RustProxy/docs/CHANGELOG_TECHNICAL_ARCHIVE.md

Historical developer-level changelog archive

Archived during the 0.25 documentation cleanup. This file preserves the pre-cleanup detailed release record, including compiler fixes, source refactors, regression notes and packaging details. It is historical technical evidence, not the operator-facing changelog. Use ../CHANGELOG.md for user/operator-visible release changes.

Changelog

0.25.1

0.25.1 source-split compiler follow-up

• Corrected Rust include! split regressions reported by a real cargo build: dangling method documentation in runtime fragments, an invalid inner module doc in balance/model.rs, and the missing sibling htaccess import in Web Server response headers.
• Removed the warning set reported by that build (stale imports, unnecessary mut bindings, an unnecessary returned timeout value, and unused Prometheus parameters).
• Strengthened rust_module_contracts.py so doc comments/attributes immediately before a closing brace and inner //! comments in included fragments fail preflight instead of producing a false PASS.

Source modularization and release guards

• Enforce a 500-line ceiling for Rust implementation/test source files and bounded dashboard JavaScript, Docker Agent Go and operational deployment/migration modules.
• Keep Rust tests in dedicated tests.rs / tests/ sources and Docker Agent tests in _test.go; split config, docker, Web Server, dashboard bundles, Docker Agent, deployment and NPM migration source by responsibility.
• Preserve public browser asset URLs by assembling the bounded app/vhost source fragments once inside the admin router.
• Add compiler-independent regressions for dangling Rust attributes, broken include! targets, missing Web Server htaccess/server_protocol/anyhow::Context wiring and browser split-boundary syntax.
• The package workspace still has no Rust toolchain, so cargo fmt/check/test --locked --all-targets remains a release-host gate.

0.25.0

• Add reusable Web Services with document root, index-file list and optional directory listing, managed from the new Web Server dashboard section.
• Add Reverse Proxy / Web Server source selection for vhosts and custom locations, including mixed static/proxy routing in one vhost and reuse of one Web Service by multiple vhosts.
• Add static GET/HEAD, streaming responses, MIME/length headers, directory index/redirect/listing behavior, HTTP validators and single-range requests (206/416).
• Enforce document-root confinement for Web Server paths, reject ambiguous/encoded traversal forms and prevent symlink escape by not following symlinks during Unix filesystem traversal.
• Reuse the existing vhost ACL/authentication/header/error/TLS/HTTP pipeline for local files without adding a separate router, error-page system or object cache.
• Add an authenticated Docs Reader for bundled project documentation alongside the existing API/OpenAPI view, and separate the current documentation index, release audit and open TODO material.
• Fix the 0.25 Docs Reader source embedding so compilation does not require a generated OUT_DIR/docs-content.json; Markdown sources are now direct compiler inputs and the JSON bundle is serialized from embedded strings.
• Split the 0.25 Web Server implementation from the former monolithic src/web_server.rs into the responsibility-based src/web_server/ module (config, filesystem, security, response, routing, FastCGI, dispatcher, .htaccess and tests), keeping mod.rs as the stable public facade and updating source/package gates for the new layout.
• Extend the source-layout cleanup across the Rust tree: every checked-in .rs file is capped at 500 lines, large config/docker/server/runtime/balance/prometheus/proxy/cache/admin/etc. modules are split by responsibility, unit-test bodies live in separate test files, and compiler-independent contracts reject dangling attributes/doc comments, broken include! targets and unbalanced split fragments.

0.24.10

• Keep Error File inside the existing revisioned logging configuration section while retaining its own Settings form; both access-log and error-file forms save atomically through /api/config/logging, so enabled/path/format persist without introducing a special endpoint.
• Preserve backward compatibility for historical /api/config/logging clients that send only the access-logging object.
• Keep the Error File panel free of the redundant ERROR/logrotate help sentence.
• Remove collapsing from Response time history and add an accessible information control explaining the cumulative mean metric.
• Update package/source/UI/OpenAPI/release identity to 0.24.10.

0.24.9

• Added composite Settings > Logging support for error_log.enabled, path and format while retaining legacy /api/config/logging payload compatibility.

• Removed the Error Log help sentence from the panel while keeping the existing controls and behavior unchanged.

• Fix Rust type inference for zeroizing ACME/Base64 and AEAD buffers so the new Secret Store and encrypted backup code compile with the pinned dependency set.

• Fix the secret-redaction KV regex literal so 0.24.9 compiles correctly; the redaction behavior itself is unchanged.

• Harden the built-in release checker for FreeBSD/OPNsense and other Unix platforms: supplement bundled Mozilla roots with common system CA bundles/SSL_CERT_FILE/CURL_CA_BUNDLE, follow bounded non-downgrading HTTP(S) redirects, and report failed checks as normal application ERROR events without changing dashboard behavior.

• Add a central AES-256-GCM encrypted Secret Store with private local master-key storage and migration of existing ACME DNS-provider credentials.

• Add encrypted full backup/restore with Argon2id, authenticated encryption, explicit manifests/checksums, staging validation and rollback-safe activation.

• Add an optional ERROR-only JSON/RAW file sink with bounded asynchronous writes, central secret redaction and system logrotate integration.

• Extend source/release regressions and update release identity to 0.24.9.

0.24.8

• Expand the overview Cache RAM diagnostics with HOT usage against limit, transient RAM history for total/fill/COLD queue/COLD I/O, and COLD storage occupancy against its disk budget.
• Hide the long RSS/cache accounting explanation behind an accessible information control in the Process heading.
• Keep COLD disk occupancy explicitly separate from transient process RAM accounting.
• Update release identity to 0.24.8.

0.24.7

• Make the transform temporary-memory ceiling configurable from Settings and preserve a 128 MiB default for existing configurations.
• Add a configurable process-wide transform concurrency ceiling; excess work fails open unchanged rather than waiting behind transformation work.
• Add persisted RAM saver, Recommended, Performance and Uber performance transform resource presets without changing enabled transform formats or extension allow-lists.
• Show transform-resource warnings when the selected budget cannot fit the worst-case buffers for one maximum compressed body or exceeds half of detected host/cgroup RAM.
• Add live dashboard resource accounting: current transform RAM reservation/budget and active slots, HOT/transient cache RAM, non-cache process RSS, plus COLD disk occupancy and object limits.
• Include global transform representation/eligibility settings in cache compatibility identity while excluding resource-only preset/budget/concurrency controls.
• Map bounded transform-body collection failures explicitly into anyhow::Error, avoiding the anyhow::Context trait-bound compile failure for Axum/HTTP body boxed errors.
• Clean compiler warnings in cache transient leases and CSS minification without suppressing lints: make RAII-only lease ownership explicit, keep COLD read reservations intentionally alive, and remove dead CSS state assignments.
• Extend SQLite/OpenAPI/offline memory/release regressions and update release identity to 0.24.7.

0.24.6

• Persist the selected memory and COLD cache preset identities in the SQLite-backed cache configuration and restore their selected/custom state in Settings.
• Add a Recommended COLD policy preset with bounded queue sizing and conservative demotion/GC defaults while preserving operator-selected disk path, disk budget and object limit.
• Add a 128 MiB process-wide transform temporary-memory budget, bounded body aggregation independent of claimed Content-Length, and bounded decompression growth.
• Validate/compact JSON without a full DOM tree, remove routine HTML raw-tag string allocations and avoid repeated CSS output scans.
• Cap stale-while-revalidate background work at 8 keys and proactive sleeping refresh tasks at 256; keep COLD cleanup single-flight and candidate memory proportional to the requested deletion limit.
• Bound COLD delete fallback tasks and deletion metadata, and add Rust-independent regression checks for memory/task bounds across background workers.
• Update release identity to 0.24.6.

0.24.5

• Normalize actually empty, length-unknown HTTP/3 request bodies before HTTP/1.1 upstream forwarding so Hyper emits a zero-length request instead of chunked framing for methods such as DELETE.
• Keep non-empty HTTP/3 bodies streaming by replaying the inspected first frame, leave declared Content-Length requests untouched, and do not alter HTTP/2 upstream framing.
• Add focused regression coverage for empty/non-empty H3 DELETE and generic empty H3 methods forwarded to HTTP/1.1.
• Keep the source package consistent with its existing release contracts by dropping the stale unreferenced src/system_stats/bsd.rs file and updating the offline container check to the already-shipped Debian 13/Trixie base images.
• Harden cache RAM admission without changing the HOT -> COLD storage model: HOT now has a 256 MiB allocation-aware default budget, fills reserve memory before buffer growth, and a small bounded allocator headroom replaces max-object-sized overshoot.
• Add a separate 64 MiB transient RAM budget plus a 32 MiB byte ceiling for the COLD writer queue; demoted bodies stay charged until persistence drops the ColdDraft, while persisted ColdEntry values retain only disk paths/metadata.
• Preserve body backing-allocation accounting across fill, revalidation and COLD promotion, expose HOT logical vs allocated bytes and the HOT/transient/COLD-queue limits, and add memory-pressure/LRU-admission counters.
• Make global cache disable authoritative over per-vhost enablement, remove the artificial 1 GiB HOT/object configuration ceiling, and hot-apply reduced HOT capacity with bounded LRU demotion/eviction.
• Add Settings memory sizing based on effective host/cgroup RAM with conservative, recommended and performance presets, a live recommended profile, host/cgroup headroom warnings, and controls for transient RAM, COLD queue RAM and bounded LRU admission. Automatic presets are disabled below 256 MiB effective RAM.
• Update release identity to 0.24.5.

0.24.4

• Disable Linux Transparent Huge Pages for the RustProxy process with prctl(PR_SET_THP_DISABLE) before the Tokio runtime is created, avoiding a host-wide THP policy change while preventing 2 MiB anonymous huge pages from amplifying allocator RSS retention.
• Treat the process-local THP operation as best-effort: unsupported/rejected kernels emit a startup warning and RustProxy continues to run.
• Update release identity to 0.24.4.

0.24.3

• Add a per-certificate reload operation for manual/file-backed certificate IDs and authorize it through the scoped Certificate API as well as the normal administrator session.

• Allow multiple Certificate API tokens (bounded to 32), operator comments, individual revocation and revoke-all while continuing to persist token hashes only.

• Replace the overview Core State block with a live connection/activity chart, move uptime into the Process block below process start, add RX/TX-style upload/download detail under Payload transferred, and persist per-browser hidden network-interface charts.

• Add MALLOC_ARENA_MAX=2 to managed Linux/systemd service units to reduce glibc arena growth and long-running RSS retention while retaining the environment-file override.

• Remove an identity-body copy from the transformation pipeline, remove Vec<char> plus final output-copy allocations from the JavaScript/CSS minifiers, release successful-transform temporary buffers earlier, and use a throttled malloc_trim(0) after large Linux/glibc transforms.

• Make HTTP/2 lifecycle tuning listener-scoped like HTTP/3: keep H2/H2C and H3 enablement in Settings -> Listeners, expose per-listener H2 GOAWAY/lifetime limits under HTTP connections -> HTTP/2, retain per-listener QUIC limits under HTTP/3, and link listener rows to the matching tuning page. Existing top-level http2 values remain a compatibility fallback for listeners without explicit H2 settings.

• Rename Proxy process to Process and dynamically hide unsupported process diagnostics and history charts instead of showing unknown values.

• Remove the stale, unreferenced legacy src/system_stats/bsd.rs parser file from the source package; shared library collectors remain the only BSD statistics implementation.

• Update release identity to 0.24.3.

0.24.2

• Version-only release bump from 0.24.1; no functional, configuration or protocol changes.

0.24.1

• Restore system network interface discovery and RX/TX counters after the shared-statistics refactor: use the cross-platform sysinfo::Networks API as the primary network inventory/counter source, merge systemstat as a library-level supplement/fallback for missing or partial inventory, preserve per-interface rate calculation, and stop silently truncating the interface list.
• Fix the compiler error in portable uptime collection by using the systemstat duration API correctly, and remove the now-unused Future import in the H2 server module.
• Remove RustProxy's artificial hostname-count ceilings from certificate SNI bindings, local certificate generation/import validation, ACME domain validation, vhost/redirect/404 hostnames, administration allowed hosts, host ACL policies and Docker aliases. Input validity and bounded control-plane/resource limits remain enforced.
• Replace per-BSD command/parsing statistics code with shared library collectors: systemstat for host metrics, sysinfo::Networks for network inventory/counters, and metrics-process for process metrics, using the documented dummy process fallback on targets without a native collector.
• Preserve Linux /proc and cgroup-specific details as additive compatibility metrics while using the common library API for portable host/process values.
• Add portable swap, system uptime, process virtual memory/limit, descriptor limit and process start-time diagnostics where the libraries support them.
• Add authenticated runtime metadata for platform, statistics source, resolved data directory and exact SQLite database path.
• Make local CLI data-directory discovery understand both /var/lib/rustproxy and the BSD/OPNsense /var/db/rustproxy convention.
• Move Logging into Settings -> Logging while retaining legacy /logging navigation compatibility.
• Update release identity to 0.24.1.

0.24.0

• Replace abrupt downstream H2 idle termination with a GOAWAY-based graceful shutdown that rechecks current activity and waits for accepted streams.
• Add independent H2 idle timeout, maximum connection lifetime and drain timeout settings; lifetime may be disabled with 0.
• Bound H2 draining so stalled streams cannot keep a retiring connection open indefinitely.
• Keep H2 Extended CONNECT/WebSocket streams under the same active-stream accounting and graceful drain path.
• Extract system statistics into platform backends while preserving Linux metric names, units and behavior; add native FreeBSD/OpenBSD/NetBSD sampling where available and explicit nulls otherwise.
• Add runtime platform to Proxy Process and Prometheus platform info.
• Add Settings UI/API/OpenAPI/language-pack support plus H2 lifecycle/configuration regressions.
• Reorganize Settings -> HTTP connections into HTTP/2 and HTTP/3 sub-tabs; move listener-scoped H3/QUIC enablement and limits out of the Listeners editor while preserving restart semantics and the existing listener configuration model.
• Update release identity to 0.24.0.

0.23.3

• Make external certificate deployment convergent: create missing manual certificate ids, rotate existing manual ids, no-op identical RustProxy-owned generations, and keep managed ACME ids protected from external ownership.
• Make the OPNsense os-acme-client hook reconcile on every run so RustProxy remains the source of truth and deleted/drifted external certificate entries self-heal.
• Add per-vhost Enable WebSocket legacy support for older appliance/embedded WebSocket implementations.
• Force legacy-mode WebSocket upstream handshakes to HTTP/1.1 and force the WebSocket Host to the configured backend authority and align Origin to the matching backend scheme + authority.
• Tolerate legacy 101 Switching Protocols response framing while keeping Sec-WebSocket-Accept and subprotocol validation strict.
• Add UI/OpenAPI/translations, documentation and regression contracts for the compatibility mode.
• Update package/source/UI identity and release verification contracts to 0.23.3.

0.23.2

• Add selectable 60/120/300/600-sample history windows to the Cache and Transformation live charts, with bounded per-workspace browser persistence.
• Fix rust-proxy --livelogs on HTTPS administration listeners by detecting the HTTP 308 redirect and reconnecting over TLS instead of looping.
• Pin local CLI HTTPS to leaf certificates present in the private data-dir/certs directory and reuse the HTTP/HTTPS-aware client for config and certificate CLI API calls.
• Update package/source/UI identity and release verification contracts to 0.23.2.

0.23.1

• Add default-collapsed, full-width live activity charts to the Cache and Transform workspaces.
• Plot Cache HIT/MISS/BYPASS rates for the selected scope using deltas from the existing cache runtime counters.
• Plot Transform applied/cache-HIT/skipped/error rates for the selected scope using the existing transform metrics endpoint.
• Reuse the administration dashboard SVG/grid/legend visual language, keep the existing 3-second live refresh, and add English/Polish language-pack labels.
• Update package/source/UI identity and release verification contracts to 0.23.1.

0.23.0

• Bound inactive inbound HTTP/2 connections to five minutes so idle TLS/H2 sessions cannot accumulate indefinitely toward the process connection limit; export rust_proxy_http2_active_connections for direct diagnosis.
• Account hot-cache response-body backing allocation capacity rather than only visible body length, preventing BytesMut growth slack from bypassing the configured RAM budget and under-reporting resident cache memory.
• Fix the --livelogs stdin reader to send owned String values from the match body rather than a pattern guard, resolving Rust E0507 during binary compilation.
• Add a scoped external Certificate API credential managed from a new Settings → Certificate API tab. RustProxy stores only the token hash plus a non-secret Key ID; the cleartext token is returned only on rotation.
• Allow the scoped Key ID + Bearer Token only on POST /api/certificates/deploy and POST /api/certificates/reload, require HTTPS for non-loopback token use, track last use, support immediate revoke, and retain normal administrator-session/CSRF access as an alternative.
• Keep production certificate operations available directly from the installed binary (rust-proxy tls deploy / rust-proxy tls reload) without requiring dev.sh.
• Add rust-proxy --livelogs: an interactive varnishlog-style all-vhost live access stream with structured filters (host, vhost, backend, route, client, method, transport, cache, status classes, path prefix, errors and slow requests), pause/resume, per-request JSON inspection and detailed error/WebSocket/H3/cache fields.
• Back live logs with a bounded non-blocking broadcast stream and authenticated SSE endpoint; slow consumers receive an explicit gap event with the dropped-entry count instead of silent loss.
• Split the large Settings → Cache form into General, Resilience, Cold cache, and Static & diagnostics sub-tabs while retaining one atomic cache-policy save.
• Add SQLite schema v5 for the scoped certificate credential, OpenAPI/security schemes, UI translations, audit events and 0.23.0 regression/release documentation.

0.22.3

• Add downstream HTTP/1.1 Upgrade: h2c on listeners that explicitly enable cleartext HTTP/2, preserving the existing prior-knowledge path and rejecting malformed/body-bearing upgrade attempts before protocol switch.
• Reconstruct the accepted H1 upgrade request as HTTP/2 stream 1 and hand subsequent framing/streams to the existing Hyper H2 server path; include raw-TCP interoperability regression source.
• Add authenticated POST /api/certificates/reload and tls reload to re-read configured public certificate/key files and hot-publish a fresh TLS/H2/H3 snapshot without changing the desired configuration revision.
• Add tls deploy --id ... --cert ... --key ... and authenticated POST /api/certificates/deploy for externally issued local certificates such as Certbot. The CLI performs bounded local reads while the running service owns pair/SAN validation, immutable generation staging, revision-CAS publication and rollback on failure, avoiding root-owned staged PEMs when Certbot hooks run as root.
• Keep all vhosts assigned to one manual certificate id synchronized during external rotation; reject RustProxy-managed ACME ids to avoid dual renewal ownership and report the administration-TLS restart caveat explicitly.
• Add Certificates-panel reload UX, OpenAPI contracts, audit events, translations and 0.22.3 audit/test documentation.

0.22.2

• Fix the 0.22.2 backend diagnostics build failure by replacing the oversized recursive serde_json::json! member payload with explicit serde_json::Map construction; the administration JSON schema is unchanged.
• Add bounded replay-safe backend failover retry for body-free GET/HEAD/OPTIONS requests, including retry policy controls, passive-health integration, logs and per-backend retry counters.
• Correct ordinary explicit-HTTP/2 upstream requests and add a real Hyper h2c prior-knowledge regression path.
• Add per-backend request-concurrency limits with bounded capacity waiting, 503 rejection and capacity/queue-timeout metrics. This limits full proxy exchanges, not TCP socket count.
• Add detailed upstream failure classes, last failure detail/timestamp, and backend health ejection/recovery timestamps to runtime diagnostics and Prometheus.
• Expand the backend administration table with concurrency capacity, last failure and last recovery columns.
• Parse public X.509 leaf metadata for issuer, SANs, validity, remaining days and expiry warning state, and surface ACME renewal status/last attempt/error in certificate inventory.
• Extend OpenAPI, language packs, source regressions, audit/TODO and release documentation for the expanded 0.22.2 scope.

0.22.1

• Vhost UX: replaced separate WebSocket/H2 RFC 8441/H3 RFC 9220 checkboxes with one transport selector; H2/H3 modes keep HTTP/1.1 Upgrade as an explicit fallback and unavailable transports are disabled from listener capabilities.

• UI polish: replaced the overview TLS listener tile with compact HTTP protocol and WebSocket protocol mini charts; Target and Cache key/tags cells remain copyable with full values.

• Keep the overview metrics in one shared stats grid so the WebSocket/H2/H3/TLS row uses exactly the same card geometry as the primary metrics, without a transport-specific dashboard layout. Make Cache Target and Cache key / tags cells copy their full untruncated value on click/keyboard activation.

• Polish the 0.22.1 administration UI: move Active tunnels into the WebSocket dashboard card, flatten the H1/H2/H3 tunnel breakdown to match the standard transport-card styling, and align Cache modal close actions with the vhost modal header pattern.

• Fix Rust ownership in tunnel registration by releasing the client-IP mutex guard before moving the shared exchange into the active tunnel, and remove an unnecessary mutable H2 upstream reader binding.

• Move selective cache PURGE/BAN and the active BAN list into dedicated Cache modals, keep their launch actions beside Purge selected scope, and use null-safe inline operation feedback consistent with login errors.

• Add opt-in RFC 8441 WebSocket Extended CONNECT for HTTP/2, with per-vhost controls beside RFC 9220, listener-scoped SETTINGS advertisement, H2-to-H1 bridging, explicit H2 upstream forwarding, cancellation/idle timeout and transport-specific metrics.

• Add opt-in cleartext HTTP/2 prior-knowledge (h2c) listeners. Legacy HTTP/1.1 Upgrade: h2c remains deliberately unsupported because the current Hyper integration cannot safely reconstruct the required HTTP/2 stream 1 bootstrap.

• Add stable active-tunnel IDs, authenticated tunnel inventory/kill API, operator-supplied close reasons, audit records, RX/TX/duration metadata and an administration modal.

• Consolidate active WebSocket/tunnel visibility on the main dashboard as total plus H1 / H2 RFC 8441 / H3 RFC 9220 counters while retaining ordinary H2/H3 request statistics separately.

• Preserve Accept-Ranges from origins and synthesize it only for RustProxy-generated cached range responses; transformed/compressed representations continue to remove incompatible range advertising.

• Update source/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.22.1.

0.22.0

• Fix a Rust ownership regression in the upstream request path: retain a cloned origin URI for proactive refresh after the request URI is assigned.
• Add per-cache-key request collapsing for foreground MISS/fill traffic with bounded wait, configurable timeout fallback, cancellation-safe leader release and collapse metrics.
• Add single Range: bytes=... handling from complete cached objects, including 206, 416, Content-Range, Accept-Ranges and If-Range; multipart/unsupported ranges remain origin pass-through and are not cached as separate objects.
• Extend stale-if-error with configurable transport failure classes and an explicit 5xx status allowlist while preserving the previous default behavior.
• Add bounded proactive cache refresh with pre-expiry scheduling, deterministic sampling, concurrency limits and reuse of the existing validator revalidation path.
• Add selective cache PURGE by exact URL, prefix, tag, regex or cache key, including query/Vary handling, RAM + Cold Cache invalidation and a publication barrier preventing pre-PURGE fills from republishing stale data.
• Add lazy BAN rules with lookup-time enforcement, bounded rule count/TTL, incremental garbage collection, rule deletion and metrics.
• Add authenticated administration API and Cache panel controls for PURGE/BAN, broad-operation confirmation, per-object Purge URL actions, BAN listing/removal and audit entries.
• Extend cache diagnostics, OpenAPI, translations and regressions for the 0.22 cache behavior.
• Update package/source/UI/OpenAPI/Debian/Grafana/tooling identity to 0.22.0.
• Preserve the resolved dependency graph; compiler/live acceptance remains an explicit release-host gate when Cargo/Rust are unavailable in the packaging workspace.

0.21.0

• Fix browser refresh on the dedicated Transform route by serving the dashboard document at /transform and covering it in the panel-route regression.

• Align the Cache Transformed marker with the dashboard geometry by replacing the capsule outline with the standard badge border and a 3px corner radius.

• Give the Live traffic Transformed series a dedicated violet chart token in dark/light themes so it remains distinct from HTTP/2 green.

• Add a dedicated Transform administration workspace with global/per-vhost runtime counters for applied/skipped/error transformations, transformed cache HITs, byte savings, reduction, transform time, kind breakdown and bounded skip reasons.

• Add a transformed-response series to Live traffic (fresh transformations plus transformed cache HITs) and render Core state uptime in compact human-readable units.

• Rename the proxy-owned backend timing diagnostic to X-RustProxy-Backend-Time; the legacy lookalike X-Rust-Proxy-Backend-Time is stripped but is no longer emitted.

• Fix Docker-vhost Passive Backend Health checkbox sizing so enabling the expanded editor cannot make fields overlap.

• Remove the unused mutable origin binding from the background revalidation path.

• Replace the monolithic src/cache.rs with the responsibility-based src/cache/ module (model, lifecycle, cold storage, dashboard, tickets, lookup, policy, fill and tests) and update source/package gates for the new layout.

• Fix the cache split so method groups are emitted from module-scope include! files wrapped in their own impl Cache blocks; this avoids the Rust compiler error caused by include! directly in impl-item position.

• Persist transformed-representation metadata through hot/Cold Cache, mark transformed objects in the Cache dashboard, and append transformed to standardized RFC 9211 Cache-Status diagnostics; origin X-Cache-Status lookalikes are stripped rather than emitted.

• Shard Cold Cache storage and add bounded asynchronous garbage collection plus selective manual cleanup.

• Add RFC 5861 stale windows, request max-stale, age-aware request max-age=N, and correct must-revalidate / proxy-revalidate behavior while preserving s-maxage priority.

• Harden transformed cache fills so transformed Content-Length is authoritative, incomplete streams cannot publish partial objects, and canonical transformed identity representations do not fragment on origin Vary: Accept-Encoding.

• Add the static-response transformation pipeline before cache/client compression, with strict no-transform, separate origin/representation validators and JS/CSS plus optional conservative HTML/SVG and parsed JSON transforms.

• Keep route cache overrides tri-state and add effective route/cache/transform diagnostics.

• Make Passive Backend Health explicit opt-in (default OFF) for ordinary and Docker vhosts, independent from active TCP/HTTP health, with per-error-class policy, separate counters and persisted Docker assignment settings.

• Extend administration UI/OpenAPI and regression coverage for Cold Cache cleanup, transform settings, passive health and cache semantics.

• Keep release/package/UI/OpenAPI/Debian/Grafana/tooling identity at 0.21.0.

• Close the 0.21.0 feature scope for release packaging. Parser-backed JS/CSS minifiers are deferred; compiler/live acceptance still has to be executed on a Rust-enabled release host.

0.20.0

• Rebuild Certificates into Installed / Renewal / Generate tabs using the same accessible keyboard tab pattern as Settings.
• Keep certificate issuance, PEM import and existing-file registration inline in the Generate tab; successful imports and edits return to Installed.
• Add explicit ACME operation state cards and include the exact private Certbot log directory in failed issuance/renewal messages.
• Expose per-managed-certificate Certbot log directories from the authenticated ACME status endpoint so persisted renewal failures remain actionable after refresh/restart.
• Rework renewal entries into readable cards with provider/environment, last check, next check, expiry and grouped actions.
• Update release/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.20.0.

0.19.4

• Align the Docker-vhost Aliases editor with the standard 38px Docker form controls and remove the inherited host-chip-field label margin that created an extra visual line below Aliases.
• Preserve backend traffic display semantics: idle renders as 0.0 KiB/s, and positive rates below 0.1 KiB/s render as <0.1 KiB/s in both backend rows and aggregate vhost traffic.
• Add a presentation filter to Cache -> Domains and effectiveness with All / Cache enabled / Cache disabled choices, using each vhost's resolved cache settings while leaving aggregate statistics unchanged.
• Update release/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.19.4.

0.19.3

• Fix the compiler error in the release checker body collector by converting Hyper/http-body-util boxed collection errors explicitly into anyhow::Error instead of calling anyhow::Context on an unsupported boxed error type.
• Simplify the dashboard footer to API latency and dropped-log count, and add a fail-soft built-in release checker using embedded UPDATE_CHECK.toml defaults. The checker reads the official Cargo manifest immediately and then hourly, exposes a newer-version link in the footer, and never performs automatic upgrades.
• Allow runtime release-check overrides through --update-repository-url, --update-version-url and --update-check-interval-secs (plus matching RUST_PROXY_* environment variables); interval 0 disables checks.
• Fix the remaining oversized Live Logs column checkboxes by excluding checkbox/radio inputs from both broad .log-tools input text-field sizing blocks that were overriding the shared 15px checkbox rules.
• Add an account-scoped light/dark administration theme stored in the existing SQLite admin_preferences document; dark remains the default and the last authenticated choice is cached locally only to avoid login/dashboard first-paint theme flicker.
• Refactor theme-sensitive UI colors into shared CSS variables and keep checkbox/radio controls out of generic text-input sizing/density rules.
• Rework the Live Logs column picker into a compact scrollbar-free list with standard-size checkboxes; short viewports use two columns instead of an internal scroll area.
• Keep expired-session re-authentication on the exact panel and Settings sub-tab, use the minimal public login document without flashing the authenticated shell, and show embedded login errors inline instead of as global toasts.
• Canonicalize the legacy /configuration shortcut to /settings?tab=manual-config and keep later Settings tab switches in the URL so F5 restores the exact page.
• Add one shared saving-state helper for settings/security/certificate forms: disable the active submit button, show Saving…, restore its translated label, and prevent duplicate submissions while a save is in flight.
• Highlight and focus the actual invalid control for local validation failures in Logging JSON, named listeners, Docker-agent listener selection, TLS policy, ACL profiles, manual JSON and certificate forms.
• Preserve selected certificate/key files after a failed certificate import/save so the administrator can correct the problem without reselecting both files.
• Mark Settings tabs with a subtle unsaved-change dot, including Manual config, and keep dirty values from being overwritten by live config refreshes.
• Update release/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.19.3.

0.19.2

• Restore the vhost local-listener risk control for administration backends when the administration socket is startup-locked or otherwise reported only by live status; treat localhost, 127.0.0.0/8 and ::1 as equivalent loopback forms for the same administration port.
• Make Discard changes reload the persisted vhost being edited instead of replacing the editor with a new blank/default vhost.
• Add descriptive HTTP reason phrases to the default-response status selectors and headings.
• Add a temporary, continuously updated 4096-entry Live-log buffer that resets when the log window closes.
• Align inline checkbox labels and compact Docker-vhost alias controls.
• Stop backend traffic EWMA tails on an idle sampling window, show idle consistently as 0.0 KiB/s, and render positive sub-0.1 KiB/s traffic as <0.1 KiB/s instead of a rounded zero.
• Make the Live Logs column picker substantially smaller with subtle 11px checkboxes; let the menu escape the log-dialog clipping boundary and open upward on short viewports.
• Default newly created vhosts to the standard HTTP :80 listener when available; HTTPS listeners are selected explicitly.
• Left-align the Settings -> Docker agents save action to match the other settings forms.
• Suppress dashboard/login first-paint flicker and preserve the active Settings sub-tab across F5, including a re-login redirect back to /settings?tab=... and /docker-vhosts.
• Replace native browser confirmations with application-styled confirmation dialogs and add panel-area context to API error messages.
• Present login failures as an inline styled error below the form, including invalid-credential responses.
• Install a login-shell PATH profile for the managed current release directory on first install; updates check and warn about the profile without changing it.
• Enforce no-store and suppress cache diagnostics/validators for local placeholder/static/default pages.
• Allow vhost-ID renames with duplicate protection, confirmation and an explicit runtime-identity warning.
• Update source, UI, OpenAPI, regressions and package identity to 0.19.2.

0.19.1

• Fix Default responses section saves by passing the normal {expected_revision, value} payload to /api/config/pages and add server-side pages section handling/regression coverage.
• Add frontend scheme to the primary cache hash so otherwise identical HTTP and HTTPS requests cannot reuse one object.
• Retain 4096 completed access-log entries while keeping the 256-entry live window; add one-shot on-demand history loading and document the API limit.
• Render backend traffic with KiB/s as the minimum unit, simplify the Live Logs column picker, align generic checkboxes and move Docker-vhost Advanced switches beside Backend protocol on desktop; remove the redundant alias help line.
• Remove stale simulated dashboard screenshots, retain only two explicitly labelled legacy references and add a documentation index for historical/version-labelled material.
• Restore the integration-test sources and independent Argon2id fixture required by release/source checks so compiler-enabled test builds no longer reference files missing from the supplied source archive.
• Update source, UI, OpenAPI, regressions and package identity to 0.19.1.

0.19.0

• Persist per-administrator Live Logs column visibility in SQLite schema v4 without changing the revisioned proxy configuration; JSON export remains complete regardless of visible columns.
• Keep the Live Logs column selector visually consistent with the existing compact check vh-check controls instead of rendering oversized standalone checkbox widgets.
• Add authenticated GET/PUT /api/preferences endpoints for dashboard-only account preferences, protected by the existing session/CSRF control-plane guards.
• Remove the duplicate version badge from the top-right dashboard toolbar while keeping the footer release identity.
• Retain the full disabled-verification legacy X.509 fix and expanded upstream connector diagnostics introduced during the 0.18.8 follow-up.
• Update release/package identity to 0.19.0.

0.18.8

• Make backend tls_verify=false a complete certificate-authentication bypass instead of delegating TLS CertificateVerify to webpki. This restores compatibility with legacy appliance certificates such as X.509 v1 while keeping TLS encryption and all backend address/DNS/loop protections in force; tls_verify=true is unchanged.
• Expand upstream connection diagnostics with the full nested Hyper/rustls/io error chain, backend/TLS context, 2 KiB UTF-8-safe detail storage and warning-level journal entries for connect failures.
• Replace Docker-vhost alias comma input with hostname-style chips for add/remove/paste workflows.
• Add per-Docker-vhost HTTP-to-HTTPS redirect, WebSocket and cache controls; new compatible assignments default HTTP-to-HTTPS redirect on while legacy assignments retain their prior redirect-off behavior until explicitly saved.
• Align Docker-vhost boolean controls with the application's standard checkbox classes and keep checkbox inputs from inheriting full-width text-input sizing.
• Add a Docker-agent default ACL-profile selector. Generated Docker vhosts inherit it unless the application selects its own ACL profile; existing per-app inline ACL configuration is unchanged.
• Remove the compression-codec negotiation explainer from the Overview dashboard.
• Update release/package identity to 0.18.8.

0.18.7

• Collapse Response time history by default on the Overview dashboard while keeping live sampling active.
• Restyle per-interface RX/TX histories to use the same chart geometry and visual treatment as the aggregate RX/TX history, without nested panel backgrounds.
• Align expanded Docker-vhost routing and ACL controls with uniform field blocks; Preserve Host and per-app ACL switches now occupy the same label/control rhythm as neighboring inputs, and ACL selects no longer stretch to textarea height.
• Update release/package identity to 0.18.7.

0.18.6

• Add bounded per-interface RX/TX diagnostics from /proc/net/dev to the administration status payload and render separate live interface histories without adding per-interface Prometheus labels.
• Strengthen compression negotiation regressions with explicit q= preference cases for gzip, Brotli, Zstd and deflate; clarify that dashboard counters track the codec actually selected per response.
• Align Docker-agent settings inputs/actions, keep Enabled/status/remove controls on one stable row, and add spacing between listener selection and the Add Docker agent action.
• Update release/package identity to 0.18.6.

0.18.5

• Make compression accounting follow an explicit RustProxy-applied codec marker instead of re-reading Content-Encoding; add independent gzip/br/zstd/deflate counter regression coverage.
• Add an explicit HTTP/1.1 request counter and render total + HTTP/1.1 + HTTP/2 + HTTP/3 request-rate series on the Overview chart.
• Add an Open app action to published Docker vhosts, using the assigned frontend listener and expanded proxied hostname.
• Label Docker-generated pools in the Backends view with their primary proxied domain.
• Remove the global Open proxy shortcut from the page header.
• Make Compact density materially tighter than Dense across cards, controls, tables, Docker rows and charts.
• Default vhost/Docker proxy timeout controls to explicit 10/120/60/60-second connect/header/read/send limits instead of blank inherited values.
• Replace free-form Docker-agent listener-ID entry with the configured named-listener selector; move Enabled left of the centered connection-status badge.
• Update release/package identity to 0.18.5.

0.18.4

• Default backend health checks to TCP for newly created or otherwise defaulted ordinary and Docker vhosts; explicit existing HTTP/off health modes are preserved.
• Replace the dense Docker-vhost service editor with summary-first rows. Publish state, service identity, backend runtime health and Hide/Show stay visible; routing, ACL, timeouts and health tuning are expanded only for the selected service.
• Collapse secondary Docker-agent inventory metadata behind Agent details while keeping host, service count, last observation and base domain immediately visible.
• Rework Settings -> Security into focused account/session and host-policy cards with on-demand password and policy editors.
• Move Administration audit into a dedicated modal and stop fetching audit entries merely by opening the Security settings tab.
• Update release/package identity and EN/PL UI copy to 0.18.4.

0.18.3

• Add Docker-vhost search plus persistent per-browser Hide/Show Hidden view controls, and allow each Docker agent to select a configured frontend certificate inherited by its generated vhosts.
• Keep Docker inventory polling driven by each agent's configured 5..3600 second interval; the 5-second dashboard refresh reads cached observations only.
• Move redirect HTTP/2 and HTTP/3 toggles below listener selection and keep Cache Updated + Live together at the right side of the toolbar.
• Remove the unused config::yes helper warning.
• Add an Open-in-browser action beside each vhost Enabled state; wildcard-only hosts open the wildcard base domain, while mixed host lists prefer the first non-wildcard name.
• Restore the documented HTTP/1.1 backend default for newly created ordinary and Docker vhosts: preserve the public Host; existing explicit backend settings are not rewritten.
• Write HTTP/1 upstream header names in conventional title case for compatibility with legacy/custom origins that incorrectly treat header names as case-sensitive; HTTP/2 is unaffected.
• Add bounded upstream_error diagnostics to access logs/live logs so TCP/TLS/HTTP-client failures that previously appeared only as 503 with no upstream status can be distinguished.
• Restrict local/error response selectors to supported error statuses; application-style 404 hosts offer only bundled 401/403/404/429/503/504 templates, including a new dedicated 404 template.
• Make Docker Publish/Unpublish an immediate per-service configuration action, add per-service Apply, and replace unconditional UI rerendering with an operator-controlled Live view that reads only RustProxy's in-memory state.
• Add per-agent Docker inventory polling intervals (5..3600 seconds), while manual refresh still polls immediately.
• Add reusable ACL-profile plus inline IP/CIDR ACL controls per Docker application, and protect referenced profiles from deletion.
• Add per-vhost proxy connect/response-header/read/send timeout controls for ordinary and Docker-backed vhosts.
• Print the Docker-agent bearer token after installation alongside the certificate fingerprint.
• Improve 404 Hosts response UX with supported error-status selectors, application-style built-in status pages, cache-diagnostic suppression and protocol toggles beside listener selection.
• Add optional per-vhost JSONL access-log files under a configurable directory while retaining the combined-file mode, Logstash and Loki sinks.
• Lock HTTP/HTTPS/admin listener addresses that are supplied explicitly by systemd/CLI/environment so the control plane cannot remove, disable or rewrite process-owned binds; listeners not supplied at startup remain editable.
• Remove the separate remote-admin risk-acknowledgement requirement; plain remote administration now requires only --allow-remote-admin, while legacy --accept-remote-admin-risk is accepted as a hidden no-op so older systemd units still start.
• Tighten Compact/Dense dashboard density, rename the Shared RAM cache surface to Cache, expose redirect targets directly on cards, and keep 404 Hosts aligned with the application error-code set.
• Clarify that TLS Policy is inherited globally and show currently effective cipher suites alongside all available rustls suites.
• Treat ACME-issued certificates as managed/read-only in the custom-file editor, require certificates to be unassigned (including the administration panel/default binding) before deletion, and default new ACME issuance to the production CA environment.
• Make classic HTTP/1.1 Upgrade the default WebSocket path; RFC 9220 Extended CONNECT over HTTP/3 is now an explicit experimental per-vhost opt-in and is advertised only on QUIC listeners with an opted-in vhost.
• Split Docker discovery/vhost observability into dedicated rust_proxy_docker_vhost_* and rust_proxy_docker_backend_* Prometheus metric families; Docker pools no longer appear in ordinary vhost/backend series.
• Add a separate live Docker vhosts Prometheus collector group, enabled by default, with configured agent/assignment/domain gauges plus Docker vhost traffic/status/duration and full backend health/probe/runtime metrics.
• Extend Prometheus/OpenAPI/UI documentation and regression coverage for the Docker metric boundary.
• Extend the bundled Grafana operations dashboard with a dedicated Docker-vhost section and per-agent/service filters using only the separate Docker metric families.
• Fix Docker discovery compilation against the locked HTTP/body stack by mapping limited-body collection errors explicitly and logging ApiError via its Debug representation.

0.18.2

• Secure Docker-agent transport by default with a persistent self-signed ECDSA certificate and SHA-256 certificate pinning in RustProxy; public-CA HTTPS remains available without a pin and plain HTTP is compatibility-only.
• Add certificate lifecycle helpers, hardened systemd state storage, installer fingerprint output and TLS regression tests for the standalone Docker agent.
• Enable per-Docker-vhost HTTP/TCP backend health checks using the same bounded backend-pool health machinery as ordinary vhosts, with live checking/up/down, latency, probe, request, active and error diagnostics in Docker vhosts.
• Rework Docker-agent and Docker-vhost UX around connection security, last observation, detected addresses, route controls and collapsible health-check tuning while retaining per-agent domains, aliases and per-service IP selection.

0.18.1

• Extend the Docker agent inventory with all usable host addresses (interfaces, routed address, public lookup and optional advertised address) and preserve every published binding per service.
• Add per-service Docker backend-IP selection, per-agent default backend IP, arbitrary FQDNs and multiple aliases while retaining short-name expansion below each agent's own base domain.
• Support many Docker agents with independent domains such as docker1.lab.local and docker2.lab.local, plus operator-controlled custom domains.
• Remove all special X-Rust-Proxy-Revision response-header behavior; the name is no longer inserted, stripped, protected or accepted as a legacy diagnostic setting.
• Keep cache-Live placement, production password recovery and Settings navigation improvements from 0.18.0.

0.18.0

• Add a standalone Go Docker discovery agent with a hardened systemd unit, token authentication, published TCP-port inventory and host/public-IP detection.
• Add per-agent Docker configuration, in-memory observations and dynamic Docker vhosts with operator-controlled service/subdomain assignments.
• Add Docker vhost/admin UI and OpenAPI endpoints for cached observations and explicit refresh.
• Move the cache Live toggle to the action-toolbar edge.
• Remove configurable X-Rust-Proxy-Revision response exposure and always strip the header.
• Use the installed rust-proxy admin reset-password command in production recovery guidance.
• Update EN/PL strings, documentation, release checks and package identity to 0.18.0.

0.17.0

• Add Debian packaging assets, a hardened systemd unit, rustproxy service user/state/log directories, three-day maximum-gzip log rotation, local .deb build tooling and signed APT-repository generation suitable for rustproxy.linuxiarz.pl.
• Expand Prometheus coverage across all current bounded process/OS diagnostics plus GeoIP, certificate renewal, backend health-probe detail, stream, logging and frontend inventory metrics; add explicit token-free scraping for trusted actual-peer CIDRs.
• Add a Grafana operations dashboard under grafana/.
• Add dedicated listener/certificate-aware local-response / 404 hosts with built-in placeholder, empty/status-only and custom-HTML modes.
• Keep the default RustProxy is running placeholder uncacheable and intentionally free of optional proxy/cache/backend/diagnostic/security/compression headers.
• Reuse vhost-style hostname chips for Redirect source domains.
• Update OpenAPI, EN/PL UI, release checks and package identity to 0.17.0.

0.16.1

• Remove internal configuration revision numbers from successful save feedback in dashboard editors/manual configuration while retaining revision-based CAS and stale-write protection internally.
• Update source, UI, OpenAPI, release tooling and packaging identity to 0.16.1.

0.16.0

• Decouple Custom locations from the main vhost backend fallback. Unmatched paths now use the main pool even when custom rules exist; untouched legacy synthetic root routes are normalized automatically.
• Fix same-process public administration login by allowing rustproxy_session across only a guarded HTTPS self-admin backend that directly targets the configured administration listener and whose public host is explicitly allowed.
• Make RFC 9220 bootstrap wait for the backend HTTP/1.1 upgrade before downstream H3 success, and extend access logging with transport/WebSocket phase/error/reset/upstream status diagnostics.
• Add cache transient-memory gauges and procfs RSS/data/swap breakdowns to the dashboard and Prometheus. Existing allocator trimming/release behavior is unchanged; no new transient-memory throttle is introduced.
• Reorganize the Vhost editor around clearer backend cards, Authentication subcards and compact protocol controls. New vhosts select standard HTTP :80 plus HTTPS :443 together when available; Redirects reuse the same listener selector; disabled vhost cache hides its subordinate controls and new vhost drafts default cache to off.
• Show the local-listener risk acceptance only when the entered backend URL directly targets the configured administration listener. Add protected opt-in X-RustProxy-Backend and X-RustProxy-Backend-Time response diagnostics for selected member identity and origin response-header latency.
• Bump source, UI, OpenAPI and packaging identity to 0.16.0.

0.15.1

• Fix Custom locations EN/PL translation loading by keeping all UI strings inside the language-pack translations map and add a regression check that rejects stray top-level translation keys.
• Make visual header rules easier to edit with numbered cards, clear field grouping, empty-state guidance and localized help.
• Add a live per-location behavior preview for matching, action, rewrite, cache, ACL and header rules, and reorganize the inline documentation with common examples.
• Add one live three-series HIT/MISS/BYPASS activity chart to the RAM cache card and CPU/RSS history charts to the Proxy process card.
• Extend offline source/release checks for the new location UX and dashboard charts; package identity is 0.15.1.

0.15.0

• Expand vhost Custom locations with Nginx-style exact/prefix/^~/regex/regex-insensitive matching, upstream path preserve/strip/replace/regex rewrites and backend-free custom responses.
• Replace the location header JSON-only workflow with a visual request/response header builder, keep Advanced JSON as an escape hatch, add in-panel documentation and reorganize the location editor into compact functional sections.
• Add nagios/ API checks for administration response time, unavailable/checking backends, backend latency and dropped logging/cold-cache work, with reusable protected session cookies and Nagios performance data.
• Move per-vhost Server-Timing and verified Cloudflare client-IP diagnostics into the main frontend/details configuration.
• Add compact dashboard history charts for RAM-cache residency, network RX/TX and mean response latency, plus administration API RTT and low-priority queue/drop information in the footer.
• Add independent cold-cache age policy controls: demote by time since last access, by total hot-tier residency, by LRU pressure and on graceful shutdown.
• Add verified effective client/source IP to live logs and logging field mappings; early responses still record at least the transport peer.
• Remove the runtime legacy renewal-observation JSON importer. Stopped source upgrades remove the obsolete sidecar as the final upgrade step without importing it or retaining a second legacy copy; SQLite remains the only live renewal-observation store.
• Normalize repeated literal path separators for routing/ACL decisions, matching Nginx merge_slashes behavior, while preserving the original request target to the backend when no rewrite is configured. URLs such as /static/js//events.js?v=... are therefore accepted without weakening encoded-separator/dot-segment protections.
• Bump source, panel, OpenAPI, upgrade tooling and package identity to 0.15.0 and extend offline regression contracts for the new controls.

0.14.0

• Fix administration reverse-proxy Host/Origin handling: explicit DNS allowlist entries describe the external authority instead of the private admin socket port; direct IP/localhost access remains bound to the actual admin port.
• Trust forwarded administration host/scheme only from loopback or configured trusted proxy peers, use the external scheme for Origin/CSRF checks, and set/clear Secure session cookies consistently behind HTTPS termination.
• Implement RFC 9220 WebSocket over HTTP/3 Extended CONNECT, including SETTINGS_ENABLE_CONNECT_PROTOCOL, :protocol=websocket validation, HTTP/1.1 backend Upgrade translation, downstream 200 bootstrap, bidirectional H3 DATA transport and FIN/reset cancellation handling.
• Replace the separate h3/h3-quinn pair with hpx-h3 2.5.19 and its integrated Quinn feature to expose the RFC 9220 protocol extension through the HTTP/3 stack.
• Rename dashboard backend, health, security, error-page and recommended-preset labels in English and Polish.
• Update release/static checks, HTTP/3 documentation and package identity. The source contains no certificates.json certificate metadata path.

0.13.2

• Fix authenticated dashboard refresh/back-forward session restoration so valid cookies are honored on every panel document route instead of briefly rendering the login shell.
• Make managed software updates force a bounded hot-to-cold cache handoff whenever the cold tier is enabled, independent of the ordinary cold_on_shutdown preference, and extend the managed systemd stop budget.
• Persist non-secret automatic-certificate-renewal observations in SQLite schema v3, preload them before administration listeners are exposed, and import the older certs/renewals.json sidecar once for upgrade continuity.
• Move the raw full-document editor from primary navigation into Settings -> Manual config while retaining /configuration as a compatibility browser route.
• Update OpenAPI, EN/PL help, cache/renewal/API documentation, migration/backup checks and release identity for 0.13.2.

0.13.1

• Make administrator browser sessions configurable from 7 to 30 days (30 days by default), replacing the previous short browser lifetime/idle behavior while preserving explicit logout/password/revoke invalidation.
• Refresh authenticated cookies only to the remaining absolute server-side expiry so session persistence cannot become an unbounded sliding session.
• Add per-backend accept_local_listener_risk with a dashboard confirmation and validation path for deliberate local-listener targets such as 127.0.0.1:9090; allow_private and special-address protections remain independent.
• Update OpenAPI, transport/security/admin-session documentation, EN/PL strings and release regressions for 0.13.1.

0.13.0

• Add first-class redirect hosts with dedicated dashboard navigation, named listeners/certificates, exact/prefix and scheme matching, URL/host/path targets, 301/302/303/307/308, path/query policies and redirect cache controls.
• Resolve redirect traffic locally before proxy routes while preserving listener ownership and global host ACLs.
• Change omitted backend tls_verify to default false and update UI/API/documentation accordingly.
• Compact TLS certificate cards: show DNS SAN coverage as the same policy-style badges used on vhosts, collapse bindings/files/assigned-vhost details, and inspect older/manual public PEM files when persisted coverage metadata is missing.
• Extend OpenAPI, English/Polish translations, regressions and release tooling for 0.13.0.

0.12.1

• Add revisioned per-section configuration PUT endpoints and move ordinary dashboard forms to them, retaining full-document updates only where multiple sections must publish atomically.
• Decouple cache compatibility from the SQLite configuration revision so logging, administration, TLS inventory, metrics and other unrelated saves do not purge hot/cold objects.
• Add explicit dashboard subpage routes plus History API navigation so browser refresh preserves the selected panel.
• Add independent cold-tier policies for idle objects, LRU evictions and graceful shutdown, reduce the cold-write body queue, flush remaining hot objects before process exit, and trim released allocator memory on glibc/Linux.
• Expose certificate DNS SubjectAltName coverage separately from active SNI bindings for uploaded and ACME-managed certificates.
• Preserve secure-by-default backend TLS verification when omitted; keep the explicit debug-origin verification bypass and improve corrective validation/help text.
• Extend regression/OpenAPI/release checks and bump source/package identity to 0.12.1.

0.12.0

• Move raw TCP/UDP stream management from Settings to a dedicated Streams main-navigation page directly below Vhosts.
• Add vhost-style searchable stream cards and a modal editor with Details, Listener & upstream, and Limits tabs plus an explicit Add TCP/UDP listener action.
• Add fixed-cardinality runtime telemetry per active stream: connections/sessions, completed sessions, active sessions, rejects, errors, RX/TX bytes and UDP packet counters.
• Add per-stream live RX/TX rate charts in the dashboard while keeping desired stream changes visibly pending until the process restarts and the listener is actually active.
• Change named HTTP/HTTPS listener bind-address editing from a textarea to chip-style addresses matching the Vhost hostname interaction, preserving existing multi-address validation.
• Keep stream forwarding as raw Layer 4 with no HTTP vhost, ACL, cache, headers, compression or authentication envelope.
• Extend authenticated-asset and offline release/source regressions for the new Streams page and telemetry contracts; bump Cargo, panel, OpenAPI and upgrade/package identity to 0.12.0.
• Extend the Debian 13+ one-line bootstrap with auto/install/update modes; managed updates build the new source as an unprivileged user and delegate to the existing backup/health-check/rollback update path while preserving saved listeners and private data.

0.11.5

• Accept percent-encoded spaces (%20) in otherwise unambiguous request paths while preserving rejection of encoded separators, double-decoding hazards, controls and dot-segment ambiguity.

• Avoid the h3-quinn 0.0.10 stop_sending() panic path when an HTTP/3 request body is dropped while a receive read is pending.

• Add raw layer-4 TCP/UDP stream hosts on dedicated listeners with bounded TCP connections / UDP client sessions and restart-bound configuration in the admin panel.

• Add a Debian 13+ source bootstrap that installs build dependencies and Rust, clones/builds the repository and installs the systemd service with the explicitly requested public admin profile.

• Match Varnish built-in request-method behavior for the shared cache: GET/HEAD participate in lookup while successful POST/PUT/PATCH/DELETE/OPTIONS/TRACE requests no longer trigger an implicit global purge.

• Replace the conservative per-request-header/backend-member cache identity with a Varnish-style Host + URL primary identity, isolated by RustProxy vhost/config scope, and use response Vary as the secondary representation selector.

• Share cached objects across load-balanced members and across GET/HEAD, reducing avoidable MISSes while retaining Cookie/Authorization pass behavior and response privacy guards.

• Preserve X-Cache-Resident-Age across backend 304 revalidation and hot/cold tier movement. Cold metadata format 2 stores variant identity and resident age explicitly.

• Add cache regressions for Vary variants/schema changes, Host/URL hashing, explicit ports, HEAD eligibility and resident-age continuity; update release/package/API/UI metadata to 0.11.5.

0.11.4

• Fix Force SSL frontend validation and messaging: require an actual non-TLS listener for the incoming redirect, prefer HTTPS port 443 when multiple TLS listeners are selected, and reject only ambiguous non-standard HTTPS target ports.
• Add a visual reusable ACL-profile rule editor with add/remove/action/CIDR rows. Keep bulk paste/import as an advanced path, normalize invisible Unicode whitespace and report malformed rules with their source line.
• When a vhost disables cache, strip and suppress RustProxy X-Cache, X-Cache-Hits, Cache-Status, X-Cache-Reason and X-Cache-Resident-Age diagnostics for that response.
• Render backend pools belonging to disabled vhosts as muted Disabled rows in the main dashboard instead of classifying them as unavailable.
• Add source/offline regression coverage and bump release/package/UI/OpenAPI/update metadata to 0.11.4. Rust compilation/runtime acceptance remains open in this packaging environment.

0.11.3

• Add per-vhost control over forwarding the effective client IP to the application. Disabling it removes Forwarded, X-Forwarded-For and X-Real-IP only on the backend request; ACLs, GeoIP, rate limiting and Tinyauth continue to use the real client identity.
• Add a compact Vhost search/filter for vhost IDs, hostnames/wildcards and backend IDs/URLs.
• Fix the invalid quinn = 0.11.22 manifest requirement to the resolved 0.11.12 and stop dev.sh from rewriting a valid checked-in Cargo.lock.
• Fix JSONL access logging under the hardened systemd unit by provisioning /var/log/rustproxy as a writable service log directory while keeping ProtectSystem=strict.
• Add source/offline regression coverage and bump release/package/UI/OpenAPI/update metadata to 0.11.3. Rust compilation/runtime acceptance remains open in this packaging environment.

0.11.2

• Fix administration HTTPS access negotiated over HTTP/2. The admin guard now derives the effective authority from H2/H3 :authority (via the request URI) when no legacy Host header is present.
• Preserve strict HTTP/1.x Host handling and reject conflicting HTTP/2 Host versus :authority values to avoid ambiguous authority validation.
• Add per-vhost Force SSL beside frontend selection. Cleartext requests receive a non-cacheable HTTP 308 to the same hostname/path/query on the vhost's unique selected TLS port; ambiguous multi-port TLS selections are rejected.
• Map NPM ssl_forced (and migrator --force-https) to RustProxy force_ssl, retaining HTTP+HTTPS listener bindings when available instead of importing forced hosts as TLS-only.
• Add unit/integration regression coverage for HTTP/2 administration authority, /healthz, Force SSL redirect construction/validation and NPM ssl_forced; bump release/package/UI/OpenAPI/update metadata to 0.11.2. Rust compilation/runtime acceptance remains open in this packaging environment.

0.11.1

• Fix release update health checks when the administration panel uses persisted HTTPS or a persisted bind different from the install-time CLI address. The check now resolves the active admin listener/scheme from config.sqlite3 and honors the admin Host allowlist.
• Add a standard-library-only Nginx Proxy Manager SQLite migrator. It reads proxy_host, creates RustProxy vhosts/backends, preserves wildcard names/WebSocket/enabled/H2 intent, uses the RustProxy default certificate for imported TLS hosts unless a named certificate is selected, and keeps unsupported NPM policy/custom-config items as explicit review warnings.
• Make NPM migration dry-run by default, emit npm-migration-plan.json, detect hostname conflicts, split source records above RustProxy's 16-host limit and use revisioned authenticated API writes only with explicit --apply.
• Add offline regression coverage and bump release/package/UI/OpenAPI/update metadata to 0.11.1. Rust compilation/runtime acceptance remains open in this packaging environment.

0.11.0

• Add reusable ACL Profiles with optional IP/CIDR ACL and country allow/block rules. Vhost profile, inline vhost ACL and route ACL enforcement remains cumulative.
• Add an ACL Profiles navigation page and per-vhost profile selection without removing individual vhost policy controls.
• Add chip-style hostname editing and validated leading *. wildcard domains. Exact hosts win before the longest matching wildcard on the same listener.
• Add compact browser-session request-rate history charts to vhost cards, with progressive compaction of older samples.
• Add the built-in HTTP 401 page and classify normal WebSocket tunnel EOF/reset/abort/broken-pipe termination after a successful 101 upgrade as websocket_closed rather than a body/proxy error.
• Redirect plaintext requests received on the HTTPS administration socket to HTTPS while keeping application content unavailable over plaintext. Permit valid DNS Host values when the HTTPS admin hostname allowlist is empty; explicit allowlists remain strict.
• Extend named listeners to up to 16 explicit local addresses under one protocol policy. Multiple-address configurations reject unspecified 0.0.0.0/:: binds.
• Align the Logging field-builder dialog with the Vhost configuration modal and reposition the Configure fields action next to the format preset.
• Make source ZIP generation deterministic and verify byte-identical archives in release smoke tests.
• Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.11.0. Rust compilation/runtime acceptance remains open in this packaging environment.

0.10.0

• Add an optional persistent cold cache tier under the private data directory. Hot LRU/idle objects demote through a bounded asynchronous queue; fresh cold hits are SHA-256 checked and promoted back into the bounded RAM tier.
• Add hot/cold object, byte, promotion, demotion, cold-hit, eviction/error and queue-drop observability to the Cache API, panel and Prometheus output.
• Add cold-tier path, byte/object budgets and idle demotion settings; purge/config publication invalidates both tiers and startup rebuilds the same-revision cold index.
• Document browser hard-reload revalidation behavior and add translations for the exact request_no_cache, request_max_age, request_min_fresh and request_pragma_no_cache reasons.
• Add structured-log Standard, Nginx-style, ECS-style and Minimal presets plus a visual field picker/renamer with JSON preview; preserve advanced raw JSON mappings.
• Reuse the shared application card component for Logging sinks and remove release-specific fieldset border styling.
• Add baseline multi-stage Docker/OCI packaging with an unprivileged runtime user and persistent data volume. Docker discovery remains deferred.
• Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.10.0. Rust compilation/runtime acceptance remains open in this packaging environment.

0.9.0

• Redesign the vhost list as readable cards with listener/protocol/TLS/cache identity and live pool health, request, active, error, latency and traffic metrics.
• Add bounded asynchronous structured access-log sinks for JSONL files, Logstash TCP and Loki HTTP(S), with configurable JSON field mapping/static fields and sink delivery/drop/error counters.
• Expand cache object inspection with body bytes, resident bytes and metadata overhead; add optional X-Cache-Resident-Age.
• Add administration HTTPS with either the application-managed default certificate or a selected inventory certificate. Persisted non-loopback administration binds are accepted when HTTPS is enabled.
• Keep loopback HTTP as the default and retain the explicit legacy risk gate for plain remote HTTP. Secure session cookies are marked Secure on HTTPS administration.
• Add global TLS 1.2/1.3 and rustls cipher-suite policy plus per-vhost TCP TLS overrides. HTTP/3 vhosts must use the global TLS 1.3 policy.
• Add dedicated Logging navigation and full-width Settings tabs with new Administration and TLS policy pages.
• Complete roadmap items for remote HTTPS administration and X-Cache-Resident-Age; bump release identity, OpenAPI and packaging metadata to 0.9.0.
• Rust compilation/runtime acceptance remains unverified in this packaging environment.

0.8.1

• Enable the shared RAM cache by default.
• Replace blanket conditional-request bypass with local conditional HITs for fresh If-None-Match / If-Modified-Since requests.
• Add validator-based backend revalidation: request no-cache, freshness constraints and legacy Pragma: no-cache can revalidate a stored representation; backend 304 refreshes metadata and reuses the cached body.
• Keep request no-store as a hard bypass. Allow response Cache-Control: no-cache with ETag/Last-Modified to be stored only for mandatory validation; no-store and private still forbid shared storage.
• Retain expired validator-bearing objects for a bounded one-hour revalidation keep window without stale delivery.
• Raise the configurable object ceiling from 8 MiB to 1 GiB, still bounded by the global 1 GiB resident budget.
• Grow fill buffers incrementally and serialize very large fills through the existing fill semaphore to avoid preallocating the configured object ceiling.
• Exclude cache-control/Pragma and conditional/precondition headers from representation-key hashing because they govern reuse rather than representation identity.
• Add cache diagnostics and regressions for conditional HIT, revalidation, no-cache/no-store semantics and the 1 GiB configuration ceiling.
• Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.8.1.

0.8.0

• Global static-cache defaults now include common image, stylesheet/script, font, media and download extensions, with request Cookie ignored for matching assets by default. The global and per-vhost controls are visible in the cache UI; Set-Cookie, private/no-store and Vary: Cookie still prevent shared caching.

• HTTP/2 and HTTP/3 are per-vhost frontend opt-outs next to listener selection. Controls are enabled only when a selected named listener supports the protocol; TLS H2 ALPN is narrowed by SNI per vhost.

• Settings -> Listeners uses normal page scrolling instead of an extra nested scrollbar.

• Add per-vhost request throttling with graphical request/window/burst controls, country-specific limits and country block/allow-only policies. Return built-in HTML 429/403 responses while preserving custom error-page overrides.

• Download the PDDL sapics/ip-location-db user-country IPv4/IPv6 data during first installation over HTTPS and verify publisher SHA-256 checksums; expose load status without exposing client data.

• Verify the installed GeoIP database against current publisher SHA-256 files on every managed update and download only stale/missing assets before downtime.

• Make managed updates regenerate the systemd unit and restore it together with code/private data on failure; preserve and report the original failure reason and add a development-only --reset-config recovery path for intentionally incompatible saved vhost/settings documents.

• Add an opt-in per-vhost Cloudflare client-IP mode that accepts CF-Connecting-IP only when the direct peer belongs to Cloudflare's published edge CIDRs.

• Add Server-Timing response diagnostics. Disabled per-vhost H3 removes Alt-Svc and rejects HTTP/3 requests for that vhost.

• Move vhost listener binding exclusively to named listener selection. Listener addresses are configured under Settings; remove the pre-production inline/global listener compatibility importer and reject the old vhost format instead of migrating it.

• Make health-check mode off fully disable active probes and passive health classification instead of quietly learning health from production requests.

• Add a new-origin debugging preset for HTTPS-by-IP origins: default pool/private-origin/HTTP1/preserve-host enabled and backend TLS verification disabled for newly created panel backends, with explicit warnings about the certificate-verification risk and mismatched settings.

• Keep per-vhost inherit/override controls for static-cookie cache behavior while the global defaults cover common static extensions. Cookie is ignored only for the cache key/request bypass decision.

• Fix cache Age calculation to retain sub-second response delay and apply RFC 9111 corrected received age before adding response delay.

• Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.8.0.

• Rust compilation/runtime acceptance remains unverified in this packaging environment.

0.7.3

• Generate the one-time administrator setup token from the release CLI even before the first server start; retain the rule that it is invalid after setup completes.
• Add explicit remote-panel opt-in for 0.0.0.0/::, requiring both --allow-remote-admin; keep plain-HTTP risk visible.
• Make Linux/systemd install defaults listen on HTTP 80 and HTTPS 443; add --no-https for explicit HTTP-only installation.
• Add deployment and admin-host regressions and bump release/package/UI/schema identifiers to 0.7.3.
• Hotfix backend HTTPS-by-IP with optional tls_server_name: TLS SNI and hostname verification may use a DNS name while the validated TCP target stays pinned to the configured backend URL.
• Add an explicit per-backend tls_verify switch, secure by default. Administrators may turn verification off for an HTTPS origin without weakening DNS/address/self-loop policy. Add matching 503/504 HTML gateway pages while preserving custom-page overrides.
• Rust compilation/runtime acceptance remains unverified in this packaging environment.

0.7.2

• Publish a distinct patch release; keep both previous 0.7.1 deliveries historical.
• Remove the build.rs panic on absent SWAGGER_UI_DOWNLOAD_URL. The asset preparer defaults to pinned Swagger UI 5.32.11 independently of Cargo config discovery.
• Remove the independently downloading utoipa-swagger-ui adapter and embed the prepared JS/CSS directly, for debug and release. Existing admin guards stay in place.
• Prepare assets with the existing Python 3.10+ tool requirement, now also needed for direct Cargo builds. Support absolute local tag ZIPs, optional archive SHA-256, bounded exact-member reads, validated download caching and retained license notices.
• Resolve build input paths from CARGO_MANIFEST_DIR, track local sources and outputs, and report missing tools/assets explicitly instead of silently changing UI versions.
• Add executable synthetic-archive regression tests and protected license notices.
• Update release identifiers, packaging/update metadata and migration/build notes.
• Rust compilation and actual Swagger rendering remain unverified in this environment.

0.7.1

• Add visual request/response header editing to each custom vhost location, with set/append/remove, validation, isolation and synchronized optional JSON.
• Split anonymous sign-in from the operational document and module/language bundles. Remove the login tagline; preserve the original brand and compact square style.
• Reduce public health to status and auth discovery to setup_required only. Make the public allowlist exact by method and path; private/unknown requests are denied before body/query extraction, including method mismatches and aliases.
• Keep Origin/Host/CSRF/session guards; reject duplicate CSRF/marker headers and hide login/setup JSON parser details. Clear UI data across tabs and on revocation.
• Add authenticated /docs and OpenAPI with pinned, build-embedded Swagger UI, same-session authorization, read-only execution by default and CSRF-confirmed writes.
• Replace updater reliance on a public version with local MainPID/executable checks.
• Add source contracts, browser script regressions, actual-router Rust tests and a read-only anonymous-access probe. Rust/build/vendor-renderer acceptance not completed.

0.7.0

• Renew managed ACME profiles automatically with shared worker bounds, jitter, backoff, private observations and validated CAS hot deployment; expose opt-out, check-now and dry-run controls. Keep previous certificates active on failure.
• Add install.sh/update.sh for Linux/systemd, root-owned release switching, stopped full-data backups and code/data rollback on failed startup/version checks.
• Add per-vhost Basic Auth with Argon2id-only storage, optional verified upstream credentials and cumulative graphical IP ACLs. Keep protected content out of cache.
• Add WebSocket toggles and graphical custom path locations, including explicit exclusion of dedicated path origins from normal pool/sticky selections.
• Replace the sample welcome page with neutral information, make the protocol fixture opt-in, unify square modal and Settings-tab styling, preserve branding.
• Add renewal/deployment helper tests and Rust/browser regressions. Rust compilation, live CA renewal and real systemd deployment remain unverified in this environment.

0.6.0

• Replace separate legacy routes with vhosts and a one-way, validated compatibility importer; preserve path-pinned origins, ACLs and existing listener scope.
• Add HTTP-01 webroot domain validation, Cloudflare DNS-01 and OVH DNS-01 alongside RFC2136 using private Certbot workers.
• Unify certificate creation/import in a provider-picker modal; record optional issuer metadata in the library and keep secrets outside exported configuration.
• Add an independently configurable Prometheus endpoint with actual-peer CIDRs, optional environment-sourced bearer token, bounded scrapes and collector switches.
• Export application/admin/listener/vhost/backend/cache/system data and full-exchange vhost histograms with bounded configured labels.
• Split Settings into functional switching cards; preserve dirty values, keyboard access and translation discovery; remove Security and legacy routing sidebar entries.
• Add offline provider/browser regression tests and Rust tests for migration, ACME challenge isolation and scrape authorization. Rust compilation/runtime and actual CA/provider integrations remain unverified.
• Preserve the original brand assets. Automatic certificate renewal, Cloudflare Tunnel and Docker discovery remain deferred.

0.5.0

• Add a compact dedicated cache panel with vhost/domain counters, object pagination, TTL/Age/hits, memory/fill diagnostics and authenticated selective purge.
• Fix reserved administrator-cookie ordering and empty terminating DATA frames; emit fixed cache decision reasons without exposing request secrets.
• Replace special X-Mock-Origin hiding with the explicit global/vhost revision switch; ordinary response rules still handle arbitrary removable headers.
• Default HTTP/3 on TLS bindings, retain explicit null opt-outs, and explain overlapping sockets with ownership and concrete protocol/limit differences.
• Return 503 for upstream connection/unavailability, 502 for invalid responses and 504 for header timeouts; generated errors use no-store.
• Add basic asynchronous Certbot DNS-01/RFC2136 issuance, staging-first consent, private TSIG/account profiles, output validation and explicit library import. No automatic renewal scheduler or real CA validation is claimed.
• Add offline helper and UI checks plus Rust regression source. Rust/Cargo remain unavailable in the packaging environment; compilation/runtime unverified.

0.4.0

• Rebuild standard Forwarded and X-Forwarded metadata at an explicit trusted-proxy boundary; use verified client IP for ACL/affinity, never for destination routing.
• Add per-vhost Tinyauth subrequests, identity header allowlists, safe same-login-origin redirects and fail-closed checks before origin/static/cache/WebSocket use.
• Move certificate upload into an independent inventory; assign certificates by ID per vhost and expose metadata-only inventory reads. ACME is not implemented.
• Add named multiple-IP listeners with descriptive scope, opt-in legacy routes, reusable vhost references and actual/desired plans.
• Add Quinn/h3-based HTTP/3 UDP transport, TLS 1.3/SNI, Alt-Svc, per-endpoint connection and per-connection stream/idle limits, shared proxy policies and bounded shutdown. Preserve TCP HTTP/2 plus HTTP/1.1.
• Hide request-ID/revision headers by default; add individual overrides and optional mock-origin stripping. Apply effective Server policy across all response paths, including extra sockets.
• Partition cache by actual frontend IP/port and safely probe unknown-length empty requests; preserve nonempty body frames instead of discarding them.
• Raise toast above active dialogs without making it inert under the modal; retain the logo, compact UI and discovered language packs.
• Add a loopback-only fake-auth development peer and Rust integration sources for forwarding, auth, extra-socket cache, listener ownership and real QUIC/TCP fallback.
• Execute frontend/helper/static checks documented in TEST_REPORT.md. Rust/Cargo are unavailable: no passing compilation, real proxy run or full RFC-conformance claim.

0.3.0

• Split the large status JSON macro into small objects and an explicit feature map; preserve response fields without increasing Rust's macro recursion limit.
• Add optional per-vhost certificate inventory selection and PEM file upload. Validate key/certificate pairing and names, write private immutable files, and activate only through the existing revisioned configuration update.
• Add per-vhost cache overrides and selective invalidation, including stale in-flight fill cancellation while leaving other host entries intact.
• Add administrator-authored, bounded global/vhost error pages, static vhost and missing-path responses, direct-IP and unknown-host responses. Retain ACL checks, HEAD handling and authentication challenges; never execute HTML in the admin UI.
• Move access logs into a separate modal/docked viewer with fixed filters, vhost identity, pause, scoped search/status/method/cache controls and JSON export.
• Add a compact vhost list, tabbed dialog, live health/latency summaries and visual per-host response/request headers; keep the original logo and favicon.
• Add density preferences and a Settings shortcut to Security.
• Add a Python-only mock origin with random data, cache/no-store/private/cookie paths, compression-size payloads, controllable delay/health and error statuses.
• Add Rust regression source for pages, cache scoping, TLS staging and API guards.
• Rust compilation/runtime acceptance remains unverified: toolchain unavailable. Executed checks and their exact limitations are recorded in TEST_REPORT.md.

0.2.0

• Replace SizeAbove(u16) with a custom u64 predicate; add >64 KiB threshold regressions.
• Add IP/port/TLS-bound virtual hosts with frontend(s), backend pool and path policies.
• Enforce real accepted destination matching; isolate legacy routes from extra sockets.
• Add weighted round-robin, least-connections, least-traffic, adaptive and IP hashing.
• Add bounded TCP/HTTP health checks, separate passive failures, recovery and slow start.
• Add connection keepalive controls, backup members, drain and opaque cookie/IP affinity.
• Preserve compatible observations/tokens across hot edits; recheck changed/re-enabled members.
• Keep leases through full uploads/responses/tunnels; never replay failed requests.
• Add per-vhost TLS-only HSTS, nosniff, frame/referrer/CSP/permissions headers.
• Retain HTTP/1.1 ALPN with HTTP/2 for TLS frontends and HTTPS origins.
• Separate cache identities by selected member; bypass cookie-affine pools.
• Add compact vhost editor, atomic legacy migration, backend observations/API/metrics/log IDs.
• Extend discovered English/Polish translations; preserve original logo and favicon.
• Add Rust regression source and a real-binary vhost/keepalive/health acceptance suite.
• Execute 63 simulated-API UI, 24 SQLite, 21 upgrade, 4 language-mirror, 10 protocol-peer and 7 backend-fixture checks. None is a passing Rust build or runtime test.
• Rust/Cargo remain unavailable in the packaging environment; compilation/runtime acceptance and a resolved Cargo.lock remain mandatory before deployment.

0.1.0

Development source advancing directly from 0.0.6. Cloudflare is deferred.

Added

• Persisted public listener addresses/ports, 80/443 presets, startup defaults and restart status.
• Bounded streaming shared RAM cache, TTL/Age, LRU, privacy/Vary protections, per-route bypass, optional HIT/MISS headers and audited purge.
• Streaming gzip, Brotli, Zstandard and deflate controls, final Server policy and a global client-response header editor.
• Compact dashboard with system/process/cache diagnostics, log filters and export.
• Compile-time language discovery, JSON packs, metadata/RTL/fallback, and preservation of extra packs during upgrade.
• Example unprivileged low-port service and cache/settings real-binary integration test source.

Changed

• Allow ordinary remote-origin 80/443 while guarding local proxy/admin listener targets.
• Keep original logo/favicon; reduce panel spacing and improve data density.
• Invalidate cache and older fills on config changes, explicit purge and successful unsafe methods.
• Expand source/SQL/upgrade/language/frontend checks; actual execution scope is in docs/TEST_REPORT.md.

Verification boundary

Rust/Cargo and real Rust integration were unavailable. This is a source candidate, not a successfully compiled or production-certified binary. No lockfile is fabricated.

0.0.6

Cumulative development source release. The planned 0.0.3, 0.0.4 and 0.0.5 scopes are included here, not represented as separately published archives.

Fixed

• Explicitly select src/auth/mod.rs to prevent the reported flat/folder module conflict when obsolete 0.0.1 source remains in an existing checkout.
• Detect mixed source layouts and preserve the known legacy auth file; refuse to delete unrecognized local changes.
• Support interactive username input for admin init.
• Replace managed source directories with rollback on copy failure rather than encouraging overlay extraction.

Added

• DNS and HTTPS manual backends with per-backend pools, bounded DNS workers, validated DNS answers, optional CIDR allowlists and additional PEM trust anchors.
• rustls public TLS listener, persistent development default certificate, exact SNI bindings, local generate/import commands and explicit hot reload.
• Public HTTP/2 over TLS ALPN and HTTP/2/auto backend protocol options.
• Validated HTTP/1.1 WebSocket handshakes and bounded bidirectional tunnels, including TLS on either side, connection leases and a separate idle timeout.
• Transport metrics, WebSocket lifetime logging, TLS editor and advanced backend controls in the English/Polish panel.
• Backup of configured/default certificate files alongside the SQLite snapshot.
• Upgrade regression tests, transport configuration tests, real protocol test scripts and CI steps. Test execution limits are recorded in TEST_REPORT.md.

Changed

• Public TLS is enabled by default by dev.sh; direct binary startup keeps it optional.
• Listener ports are protected across HTTP, HTTPS and administration.
• All Markdown documentation is maintained in English.
• The roadmap identifies the combined transport release and upcoming Docker stages.

0.0.2

• Introduced RustProxy naming, administrator setup, Argon2id passwords, sessions, CSRF checks, login throttling, password recovery and credential revocation.
• Added host/route ACLs, generic request/response header policies, administration audit, SSE dashboard updates and security controls in the bilingual panel.
• Added an additive SQLite migration, offline validation and online database backup.
• Rust build/runtime verification was unavailable for the source package.

0.0.1

• Initial manual-backend HTTP/1.1 proxy, streaming and keep-alive.
• SQLite configuration, dynamic host/alias/path routing and local token control plane.
• English/Polish interface, bounded access log, counters, CLI, demo backend and dev.sh.
• Rust build/runtime verification was unavailable for the source package.