RustProxy/ROADMAP.md

RustProxy roadmap

0.28.1 - External certificate paths and certificate-source clarity

Current direction: 0.28.0 -> 0.28.1

• Allow manual certificate entries to reference an absolute external certificate path and absolute external private-key path.
• Resolve Certbot-style live/ symlinks on every reload while preserving bounded PEM parsing, regular-file checks and private-key permission checks.
• Keep targeted certificate reload revision-stable so renewal wrappers can call POST /api/certificates/{certificate_id}/reload after renewing external files.
• Preserve managed <data-dir>/certs filenames and reject mixed managed/external pairs.
• Exclude external certificate material from RustProxy backups while retaining the configured absolute paths.
• Clarify certificate-source, storage and path expectations in English/Polish UI text and operator documentation.
• Keep SQLite schema 8 and COLD format 3 unchanged.

0.28.0 - GeoIP control, listener clarity and cache policy refinement

Current direction: 0.27.3 -> 0.28.0

• Add on-demand GeoIP refresh through the authenticated administration UI and reuse the automatic updater pipeline.
• Hot-swap validated GeoIP databases so subsequent country ACL/rate-limit/logging lookups use the new data without a process restart.
• Use direct GeoIP file URLs with optional per-file SHA-256 verification and support either separate IPv4/IPv6 CSV ranges or one native MaxMind MMDB database.
• Present active listeners as readable HTTP/HTTPS endpoint cards with explicit H3/UDP state.
• Add configurable Via: RustProxy cache response metadata while preserving upstream Via values.
• Preserve cache objects across bypass and response-only diagnostic/Via setting changes.
• Separate vhost Security header-rule Delete controls from the Operation selector.
• Keep SQLite schema 8 and COLD format 3 unchanged.

0.27.3 - HTTP/3 cache parity and bounded memory retention

Current direction: 0.27.2 -> 0.27.3

• Make body-less HEAD cache eligibility consistent between HTTP/2 and HTTP/3.
• Reduce persistent COLD-index RAM while preserving the existing on-disk cache format and cache behavior.
• Reclaim expired rate-limit client buckets and avoid duplicating the vhost name for every tracked IP.
• Confirm downstream compression remains streaming and does not retain complete response bodies in memory.
• Exclude rebuildable managed Certbot Python environments from backups.
• Document DEB/RPM and OPNsense repositories as the official installation paths; keep Debian source builds optional.
• Separate application-coupled scripts from QA/dev/audit tooling and external platform integrations while preserving all entry points.
• Keep SQLite schema 8 and saved configuration compatibility with 0.27.2.

0.27.2 - Managed ACME renewal repair

Current direction: 0.27.1 -> 0.27.2

• Make the managed Certbot runtime independent of pip console-script shebang relocation.
• Reuse existing 0.27.1 acme-python environments without operator cleanup.
• Preserve the system Certbot fallback and schema/config compatibility.

0.27.1 - Portable certificate runtime and list sorting

Current direction: 0.27.0 -> 0.27.1

• Show complete default and standard-service setup-token commands during first-administrator onboarding.
• Initialize the Certbot Python environment under the RustProxy data directory with app-owned venv/pip state and a local virtualenv bootstrap when stdlib venv is unavailable.
• Fall back to distribution Certbot binaries when usable and report missing Python/pip or setup failures in the Certificates panel.
• Add account-scoped column + direction sorting for vhosts, Docker vhosts, redirects, 404 hosts and streams; keep Redirects/404 toolbar placement identical to Vhosts.
• Use the installed production binary in the Certbot hook example and expose official source/package repository links plus Python/pip/Certbot runtime state in application information.
• Keep SQLite schema 8 and additive/defaulted administrator-preference compatibility.

0.27.0 - Compression policy and persistent Docker publications

Current direction: 0.26.7 -> 0.27.0

• Enable zstd/Brotli/gzip downstream compression by default, keep deflate opt-in, honor client q-values and use deterministic zstd -> br -> gzip -> deflate tie priority.
• Allow authenticated/cookie/private/no-store responses to compress while retaining explicit no-transform/range/SSE/upgrade/existing-encoding exclusions.
• Add inherited dynamic-compression overrides and per-scope codec filters for ordinary vhosts and Web Server services under the global codec ceiling; keep Docker publications intentionally simple with one Compression on/off checkbox using the global codec set.
• Default fresh installations to Server: RustProxy without rewriting existing saved policies.
• Remove Debian package-build metadata from this source tree; packaging is maintained separately at rustproxy.linuxiarz.pl.
• Keep published Docker hostnames materialized while a service is missing, return 503 until it returns, and reuse last-known inventory during temporary agent communication failures.
• Render cache occupancy progress fill consistently across Chromium/WebKit and Firefox.
• Keep SQLite schema 8 and additive/defaulted saved configuration compatibility with 0.26.x.

0.26.7 - Cache occupancy and backend rotation continuity

Current direction: 0.26.6 -> 0.26.7

• Show HOT/COLD cache occupancy progress against configured entry and byte limits on /cache.
• Preserve compatible upstream client generations across unrelated runtime snapshot rebuilds so rotation age/counters remain continuous.
• Keep request-count and age-based backend client recycling covered by tests and visible diagnostics.
• Refresh container documentation and include all supported Certbot DNS plugins in the shipped OCI image.
• Review current installation/cache/backend lifecycle documentation for stale behavior statements.
• Keep existing 0.26.6 custom Age rules loadable while isolating response-side Age overrides from cache freshness/storage semantics.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.6.

0.26.6 - Access-policy composition and administration fixes

Current direction: 0.26.5 -> 0.26.6

• Keep backend table visible columns, sort key and sort direction synchronized with account-scoped user preferences.
• Clear the certificate-issuance form after the ACME issuance job succeeds while preserving non-secret values after failed jobs.
• Document the sibling Python modules required by scripts/migration/migrate_npm.py and fix the container helper example.
• Treat explicit IP allows and allow-only countries as alternative allow sources inside one ACL policy scope, with explicit denies taking precedence and separate scopes remaining cumulative.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.5.

0.26.5 - Scaled controls and listener navigation

Current direction: 0.26.4 -> 0.26.5

• Keep compact toolbar selects and inputs on the same interface-scaled control height.
• Reuse the interface-scale field variables for ordinary form controls so inputs/selects resize consistently with the UI scale setting.
• Route the Streams Add TCP/UDP listener shortcut to Settings -> Listeners instead of opening a Stream editor.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.4.

0.26.4 - Administration consistency and backend rotation reliability

Current direction: 0.26.3 -> 0.26.4

• Add 404-host forms to the session-only draft workflow.
• Complete Polish translations for the Button style appearance setting.
• Align toolbar search/filter input height with the active button style.
• Reuse the vhost Enabled control styling in 404 hosts, Redirects and Streams.
• Replace the Overview-card checkbox list with compact visibility/reorder tiles.
• Run age-based backend client recycling independently of request arrival.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.3.

0.26.3 - Administration appearance and draft workflow polish

Current direction: 0.26.2 -> 0.26.3

• Make interface scaling global across navigation, workspace, dialogs, overlays and the draft dock; extend the range to 70-125% and make form-control sizing respond more visibly across that range.
• Make Overview telemetry cards denser without changing responsive breakpoints.
• Expand chart themes to eight full-palette presets affecting colors, surfaces, grid and line treatment.
• Restyle the draft dock as a square-corner RustProxy panel without rounded/glass styling.
• Add a collapse-to-bar state and per-draft age indicator to the session-only draft dock.
• Add Settings search without rebuilding forms, preserving unsaved values while categories are filtered.
• Add chart-style palette previews beside the eight chart presets.
• Add independent Normal/Compact/Ultra table-log density and Overview dashboard density preferences.
• Add per-account Overview card visibility and ordering controls.
• Add per-section Appearance resets plus a full Appearance reset while keeping unrelated account preferences intact.
• Add an account-scoped Normal/Compact button-style selector, with Compact matching the smaller source-style control dimensions independently from global scale, including generated vhost actions and modal tabs.
• Retain sticky Settings category navigation and unsaved-category indicators.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.2.

0.26.2 - Unified logs search and dynamic fields

Completed direction: 0.26.1 -> 0.26.2

• Add independent in-session editor drafts for Web Server, Vhosts, Redirects and Streams, with minimize/restore/discard actions in a bottom-right dock.

• Consolidate theme/language/display controls under Settings -> Appearance, replace density modes with an interface-scale slider and persist appearance choices in administrator preferences.

• Add 12/24-hour timestamp formatting, chart presentation presets and a denser expanded Stored Logs record view.

• Merge Stored Logs and Live Logs into one top-bar Logs menu.

• Replace fixed Stored Logs filters with one bounded field-query syntax supporting AND, negation, quotes, wildcards and numeric comparisons.

• Discover selectable Stored Logs columns from parsed record fields and keep arbitrary safe field choices in account preferences.

• Parse the built-in RAW error-log line format into basic structured fields while retaining the raw record.

• Remove the configured-file inventory/source selector from the Logs workspace and keep bounded all-source scanning by default.

• Move Stored Logs column configuration to the table toolbar and use arrow symbols for backend sort direction.

0.26.1 - Vhost-aware protocol diagnostics and Logs Explorer UX

Current direction: 0.26.0 -> 0.26.1

• Attribute persistent protocol errors through one shared vhost resolver using routed vhost, authority/Host and SNI in that order.
• Keep unresolved traffic in _unmatched.jsonl and keep low-level protocol errors out of Live Logs.
• Add bounded protocol diagnostic identity fields for Stored Logs filtering and inspection.
• Add selectable Stored Logs columns, sticky headers, highlighted selection and inline details.
• Hide configured-file inventory by default and repair mapped client-IP/search behavior.
• Preserve schema 8 and the existing saved proxy configuration format.

0.26.0 - Persistent protocol diagnostics and stored-log explorer

Completed direction: 0.25.7 -> 0.26.0

• Persist malformed HTTP, TLS/QUIC handshake failures, HTTP/2/HTTP/3 protocol failures, invalid h2c attempts and connection-limit rejects through the existing bounded logging sink.
• Keep low-level protocol failures out of the Live Logs memory ring so hostile scans cannot displace ordinary live request history.
• Add a local read-only Logs explorer with bounded server-side filtering and pagination over configured access/error files.
• Prevent arbitrary-path browsing and symlink following; enumerate only paths derived from active RustProxy logging configuration.
• Add /logs dashboard navigation plus a Logging-settings launcher while retaining the existing Live Logs dialog unchanged.
• Keep schema 8 and configuration compatibility with 0.25.7.

0.25.7 - Vhost operations and backend observability

Current direction: 0.25.6 -> 0.25.7

• Add a fast vhost enable/disable action to the vhost cards using the existing revisioned save path.
• Add backend-table search, sorting and account-scoped persisted column visibility preferences to the main dashboard.
• Style scrollbars for dark and light dashboard themes.
• Export retry and upstream-client lifecycle metrics for ordinary and Docker backends.
• Add Grafana panels for backend client generation, age, retry activity and rotations.
• Make the vhost editor Enabled control visually distinct from ordinary settings.

0.25.6 - Backend memory diagnostics visibility

Current direction: 0.25.5 -> 0.25.6

• Show upstream client generation, current-generation request count, generation age and total rotations in the main Backends diagnostics table.
• Reuse the existing /api/events status snapshot refresh path; do not add a second diagnostics polling loop.
• Keep the 0.25.5 client-generation recycling defaults and configuration compatibility unchanged.

0.25.5 - Traffic country consistency and Revision History styling

Current direction: 0.25.4 -> 0.25.5

• Use trusted CF-IPCountry when verified Cloudflare client-IP mode is active, with local GeoIP fallback for missing/invalid country headers.
• Keep country analytics, retained country logging and country policy evaluation on the same verified country source.
• Align the Revision History dialog with the shared square-corner modal styling and remove duplicated history-only dialog CSS.
• Add Cloudflare-country trust regression coverage and release/source-contract checks.
• Extend Prometheus with a live Traffic analytics collector, fixed-cardinality User-Agent/method/source families, country/top-route views and built-in Web Server inventory/source metrics.
• Extend the bundled Grafana dashboard with a Traffic vhost filter, Web Server request rate, countries, User-Agent families, serving sources, methods, status classes, cache outcomes, capture-state gauges and configured routes.
• Bound backend Hyper client lifetime with configurable request/age recycling and an upstream HTTP/1 buffer ceiling so sustained traffic can release pool/TLS high-water allocations without a vhost save.

0.25.4 - Configuration history restore

Current direction: 0.25.3 -> 0.25.4

• Restore an older retained configuration through the normal validation and hot-publish path.
• Save restore as a new revision without deleting or rewinding existing history.
• Require current-revision CAS plus administrator session/CSRF and audit restore source/new revision.
• Add restore action and confirmation to the existing revision-history modal.

0.25.3 - Request policy, correlation and configuration history

Current direction: 0.25.2 -> 0.25.3

• Add per-vhost HTTP method allow/block policy.
• Add per-location HTTP method policy, reusable ACL profile, inline IP ACL and country allow/block policy.
• Enforce host and location policies before upstream selection/connection.
• Generate one SHA-256 request ID per exchange and forward it unchanged to the backend as X-Request-ID.
• Persist bounded manual-configuration revision history in SQLite schema 8.
• Add a calendar/day revision-history modal with change preview in the existing dashboard style.

0.25.2 - Live backup and resumed-session hardening

Current direction: 0.25.1 -> 0.25.2

• Allow encrypted full-backup creation while RustProxy owns the data-directory process lock.
• Snapshot SQLite consistently and stage durable files before archive encryption.
• Preserve only validated relative symlinks that resolve inside the staged data tree, including Certbot live -> archive links.
• Keep restore offline, validated, staged and atomically activated.
• Recover transient invalid-origin state in restored/resumed admin tabs with a one-shot same-origin reload, without weakening server Host/Origin/CSRF checks.

0.25.1 - Traffic UX and source modularization

Current direction: 0.25.0 -> 0.25.1

• Split Traffic into Overview, Clients, Requests and Delivery sub-tabs.
• Chart every bounded Traffic dimension with donut or horizontal bar visualizations suited to the data shape.
• Keep every Rust source file at or below 500 lines and keep unit tests outside implementation files.
• Split oversized dashboard source bundles and the Docker Agent into bounded source modules while preserving behavior and URLs.
• Guard the Web Server split against dangling attributes and missing htaccess, server_protocol and anyhow::Context imports.

0.25.0 - Web Server foundation

Current direction: 0.24.10 -> 0.25.0

• Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
• Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
• Add Reverse Proxy / Web Server source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
• Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
• Add GET, HEAD, MIME, Content-Length, streaming, index lookup, directory slash redirect and optional directory listing.
• Add repeatable per-request directory listing, per-directory index-before-listing behavior, Web Service MIME overrides/default MIME and a default static Cache-Control policy.
• Organize Web Service editing into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs.
• Add Web Service try_files, internal/redirect regex rewrites, ordered per-extension/MIME Cache-Control rules, fixed response headers, precompressed .br/.gz delivery and forced-download extensions.
• Add bounded FastCGI/PHP-FPM execution over Unix sockets or loopback TCP with index.php/front-controller routing and no source fallback on upstream failure; expose advanced bounded limits, Authorization forwarding, custom FastCGI parameters and controlled PHP_VALUE overrides with in-panel syntax documentation.
• Add explicit symlink policy: deny by default, with Linux-only inside-root following for static files; PHP-FPM remains restricted to deny.
• Add a bounded .htaccess compatibility layer for common Apache migration rules, including rewrite conditions/rules, directory index/listing, MIME, headers, Expires and PHP AddHandler integration, with a dashboard documentation modal and fail-closed security-sensitive directives.
• Add one-shot Web Service presets for Static, SPA, PHP generic, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads, with optional deterministic hardening for common exploit probes/sensitive paths and fingerprint-header stripping.
• Expose vhost-wide request/active/error/EWMA/traffic metrics for Web Server-only vhosts and fix custom logging mappings for route/cache/transform effective fields.
• Add bounded per-vhost Traffic analytics, User-Agent logging and opt-in country/GeoIP logging with top-dimension views, effective-client-IP rankings and donut charts for the main dimensions.
• Keep Web Service dashboard rendering stable when configuration loads before the deferred Web Server UI module and use the existing generic/custom 403 error-page pipeline when directory listing is disabled.
• Add automatic allocator release and idle HOT-cache waterline trimming so sustained traffic does not require a vhost save/reload to return reclaimable RSS.
• Add metadata-based ETag/Last-Modified, conditional 304, single Range/If-Range, 206 and 416.
• Enforce decoded-path validation and document-root confinement; Unix traversal uses openat + O_NOFOLLOW and does not serve symlinks.
• Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
• Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
• Clean README/Docs/CHANGELOG/ROADMAP material, add a canonical docs index, authenticated Markdown Reader, 0.25 specification audit and open-work TODO.
• Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test plus live H1/H2/H3/static-file acceptance on the release host.

Web Server follow-up

Future Web Server work must retain the 0.25 split between reusable Web Service configuration and vhost/location source selection.

• Multipart byte ranges if operational demand justifies them.
• Named locations without introducing a second URL router.
• Opt-in PHP PATH_INFO script/path splitting with an unambiguous confinement rule.
• Race-resistant filesystem confinement for non-Unix targets before enabling local file serving there.
• Real PHP-FPM release-host acceptance over Unix socket and loopback TCP.

See docs/TODO.md for unresolved work and release acceptance, and docs/ROADMAP_HISTORY.md for completed historical milestones.