Prepare Fluxheim 1.0.0 release

Author: eldryoth

CHANGELOG.md

@@ -9,6 +9,10 @@ behavior when the change improves security or project direction.
 
 ## Unreleased
 
+## 1.0.0 - Gateway Foundation
+
+Released: 2026-05-08
+
 ### Added
 
 - `1.0` gateway migration fixtures and smoke coverage for representative

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "0.5.0"
+version = "1.0.0"
 edition = "2024"
 rust-version = "1.95"
 license = "EUPL-1.2"

Cargo.toml

@@ -225,24 +225,23 @@ scripts/validate-features.sh proxy,web,tls-rustls,load-balancer
 
 </details>
 
-## Next Target: 1.0 Gateway Core
+## Current Stable: 1.0 Gateway Core
 
-Fluxheim will not treat every planned feature as part of `1.0`. The `1.0`
-target is the first release intended to migrate representative real multi-site
+Fluxheim does not treat every planned feature as part of `1.0`. The `1.0`
+release is the first release intended to migrate representative real multi-site
 gateway configs.
 
-Already landed after `0.5.0`: route-level exact/prefix/fallback matching,
-route actions for proxy/static/redirects, route prefix stripping, per-route
-body limits, upstream connect/read/send timeout knobs, websocket-safe upgrade
-smoke coverage for `/chat/`-style routes, and custom upstream error pages,
-secure static aliases with optional directory listing, cleartext ACME challenge
-exceptions, safe dynamic request-header templates for common proxy migrations,
-SNI certificate selection for the default rustls TLS backend and
-callback-capable TLS backends, and native systemd deployment files for manually
-compiled binaries. Direct proxy upstream DNS names
-are resolved per request and resolution failures return upstream errors instead
-of panicking the worker, which covers local Podman service names for the non-LB
-gateway path.
+Included in `1.0`: route-level exact/prefix/fallback matching, route actions
+for proxy/static/redirects, route prefix stripping, per-route body limits,
+upstream connect/read/send timeout knobs, websocket-safe upgrade smoke coverage
+for `/chat/`-style routes, custom upstream error pages, secure static aliases
+with optional directory listing, cleartext ACME challenge exceptions, safe
+dynamic request-header templates for common proxy migrations, SNI certificate
+selection for the default rustls TLS backend and callback-capable TLS backends,
+and native systemd deployment files for manually compiled binaries. Direct proxy
+upstream DNS names are resolved per request and resolution failures return
+upstream errors instead of panicking the worker, which covers local Podman
+service names for the non-LB gateway path.
 
 After `1.0`, the planned release ladder continues with TLS policy hardening,
 operations tooling, load balancing, cache improvements, certificate automation,

README.md

@@ -0,0 +1,68 @@
+# Fluxheim 1.0.0 Release Notes
+
+## Release Metadata
+
+- Version: `1.0.0`
+- Release date: 2026-05-08
+- Git tag: `v1.0.0`
+- Release type: stable gateway foundation
+
+## Summary
+
+Fluxheim `1.0.0` is the first stable gateway foundation release. It is intended
+for production testing of static sites, vhosts, redirects, TLS/SNI, HTTP/2,
+secure defaults, systemd/RPM deployment, and external ACME challenge forwarding.
+
+## Highlights
+
+- Static site serving with secure path validation, index files, ETags, range
+  requests, and optional directory listing.
+- Vhost routing with default-vhost fallback, wildcard host matching, route
+  exact/prefix/fallback matching, redirects, static route actions, and proxy
+  route actions.
+- HTTP to HTTPS redirects and canonical host redirects that preserve safe request
+  URIs.
+- TLS with rustls by default, static vhost certificates, SNI selection, and
+  default-vhost fallback certificate support.
+- External ACME HTTP-01 challenge forwarding helper for
+  `/.well-known/acme-challenge/`.
+- Dynamic request header templates for common proxy migrations.
+- Native systemd/RPM packaging, packaged default config/site, and server
+  preparation helper.
+- CodeQL, cargo audit/deny, SBOM generation, reproducible-build checks, panic
+  policy hardening, zeroized admin token handling, and constant-time admin token
+  verification.
+
+## Validated Scope
+
+- Native RPM/systemd deployment.
+- Static web roots and config preflight.
+- HTTP/80 and TLS/443 listeners.
+- HTTP/2 via ALPN.
+- Multi-certificate SNI with rustls.
+- External certbot/Actalis challenge forwarding.
+- Basic proxy migration headers and route/vhost proxying.
+
+## Known Limits
+
+- Native ACME certificate issuance/storage is still future work; use an external
+  ACME client plus deploy hook for this release.
+- HTTP/3/QUIC is post-1.0 work.
+- Advanced gateway modules such as compression policy, identity-aware auth,
+  trusted proxy providers, secure links, WAF, and WASM are roadmap items.
+- Vhost TLS certificate changes require the normal process restart/reload
+  workflow; automatic renewal reload is not first-class yet.
+
+## Checksums And Signatures
+
+Record during the release:
+
+- Commit: to be filled after the release-prep commit
+- Local gate: GitHub CI green before tag; local release metadata checks passed
+- CodeQL/code scanning: no open release-blocking alerts before tag
+- Source archive checksums: to be filled
+- Binary checksums: to be filled
+- SBOM checksums: to be filled
+- Reproducible build: to be filled
+- Container digests: to be filled
+- Tag signature: to be filled

RELEASE_NOTES_1.0.0.md

@@ -7,7 +7,7 @@ Use this from a clean `main` checkout. Set the release variables once, then
 reuse them through the commands below:
 
 ```bash
-RELEASE_VERSION=0.5.0
+RELEASE_VERSION=1.0.0
 TAG="v${RELEASE_VERSION}"
 TITLE="Fluxheim ${RELEASE_VERSION}"
 RELEASE_NOTES="RELEASE_NOTES_${RELEASE_VERSION}.md"

docs/release-runbook.md

@@ -7,15 +7,15 @@
 %{!?_unitdir:%global _unitdir %{_prefix}/lib/systemd/system}
 
 Name:           fluxheim
-Version:        0.5.0
+Version:        1.0.0
 Release:        1%{?dist}
 Summary:        Modular Pingora-based reverse proxy and static web server
 License:        EUPL-1.2
 URL:            https://github.com/valkyoth/fluxheim
 Source0:        https://github.com/valkyoth/fluxheim/archive/refs/tags/v%{version}/%{name}-%{version}.tar.gz
 # Create with:
 #   cargo vendor vendor > /tmp/fluxheim-cargo-config.toml
-#   tar -czf fluxheim-0.5.0-vendor.tar.gz vendor
+#   tar -czf fluxheim-1.0.0-vendor.tar.gz vendor
 Source1:        %{name}-%{version}-vendor.tar.gz
 Source2:        fluxheim.tmpfiles
 Source3:        fluxheim.service
@@ -43,9 +43,10 @@ Requires(pre):   shadow-utils
 Requires:       ca-certificates
 
 %description
-Fluxheim is a modular Rust edge server built on Pingora. The 0.5.x release line
-is a basic-sites preview for static website hosting, static TLS certificates,
-vhost routing, secure header policy, and simple whole-vhost reverse proxying.
+Fluxheim is a modular Rust edge server built on Pingora. The 1.0 release is the
+gateway foundation for static website hosting, vhost routing, HTTP to HTTPS
+redirects, static TLS certificates with SNI, secure header policy, route-level
+proxy/static/redirect behavior, and native systemd deployment.
 
 This spec builds from vendored Cargo dependencies and uses Cargo offline mode.
 It intentionally does not download crates during the RPM build.
@@ -118,7 +119,7 @@ fi
 
 %files
 %license LICENSE
-%doc README.md CHANGELOG.md ROADMAP.md RELEASE_NOTES_0.5.0.md docs examples
+%doc README.md CHANGELOG.md ROADMAP.md RELEASE_NOTES_1.0.0.md docs examples
 %{_bindir}/fluxheim
 %{_tmpfilesdir}/fluxheim.conf
 %{_sysusersdir}/fluxheim.conf
@@ -135,5 +136,8 @@ fi
 %config(noreplace) %attr(0644,fluxheim,fluxheim) /srv/fluxheim/index.html
 
 %changelog
+* Fri May 08 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.0.0-1
+- Stable gateway foundation release with vhosts, TLS/SNI, redirects, static sites, routes, and systemd/RPM packaging.
+
 * Wed May 06 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 0.5.0-1
 - Initial RPM packaging spec for the basic-sites preview.