RustProxy/ROADMAP.md

RustProxy roadmap

0.25.6 - Backend memory diagnostics visibility

Current direction: 0.25.5 -> 0.25.6

• Show upstream client generation, current-generation request count, generation age and total rotations in the main Backends diagnostics table.
• Reuse the existing /api/events status snapshot refresh path; do not add a second diagnostics polling loop.
• Keep the 0.25.5 client-generation recycling defaults and configuration compatibility unchanged.
• Run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on a Rust release host.

0.25.5 - Traffic country consistency and Revision History styling

Current direction: 0.25.4 -> 0.25.5

• Use trusted CF-IPCountry when verified Cloudflare client-IP mode is active, with local GeoIP fallback for missing/invalid country headers.
• Keep country analytics, retained country logging and country policy evaluation on the same verified country source.
• Align the Revision History dialog with the shared square-corner modal styling and remove duplicated history-only dialog CSS.
• Add Cloudflare-country trust regression coverage and release/source-contract checks.
• Extend Prometheus with a live Traffic analytics collector, fixed-cardinality User-Agent/method/source families, country/top-route views and built-in Web Server inventory/source metrics.
• Extend the bundled Grafana dashboard with a Traffic vhost filter, Web Server request rate, countries, User-Agent families, serving sources, methods, status classes, cache outcomes, capture-state gauges and configured routes.
• Bound backend Hyper client lifetime with configurable request/age recycling and an upstream HTTP/1 buffer ceiling so sustained traffic can release pool/TLS high-water allocations without a vhost save.
• Run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on a Rust release host.

0.25.4 - Configuration history restore

Current direction: 0.25.3 -> 0.25.4

• Restore an older retained configuration through the normal validation and hot-publish path.
• Save restore as a new revision without deleting or rewinding existing history.
• Require current-revision CAS plus administrator session/CSRF and audit restore source/new revision.
• Add restore action and confirmation to the existing revision-history modal.
• Run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on a Rust release host.

0.25.3 - Request policy, correlation and configuration history

Current direction: 0.25.2 -> 0.25.3

• Add per-vhost HTTP method allow/block policy.
• Add per-location HTTP method policy, reusable ACL profile, inline IP ACL and country allow/block policy.
• Enforce host and location policies before upstream selection/connection.
• Generate one SHA-256 request ID per exchange and forward it unchanged to the backend as X-Request-ID.
• Persist bounded manual-configuration revision history in SQLite schema 8.
• Add a calendar/day revision-history modal with change preview in the existing dashboard style.
• Run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on a Rust release host.

0.25.2 - Live backup and resumed-session hardening

Current direction: 0.25.1 -> 0.25.2

• Allow encrypted full-backup creation while RustProxy owns the data-directory process lock.
• Snapshot SQLite consistently and stage durable files before archive encryption.
• Preserve only validated relative symlinks that resolve inside the staged data tree, including Certbot live -> archive links.
• Keep restore offline, validated, staged and atomically activated.
• Recover transient invalid-origin state in restored/resumed admin tabs with a one-shot same-origin reload, without weakening server Host/Origin/CSRF checks.
• Run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on the release host.

0.25.1 - Traffic UX and source modularization

Current direction: 0.25.0 -> 0.25.1

• Split Traffic into Overview, Clients, Requests and Delivery sub-tabs.
• Chart every bounded Traffic dimension with donut or horizontal bar visualizations suited to the data shape.
• Keep every Rust source file at or below 500 lines and keep unit tests outside implementation files.
• Split oversized dashboard source bundles and the Docker Agent into bounded source modules while preserving behavior and URLs.
• Guard the Web Server split against dangling attributes and missing htaccess, server_protocol and anyhow::Context imports.
• Run compiler-enabled cargo fmt --all, cargo check --locked --all-targets and cargo test --locked --all-targets on the release host.

0.25.0 - Web Server foundation

Current direction: 0.24.10 -> 0.25.0

• Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
• Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
• Add Reverse Proxy / Web Server source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
• Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
• Add GET, HEAD, MIME, Content-Length, streaming, index lookup, directory slash redirect and optional directory listing.
• Add repeatable per-request directory listing, per-directory index-before-listing behavior, Web Service MIME overrides/default MIME and a default static Cache-Control policy.
• Organize Web Service editing into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs.
• Add Web Service try_files, internal/redirect regex rewrites, ordered per-extension/MIME Cache-Control rules, fixed response headers, precompressed .br/.gz delivery and forced-download extensions.
• Add bounded FastCGI/PHP-FPM execution over Unix sockets or loopback TCP with index.php/front-controller routing and no source fallback on upstream failure; expose advanced bounded limits, Authorization forwarding, custom FastCGI parameters and controlled PHP_VALUE overrides with in-panel syntax documentation.
• Add explicit symlink policy: deny by default, with Linux-only inside-root following for static files; PHP-FPM remains restricted to deny.
• Add a bounded .htaccess compatibility layer for common Apache migration rules, including rewrite conditions/rules, directory index/listing, MIME, headers, Expires and PHP AddHandler integration, with a dashboard documentation modal and fail-closed security-sensitive directives.
• Add one-shot Web Service presets for Static, SPA, PHP generic, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads, with optional deterministic hardening for common exploit probes/sensitive paths and fingerprint-header stripping.
• Expose vhost-wide request/active/error/EWMA/traffic metrics for Web Server-only vhosts and fix custom logging mappings for route/cache/transform effective fields.
• Add bounded per-vhost Traffic analytics, User-Agent logging and opt-in country/GeoIP logging with top-dimension views, effective-client-IP rankings and donut charts for the main dimensions.
• Keep Web Service dashboard rendering stable when configuration loads before the deferred Web Server UI module and use the existing generic/custom 403 error-page pipeline when directory listing is disabled.
• Add automatic allocator release and idle HOT-cache waterline trimming so sustained traffic does not require a vhost save/reload to return reclaimable RSS.
• Add metadata-based ETag/Last-Modified, conditional 304, single Range/If-Range, 206 and 416.
• Enforce decoded-path validation and document-root confinement; Unix traversal uses openat + O_NOFOLLOW and does not serve symlinks.
• Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
• Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
• Clean README/Docs/CHANGELOG/ROADMAP material, add a canonical docs index, authenticated Markdown Reader, 0.25 specification audit and open-work TODO.
• Run compiler-enabled ./dev.sh fmt, ./dev.sh check, ./dev.sh test plus live H1/H2/H3/static-file acceptance on the release host.

Web Server follow-up

Future Web Server work must retain the 0.25 split between reusable Web Service configuration and vhost/location source selection.

• Multipart byte ranges if operational demand justifies them.
• Named locations without introducing a second URL router.
• Opt-in PHP PATH_INFO script/path splitting with an unambiguous confinement rule.
• Race-resistant filesystem confinement for non-Unix targets before enabling local file serving there.
• Real PHP-FPM release-host acceptance over Unix socket and loopback TCP.

See docs/TODO.md for unresolved work and release acceptance, and docs/ROADMAP_HISTORY.md for completed historical milestones.