RustProxy/CHANGELOG.md

Changelog

User/operator-facing release history. Low-level compiler fixes, internal refactors, test-only changes and packaging implementation notes were moved to docs/CHANGELOG_TECHNICAL_ARCHIVE.md.

0.27.2

• Fix managed ACME issuance/renewal after the 0.27.1 private-Python change: Certbot is now launched through the final managed interpreter (acme-python/bin/python -m certbot) instead of the pip console script whose absolute shebang still referenced the temporary acme-python.installing path after the atomic directory rename.
• Validate managed Certbot through the same module-based launch path, so already-created 0.27.1 environments recover immediately after upgrade without deleting or rebuilding /var/lib/rustproxy/acme-python.
• Keep the distribution Certbot fallback unchanged for systems where the managed environment cannot be used.
• Keep SQLite schema 8 and the saved configuration format unchanged.

0.27.1

• Show ready-to-run first-administrator setup-token commands instead of requiring a $DATA_DIR placeholder substitution.
• Move Certbot automation to a RustProxy-managed Python environment under the application data directory, initialized automatically with venv/pip and an app-local virtualenv bootstrap when needed.
• Retain distribution Certbot as a fallback when available and expose managed/system/unavailable runtime state in the Certificates panel, including explicit missing-Python/pip diagnostics for minimal systems such as OPNsense.
• Add account-scoped column and direction sorting to vhosts, Docker vhosts, redirects, 404 hosts and streams with feature-specific columns; Redirects and 404 hosts use the same search/sort/action toolbar layout as Vhosts.
• Replace the development-only Certbot hook example with the installed production binary plus explicit data directory, and expose the official source/package repositories plus Python/pip/Certbot runtime state in the startup banner and About/runtime views.
• Keep SQLite schema 8; administrator sort preferences are additive/defaulted and require no migration.

0.27.0

• Enable downstream response compression by default for zstd, Brotli and gzip; keep deflate opt-in. Client q-values remain authoritative and equal-quality encodings use zstd -> br -> gzip -> deflate priority. Existing Content-Encoding is passed through unchanged.
• Compress eligible authenticated/cookie/private/no-store responses instead of broadly excluding them. Explicit no-transform, ranges, SSE, upgrades and already encoded responses remain uncompressed by RustProxy.
• Add inherit/enable/disable dynamic-compression controls plus per-scope zstd/Brotli/gzip/deflate filters to ordinary vhosts and Web Server services. Docker vhosts use a deliberately simpler single Compression checkbox and always use the codec set/priorities from global Response settings. Global Response settings remain the hard codec ceiling and own the minimum size.
• Keep every explicitly published Docker hostname routed until it is explicitly unpublished. Missing services return 503 Service Unavailable; temporary agent failures reuse the last successful inventory when present, and returning services are reattached automatically.
• Fix HOT/COLD cache progress meters so their configured-limit fill is visible in Chromium/WebKit and Firefox.
• Make fresh installations emit Server: RustProxy by default while preserving existing saved/legacy behavior.
• Remove Debian package-build metadata from the main source tree; ready Debian packages are maintained separately at https://rustproxy.linuxiarz.pl.
• Keep SQLite schema 8; the new compression override fields are defaulted/additive and require no database migration.

0.26.7

• Add HOT and COLD cache occupancy progress bars on /cache for configured object and byte limits, with explicit percentage/limit details.
• Verify cache Age progression on stored HITs and retain 0.26.6 compatibility for existing custom Age rules. Response-side Age rules are deferred to the final wire stage so they cannot alter internal freshness/storage. Successful validator revalidation still legitimately restarts HTTP freshness age while X-Cache-Resident-Age continues to grow.
• Restore downstream compression for cookie-bearing responses only when RustProxy is serving a shared-cache HIT already accepted by cache policy or a local static Web Server response; privacy-sensitive dynamic/cookie responses remain excluded.
• Keep Content-Encoding/Vary: Accept-Encoding negotiation for gzip, Brotli, Zstandard and deflate, and make the bundled compression tester stop forcing Cache-Control: no-cache unless explicitly requested.
• Preserve compatible backend upstream clients across unrelated active-snapshot rebuilds so generation age, generation request count and rotation totals do not reset spuriously.
• Keep age-based and request-count upstream client recycling active while making long-running rotation diagnostics reliable.
• Update the OCI image to ship Certbot with the supported Cloudflare, OVH and RFC2136 DNS plugins in one pinned Python environment, and refresh container/install documentation.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.6.

0.26.6

• Persist and reapply backend diagnostics column and sorting preferences as account-scoped user preferences.
• Reset the certificate-creation form after an ACME issuance job succeeds; failed jobs keep non-secret values for correction.
• Fix ACL evaluation so explicit IP allow ranges and allow-only countries can independently satisfy the same default=deny policy while explicit denies continue to take precedence.
• Rework the ACL profile editor around two readable policy modes: block by default + allow country/IP exceptions and allow by default + block country/IP exceptions, with a live OR-policy preview and a retained custom mode for mixed rules.
• Refresh dynamic ACL editor translations after the language bundle loads or the user changes language, preventing raw keys such as aclProfileNew or aclProfilePreviewBlocksAll from appearing in the UI.
• Accept single IPv4/IPv6 host addresses in ACL rules without requiring users to type /32 or /128; CIDR input remains supported.
• Document migrate_npm.py sibling-module requirements and correct the container migration example.
• Detect Linux runtime type in Process diagnostics and make LXC uptime/load container-aware while leaving VM/host and other environments on the existing statistics path.
• Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.5.

0.26.5

• Keep compact toolbar selects and neighboring inputs on one interface-scaled control box so filters such as Stored Logs no longer render mismatched heights.
• Make Streams -> Add TCP/UDP listener navigate to Settings -> Listeners instead of opening the Stream editor.
• Keep SQLite schema 8 and the saved proxy configuration format unchanged; no migration is required from 0.26.4.

0.26.4

• Add 404-host editors to the session draft dock so unfinished 404 forms can be minimized, switched away from and restored like Web Server, Vhost, Redirect and Stream drafts.
• Complete Polish Button style translations and align compact toolbar search/filter inputs with the selected button height.
• Standardize modal Enabled controls for 404 hosts, Redirects and Streams on the vhost state-control presentation.
• Replace the Overview-card checkbox list in Appearance with compact responsive visibility/reorder tiles.
• Make age-based upstream client recycling run from backend maintenance even without traffic, fixing idle backends that could remain at rotation count 0 for hours.
• Keep SQLite schema 8 and the saved proxy configuration format unchanged; no migration is required from 0.26.3.

0.26.3

• Make the Settings -> Appearance interface scale global across the authenticated administration UI, including dialogs, overlays and other top-level surfaces, and extend the selectable range from 80-125% to 70-125%. Form fields also receive a bounded proportional size adjustment so they track the selected scale more visibly.
• Reduce padding and typography in the Overview telemetry cards so the dashboard stays compact at wide resolutions while retaining the existing responsive layout.
• Expand chart presets from four to eight: Default, Soft, Technical, High contrast, Neon, Monochrome, Warm and Cool.
• Make chart presets alter the full presentation palette: line colors, chart surfaces, grid treatment, line weight/caps and contrast now change together across overview diagnostics, vhost/stream charts and Traffic donut/bar charts.
• Restyle the session draft dock as a square-corner RustProxy panel with ordinary panel surfaces, thin separators and compact rows instead of a rounded blurred floating card.
• Let the draft dock collapse to a single title bar and show the age of each suspended editor draft, while keeping drafts session-only and independently restorable/discardable.
• Add a Settings search field that filters settings categories by their translated label and page content without rebuilding forms or discarding unsaved values.
• Add color-palette selectors beside chart presets so the visual character of each chart theme is visible before/while selecting it.
• Add independent Normal/Compact/Ultra compact density controls for tables/logs and for Overview telemetry cards; these are separate from the global 70-125% interface scale.
• Make the Overview telemetry row configurable per administrator: cards can be hidden, restored and reordered without changing runtime telemetry collection.
• Add per-section Appearance reset actions for Interface, Charts, Tables/Logs and Dashboard, while retaining the full Appearance reset and preserving unrelated account-scoped preferences.
• Add an account-scoped Button style preference: Normal keeps the refreshed control sizing, while Compact restores the smaller source-style button dimensions without changing global interface scale. Apply it consistently to generated vhost actions and tabs inside dialogs.
• Keep appearance data in the existing account-scoped administrator preference JSON; SQLite schema 8 and the saved proxy configuration format are unchanged, so no data migration is required from 0.26.2.

0.26.2

• Add a bottom-right draft dock for unfinished Web Server, Vhost, Redirect and Stream editors. Closing a dirty editor minimizes its exact in-session state instead of leaving stale modal state or blocking a new editor; drafts can be restored or discarded independently.

• Add Settings -> Appearance with account-scoped theme, automatic/explicit language, 80-125% interface scale, 12/24-hour time display and chart-style presets. These preferences are stored in the existing administrator preferences row.

• Apply the selected time format across dashboard timestamps and make expanded Stored Logs records more compact for long entries.

• Combine Stored Logs and Live Logs under one top-bar Logs menu.

• Replace the Stored Logs filter matrix with an optional source selector plus a single field-query search supporting field:value, explicit AND, ! negation, quoted values, wildcards and numeric comparisons.

• Build selectable Stored Logs columns dynamically from JSON fields instead of fixed matched_by/SNI protocol columns; saved account preferences can retain discovered fields.

• Parse RAW error-log lines into timestamp, level, target, message and detectable key=value fields, while preserving the original raw line.

• Show parsed field/value details for a selected record with raw JSON available on demand, and move the column picker to the upper-right table toolbar.

• Remove the configured-file inventory while retaining an optional source selector; bounded searches scan configured sources together by default or one selected source on demand.

• Replace backend sort-direction text with ↑/↓ symbols.

• Keep SQLite schema 8 and the existing saved proxy configuration format; no data migration is required from 0.26.1.

0.26.1

• Route low-level protocol errors to per-vhost persistent logs when a vhost can be safely resolved from HTTP authority/Host or TLS SNI; unknown, malformed and non-attributable traffic remains in _unmatched.jsonl.
• Add sni, authority, matched_by, reason and error diagnostics to stored protocol-error records while keeping the 0.26.0 compatibility fields.
• Keep protocol-error persistence independent from the Live Logs memory buffer.
• Improve Logs Explorer with selectable saved columns, a sticky table header, highlighted selection and inline JSON record details.
• Collapse the configured-file inventory by default, repair mapped client_ip display and extend keyword filtering to protocol diagnostics.
• Keep schema 8 and the existing saved proxy configuration format.

0.26.0

• Add persistent protocol-error traffic records for malformed HTTP, TLS ClientHello/handshake failures and timeouts, HTTP/2/HTTP/3 protocol failures, invalid h2c bootstraps and rejected connection/stream limits. These records use the existing bounded external logging queue and do not enter the Live Logs memory ring.
• Add a built-in read-only Logs explorer at /logs, reachable from the top bar and Settings -> Logging, with source, text, event, status-class, client-IP and vhost filters plus bounded pagination and JSON record inspection.
• Keep the stored-log explorer independent from Live Logs: it reads only configured access/error files, including existing files when file logging is currently disabled.
• Harden local log-file access with regular-file checks and O_NOFOLLOW on Unix; the browser API never accepts an arbitrary filesystem path and enforces bounded bytes, lines, sources, offsets and page sizes.
• Extend structured access-log fields with event, protocol_error, error_detail, local_addr and tls_sni so protocol failures can be distinguished from ordinary request records.
• Keep SQLite schema 8 and the existing saved configuration format; no data migration is required from 0.25.7.

0.25.7

• Add one-click vhost enable/disable actions and make the vhost editor Enabled control clearly stand out with an explicit state indicator.
• Add search, sorting and selectable columns to the main Backends diagnostics table; visible columns and sort order are saved in the existing account-scoped administration preferences.
• Theme dashboard scrollbars for dark and light modes.
• Add ordinary/Docker Prometheus metrics for backend retry attempts/successes and upstream-client generation, generation request count, generation age and rotations.
• Add Grafana panels for ordinary and Docker backend client lifecycle, retries and rotations.
• Keep SQLite schema 8 and the existing configuration format; no migration is required from 0.25.6.

0.25.6

• Show upstream Hyper client generation, request budget progress, generation age and rotation count in the live Backends diagnostics table, sourced from the same /api/events status snapshots as the existing backend metrics.
• Retain the configurable backend client generation recycling and HTTP/1 buffer ceiling introduced in 0.25.5.
• Keep SQLite schema 8 and the existing configuration format; no migration is required from 0.25.5.

0.25.5

• Bound long-lived backend Hyper client generations with configurable request-count and age recycling, add a configurable upstream HTTP/1 read-buffer ceiling, and expose per-backend rotation diagnostics without reloading vhosts or purging cache.
• Expand Prometheus/Grafana coverage with bounded Traffic analytics for countries, fixed User-Agent families, methods, status classes, cache outcomes, routes and serving source; add explicit built-in Web Server inventory/source metrics while keeping raw IPs, paths and full User-Agent values out of Prometheus labels.
• Add an About dialog in the dashboard top bar with project author, open-source notice and source repository link; rename the top-bar Docs action to Documentation.
• Replace the always-expanded mobile dashboard navigation with a compact on-demand Menu control that closes after section selection, Escape or an outside click; desktop navigation is unchanged.
• Make the Revision History modal use the same square-corner dialog styling as the rest of the dashboard and remove its duplicated modal/backdrop CSS.
• For vhosts using verified Cloudflare client-IP mode, use trusted CF-IPCountry for country analytics/logging and country rules, falling back to local GeoIP when the header is absent or invalid.
• Keep SQLite schema 8 and the existing configuration format; no database migration is required from 0.25.4.

0.25.4

• Add restore from retained configuration history. An older retained document is validated and saved as a new revision instead of rewinding or overwriting history.
• Protect restore with the current-revision compare-and-swap, administrator session and CSRF controls, and record the source/new revision in administration audit.
• Keep SQLite schema 8 and the 512-revision retention limit; no database migration is required from 0.25.3.

0.25.3

• Add vhost and Custom-location HTTP method allow/block policies, with location-level reusable ACL profiles, inline IP ACLs and country access rules enforced before origin work.
• Forward a per-request SHA-256 X-Request-ID to backends and keep the same identifier in diagnostics and access logs for end-to-end correlation.
• Retain the newest 512 manual-configuration revisions and add a calendar-style dashboard history modal with revision metadata and path-level change previews.
• Migrate the embedded SQLite schema from 7 to 8 for configuration-history retention while preserving existing configuration automatically.

0.25.2

• Allow password-encrypted full backups while RustProxy is running by using a consistent SQLite snapshot and a private staged copy of durable filesystem state; restore remains offline and atomic.
• Preserve validated internal relative symlinks in backup/restore, including Certbot live/ links into archive/, while rejecting absolute, escaping and dangling links. Version-1 backup archives remain restorable.
• Recover a restored/resumed authenticated dashboard tab from a transient auth.invalid_origin response with one bounded same-origin reload; server-side Host, Origin, request-marker and CSRF validation remain unchanged.

0.25.1

• Reorganize Traffic into compact Overview, Clients, Requests and Delivery sub-tabs and visualize all bounded analytics dimensions with donut or horizontal bar charts instead of requiring a long page scroll.

0.25.0

• Add reusable Web Services with document root, ordered index files and optional directory listing in the new Web Server dashboard section.
• Allow vhosts and custom locations to choose Reverse Proxy or Web Server, reuse one Web Service across multiple vhosts and mix static/proxy routing in one vhost.
• Add static GET/HEAD, streaming responses, MIME/length headers, index/redirect/listing behavior, HTTP validators and single-range requests (206/416).
• Enforce document-root confinement, reject ambiguous/encoded traversal and prevent symlink escape on Unix by refusing to follow symlinks.
• Reuse the existing vhost ACL/authentication/header/error/TLS/H1/H2/H3 pipeline without adding a second router, error-page subsystem or object cache.
• Add an authenticated Docs Reader alongside the API/OpenAPI view, with a canonical documentation index, 0.25 audit and separate TODO.
• Align Web Server directory listings and Web Service cards with the RustProxy panel UI, make index files optional for listing-only services, clarify Web Server vhosts in backend summaries and show a dedicated validation error when Reverse Proxy has no backend.
• Fix Web Service card rendering and authenticated-panel refresh behavior so a UI startup error cannot be mistaken for an expired login session; also render an already-loaded configuration when the Web Server UI module registers, removing intermittent blank Web Service lists after fast page refreshes.
• Fix Web Server vhost dashboards so status, request/active/error counters, EWMA latency and traffic are populated from vhost-wide metrics even when no reverse-proxy backend pool exists.
• Fix repeated directory-listing requests so refreshing a directory does not reuse an exhausted directory offset; keep per-directory index lookup ahead of listing fallback.
• Add Web Service MIME overrides, a configurable fallback MIME type and an optional default Cache-Control policy while retaining vhost/location response-header overrides and the OS page cache instead of a second static object cache.
• Expand Web Service configuration into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs; add try_files, internal/redirect rewrites, ordered extension/MIME cache rules, fixed response headers, precompressed sidecars and forced-download extensions.
• Add bounded FastCGI/PHP-FPM execution over local Unix sockets or loopback TCP with configurable executable extensions, timeouts and concurrency; support index.php/front-controller routing and never expose PHP source when PHP-FPM is unavailable. Extend PHP-FPM configuration with explicit TCP/Unix syntax help, Authorization forwarding control, a streaming request-body limit, bounded response headers/stderr, trusted custom FastCGI parameters and validated PHP_VALUE overrides.
• Add bounded .htaccess migration compatibility for common RewriteRule/RewriteCond front controllers, DirectoryIndex/Indexes, AddType, response Header, Expires and PHP AddHandler directives, with recursive compile-time scanning, strict mode, fail-closed handling of unsupported access/handler directives and protected .ht* files.
• Add one-shot Web Service presets for Static, SPA, PHP, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads plus optional per-service hardening that blocks high-confidence exploit probes/sensitive files and strips common implementation fingerprint headers.
• Add an explicit Web Service symlink policy: deny by default, with a Linux-only static-files mode that follows links only when the opened target remains inside the configured document root.
• Split Settings -> Logging into Outputs, JSON format and Error log subsections inside the same card/sub-tab layout as Cache, and allow route, cache_effective_enabled and transform_effective_enabled in custom JSON log mappings.
• Add user_agent and optional country structured access-log fields. Country capture is disabled by default so GeoIP lookup is not added to the normal request path unless explicitly enabled or already required by country access/rate-limit policy.
• Add a bounded per-vhost Traffic dashboard with top countries, User-Agents, effective client IPs, paths, routes, methods, status classes and cache outcomes plus aggregate request/error/byte/latency counters; add donut charts for countries, User-Agents, client IPs, methods, status classes and cache outcomes.
• Use the standard generic/customizable 403 error-page pipeline when a Web Server directory has no matching index and directory listing is disabled instead of returning an implementation-specific diagnostic string.
• Reduce sustained-traffic RSS retention without configuration reloads by periodically releasing already-free glibc pages and automatically trimming only sufficiently idle HOT cache entries above a configurable target waterline.
• Harden production defaults and FastCGI boundaries: keep the one-line/bootstrap reference admin listener on loopback unless plain remote HTTP is explicitly opted into, never pass client Proxy as CGI HTTP_PROXY, reject informational FastCGI statuses, discard application-supplied response framing/hop-by-hop headers, reject symlinked .htaccess control files, use owner-only Debian service umask defaults, and prevent local .env files from entering source release archives.
• Fix CMS preset selection so choosing a non-Custom Web Service preset immediately fills and saves its generated index, try_files, PHP, delivery and cache settings without requiring a separate Apply click.

0.24.10

• Persist Error File enabled/path/format through the existing revisioned Logging configuration while retaining compatibility with older logging API payloads.
• Keep response-time history permanently visible and add an accessible explanation of the cumulative mean metric.

0.24.9

• Add a central encrypted Secret Store and migrate ACME DNS-provider credentials away from persistent plaintext storage.
• Add password-encrypted full backup/restore with authenticated encryption, integrity validation, staging and rollback-safe activation.
• Add an optional ERROR-only JSON/RAW file sink with bounded asynchronous writes, secret redaction and logrotate integration.
• Harden the built-in release checker on FreeBSD/OPNsense and other Unix platforms with system CA bundle support and bounded redirects.

0.24.8

• Expand Cache RAM diagnostics with HOT usage/limit, transient cache RAM breakdown and COLD storage occupancy.
• Move the long RSS/cache accounting explanation behind an accessible information control while keeping COLD disk usage separate from process RAM.

0.24.7

• Make transform temporary-memory and concurrency ceilings configurable, preserving safe defaults for existing installations.
• Add persisted RAM saver, Recommended, Performance and Uber performance transform resource presets without changing transformation semantics.
• Add safety warnings and live resource accounting for transform RAM/slots, cache RAM and COLD disk occupancy.
• Include transformation representation/eligibility settings in cache compatibility identity while excluding resource-only capacity settings.

0.24.6

• Persist selected HOT/COLD cache preset identities and restore them in Settings.
• Add a Recommended COLD policy preset while preserving operator-selected disk path and capacity.
• Bound transformation buffers/decompression and background cache work to prevent unbounded memory/task growth.
• Bound stale revalidation, proactive refresh, COLD cleanup and delete fallback work.

0.24.5

• Fix empty, length-unknown HTTP/3 request forwarding to HTTP/1.1 origins while keeping non-empty bodies streaming.
• Harden HOT/COLD cache memory admission with allocation-aware HOT limits and separate transient/COLD-queue RAM budgets.
• Expose HOT logical/allocated/transient memory and pressure counters.
• Make global cache disable authoritative over per-vhost settings and remove the artificial 1 GiB HOT/object ceiling.
• Add host/cgroup-aware cache memory presets and safety/headroom guidance in Settings.

0.24.4

• Reduce Linux RSS amplification by disabling Transparent Huge Pages only for the RustProxy process, without changing the host-wide THP policy.

0.24.3

• Add per-certificate reload for manual/file-backed certificate IDs and scoped Certificate API authorization.
• Allow multiple Certificate API keys with comments, individual revocation and revoke-all while storing only token hashes.
• Add Linux allocator tuning and reduce avoidable transformation allocations to improve long-running RSS behavior.
• Move HTTP/2 lifecycle tuning to listeners, align HTTP/3 tuning, and keep compatibility fallback for older configuration.
• Improve dashboard process/platform diagnostics and remove stale platform-specific source from release output.

0.24.2

• Version-only release bump from 0.24.1; no functional, configuration or protocol changes.

0.24.1

• Restore portable network-interface discovery/RX/TX counters and add broader portable system/process diagnostics.
• Expose authenticated runtime metadata for platform, statistics source and resolved data/database paths.
• Make local CLI data-directory discovery support Linux and BSD/OPNsense conventions.
• Move Logging into Settings -> Logging while retaining legacy /logging navigation compatibility.

0.24.0

• Replace abrupt downstream H2 idle termination with a GOAWAY-based graceful shutdown that rechecks current activity and waits for accepted streams.
• Add independent H2 idle timeout, maximum connection lifetime and drain timeout settings; lifetime may be disabled with 0.
• Bound H2 draining so stalled streams cannot keep a retiring connection open indefinitely.
• Keep H2 Extended CONNECT/WebSocket streams under the same active-stream accounting and graceful drain path.
• Extract system statistics into platform backends while preserving Linux metric names, units and behavior; add native FreeBSD/OpenBSD/NetBSD sampling where available and explicit nulls otherwise.
• Add runtime platform to Proxy Process and Prometheus platform info.
• Expose H2 lifecycle controls through Settings and the administration API.
• Reorganize Settings -> HTTP connections into HTTP/2 and HTTP/3 sub-tabs; move listener-scoped H3/QUIC enablement and limits out of the Listeners editor while preserving restart semantics and the existing listener configuration model.

0.23.3

• Make external certificate deployment convergent: create missing manual certificate ids, rotate existing manual ids, no-op identical RustProxy-owned generations, and keep managed ACME ids protected from external ownership.
• Make the OPNsense os-acme-client hook reconcile on every run so RustProxy remains the source of truth and deleted/drifted external certificate entries self-heal.
• Add per-vhost Enable WebSocket legacy support for older appliance/embedded WebSocket implementations.
• Force legacy-mode WebSocket upstream handshakes to HTTP/1.1 and force the WebSocket Host to the configured backend authority and align Origin to the matching backend scheme + authority.
• Tolerate legacy 101 Switching Protocols response framing while keeping Sec-WebSocket-Accept and subprotocol validation strict.

0.23.2

• Add selectable 60/120/300/600-sample history windows to the Cache and Transformation live charts, with bounded per-workspace browser persistence.
• Fix rust-proxy --livelogs on HTTPS administration listeners by detecting the HTTP 308 redirect and reconnecting over TLS instead of looping.
• Pin local CLI HTTPS to leaf certificates present in the private data-dir/certs directory and reuse the HTTP/HTTPS-aware client for config and certificate CLI API calls.

0.23.1

• Add default-collapsed, full-width live activity charts to the Cache and Transform workspaces.
• Plot Cache HIT/MISS/BYPASS rates for the selected scope using deltas from the existing cache runtime counters.
• Plot Transform applied/cache-HIT/skipped/error rates for the selected scope using the existing transform metrics endpoint.
• Reuse the administration dashboard SVG/grid/legend visual language, keep the existing 3-second live refresh, and add English/Polish language-pack labels.

0.23.0

• Bound inactive inbound HTTP/2 connections to five minutes so idle TLS/H2 sessions cannot accumulate indefinitely toward the process connection limit; export rust_proxy_http2_active_connections for direct diagnosis.
• Account hot-cache response-body backing allocation capacity rather than only visible body length, preventing BytesMut growth slack from bypassing the configured RAM budget and under-reporting resident cache memory.
• Add a scoped external Certificate API credential managed from a new Settings → Certificate API tab. RustProxy stores only the token hash plus a non-secret Key ID; the cleartext token is returned only on rotation.
• Allow the scoped Key ID + Bearer Token only on POST /api/certificates/deploy and POST /api/certificates/reload, require HTTPS for non-loopback token use, track last use, support immediate revoke, and retain normal administrator-session/CSRF access as an alternative.
• Keep production certificate operations available directly from the installed binary (rust-proxy tls deploy / rust-proxy tls reload) without requiring dev.sh.
• Add rust-proxy --livelogs: an interactive varnishlog-style all-vhost live access stream with structured filters (host, vhost, backend, route, client, method, transport, cache, status classes, path prefix, errors and slow requests), pause/resume, per-request JSON inspection and detailed error/WebSocket/H3/cache fields.
• Back live logs with a bounded non-blocking broadcast stream and authenticated SSE endpoint; slow consumers receive an explicit gap event with the dropped-entry count instead of silent loss.
• Additional historical details for this release are retained in the technical archive.

0.22.3

• Add downstream HTTP/1.1 Upgrade: h2c on listeners that explicitly enable cleartext HTTP/2, preserving the existing prior-knowledge path and rejecting malformed/body-bearing upgrade attempts before protocol switch.
• Add authenticated POST /api/certificates/reload and tls reload to re-read configured public certificate/key files and hot-publish a fresh TLS/H2/H3 snapshot without changing the desired configuration revision.
• Add tls deploy --id ... --cert ... --key ... and authenticated POST /api/certificates/deploy for externally issued local certificates such as Certbot. The CLI performs bounded local reads while the running service owns pair/SAN validation, immutable generation staging, revision-CAS publication and rollback on failure, avoiding root-owned staged PEMs when Certbot hooks run as root.
• Keep all vhosts assigned to one manual certificate id synchronized during external rotation; reject RustProxy-managed ACME ids to avoid dual renewal ownership and report the administration-TLS restart caveat explicitly.
• Add Certificates-panel reload controls and certificate audit events.

0.22.2

• Add bounded replay-safe backend failover retry for body-free GET/HEAD/OPTIONS requests, including retry policy controls, passive-health integration, logs and per-backend retry counters.
• Correct explicit HTTP/2 upstream requests and h2c prior-knowledge forwarding.
• Add per-backend request-concurrency limits with bounded capacity waiting, 503 rejection and capacity/queue-timeout metrics. This limits full proxy exchanges, not TCP socket count.
• Add detailed upstream failure classes, last failure detail/timestamp, and backend health ejection/recovery timestamps to runtime diagnostics and Prometheus.
• Expand the backend administration table with concurrency capacity, last failure and last recovery columns.
• Parse public X.509 leaf metadata for issuer, SANs, validity, remaining days and expiry warning state, and surface ACME renewal status/last attempt/error in certificate inventory.

0.22.1

• Vhost UX: replaced separate WebSocket/H2 RFC 8441/H3 RFC 9220 checkboxes with one transport selector; H2/H3 modes keep HTTP/1.1 Upgrade as an explicit fallback and unavailable transports are disabled from listener capabilities.
• UI polish: replaced the overview TLS listener tile with compact HTTP protocol and WebSocket protocol mini charts; Target and Cache key/tags cells remain copyable with full values.
• Keep the overview metrics in one shared stats grid so the WebSocket/H2/H3/TLS row uses exactly the same card geometry as the primary metrics, without a transport-specific dashboard layout. Make Cache Target and Cache key / tags cells copy their full untruncated value on click/keyboard activation.
• Polish the 0.22.1 administration UI: move Active tunnels into the WebSocket dashboard card, flatten the H1/H2/H3 tunnel breakdown to match the standard transport-card styling, and align Cache modal close actions with the vhost modal header pattern.
• Move selective cache PURGE/BAN and the active BAN list into dedicated Cache modals, keep their launch actions beside Purge selected scope, and use null-safe inline operation feedback consistent with login errors.
• Add opt-in RFC 8441 WebSocket Extended CONNECT for HTTP/2, with per-vhost controls beside RFC 9220, listener-scoped SETTINGS advertisement, H2-to-H1 bridging, explicit H2 upstream forwarding, cancellation/idle timeout and transport-specific metrics.
• Add opt-in cleartext HTTP/2 prior-knowledge (h2c) listeners. Legacy HTTP/1.1 Upgrade: h2c remains deliberately unsupported because the current Hyper integration cannot safely reconstruct the required HTTP/2 stream 1 bootstrap.
• Add stable active-tunnel IDs, authenticated tunnel inventory/kill API, operator-supplied close reasons, audit records, RX/TX/duration metadata and an administration modal.
• Additional historical details for this release are retained in the technical archive.

0.22.0

• Add per-cache-key request collapsing for foreground MISS/fill traffic with bounded wait, configurable timeout fallback, cancellation-safe leader release and collapse metrics.
• Add single Range: bytes=... handling from complete cached objects, including 206, 416, Content-Range, Accept-Ranges and If-Range; multipart/unsupported ranges remain origin pass-through and are not cached as separate objects.
• Extend stale-if-error with configurable transport failure classes and an explicit 5xx status allowlist while preserving the previous default behavior.
• Add bounded proactive cache refresh with pre-expiry scheduling, deterministic sampling, concurrency limits and reuse of the existing validator revalidation path.
• Add selective cache PURGE by exact URL, prefix, tag, regex or cache key, including query/Vary handling, RAM + Cold Cache invalidation and a publication barrier preventing pre-PURGE fills from republishing stale data.
• Add lazy BAN rules with lookup-time enforcement, bounded rule count/TTL, incremental garbage collection, rule deletion and metrics.
• Add authenticated administration API and Cache panel controls for PURGE/BAN, broad-operation confirmation, per-object Purge URL actions, BAN listing/removal and audit entries.

0.21.0

• Fix browser refresh on the dedicated Transform route by serving the dashboard document at /transform.
• Add a dedicated Transform administration workspace with global/per-vhost runtime counters for applied/skipped/error transformations, transformed cache HITs, byte savings, reduction, transform time, kind breakdown and bounded skip reasons.
• Add a transformed-response series to Live traffic (fresh transformations plus transformed cache HITs) and render Core state uptime in compact human-readable units.
• Rename the proxy-owned backend timing diagnostic to X-RustProxy-Backend-Time; the legacy lookalike X-Rust-Proxy-Backend-Time is stripped but is no longer emitted.
• Persist transformed-representation metadata through hot/Cold Cache, mark transformed objects in the Cache dashboard, and append transformed to standardized RFC 9211 Cache-Status diagnostics; origin X-Cache-Status lookalikes are stripped rather than emitted.
• Shard Cold Cache storage and add bounded asynchronous garbage collection plus selective manual cleanup.
• Add RFC 5861 stale windows, request max-stale, age-aware request max-age=N, and correct must-revalidate / proxy-revalidate behavior while preserving s-maxage priority.
• Harden transformed cache fills so transformed Content-Length is authoritative, incomplete streams cannot publish partial objects, and canonical transformed identity representations do not fragment on origin Vary: Accept-Encoding.
• Additional historical details for this release are retained in the technical archive.

0.20.0

• Rebuild Certificates into Installed / Renewal / Generate tabs using the same accessible keyboard tab pattern as Settings.
• Keep certificate issuance, PEM import and existing-file registration inline in the Generate tab; successful imports and edits return to Installed.
• Add explicit ACME operation state cards and include the exact private Certbot log directory in failed issuance/renewal messages.
• Expose per-managed-certificate Certbot log directories from the authenticated ACME status endpoint so persisted renewal failures remain actionable after refresh/restart.
• Rework renewal entries into readable cards with provider/environment, last check, next check, expiry and grouped actions.

0.19.4

• Preserve backend traffic display semantics: idle renders as 0.0 KiB/s, and positive rates below 0.1 KiB/s render as <0.1 KiB/s in both backend rows and aggregate vhost traffic.
• Add a presentation filter to Cache -> Domains and effectiveness with All / Cache enabled / Cache disabled choices, using each vhost's resolved cache settings while leaving aggregate statistics unchanged.

0.19.3

• Simplify the dashboard footer to API latency and dropped-log count, and add a fail-soft built-in release checker using embedded UPDATE_CHECK.toml defaults. The checker reads the official Cargo manifest immediately and then hourly, exposes a newer-version link in the footer, and never performs automatic upgrades.
• Allow runtime release-check overrides through --update-repository-url, --update-version-url and --update-check-interval-secs (plus matching RUST_PROXY_* environment variables); interval 0 disables checks.
• Add an account-scoped light/dark administration theme stored in the existing SQLite admin_preferences document; dark remains the default and the last authenticated choice is cached locally only to avoid login/dashboard first-paint theme flicker.
• Additional historical details for this release are retained in the technical archive.

0.19.2

• Restore the vhost local-listener risk control for administration backends when the administration socket is startup-locked or otherwise reported only by live status; treat localhost, 127.0.0.0/8 and ::1 as equivalent loopback forms for the same administration port.
• Make Discard changes reload the persisted vhost being edited instead of replacing the editor with a new blank/default vhost.
• Add descriptive HTTP reason phrases to the default-response status selectors and headings.
• Add a temporary, continuously updated 4096-entry Live-log buffer that resets when the log window closes.
• Stop backend traffic EWMA tails on an idle sampling window, show idle consistently as 0.0 KiB/s, and render positive sub-0.1 KiB/s traffic as <0.1 KiB/s instead of a rounded zero.
• Additional historical details for this release are retained in the technical archive.

0.19.1

• Add frontend scheme to the primary cache hash so otherwise identical HTTP and HTTPS requests cannot reuse one object.
• Retain 4096 completed access-log entries while keeping the 256-entry live window; add one-shot on-demand history loading and document the API limit.
• Render backend traffic with KiB/s as the minimum unit, simplify the Live Logs column picker, align generic checkboxes and move Docker-vhost Advanced switches beside Backend protocol on desktop; remove the redundant alias help line.

0.19.0

• Persist per-administrator Live Logs column visibility in SQLite schema v4 without changing the revisioned proxy configuration; JSON export remains complete regardless of visible columns.
• Add authenticated GET/PUT /api/preferences endpoints for dashboard-only account preferences, protected by the existing session/CSRF control-plane guards.
• Retain the full disabled-verification legacy X.509 fix and expanded upstream connector diagnostics introduced during the 0.18.8 follow-up.

0.18.8

• Make backend tls_verify=false a complete certificate-authentication bypass instead of delegating TLS CertificateVerify to webpki. This restores compatibility with legacy appliance certificates such as X.509 v1 while keeping TLS encryption and all backend address/DNS/loop protections in force; tls_verify=true is unchanged.
• Expand upstream connection diagnostics with the full nested Hyper/rustls/io error chain, backend/TLS context, 2 KiB UTF-8-safe detail storage and warning-level journal entries for connect failures.
• Replace Docker-vhost alias comma input with hostname-style chips for add/remove/paste workflows.
• Add per-Docker-vhost HTTP-to-HTTPS redirect, WebSocket and cache controls; new compatible assignments default HTTP-to-HTTPS redirect on while legacy assignments retain their prior redirect-off behavior until explicitly saved.
• Add a Docker-agent default ACL-profile selector. Generated Docker vhosts inherit it unless the application selects its own ACL profile; existing per-app inline ACL configuration is unchanged.
• Additional historical details for this release are retained in the technical archive.

0.18.7

• Collapse Response time history by default on the Overview dashboard while keeping live sampling active.

0.18.6

• Add bounded per-interface RX/TX diagnostics from /proc/net/dev to the administration status payload and render separate live interface histories without adding per-interface Prometheus labels.
• Clarify compression negotiation and make dashboard counters track the codec actually selected per response.

0.18.5

• Add an explicit HTTP/1.1 request counter and render total + HTTP/1.1 + HTTP/2 + HTTP/3 request-rate series on the Overview chart.
• Add an Open app action to published Docker vhosts, using the assigned frontend listener and expanded proxied hostname.
• Label Docker-generated pools in the Backends view with their primary proxied domain.
• Remove the global Open proxy shortcut from the page header.
• Make Compact density materially tighter than Dense across cards, controls, tables, Docker rows and charts.
• Default vhost/Docker proxy timeout controls to explicit 10/120/60/60-second connect/header/read/send limits instead of blank inherited values.
• Additional historical details for this release are retained in the technical archive.

0.18.4

• Default backend health checks to TCP for newly created or otherwise defaulted ordinary and Docker vhosts; explicit existing HTTP/off health modes are preserved.
• Replace the dense Docker-vhost service editor with summary-first rows. Publish state, service identity, backend runtime health and Hide/Show stay visible; routing, ACL, timeouts and health tuning are expanded only for the selected service.
• Collapse secondary Docker-agent inventory metadata behind Agent details while keeping host, service count, last observation and base domain immediately visible.
• Rework Settings -> Security into focused account/session and host-policy cards with on-demand password and policy editors.
• Move Administration audit into a dedicated modal and stop fetching audit entries merely by opening the Security settings tab.

0.18.3

• Add Docker-vhost search plus persistent per-browser Hide/Show Hidden view controls, and allow each Docker agent to select a configured frontend certificate inherited by its generated vhosts.
• Keep Docker inventory polling driven by each agent's configured 5..3600 second interval; the 5-second dashboard refresh reads cached observations only.
• Move redirect HTTP/2 and HTTP/3 toggles below listener selection and keep Cache Updated + Live together at the right side of the toolbar.
• Add an Open-in-browser action beside each vhost Enabled state; wildcard-only hosts open the wildcard base domain, while mixed host lists prefer the first non-wildcard name.
• Restore the documented HTTP/1.1 backend default for newly created ordinary and Docker vhosts: preserve the public Host; existing explicit backend settings are not rewritten.
• Write HTTP/1 upstream header names in conventional title case for compatibility with legacy/custom origins that incorrectly treat header names as case-sensitive; HTTP/2 is unaffected.
• Additional historical details for this release are retained in the technical archive.

0.18.2

• Secure Docker-agent transport by default with a persistent self-signed ECDSA certificate and SHA-256 certificate pinning in RustProxy; public-CA HTTPS remains available without a pin and plain HTTP is compatibility-only.
• Add certificate lifecycle handling, hardened systemd state storage and installer fingerprint output for the standalone Docker agent.
• Enable per-Docker-vhost HTTP/TCP backend health checks using the same bounded backend-pool health machinery as ordinary vhosts, with live checking/up/down, latency, probe, request, active and error diagnostics in Docker vhosts.
• Rework Docker-agent and Docker-vhost UX around connection security, last observation, detected addresses, route controls and collapsible health-check tuning while retaining per-agent domains, aliases and per-service IP selection.

0.18.1

• Extend the Docker agent inventory with all usable host addresses (interfaces, routed address, public lookup and optional advertised address) and preserve every published binding per service.
• Add per-service Docker backend-IP selection, per-agent default backend IP, arbitrary FQDNs and multiple aliases while retaining short-name expansion below each agent's own base domain.
• Support many Docker agents with independent domains such as docker1.lab.local and docker2.lab.local, plus operator-controlled custom domains.
• Remove all special X-Rust-Proxy-Revision response-header behavior; the name is no longer inserted, stripped, protected or accepted as a legacy diagnostic setting.
• Keep cache-Live placement, production password recovery and Settings navigation improvements from 0.18.0.

0.18.0

• Add a standalone Go Docker discovery agent with a hardened systemd unit, token authentication, published TCP-port inventory and host/public-IP detection.
• Add per-agent Docker configuration, in-memory observations and dynamic Docker vhosts with operator-controlled service/subdomain assignments.
• Add Docker vhost/admin UI and OpenAPI endpoints for cached observations and explicit refresh.
• Move the cache Live toggle to the action-toolbar edge.
• Remove configurable X-Rust-Proxy-Revision response exposure and always strip the header.
• Use the installed rust-proxy admin reset-password command in production recovery guidance.

0.17.0

• Add Debian packaging assets, a hardened systemd unit, rustproxy service user/state/log directories, three-day maximum-gzip log rotation, local .deb build tooling and signed APT-repository generation suitable for rustproxy.linuxiarz.pl.
• Expand Prometheus coverage across all current bounded process/OS diagnostics plus GeoIP, certificate renewal, backend health-probe detail, stream, logging and frontend inventory metrics; add explicit token-free scraping for trusted actual-peer CIDRs.
• Add a Grafana operations dashboard under grafana/.
• Add dedicated listener/certificate-aware local-response / 404 hosts with built-in placeholder, empty/status-only and custom-HTML modes.
• Keep the default RustProxy is running placeholder uncacheable and intentionally free of optional proxy/cache/backend/diagnostic/security/compression headers.
• Reuse vhost-style hostname chips for Redirect source domains.

0.16.1

• Remove internal configuration revision numbers from successful save feedback in dashboard editors/manual configuration while retaining revision-based CAS and stale-write protection internally.

0.16.0

• Decouple Custom locations from the main vhost backend fallback. Unmatched paths now use the main pool even when custom rules exist; untouched legacy synthetic root routes are normalized automatically.
• Fix same-process public administration login by allowing rustproxy_session across only a guarded HTTPS self-admin backend that directly targets the configured administration listener and whose public host is explicitly allowed.
• Make RFC 9220 bootstrap wait for the backend HTTP/1.1 upgrade before downstream H3 success, and extend access logging with transport/WebSocket phase/error/reset/upstream status diagnostics.
• Add cache transient-memory gauges and procfs RSS/data/swap breakdowns to the dashboard and Prometheus. Existing allocator trimming/release behavior is unchanged; no new transient-memory throttle is introduced.
• Reorganize the Vhost editor around clearer backend cards, Authentication subcards and compact protocol controls. New vhosts select standard HTTP :80 plus HTTPS :443 together when available; Redirects reuse the same listener selector; disabled vhost cache hides its subordinate controls and new vhost drafts default cache to off.
• Show the local-listener risk acceptance only when the entered backend URL directly targets the configured administration listener. Add protected opt-in X-RustProxy-Backend and X-RustProxy-Backend-Time response diagnostics for selected member identity and origin response-header latency.

0.15.1

• Fix Custom locations English/Polish translation loading in the administration UI.
• Make visual header rules easier to edit with numbered cards, clear field grouping, empty-state guidance and localized help.
• Add a live per-location behavior preview for matching, action, rewrite, cache, ACL and header rules, and reorganize the inline documentation with common examples.
• Add one live three-series HIT/MISS/BYPASS activity chart to the RAM cache card and CPU/RSS history charts to the Proxy process card.

0.15.0

• Expand vhost Custom locations with Nginx-style exact/prefix/^~/regex/regex-insensitive matching, upstream path preserve/strip/replace/regex rewrites and backend-free custom responses.
• Replace the location header JSON-only workflow with a visual request/response header builder, keep Advanced JSON as an escape hatch, add in-panel documentation and reorganize the location editor into compact functional sections.
• Add nagios/ API checks for administration response time, unavailable/checking backends, backend latency and dropped logging/cold-cache work, with reusable protected session cookies and Nagios performance data.
• Move per-vhost Server-Timing and verified Cloudflare client-IP diagnostics into the main frontend/details configuration.
• Add compact dashboard history charts for RAM-cache residency, network RX/TX and mean response latency, plus administration API RTT and low-priority queue/drop information in the footer.
• Add independent cold-cache age policy controls: demote by time since last access, by total hot-tier residency, by LRU pressure and on graceful shutdown.
• Additional historical details for this release are retained in the technical archive.

0.14.0

• Fix administration reverse-proxy Host/Origin handling: explicit DNS allowlist entries describe the external authority instead of the private admin socket port; direct IP/localhost access remains bound to the actual admin port.
• Trust forwarded administration host/scheme only from loopback or configured trusted proxy peers, use the external scheme for Origin/CSRF checks, and set/clear Secure session cookies consistently behind HTTPS termination.
• Implement RFC 9220 WebSocket over HTTP/3 Extended CONNECT, including SETTINGS_ENABLE_CONNECT_PROTOCOL, :protocol=websocket validation, HTTP/1.1 backend Upgrade translation, downstream 200 bootstrap, bidirectional H3 DATA transport and FIN/reset cancellation handling.
• Replace the separate h3/h3-quinn pair with hpx-h3 2.5.19 and its integrated Quinn feature to expose the RFC 9220 protocol extension through the HTTP/3 stack.

0.13.2

• Fix authenticated dashboard refresh/back-forward session restoration so valid cookies are honored on every panel document route instead of briefly rendering the login shell.
• Make managed software updates force a bounded hot-to-cold cache handoff whenever the cold tier is enabled, independent of the ordinary cold_on_shutdown preference, and extend the managed systemd stop budget.
• Persist non-secret automatic-certificate-renewal observations in SQLite schema v3, preload them before administration listeners are exposed, and import the older certs/renewals.json sidecar once for upgrade continuity.
• Move the raw full-document editor from primary navigation into Settings -> Manual config while retaining /configuration as a compatibility browser route.

0.13.1

• Make administrator browser sessions configurable from 7 to 30 days (30 days by default), replacing the previous short browser lifetime/idle behavior while preserving explicit logout/password/revoke invalidation.
• Refresh authenticated cookies only to the remaining absolute server-side expiry so session persistence cannot become an unbounded sliding session.
• Add per-backend accept_local_listener_risk with a dashboard confirmation and validation path for deliberate local-listener targets such as 127.0.0.1:9090; allow_private and special-address protections remain independent.

0.13.0

• Add first-class redirect hosts with dedicated dashboard navigation, named listeners/certificates, exact/prefix and scheme matching, URL/host/path targets, 301/302/303/307/308, path/query policies and redirect cache controls.
• Resolve redirect traffic locally before proxy routes while preserving listener ownership and global host ACLs.
• Change omitted backend tls_verify to default false and update UI/API/documentation accordingly.
• Compact TLS certificate cards: show DNS SAN coverage as the same policy-style badges used on vhosts, collapse bindings/files/assigned-vhost details, and inspect older/manual public PEM files when persisted coverage metadata is missing.

0.12.1

• Add revisioned per-section configuration PUT endpoints and move ordinary dashboard forms to them, retaining full-document updates only where multiple sections must publish atomically.
• Decouple cache compatibility from the SQLite configuration revision so logging, administration, TLS inventory, metrics and other unrelated saves do not purge hot/cold objects.
• Add explicit dashboard subpage routes plus History API navigation so browser refresh preserves the selected panel.
• Add independent cold-tier policies for idle objects, LRU evictions and graceful shutdown, reduce the cold-write body queue, flush remaining hot objects before process exit, and trim released allocator memory on glibc/Linux.
• Expose certificate DNS SubjectAltName coverage separately from active SNI bindings for uploaded and ACME-managed certificates.
• Preserve secure-by-default backend TLS verification when omitted; keep the explicit debug-origin verification bypass and improve corrective validation/help text.

0.12.0

• Move raw TCP/UDP stream management from Settings to a dedicated Streams main-navigation page directly below Vhosts.
• Add vhost-style searchable stream cards and a modal editor with Details, Listener & upstream, and Limits tabs plus an explicit Add TCP/UDP listener action.
• Add fixed-cardinality runtime telemetry per active stream: connections/sessions, completed sessions, active sessions, rejects, errors, RX/TX bytes and UDP packet counters.
• Add per-stream live RX/TX rate charts in the dashboard while keeping desired stream changes visibly pending until the process restarts and the listener is actually active.
• Change named HTTP/HTTPS listener bind-address editing from a textarea to chip-style addresses matching the Vhost hostname interaction, preserving existing multi-address validation.
• Keep stream forwarding as raw Layer 4 with no HTTP vhost, ACL, cache, headers, compression or authentication envelope.
• Additional historical details for this release are retained in the technical archive.

0.11.5

• Accept percent-encoded spaces (%20) in otherwise unambiguous request paths while preserving rejection of encoded separators, double-decoding hazards, controls and dot-segment ambiguity.
• Avoid the h3-quinn 0.0.10 stop_sending() panic path when an HTTP/3 request body is dropped while a receive read is pending.
• Add raw layer-4 TCP/UDP stream hosts on dedicated listeners with bounded TCP connections / UDP client sessions and restart-bound configuration in the admin panel.
• Add a Debian 13+ source bootstrap that installs build dependencies and Rust, clones/builds the repository and installs the systemd service with the explicitly requested public admin profile.
• Match Varnish built-in request-method behavior for the shared cache: GET/HEAD participate in lookup while successful POST/PUT/PATCH/DELETE/OPTIONS/TRACE requests no longer trigger an implicit global purge.
• Replace the conservative per-request-header/backend-member cache identity with a Varnish-style Host + URL primary identity, isolated by RustProxy vhost/config scope, and use response Vary as the secondary representation selector.
• Additional historical details for this release are retained in the technical archive.

0.11.4

• Fix Force SSL frontend validation and messaging: require an actual non-TLS listener for the incoming redirect, prefer HTTPS port 443 when multiple TLS listeners are selected, and reject only ambiguous non-standard HTTPS target ports.
• Add a visual reusable ACL-profile rule editor with add/remove/action/CIDR rows. Keep bulk paste/import as an advanced path, normalize invisible Unicode whitespace and report malformed rules with their source line.
• When a vhost disables cache, strip and suppress RustProxy X-Cache, X-Cache-Hits, Cache-Status, X-Cache-Reason and X-Cache-Resident-Age diagnostics for that response.
• Render backend pools belonging to disabled vhosts as muted Disabled rows in the main dashboard instead of classifying them as unavailable.

0.11.3

• Add per-vhost control over forwarding the effective client IP to the application. Disabling it removes Forwarded, X-Forwarded-For and X-Real-IP only on the backend request; ACLs, GeoIP, rate limiting and Tinyauth continue to use the real client identity.
• Add a compact Vhost search/filter for vhost IDs, hostnames/wildcards and backend IDs/URLs.
• Fix JSONL access logging under the hardened systemd unit by provisioning /var/log/rustproxy as a writable service log directory while keeping ProtectSystem=strict.

0.11.2

• Fix administration HTTPS access negotiated over HTTP/2. The admin guard now derives the effective authority from H2/H3 :authority (via the request URI) when no legacy Host header is present.
• Preserve strict HTTP/1.x Host handling and reject conflicting HTTP/2 Host versus :authority values to avoid ambiguous authority validation.
• Add per-vhost Force SSL beside frontend selection. Cleartext requests receive a non-cacheable HTTP 308 to the same hostname/path/query on the vhost's unique selected TLS port; ambiguous multi-port TLS selections are rejected.
• Map NPM ssl_forced (and migrator --force-https) to RustProxy force_ssl, retaining HTTP+HTTPS listener bindings when available instead of importing forced hosts as TLS-only.

0.11.1

• Fix release update health checks when the administration panel uses persisted HTTPS or a persisted bind different from the install-time CLI address. The check now resolves the active admin listener/scheme from config.sqlite3 and honors the admin Host allowlist.
• Add a standard-library-only Nginx Proxy Manager SQLite migrator. It reads proxy_host, creates RustProxy vhosts/backends, preserves wildcard names/WebSocket/enabled/H2 intent, uses the RustProxy default certificate for imported TLS hosts unless a named certificate is selected, and keeps unsupported NPM policy/custom-config items as explicit review warnings.
• Make NPM migration dry-run by default, emit npm-migration-plan.json, detect hostname conflicts, split source records above RustProxy's 16-host limit and use revisioned authenticated API writes only with explicit --apply.

0.11.0

• Add reusable ACL Profiles with optional IP/CIDR ACL and country allow/block rules. Vhost profile, inline vhost ACL and route ACL enforcement remains cumulative.
• Add an ACL Profiles navigation page and per-vhost profile selection without removing individual vhost policy controls.
• Add chip-style hostname editing and validated leading *. wildcard domains. Exact hosts win before the longest matching wildcard on the same listener.
• Add compact browser-session request-rate history charts to vhost cards, with progressive compaction of older samples.
• Add the built-in HTTP 401 page and classify normal WebSocket tunnel EOF/reset/abort/broken-pipe termination after a successful 101 upgrade as websocket_closed rather than a body/proxy error.
• Redirect plaintext requests received on the HTTPS administration socket to HTTPS while keeping application content unavailable over plaintext. Permit valid DNS Host values when the HTTPS admin hostname allowlist is empty; explicit allowlists remain strict.
• Additional historical details for this release are retained in the technical archive.

0.10.0

• Add an optional persistent cold cache tier under the private data directory. Hot LRU/idle objects demote through a bounded asynchronous queue; fresh cold hits are SHA-256 checked and promoted back into the bounded RAM tier.
• Add hot/cold object, byte, promotion, demotion, cold-hit, eviction/error and queue-drop observability to the Cache API, panel and Prometheus output.
• Add cold-tier path, byte/object budgets and idle demotion settings; purge/config publication invalidates both tiers and startup rebuilds the same-revision cold index.
• Add structured-log Standard, Nginx-style, ECS-style and Minimal presets plus a visual field picker/renamer with JSON preview; preserve advanced raw JSON mappings.
• Reuse the shared application card component for Logging sinks and remove release-specific fieldset border styling.
• Additional historical details for this release are retained in the technical archive.

0.9.0

• Redesign the vhost list as readable cards with listener/protocol/TLS/cache identity and live pool health, request, active, error, latency and traffic metrics.
• Add bounded asynchronous structured access-log sinks for JSONL files, Logstash TCP and Loki HTTP(S), with configurable JSON field mapping/static fields and sink delivery/drop/error counters.
• Expand cache object inspection with body bytes, resident bytes and metadata overhead; add optional X-Cache-Resident-Age.
• Add administration HTTPS with either the application-managed default certificate or a selected inventory certificate. Persisted non-loopback administration binds are accepted when HTTPS is enabled.
• Keep loopback HTTP as the default and retain the explicit legacy risk gate for plain remote HTTP. Secure session cookies are marked Secure on HTTPS administration.
• Add global TLS 1.2/1.3 and rustls cipher-suite policy plus per-vhost TCP TLS overrides. HTTP/3 vhosts must use the global TLS 1.3 policy.
• Additional historical details for this release are retained in the technical archive.

0.8.1

• Enable the shared RAM cache by default.
• Replace blanket conditional-request bypass with local conditional HITs for fresh If-None-Match / If-Modified-Since requests.
• Add validator-based backend revalidation: request no-cache, freshness constraints and legacy Pragma: no-cache can revalidate a stored representation; backend 304 refreshes metadata and reuses the cached body.
• Keep request no-store as a hard bypass. Allow response Cache-Control: no-cache with ETag/Last-Modified to be stored only for mandatory validation; no-store and private still forbid shared storage.
• Retain expired validator-bearing objects for a bounded one-hour revalidation keep window without stale delivery.
• Raise the configurable object ceiling from 8 MiB to 1 GiB, still bounded by the global 1 GiB resident budget.
• Additional historical details for this release are retained in the technical archive.

0.8.0

• Global static-cache defaults now include common image, stylesheet/script, font, media and download extensions, with request Cookie ignored for matching assets by default. The global and per-vhost controls are visible in the cache UI; Set-Cookie, private/no-store and Vary: Cookie still prevent shared caching.
• HTTP/2 and HTTP/3 are per-vhost frontend opt-outs next to listener selection. Controls are enabled only when a selected named listener supports the protocol; TLS H2 ALPN is narrowed by SNI per vhost.
• Settings -> Listeners uses normal page scrolling instead of an extra nested scrollbar.
• Add per-vhost request throttling with graphical request/window/burst controls, country-specific limits and country block/allow-only policies. Return built-in HTML 429/403 responses while preserving custom error-page overrides.
• Download the PDDL sapics/ip-location-db user-country IPv4/IPv6 data during first installation over HTTPS and verify publisher SHA-256 checksums; expose load status without exposing client data.
• Verify the installed GeoIP database against current publisher SHA-256 files on every managed update and download only stale/missing assets before downtime.
• Additional historical details for this release are retained in the technical archive.

0.7.3

• Generate the one-time administrator setup token from the release CLI even before the first server start; retain the rule that it is invalid after setup completes.
• Add explicit remote-panel opt-in for 0.0.0.0/::, requiring both --allow-remote-admin; keep plain-HTTP risk visible.
• Make Linux/systemd install defaults listen on HTTP 80 and HTTPS 443; add --no-https for explicit HTTP-only installation.
• Hotfix backend HTTPS-by-IP with optional tls_server_name: TLS SNI and hostname verification may use a DNS name while the validated TCP target stays pinned to the configured backend URL.
• Add an explicit per-backend tls_verify switch, secure by default. Administrators may turn verification off for an HTTPS origin without weakening DNS/address/self-loop policy. Add matching 503/504 HTML gateway pages while preserving custom-page overrides.

0.7.2

• Publish a distinct patch release; keep both previous 0.7.1 deliveries historical.
• Remove the build.rs panic on absent SWAGGER_UI_DOWNLOAD_URL. The asset preparer defaults to pinned Swagger UI 5.32.11 independently of Cargo config discovery.
• Remove the independently downloading utoipa-swagger-ui adapter and embed the prepared JS/CSS directly, for debug and release. Existing admin guards stay in place.
• Prepare assets with the existing Python 3.10+ tool requirement, now also needed for direct Cargo builds. Support absolute local tag ZIPs, optional archive SHA-256, bounded exact-member reads, validated download caching and retained license notices.
• Resolve build input paths from CARGO_MANIFEST_DIR, track local sources and outputs, and report missing tools/assets explicitly instead of silently changing UI versions.
• Additional historical details for this release are retained in the technical archive.

0.7.1

• Add visual request/response header editing to each custom vhost location, with set/append/remove, validation, isolation and synchronized optional JSON.
• Split anonymous sign-in from the operational document and module/language bundles. Remove the login tagline; preserve the original brand and compact square style.
• Reduce public health to status and auth discovery to setup_required only. Make the public allowlist exact by method and path; private/unknown requests are denied before body/query extraction, including method mismatches and aliases.
• Keep Origin/Host/CSRF/session guards; reject duplicate CSRF/marker headers and hide login/setup JSON parser details. Clear UI data across tabs and on revocation.
• Add authenticated /docs and OpenAPI with pinned, build-embedded Swagger UI, same-session authorization, read-only execution by default and CSRF-confirmed writes.
• Replace updater reliance on a public version with local MainPID/executable checks.
• Additional historical details for this release are retained in the technical archive.

0.7.0

• Renew managed ACME profiles automatically with shared worker bounds, jitter, backoff, private observations and validated CAS hot deployment; expose opt-out, check-now and dry-run controls. Keep previous certificates active on failure.
• Add install.sh/update.sh for Linux/systemd, root-owned release switching, stopped full-data backups and code/data rollback on failed startup/version checks.
• Add per-vhost Basic Auth with Argon2id-only storage, optional verified upstream credentials and cumulative graphical IP ACLs. Keep protected content out of cache.
• Add WebSocket toggles and graphical custom path locations, including explicit exclusion of dedicated path origins from normal pool/sticky selections.
• Replace the sample welcome page with neutral information, make the protocol fixture opt-in, unify square modal and Settings-tab styling, preserve branding.

0.6.0

• Replace separate legacy routes with vhosts and a one-way, validated compatibility importer; preserve path-pinned origins, ACLs and existing listener scope.
• Add HTTP-01 webroot domain validation, Cloudflare DNS-01 and OVH DNS-01 alongside RFC2136 using private Certbot workers.
• Unify certificate creation/import in a provider-picker modal; record optional issuer metadata in the library and keep secrets outside exported configuration.
• Add an independently configurable Prometheus endpoint with actual-peer CIDRs, optional environment-sourced bearer token, bounded scrapes and collector switches.
• Export application/admin/listener/vhost/backend/cache/system data and full-exchange vhost histograms with bounded configured labels.
• Split Settings into functional switching cards; preserve dirty values, keyboard access and translation discovery; remove Security and legacy routing sidebar entries.
• Additional historical details for this release are retained in the technical archive.

0.5.0

• Add a compact dedicated cache panel with vhost/domain counters, object pagination, TTL/Age/hits, memory/fill diagnostics and authenticated selective purge.
• Fix reserved administrator-cookie ordering and empty terminating DATA frames; emit fixed cache decision reasons without exposing request secrets.
• Replace special X-Mock-Origin hiding with the explicit global/vhost revision switch; ordinary response rules still handle arbitrary removable headers.
• Default HTTP/3 on TLS bindings, retain explicit null opt-outs, and explain overlapping sockets with ownership and concrete protocol/limit differences.
• Return 503 for upstream connection/unavailability, 502 for invalid responses and 504 for header timeouts; generated errors use no-store.
• Add basic asynchronous Certbot DNS-01/RFC2136 issuance, staging-first consent, private TSIG/account profiles, output validation and explicit library import. No automatic renewal scheduler or real CA validation is claimed.

0.4.0

• Rebuild standard Forwarded and X-Forwarded metadata at an explicit trusted-proxy boundary; use verified client IP for ACL/affinity, never for destination routing.
• Add per-vhost Tinyauth subrequests, identity header allowlists, safe same-login-origin redirects and fail-closed checks before origin/static/cache/WebSocket use.
• Move certificate upload into an independent inventory; assign certificates by ID per vhost and expose metadata-only inventory reads. ACME is not implemented.
• Add named multiple-IP listeners with descriptive scope, opt-in legacy routes, reusable vhost references and actual/desired plans.
• Add Quinn/h3-based HTTP/3 UDP transport, TLS 1.3/SNI, Alt-Svc, per-endpoint connection and per-connection stream/idle limits, shared proxy policies and bounded shutdown. Preserve TCP HTTP/2 plus HTTP/1.1.
• Hide request-ID/revision headers by default; add individual overrides and optional mock-origin stripping. Apply effective Server policy across all response paths, including extra sockets.
• Additional historical details for this release are retained in the technical archive.

0.3.0

• Add optional per-vhost certificate inventory selection and PEM file upload. Validate key/certificate pairing and names, write private immutable files, and activate only through the existing revisioned configuration update.
• Add per-vhost cache overrides and selective invalidation, including stale in-flight fill cancellation while leaving other host entries intact.
• Add administrator-authored, bounded global/vhost error pages, static vhost and missing-path responses, direct-IP and unknown-host responses. Retain ACL checks, HEAD handling and authentication challenges; never execute HTML in the admin UI.
• Move access logs into a separate modal/docked viewer with fixed filters, vhost identity, pause, scoped search/status/method/cache controls and JSON export.
• Add a compact vhost list, tabbed dialog, live health/latency summaries and visual per-host response/request headers; keep the original logo and favicon.
• Add density preferences and a Settings shortcut to Security.
• Additional historical details for this release are retained in the technical archive.

0.2.0

• Support compression size thresholds above 64 KiB without truncation.
• Add IP/port/TLS-bound virtual hosts with frontend(s), backend pool and path policies.
• Enforce real accepted destination matching; isolate legacy routes from extra sockets.
• Add weighted round-robin, least-connections, least-traffic, adaptive and IP hashing.
• Add bounded TCP/HTTP health checks, separate passive failures, recovery and slow start.
• Add connection keepalive controls, backup members, drain and opaque cookie/IP affinity.
• Additional historical details for this release are retained in the technical archive.

0.1.0

• Persisted public listener addresses/ports, 80/443 presets, startup defaults and restart status.
• Bounded streaming shared RAM cache, TTL/Age, LRU, privacy/Vary protections, per-route bypass, optional HIT/MISS headers and audited purge.
• Streaming gzip, Brotli, Zstandard and deflate controls, final Server policy and a global client-response header editor.
• Compact dashboard with system/process/cache diagnostics, log filters and export.
• Allow ordinary remote-origin 80/443 while guarding local proxy/admin listener targets.
• Additional historical details for this release are retained in the technical archive.

0.0.6

• Detect mixed source layouts and preserve the known legacy auth file; refuse to delete unrecognized local changes.
• Support interactive username input for admin init.
• Replace managed source directories with rollback on copy failure rather than encouraging overlay extraction.
• DNS and HTTPS manual backends with per-backend pools, bounded DNS workers, validated DNS answers, optional CIDR allowlists and additional PEM trust anchors.
• rustls public TLS listener, persistent development default certificate, exact SNI bindings, local generate/import commands and explicit hot reload.
• Additional historical details for this release are retained in the technical archive.

0.0.2

• Introduced RustProxy naming, administrator setup, Argon2id passwords, sessions, CSRF checks, login throttling, password recovery and credential revocation.
• Added host/route ACLs, generic request/response header policies, administration audit, SSE dashboard updates and security controls in the bilingual panel.
• Added an additive SQLite migration, offline validation and online database backup.

0.0.1

• Initial manual-backend HTTP/1.1 proxy, streaming and keep-alive.
• SQLite configuration, dynamic host/alias/path routing and local token control plane.
• English/Polish interface, bounded access log, counters, CLI, demo backend and dev.sh.