Prepare Fluxheim 1.6.29 release

eldryoth · eldryoth · commit 12e744dcc613 · 2026-06-23T16:20:42.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,7 +7,7 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
-## 1.6.29 - 2026-06-21
+## 1.6.29 - 2026-06-23
 
 ### Changed
 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/README.md b/README.md
@@ -344,8 +344,8 @@ Official container images are published to GitHub Container Registry and Quay:
 - `quay.io/valkyoth/fluxheim`
 
 Release tags use the same profile/OS suffixes on both registries, for example
-`v1.6.28-wolfi`, `v1.6.28-cache-wolfi`, `v1.6.28-proxy-wolfi`,
-`v1.6.28-load-balancer-wolfi`, and `v1.6.28-php-wolfi`.
+`v1.6.29-wolfi`, `v1.6.29-cache-wolfi`, `v1.6.29-proxy-wolfi`,
+`v1.6.29-load-balancer-wolfi`, and `v1.6.29-php-wolfi`.
 
 Release note for `1.5.15`: the signed git tag `v1.5.15` is the canonical code
 tag. The GitHub Release page is published under `v1.5.15-release` because the
diff --git a/crates/fluxheim-cache/Cargo.toml b/crates/fluxheim-cache/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-cache"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-common/Cargo.toml b/crates/fluxheim-common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-common"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-compression/Cargo.toml b/crates/fluxheim-compression/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-compression"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-config/Cargo.toml b/crates/fluxheim-config/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-config"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-geoip/Cargo.toml b/crates/fluxheim-geoip/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-geoip"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-headers/Cargo.toml b/crates/fluxheim-headers/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-headers"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-load-balancer/Cargo.toml b/crates/fluxheim-load-balancer/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-load-balancer"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-observability/Cargo.toml b/crates/fluxheim-observability/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-observability"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-php-fpm/Cargo.toml b/crates/fluxheim-php-fpm/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-php-fpm"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-protocol/Cargo.toml b/crates/fluxheim-protocol/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-protocol"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-runtime/Cargo.toml b/crates/fluxheim-runtime/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-runtime"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-server/Cargo.toml b/crates/fluxheim-server/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-server"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-snapshot/Cargo.toml b/crates/fluxheim-snapshot/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-snapshot"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-stream/Cargo.toml b/crates/fluxheim-stream/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-stream"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-tls/Cargo.toml b/crates/fluxheim-tls/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-tls"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-web/Cargo.toml b/crates/fluxheim-web/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-web"
-version = "1.6.28"
+version = "1.6.29"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/docs/build-and-podman.md b/docs/build-and-podman.md
@@ -470,15 +470,15 @@ Optional Quay repository secrets and variables:
 
 The workflow publishes OS-variant tags for the full/default image profile:
 
-- `v1.6.28-wolfi`, `v1.6.28-alpine`, `v1.6.28-suse-micro`, `v1.6.28-debian`
+- `v1.6.29-wolfi`, `v1.6.29-alpine`, `v1.6.29-suse-micro`, `v1.6.29-debian`
 - `sha-<short-sha>-wolfi`, `sha-<short-sha>-alpine`, etc.
 - `latest-wolfi`, `latest-alpine`, etc. when run from the default branch
 
 For the recommended Wolfi runtime, the full/default profile also gets short
 aliases:
 
-- `v1.6.28`
-- `v1.6.28-base`
+- `v1.6.29`
+- `v1.6.29-base`
 - `latest`
 - `latest-base`
 
@@ -487,21 +487,21 @@ automation. They point at the full/default image profile.
 
 The focused image profiles publish tags with a profile segment:
 
-- `v1.6.28-cache-wolfi`, `v1.6.28-cache-alpine`,
-  `v1.6.28-cache-suse-micro`, `v1.6.28-cache-debian`
-- `v1.6.28-proxy-wolfi`, `v1.6.28-proxy-alpine`,
-  `v1.6.28-proxy-suse-micro`, `v1.6.28-proxy-debian`
-- `v1.6.28-load-balancer-wolfi`, `v1.6.28-load-balancer-alpine`,
-  `v1.6.28-load-balancer-suse-micro`, `v1.6.28-load-balancer-debian`
-- `v1.6.28-php-wolfi`, `v1.6.28-php-alpine`,
-  `v1.6.28-php-suse-micro`, `v1.6.28-php-debian`
+- `v1.6.29-cache-wolfi`, `v1.6.29-cache-alpine`,
+  `v1.6.29-cache-suse-micro`, `v1.6.29-cache-debian`
+- `v1.6.29-proxy-wolfi`, `v1.6.29-proxy-alpine`,
+  `v1.6.29-proxy-suse-micro`, `v1.6.29-proxy-debian`
+- `v1.6.29-load-balancer-wolfi`, `v1.6.29-load-balancer-alpine`,
+  `v1.6.29-load-balancer-suse-micro`, `v1.6.29-load-balancer-debian`
+- `v1.6.29-php-wolfi`, `v1.6.29-php-alpine`,
+  `v1.6.29-php-suse-micro`, `v1.6.29-php-debian`
 - `sha-<short-sha>-cache-wolfi`, `sha-<short-sha>-proxy-wolfi`,
   `sha-<short-sha>-load-balancer-wolfi`, `sha-<short-sha>-php-wolfi`, etc.
 - `latest-cache-wolfi`, `latest-proxy-wolfi`,
   `latest-load-balancer-wolfi`, `latest-php-wolfi`, etc. when run from the
   default branch
-- Wolfi short aliases: `v1.6.28-cache`, `v1.6.28-proxy`,
-  `v1.6.28-load-balancer`, `v1.6.28-php`, `latest-cache`, `latest-proxy`,
+- Wolfi short aliases: `v1.6.29-cache`, `v1.6.29-proxy`,
+  `v1.6.29-load-balancer`, `v1.6.29-php`, `latest-cache`, `latest-proxy`,
   `latest-load-balancer`, and `latest-php`
 
 Starting with `v1.5.0`, the load-balancer image profile is part of normal tag
diff --git a/docs/modularity-exceptions.md b/docs/modularity-exceptions.md
@@ -25,6 +25,7 @@ documents why the exception is temporary and how it will be removed.
 | `crates/fluxheim-config/src/config.rs` | 2514 | Config root, validation helpers, and shared parsing glue. | Split by shared config primitives. |
 | `crates/fluxheim-config/src/config_cache.rs` | 2495 | Cache config, validation, and merge behavior. | Split cache config primitives when `fluxheim-cache` owns more runtime. |
 | `src/headers.rs` | 1829 | Remaining Pingora request/response header mutation adapter after the first `fluxheim-headers` extraction. | Keep shrinking with native HTTP/header-policy cutovers. |
+| `crates/fluxheim-headers/src/lib.rs` | 505 | Header-policy helper crate root temporarily groups forwarded-header synthesis, trusted-chain parsing, hop-by-hop stripping, response security headers, and tests while native and compatibility callers converge on the shared API. | Split forwarded-chain parsing, request forwarding headers, response security headers, and tests before final native runtime cutover. |
 | `src/runtime.rs` | 2013 | Pingora server/bootstrap/listener orchestration; TLS listener planning and server process/listener inventory now come from focused crates while this file remains the compatibility adapter. | Continue replacing through `fluxheim-runtime`/`fluxheim-server` during the remaining `1.6` runtime cutover. |
 | `src/tls.rs` | 1456 | Root TLS storage, ACME path resolution, and compatibility glue after `fluxheim-tls` extracted listener planning, provider, ALPN, cipher, and SNI selector policy. | Move remaining ACME/storage helpers to focused crates after native listener cutover. |
 | `crates/fluxheim-runtime/src/lib.rs` | 619 | Native background supervisor, shutdown view, readiness callback, task spec, policy facts, and tests are grouped during the `1.6.21` supervisor proof. | Split supervisor/watchdog code, shutdown/readiness primitives, policy facts, and tests into focused runtime modules before the `1.6.24` Pingora-free proof. |
@@ -61,6 +62,7 @@ documents why the exception is temporary and how it will be removed.
 | `crates/fluxheim-cache/src/storage_bin.rs` | 627 | Storage-bin layout, manifest, allocation, and free-map helpers were moved together to preserve allocator review context. | Split manifest/layout, allocator, and index-entry helpers after the storage-bin file adapter moves out of `src/cache.rs`. |
 | `crates/fluxheim-server/src/native_http1_proxy_tests.rs` | 805 | Native HTTP/1 proxy parity tests temporarily group plain, TLS, mTLS, failover, pooling, round-robin, weighted round-robin, config-gate, compression, error-page, and forwarded-header fixtures for the native upstream cutover slices. | Split plain failover/round-robin, TLS/mTLS, pooling, compression/error-page, forwarded-header, and config-gate tests after the native proxy API stabilizes. |
 | `crates/fluxheim-server/src/native_http1_proxy.rs` | 509 | Native HTTP/1 proxy temporarily groups static upstream selection, pooling, compression, header policy, and error-page handling during the rich-proxy parity slices. | Split upstream selection, request policy, response policy/compression, and error-page handling before final native runtime cutover. |
+| `crates/fluxheim-server/src/native_http1_client.rs` | 740 | Native upstream HTTP/1 client temporarily groups connection pooling, request writing, response parsing, stale-connection retry, timeout handling, and forwarded-header-safe request construction during the final native upstream parity work. | Split pooling, request writer, response parser, retry/timeout policy, and request-construction helpers before final native runtime cutover. |
 | `crates/fluxheim-server/src/native_http1_tls.rs` | 872 | Native upstream TLS connector covers rustls/OpenSSL, trust roots, SNI, hostname policy, mTLS material, and file-safety checks during the staged `1.6.14` cutover. | Split rustls, OpenSSL, file loading, and hostname-policy helpers before production native proxy cutover. |
 | `crates/fluxheim-server/src/native_http1.rs` | 673 | Native downstream HTTP/1 listener, TLS accept loop, connection budget, request parsing, request metadata, and response framing remain grouped during the `1.6.19`-`1.6.29` native listener/proxy parity work. | Split plain listener, TLS accept loops, connection serving, request parsing, and response framing before production native HTTP cutover. |
 | `crates/fluxheim-server/src/native_http1_tests.rs` | 605 | Native downstream HTTP/1 listener tests temporarily group request parsing, keep-alive, timeout, body, and listener-budget fixtures for parity review. | Split listener, request-body, timeout, and response-framing tests after the native HTTP/1 API stabilizes. |
diff --git a/packaging/rpm/fluxheim.spec b/packaging/rpm/fluxheim.spec
@@ -7,7 +7,7 @@
 %{!?_unitdir:%global _unitdir %{_prefix}/lib/systemd/system}
 
 Name:           fluxheim
-Version:        1.6.28
+Version:        1.6.29
 Release:        1%{?dist}
 Summary:        Rust edge gateway for websites, caching, and load balancing
 License:        EUPL-1.2
@@ -154,6 +154,18 @@ fi
 %config(noreplace) %attr(0644,fluxheim,fluxheim) /srv/fluxheim/index.html
 
 %changelog
+* Tue Jun 23 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.6.29-1
+- Move inherited compression, header-policy behavior, forwarded-header
+  ownership, access policy, concurrency, rate limiting, gRPC validation,
+  ACME HTTP-01 local challenge serving, auth-request, and safe-method traffic
+  mirroring onto the native HTTP/1 proxy path.
+- Add native downstream request/response timeout policy and native upstream
+  TCP socket option parity for receive buffers, DSCP, keepalive, and supported
+  TCP user-timeout.
+- Harden trusted forwarded-chain parsing, native rate-limit eviction, native
+  ACME token loading, mirror recursion markers, and auth-request response
+  handling during the Pingora-exit migration.
+
 * Sun Jun 21 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.6.28-1
 - Add native route-level response compression for gzip, Brotli, and zstd.
 - Honor Accept-Encoding q-values when selecting native route compression
