standard library and require no third-party package installation, but all three files must stay together. The documented container command now mounts the complete `scripts` directory.
|
|
|
|
## ACL policy composition
|
|
|
|
IP ACLs and country access are evaluated together inside each policy scope. Explicit IP denies and blocked countries take precedence. In **Allow only** country mode, either a listed country or an explicit IP allow can satisfy that scope, so a `default=deny` policy can express private/internal CIDRs **or** selected countries. An unresolved country fails the country branch but may still be admitted by an explicit IP allow.
|
|
|
|
Profile, vhost and location policy scopes remain cumulative: satisfying one scope never bypasses another scope or authentication. Country **Block** mode continues to reject listed countries while the IP ACL controls all other clients.
|
|
|
|
The reusable ACL editor exposes this as two guided modes without changing the saved configuration schema:
|
|
|
|
- **Block by default** — each selected country **OR** allowed IP/CIDR is an access exception. For example, `CN` plus `203.0.113.7` allows clients from China and also that single address from any other resolvable country.
|
|
- **Allow by default** — each selected country **OR** denied IP/CIDR is a block condition.
|
|
- **Custom** — retains manual default action, country mode and mixed IP allow/deny actions for advanced policies.
|
|
|
|
A live policy preview shows the effective default and OR branches before save. The editor also accepts a single IPv4/IPv6 address and normalizes it to a host rule; the backend accepts the same address form directly, so API-authored profiles do not require `/32` or `/128` either.
|
|
|
|
## LXC runtime diagnostics
|
|
|
|
Linux diagnostics classify the runtime as LXC, Docker, Podman, systemd-nspawn, WSL, VM or Host for the Process platform label. Classification uses namespace/container metadata already exposed by procfs/sysfs/systemd and does not shell out. LXC detection takes precedence over DMI virtualization so an LXC guest running on a virtualized host is still shown as `Linux / LXC`.
|
|
|
|
Only LXC changes metric sourcing. `system_uptime_seconds` is replaced with the age of PID 1 calculated from `/proc/1/stat` and `CLOCK_BOOTTIME`, avoiding the host uptime returned by ordinary Linux system APIs. The 1/5/15 load values are read from the container-visible `/proc/loadavg`, allowing LXCFS-backed installations to expose their virtualized container load instead of the host load. Other environments retain the existing `systemstat` uptime/load path.
|
|
|
|
## Compatibility
|
|
|
|
- SQLite schema: 8, unchanged.
|
|
- Saved proxy configuration format: unchanged from 0.26.5.
|
|
- No data migration is required for upgrade from 0.26.5.
|
|
- Existing ACL/country configuration is reinterpreted only where allow-only countries previously conflicted with `default=deny` IP rules.
|
|
|
|
Verification status and environment limitations are recorded in [TEST_REPORT](TEST_REPORT.md).
|