RustProxy/CHANGELOG.md

# Changelog

Release history focused on **features, settings, default behavior, compatibility and fixes**. Changes to internal code structure and preliminary performance experiments are intentionally omitted. Historical descriptions reflect their respective releases; consult the current documentation for the settings available in 0.34.0.

## 0.34.0 — cache consistency, static delivery and proxy optimization

### Cache
- Improved HOT/COLD cache retention when saving operational Vhost settings such as backend keepalive, connection recycling and load-balancer diagnostics. Unrelated changes should no longer unnecessarily clear compatible cached content.
- Changes affecting served content invalidate the relevant Vhost cache scope and pending fills. Global changes to response representation may still invalidate content more broadly.
- Added protection against restoring obsolete persistent COLD responses after an interrupted scoped purge or restart. Previously stored objects may need to be populated again during compatibility checks.
- Corrected freshness and expiry handling: a local maximum TTL limits **remaining freshness**, not the upstream response's existing `Age`. The dashboard now distinguishes total HTTP `Age` from time spent in HOT/COLD cache.
- Improved cache HIT/LRU accounting, `Vary` handling and response-header isolation. Existing `private`/`no-store` rules, conditional requests, PURGE/BAN controls and authenticated-request protections remain in effect.

### Static content and backend traffic
- Added **`sendfile: off | auto`** in **Web Server → Delivery**, disabled by default. `auto` supports eligible full static GET responses of **64 KiB or more** on Linux over unencrypted HTTP/1.1; TLS, HTTP/2, HTTP/3, ranges, compression, transformations and other excluded requests use standard delivery.
- Increased the default HTTP/1.1 idle backend connection pool size for **new** Vhost/origin configurations from **4 to 64**. Existing explicitly saved values remain unchanged; a larger pool can use more file descriptors and connections.
- Reduced overhead in common reverse-proxy routing, upstream connection reuse, backend selection, request forwarding and streamed responses. Existing ACLs, trusted-proxy checks, request limits, load-balancer choices and retry rules are preserved.
- Optimized request forwarding for common HTTP/1.1 paths and forwarding headers without changing public path validation, IPv6 handling or the HTTP/2 and HTTP/3 security model.

### Metrics, logging and compatibility
- Improved traffic analytics, per-Vhost cache statistics, latency reporting and log handling under load. Analytics collection remains bounded and non-blocking; dropped samples are still counted when limits are reached.
- Reduced monitoring overhead without removing existing Prometheus, dashboard, cache or protocol metrics. Dashboard labels and reported cumulative latency values remain compatible.
- Preserved protected `X-Request-ID` formatting as **64 lowercase hexadecimal characters**; request IDs now use cryptographically secure 256-bit randomness combined with the process sequence.
- Preserved response-compression settings, cache exclusions, existing configuration formats and database compatibility. No new mandatory migration or load-balancer control was introduced for these optimizations.

**Validation:** Several later 0.34.0 changes were provided as source changes and require final Rust compilation, regression tests and comparable performance measurements. Earlier candidates passed **151 live HTTP checks** with one optional Zstandard check skipped, but these results do not validate the latest source. No measured RPS advantage over 0.33.8 or nginx is claimed.

## 0.33.8 — safer file responses and request handling

- Reduced work for requests where caching cannot apply, while retaining independently configured security checks, response transformations and monitoring.
- Improved Web Server file streaming and file-read behavior, preserving filesystem root and symlink protections.
- Fixed successful HTTP/1.1 file responses sometimes being reported as cancelled; corrected cases where complete or empty eligible files were not committed to cache.
- Improved handling of short or unexpectedly oversized local streams without changing upstream streaming and trailer behavior.
- Fixed Host/port validation, extended `Expires` parsing, cache inventory reporting, diagnostic-header spoof protection and redaction of sensitive values in escaped JSON logs.
- Corrected certificate API token authorization checks; added HTTP compatibility and performance test scenarios for future releases.

## 0.33.7 — saved dashboards and Vhost backend details

- Added **Dashboard Presets**: up to **16 named Overview layouts per administrator**, with save, load, overwrite, rename, delete and factory reset.
- Presets retain card order, visibility, widths, density and chart history length. Existing account preferences and proxy settings remain compatible.
- Added an interactive Vhost backend summary showing the configured destination, HTTP mode, health state and latest observed HTTP response without generating extra probes.
- Changed HTTP/1.1 and HTTP/2 backend badges from basic tooltips into interactive details panels with current observations and response counts.
- Standardized Overview card titles, chart captions, legend typography and popover appearance; styles follow the selected dashboard theme and corner-rounding preset.

## 0.33.6 — consistent chart scales

- Fixed Overview and Web Server chart heights to prevent stretched or uneven plots at different screen sizes.
- Kept CPU and other percentage-based charts on consistent **0–100%** scales, with actual values still shown in legends.
- Made rate, count, latency and memory charts start from zero instead of exaggerating low traffic.
- Unified Cache and Transform rate-chart dimensions, preserving the real values, history and refresh intervals.

## 0.33.5 — CPU monitoring and chart headings

- Corrected System and process CPU charts so low utilization no longer appears as a full-height spike; legends continue to show actual percentages.
- Stabilized CPU chart dimensions across layout sizes and dashboard densities.
- Moved the maximum requests-per-second reading next to the Requests per second heading and simplified live chart labels.

## 0.33.4 — Web Service live metrics

- Made Web Service live metrics always visible in the service view, with **six responsive metric tiles** matching the Vhost dashboard.
- Added a full-width Web Service request-rate history chart and improved metric refresh during service-list updates.
- Preserved existing PHP concurrency metrics, request sampling and monitoring APIs.

## 0.33.3 — flexible Overview layout

- Added card-width choices of **2, 3, 4, 6 or 12 columns** and improved drag-and-drop ordering between different widget groups.
- Updated the layout editor to remain usable on small screens; saved widths, hidden widgets and factory layout settings are preserved.
- Fixed charts that did not fill resized widgets and false gaps or zero readings after returning to a suspended browser tab.
- Made the sidebar's selected/hover colors follow the interface theme rather than the independent chart palette.

## 0.33.2 — theme consistency

- Made Cache, Web Server, Traffic and Overview progress indicators follow the selected chart colors and corner-rounding style.
- Unified RAM utilization meters and matching progress bars across dashboard panels, including light/dark theme switching.
- Monitoring values, polling frequency and saved preferences remain unchanged.

## 0.33.1 — reliable layout editing

- Fixed hidden/shown Overview widgets unexpectedly reverting while editing the layout; Save and Cancel now respect the unfinished changes.
- Added a consistent factory Overview layout and an explicit reset/preview workflow for card order, visibility, compact density and initial chart history.
- Preserved history and rate baselines while widgets are temporarily hidden, and clarified lifetime versus recent cache HIT ratios.

## 0.33.0 — Web Server monitoring

- Added richer Web Server and PHP-FPM statistics, including request types, HTTP status counts, methods, response-header timing, compression and PHP concurrency.
- Expanded Prometheus/Grafana reporting with per-service Web Server and PHP activity, errors and performance metrics.
- Added **12 optional Web Server Overview cards**, hidden by default, with the existing layout and refresh controls.
- Improved Overview history selection and corrected a dashboard initialization issue that could stop the panel loading.
- Kept the existing configuration format, API compatibility and saved dashboard preferences.

## 0.32.8 — resource and compression charts

- Added capacity indicators for HOT RAM cache, COLD queue/disk, file descriptors, HTTP protocol share and backend usage.
- Added compact cache HIT/MISS donut charts with counts and percentages.
- Added detailed Transform and Compression activity graphs with separate series for transformation results and gzip/Brotli/Zstd/deflate.
- Improved Overview action-button layout on narrow screens without changing stored settings or metrics.

## 0.32.7 — HTTP/2 lifecycle and dashboard fixes

- Improved handling of an upstream HTTP/2 connection shutting down gracefully, including a limited retry for eligible empty, safe requests on the same backend.
- Prevented normal HTTP/2 shutdown events from incorrectly counting as backend health failures; unrelated connection errors still count.
- Improved backend recovery after passive health ejection, including bounded recovery when active health probes are disabled.
- Reduced duplicate shutdown diagnostics and improved Overview button sizing and density presentation.

## 0.32.6 — appearance and backend protocol visibility

- Improved Appearance layout controls, dashboard card density, responsive mobile metrics and corner-rounding consistency.
- Expanded live Process and Network charts using available CPU, memory and network-interface measurements.
- Prevented false zero-rate readings and interrupted chart histories when returning to inactive browser tabs.
- Added the **observed** backend HTTP/1.1/HTTP/2 mode next to the configured mode; unknown or stale observations display `?` instead of a guessed result.
- Preserved existing refresh settings, polling behavior and administrator preferences.

## 0.32.5 — DNS/DDNS access rules

- Added DNS/DDNS hostnames as **allow-only** entries in reusable client ACLs, Vhosts, Custom locations and Docker ACL assignments.
- Hostname A/AAAA records are periodically refreshed (**60-second** interval); unresolved or failed lookups deny access rather than allowing unknown clients.
- Added DNS/IP selection and guidance to the ACL editor. Existing IP/CIDR rules and stored policy formats remain compatible.

## 0.32.4 — Preserve Host with HTTP/2

- Expanded **Preserve Host** support across HTTP/1.1, automatic HTTPS H2/H1, compatible HTTP/2 and strict H2/H2C upstream modes.
- Forwarded the public hostname as HTTP/2 authority while continuing to use the configured origin for destination routing and TLS identity checks.
- Removed unnecessary UI restrictions when using Preserve Host with different backend protocols, while retaining warnings for potentially invalid HTTPS certificate names.

## 0.32.3 — protocol selection and customizable Overview

- Added strict **`h2`** upstream mode; existing `http2` remains compatible with HTTPS H2/H1 negotiation and plaintext H2C. `http1` and `auto` keep their previous behavior.
- Expanded the Vhost Origin protocol selector with clearer choices for HTTP/1.1, Auto, compatible HTTP/2 and H2-only.
- Expanded Overview customization: unlock editing directly on the dashboard, reorder or hide registered cards, preview changes, Save/Cancel and reset to the default layout.
- Added optional protocol, cache, backend health, connection and system/process charts; the Overview catalog expanded to **62 blocks**. New diagnostic cards remain hidden unless enabled.
- Added **Ultra dark** and **Warm cream** panel themes and account-level corner-rounding presets (Original, Square, Subtle, Rounded and Extra rounded).
- Improved the default Overview grid and customized card arrangement across desktop, mobile and browser zoom. Existing saved layouts remain compatible.

## 0.32.2 — correct local cache revalidation

- Fixed Web Server cache revalidation with `ETag` and `Last-Modified`, including requests using `no-cache` or `max-age=0`.
- A valid origin `304 Not Modified` can refresh the existing cached body; changed or no-longer-cacheable content is not incorrectly reused.
- Preserved client-side HEAD, conditional and Range behavior as well as transformed-response headers.
- No database, cache-format, API or Web Server setting changes.

## 0.32.1 — dashboard readability

- Restored the earlier Overview layout proportions and consistent spacing between dashboard cards.
- Improved compact font sizes and responsive layout at reduced UI zoom, without forcing large empty chart areas.
- Simplified Stream card help text and retained the existing visibility and saved Appearance settings.

## 0.32.0 — multi-backend TCP/UDP Streams

- Added Stream backend pools of up to **32 members**, with weights, enable/disable, draining, session caps and compatible single-upstream fallback.
- Added weighted Round Robin and Least Connections/Sessions balancing for Stream backends, with connections remaining associated with their selected backend.
- Added optional TCP connect and response-based UDP health checks with configurable intervals, timeouts and recovery/failure thresholds.
- Expanded per-backend Stream status and optional Prometheus metrics; the existing global Stream metrics switch remains in control.
- Added four optional Stream cards to Overview and improved their no-data and enabled/disabled presentation.
- Preserved the six-column desktop Overview and previous Stream configurations.

## 0.31.9 — Certificate API credentials

- Added **View settings**, **Edit settings** and **Regenerate token** for individual Certificate API credentials.
- Administrators can update certificate grants, comments and deployment permissions without rotating an existing token.
- Token regeneration invalidates the old secret immediately; the new token is shown only when generated, not returned by later settings reads.
- Added matching authenticated API operations while retaining certificate-scoped authorization and existing session security.

## 0.31.8 — Docker status and log explorer

- Changed an unobserved Docker agent startup state to **WAITING** rather than incorrectly reporting a failed connection; actual failures are shown after a check.
- Added server-side sorting in Stored Logs, including numeric and nested fields, before paginating matching results.
- Added consistent built-in HTML error/status pages for more response codes; custom error pages keep priority.
- Improved cache and GeoIP resource handling without changing saved configuration formats.

## 0.31.7 — rate limits and configuration history

- Added a **Settings → Rules & headers** workspace for the global User-Agent blocklist, custom headers and client-response rules.
- Added per-Vhost User-Agent request limits: up to **64 patterns**, each with its own rate, window and burst. Rules are optional; unmatched clients use existing limits.
- Improved configuration revision previews to show changed fields first, with full JSON comparison available separately.
- Fixed managed-update cleanup and documented retention of two installed releases plus three private stopped-service rollback backups.
- Improved preservation of eligible HOT cache entries to COLD storage during managed updates when COLD is enabled.

## 0.31.6 — HTTP/3 forwarding diagnostics

- Improved empty HTTP/3 GET/HEAD forwarding to HTTP/1.1 backends and handling of graceful HTTP/3 connection shutdown.
- Distinguished cancelled HTTP/3 requests from genuine HTTP 400 errors in stored diagnostics.
- Expanded interrupted-response diagnostics with phase, response status, transferred bytes and redacted failure context.

## 0.31.5 — Stored Logs and request filtering

- Improved Stored Logs on mobile with readable expandable records, configurable columns and repeated-value analysis for User-Agent, client IP and other parsed fields.
- Added consolidated viewing of a Vhost's active JSONL logs together with compressed rotations, while preserving each file's identity.
- Added optional global and per-Vhost **User-Agent blocklists**, disabled by default, using case-insensitive patterns.
- Improved HTTP/3 cancellation reporting and preserved HOT/COLD cache contents when only frontend HTTP/2 or HTTP/3 enablement changes.
- Improved panel asset-cache versioning and trusted-public-origin guidance for administrators using a reverse proxy.

## 0.31.4 — administration behind HTTPS proxies

- Added an explicit **administration public HTTPS origin** option for panels published behind a trusted reverse proxy.
- Corrected forwarded-protocol validation and automatically included the configured public hostname in the effective administration Host allowlist.
- Preserved strict Origin, Host, CSRF and trusted-proxy checks; the setting does not make untrusted forwarded headers acceptable.

## 0.31.3 — session and browser restoration

- Fixed duplicate panel session checks and repeated reload attempts after tab suspension or browser back/forward restoration.
- Added a recoverable startup/retry state and clearer invalid-Origin navigation errors while keeping cross-origin API requests blocked.

## 0.31.2 — updated runtime baseline

- Updated runtime, TLS, database, Swagger and monitoring dependencies.
- Raised the minimum Rust toolchain requirement to **1.99** for source builds, while preserving configuration and data-format compatibility.

## 0.31.1 — panel loading reliability

- Improved dashboard startup after mobile reloads and navigation through reverse proxies.
- Added versioned dashboard JavaScript/CSS assets to reduce problems caused by mixed browser/intermediary caches.

## 0.31.0 — selective cache purge and live monitoring

- Added optional, IP/CIDR-restricted public HTTP **`PURGE`** (exact URL) and **`BAN`** (URL prefix) controls. An empty allowlist keeps the feature off; requests remain subject to relevant validation and audit rules.
- Tightened Vhost/scheme isolation for cache invalidation and bounded background cache-maintenance work.
- Added configurable compression for administration HTML and assets, with gzip, Brotli and Zstd negotiation where supported.
- Added per-administrator live-refresh controls for Overview, Traffic/Cache and System information, including the option to stop certain automatic refreshes.
- Improved panel startup and separated compact live status updates from more expensive system information requests, preserving full status API compatibility.

## 0.30.1 — dashboard diagnostics

- Corrected HTTP/WebSocket protocol legend colors so charts follow the selected palette.
- Moved Python/Certbot and system diagnostics into **Settings → System information** with live OS/runtime details.

## 0.30.0 — backend health configuration

- Moved per-backend health-check editing into the Vhost **Health** tab with a selector for monitored backends.
- Kept independent backend health overrides when switching between members or temporarily disabling checks.
- Improved historical log processing and resource usage without changing saved Vhost, database or COLD cache formats.

## 0.29.7 — PHP-FPM safety, health checks and custom errors

- Added independent per-backend health-check enable switches and optional probe overrides, including the ability to disable active/passive checks for a selected backend.
- Added optional **HIT-only cache diagnostic headers** (`expose_only_hits`) at global or Vhost scope; non-HIT outcomes can remain unadvertised.
- Added warnings and practical guidance for PHP-FPM services sharing a pool with conflicting per-request PHP settings. Separate pools are recommended where settings differ.
- Expanded PHP-FPM profile help, `PATH_INFO` guidance and examples for applications such as WordPress and Roundcube.
- Added configurable application-error interception (`pages.intercept_statuses`) to serve internal, Vhost or global error pages while retaining the appropriate status code. Disabled for existing configurations unless enabled.

## 0.29.6 — compressed PHP responses

- Fixed truncated PHP-FPM responses when serving gzip, Brotli, Zstd or deflate content in Web Server mode.
- Improved error-file routing for PHP-FPM diagnostic output and service warnings, with fallback to console logs when writing fails.

## 0.29.5 — PHP PATH_INFO and Roundcube

- Fixed Roundcube `static.php/...` routes being incorrectly sent through the front-controller fallback, which could return HTML instead of CSS or JavaScript.
- Applied Web Server security and `.htaccess` restrictions to the resolved PHP script path, including when optional `PATH_INFO` is used.

## 0.29.4 — reusable PHP-FPM profiles

- Added named shared PHP-FPM profiles, manageable from the Web Server toolbar or a Web Service editor; services can attach/detach a profile without losing their local configuration.
- Extended Vhost cache, transformation and response policies to appropriate local Web Server file/PHP responses.
- Corrected FastCGI `HTTP_HOST` forwarding for valid HTTP/2 and HTTP/3 requests, supporting applications such as WordPress.

## 0.29.3 — internal error fallback

- Corrected internal error fallback for empty HTTP/2 and HTTP/3 GET/HEAD requests.
- Preserved the final status and response body of an internal fallback location, even when it returns its own error page.
- Improved warnings for missing internal fallback destinations.

## 0.29.2 — managed logs and PHP monitoring

- Added managed log rotation for Debian installation/update, including daily rotation and compressed history.
- Fixed Web Server routes incorrectly returning 503 when backend availability flags were unrelated to local file/PHP serving.
- Added validated `PHP_ADMIN_VALUE` support for trusted PHP-FPM use, and expanded Web Service Prometheus status, latency and concurrency measurements.

## 0.29.1 — internal locations, range delivery and PHP scripts

- Added internal-only named Custom locations for controlled error fallback, with selectable interception of common 4xx/5xx statuses and validation against routing loops.
- Added multipart HTTP `Range` delivery for up to **16 byte ranges** per request.
- Added optional PHP-FPM `PATH_INFO`, securely separating an existing script from its trailing request path.
- Preserved existing configuration and persistent cache compatibility.

## 0.29.0 — canonical hostnames and redirect rules

- Added easier management of domain aliases and **www/non-www canonical redirects**, including one-click permanent canonicalization and retention of the original request target.
- Added a Custom location **Redirect** action supporting permanent/temporary responses, full HTTP(S) destinations, optional capture-based rewriting and query preservation.
- Improved default HTTP health-check Host selection using the Vhost's first exact DNS name when no explicit override is set.
- Added narrowly scoped **force-cache targets** for configured URLs while continuing to respect response-side privacy exclusions such as `private`, `no-store` and `Set-Cookie`.
- Expanded Stored Logs to search permitted compressed log rotations, and improved maintenance/error-page and nested URL handling.

## 0.28.x — external certificates and GeoIP

| Version | Technical changes |
|---|---|
| **0.28.2** | Safer external PEM/key access, including POSIX ACLs and Certbot symlinks; certificate API keys now default to limited reload-only permissions and explicit certificate grants. |
| **0.28.1** | Support externally managed absolute certificate/key paths and hot reload after Certbot renewal; keep external key files outside RustProxy backups. |
| **0.28.0** | Add manual GeoIP downloads, flexible CSV/MMDB source URLs and checksum validation; improve active listener/protocol display and cache Via controls. |

## 0.27.x — compression and managed deployment

| Version | Technical changes |
|---|---|
| **0.27.3** | Protect ownership during backup restore; enable scheduled GeoIP updates; fix listener overrides and valid WebSocket upgrade framing. |
| **0.27.2** | Fix managed Certbot issue/renew invocation without requiring operators to delete existing private Python environments. |
| **0.27.1** | Add application-managed Python/Certbot installation with system fallback and clearer runtime errors; extend sortable host lists and first-admin help. |
| **0.27.0** | Enable eligible response compression with zstd, Brotli and gzip by default, with scoped Vhost/Web Service controls; preserve published Docker routes during temporary discovery failures. |

## 0.26.x — cache, logs and interface operations

| Version | Technical changes |
|---|---|
| **0.26.7** | Show HOT/COLD cache capacity and progress; improve HTTP `Age` diagnostics and safe compression behavior for eligible cached/static responses. |
| **0.26.6** | Store backend table preferences per administrator; correct combined IP/country ACL logic and clarify the ACL editor's allow/deny modes. |
| **0.26.5** | Align compact filters and streamline navigation from Streams into listener configuration; no configuration migration. |
| **0.26.4** | Add draft recovery for 404-host forms, improve Appearance layout editing and keep idle upstream connection recycling effective. |
| **0.26.3** | Apply display scale consistently across the administration panel, including dialogs and controls. |
| **0.26.2** | Add minimizable draft editing for Vhosts, Web Services, Redirects and Streams so unfinished forms survive page changes. |
| **0.26.1** | Extend persisted protocol error records with the affected Vhost when it can be identified safely. |
| **0.26.0** | Record malformed HTTP, TLS, H2/H3 and connection/protocol failures separately from normal HTTP responses; expand error-log inspection. |

## 0.25.x — Web Server and recovery

| Version | Technical changes |
|---|---|
| **0.25.7** | Add quick Vhost enable/disable and clearer active-state controls. |
| **0.25.6** | Show upstream connection age, reuse and recycle diagnostics in the backend panel. |
| **0.25.5** | Add configurable HTTP/1.1 upstream connection recycling by age/request count and expand connection telemetry. |
| **0.25.4** | Restore configuration from retained history as a validated new revision. |
| **0.25.3** | Add per-Vhost and per-location HTTP method allow/block policies and location-level access profiles. |
| **0.25.2** | Support password-encrypted full backups while the service is running, using a consistent configuration/database snapshot. |
| **0.25.1** | Reorganize Traffic into focused Overview, Clients, Requests and Delivery views; improve saved analytics. |
| **0.25.0** | Introduce reusable static Web Services with document roots, indexes and optional directory listing, integrated with Vhosts. |

## 0.24.x — monitoring, security and transport

| Version | Technical changes |
|---|---|
| **0.24.10** | Persist separate error-file logging settings and keep compatibility with existing logs. |
| **0.24.9** | Introduce encrypted Secret Store for managed credentials, including migration of ACME DNS secrets. |
| **0.24.8** | Expand Cache diagnostics with memory breakdowns and HOT/COLD occupancy. |
| **0.24.7** | Make response transformation memory and concurrency limits configurable. |
| **0.24.6** | Preserve selected HOT/COLD cache capacity presets across saves. |
| **0.24.5** | Fix empty HTTP/3 request forwarding and strengthen cache memory admission, transient limits and disabled-cache behavior. |
| **0.24.4** | Reduce excessive process memory usage on Linux without changing host-wide memory settings. |
| **0.24.3** | Extend per-certificate reload and multiple scoped certificate API keys; move H2 lifecycle controls to listeners. |
| **0.24.2** | Version-only update; no functional or configuration change. |
| **0.24.1** | Improve portable network/system metrics, runtime metadata and BSD-compatible CLI data-path discovery. |
| **0.24.0** | Add graceful downstream HTTP/2 connection retirement and separate lifetime/idle/drain controls; broaden BSD system statistics. |

## 0.23.x — certificates and dashboard diagnostics

| Version | Technical changes |
|---|---|
| **0.23.3** | Make external certificate deploy idempotent and self-reconciling; add opt-in legacy WebSocket compatibility. |
| **0.23.2** | Add configurable Cache/Transform chart history windows and fix live-log CLI connections to HTTPS administration. |
| **0.23.1** | Add live Cache and Transform activity charts with per-scope request and outcome rates. |
| **0.23.0** | Introduce restricted external certificate API keys with token hashing, certificate-specific permissions, revocation and authenticated deploy/reload; limit inactive H2 connections. |

## 0.22.x — cache controls and protocol handling

| Version | Technical changes |
|---|---|
| **0.22.3** | Support guarded cleartext H2 upgrade; add hot reload and external deploy for manual certificate IDs from CLI/API. |
| **0.22.2** | Add bounded safe-method failover retry, per-backend concurrency/capacity limits and detailed upstream failure diagnostics. |
| **0.22.1** | Simplify WebSocket transport selection and add focused active-tunnel, protocol and selective cache-invalidation controls. |
| **0.22.0** | Add request collapsing, supported cached range responses, safer stale-if-error rules, proactive refresh and selective cache PURGE/BAN. |

## 0.21.x–0.19.x — transformations and certificate workflows

| Version | Technical changes |
|---|---|
| **0.21.0** | Add a dedicated Transform workspace, savings/error counters and cache diagnostics for transformed representations. |
| **0.20.0** | Reorganize Certificates into Installed, Renewal and Generate; expose managed ACME job and Certbot diagnostics. |
| **0.19.4** | Improve presentation of idle and very small backend traffic rates. |
| **0.19.3** | Add a non-blocking release/update checker and simplify dashboard footer diagnostics. |
| **0.19.2** | Restore explicit per-backend protection/exception controls for deliberately targeting local administration listeners. |
| **0.19.1** | Separate HTTP and HTTPS cache identities to prevent accidental cross-scheme reuse. |
| **0.19.0** | Store Live Logs column preferences per administrator without rewriting proxy configuration. |

## 0.18.x — Docker discovery and UI

| Version | Technical changes |
|---|---|
| **0.18.8** | Correct the explicitly disabled backend TLS verification path while retaining separate destination protection. |
| **0.18.7** | Make Response Time History collapsible by default. |
| **0.18.6** | Add live network-interface throughput and process diagnostics. |
| **0.18.5** | Break down live request-rate charts by HTTP/1.1, HTTP/2 and HTTP/3. |
| **0.18.4** | Default new backend health checks to TCP and simplify Docker agent/service and Security editors. |
| **0.18.3** | Add Docker-vhost search/hide controls, agent-assigned certificates and per-agent inventory poll intervals. |
| **0.18.2** | Secure Docker agents with HTTPS certificate fingerprint pinning; add per-Docker-vhost backend health checks. |
| **0.18.1** | Support multiple Docker host addresses, selected published IPs, multiple agents and custom service aliases. |
| **0.18.0** | Introduce a separate authenticated Docker discovery agent, automatic service observations and optional generated Docker Vhosts. |

## 0.17.x–0.13.x — platform and routing improvements

| Version | Technical changes |
|---|---|
| **0.17.0** | Add Debian package/service assets, a Grafana dashboard, broader Prometheus metrics and local-response/404 hostname support. |
| **0.16.1** | Hide internal configuration revision numbers from normal save feedback while retaining conflict protection. |
| **0.16.0** | Keep unmatched paths on the main backend when custom locations exist; improve guarded self-admin routing, WebSocket/H3 and resource diagnostics. |
| **0.15.1** | Improve visual Custom-location and header-rule editors, previews and cache/process live charts. |
| **0.15.0** | Add Nginx-style path matching/rewrite options, visual header configuration and Nagios/Icinga check scripts. |
| **0.14.0** | Correct administration Host/Origin checks behind trusted HTTPS proxies and add HTTP/3 WebSocket transport support. |
| **0.13.2** | Fix signed-in dashboard refresh; improve managed-update cache handoff and retention of certificate renewal status. |
| **0.13.1** | Add configurable 7–30 day administrator sessions and explicit risk approval for backends pointing to local listeners. |
| **0.13.0** | Add first-class Redirect hosts and local redirects; establish the omitted backend `tls_verify: false` compatibility default. |

## 0.12.x–0.10.x — API, Streams and disk cache

| Version | Technical changes |
|---|---|
| **0.12.1** | Add revisioned per-section configuration API, cache retention across unrelated settings saves and configurable COLD demotion behavior. |
| **0.12.0** | Move TCP/UDP Streams into a dedicated editor with session, traffic and active/pending listener views. |
| **0.11.5** | Add guarded TCP/UDP forwarding, Debian 13 source bootstrap and stricter-but-compatible URL path handling. |
| **0.11.4** | Fix force-HTTPS validation; add visual ACL profiles and hide cache diagnostics when a Vhost disables cache. |
| **0.11.3** | Add per-Vhost upstream client-IP forwarding control and improve Vhost search and stored access logs. |
| **0.11.2** | Correct administration HTTP/2 authority validation and add per-Vhost `308` force-HTTPS redirects. |
| **0.11.1** | Add Nginx Proxy Manager import with dry-run/conflict detection and explicit API-based apply; improve managed update health checks. |
| **0.11.0** | Add reusable ACL profiles, wildcard domains and cumulative access enforcement. |
| **0.10.0** | Introduce optional persistent COLD cache, HOT/COLD metrics, capacity controls and structured-log output presets. |

## 0.9.x–0.7.x — administration and access

| Version | Technical changes |
|---|---|
| **0.9.0** | Add structured JSONL/Logstash/Loki access-log sinks, expanded Vhost cards, cache inspection and administration HTTPS. |
| **0.8.1** | Enable the shared RAM cache by default and improve conditional/cached static behavior; Vhost and privacy rules still apply. |
| **0.8.0** | Add static-cache extension defaults, per-Vhost rate limits and GeoIP country policies. |
| **0.7.3** | Add first-admin setup token before service start, safer remote-admin opt-in and managed default HTTP/HTTPS listeners. |
| **0.7.2** | Embed offline Swagger UI assets during the build and remove runtime asset download dependencies. |
| **0.7.1** | Protect sign-in and administration routes more strictly; add authenticated `/docs`, Swagger and visual location header editing. |
| **0.7.0** | Add automated ACME renewal, safe Linux install/update rollback, Basic Auth, graphical ACLs and Custom locations. |

## 0.6.x–0.0.x — initial proxy platform

| Version | Technical changes |
|---|---|
| **0.6.0** | Unify Vhost configuration, add HTTP-01 and Cloudflare/OVH DNS-01 ACME, and introduce protected Prometheus export. |
| **0.5.0** | Add cache inspection/purge dashboard and first HTTP/3/frontend controls. |
| **0.4.0** | Add validated forwarding identity, Tinyauth protection, named multi-address listeners and HTTP/3 (QUIC). |
| **0.3.0** | Add certificate inventory/PEM upload, per-Vhost cache overrides, error pages and richer request logs. |
| **0.2.0** | Add Vhosts with multiple backends, load balancing, health checks and path policies. |
| **0.1.0** | Add persistent listeners, shared RAM cache, streaming compression and operational dashboard. |
| **0.0.6** | Improve source-upgrade safety, HTTPS origins, TLS certificates and validated backend DNS. |
| **0.0.2** | Add administrator credentials/sessions/CSRF, audit and SQLite migration support. |
| **0.0.1** | Initial HTTP/1.1 reverse proxy with streaming, SQLite configuration, access log and basic panel. |