Skip to content

Fluxheim 1.5.20

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 13 Jun 18:15
Immutable release. Only release title and notes can be modified.
v1.5.20
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
f1ff4e5
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.5.20 Release Notes

Fluxheim 1.5.20 starts the web, PHP-FPM, and cache boundary-preparation line
and carries forward the post-1.5.19 trusted-proxy validation fix.

Changed

  • Started the fluxheim-cache crate boundary by moving shared cache-header
    request/response directive parsing into crates/fluxheim-cache. The root
    crate keeps crate::cache_headers as a compatibility re-export, so runtime
    behavior and call sites are unchanged.
  • Moved pure cache admin request/result/preview DTOs into
    crates/fluxheim-cache::api, with root crate::cache_api and
    crate::proxy re-exports kept for compatibility. Pure runtime totals and
    activity-reset DTOs also moved.
  • Moved cache object metadata, activity stats, tier stats, object lookup, and
    vhost/route runtime stats into crates/fluxheim-cache::api. Root
    crate::cache and crate::cache_api keep compatibility re-exports so admin,
    CLI, metrics, and proxy call sites are unchanged.
  • Moved cache storage-plan DTOs into crates/fluxheim-cache::plan, keeping
    root crate::cache re-exports while the Pingora storage adapters remain in
    the root cache runtime.
  • Moved cached object DTOs and CacheStoreError into
    crates/fluxheim-cache::object, keeping root crate::cache re-exports for
    memory-cache and test call sites.
  • Moved cache request/key DTOs into crates/fluxheim-cache::request, with root
    crate::cache re-exports and root cache-key builders preserving the existing
    behavior.
  • Moved cache range/slice request DTOs, single-range parsing, client range
    parsing, client-range resolution, and required-slice planning into
    crates/fluxheim-cache::request, leaving root crate::proxy_cache as the
    Pingora request-header and cache-key adapter.
  • Moved Content-Range parsing into crates/fluxheim-cache::request, so
    range-cache admission and slice-object reconstruction share one pure parser.
  • Moved pure cache freshness helpers for remaining TTL and synthesized
    Cache-Control freshness directives into crates/fluxheim-cache::headers.
  • Moved Vary header parsing and configured request-header variance policy into
    crates/fluxheim-cache::headers, keeping root crate::proxy_cache focused
    on Pingora request hashing and adapter logic.
  • Moved Vary request hash material framing into
    crates/fluxheim-cache::headers; root crate::proxy_cache now only adapts
    Pingora request headers and calls the Pingora hash function.
  • Moved cacheable response Content-Type matching into
    crates/fluxheim-cache::headers, leaving root cache admission as the
    status/header adapter.
  • Moved cache-bypass cookie and query-string matching, including
    percent-decoded query comparisons, into crates/fluxheim-cache::headers.
  • Moved cache stale-serving event and status/error allow policy into
    crates/fluxheim-cache::headers, keeping Pingora error classification in
    root crate::proxy_cache.
  • Moved response Age and Cache-Control max-age/s-maxage parsers into
    crates/fluxheim-cache::headers, leaving root response helpers as thin
    Pingora header adapters.
  • Moved Cache-Control directive merge/replacement into
    crates/fluxheim-cache::headers, leaving root response mutation as a
    Pingora header adapter.
  • Moved range response Content-Range and Content-Length validation into
    crates/fluxheim-cache::request, leaving root range-cache admission as the
    Pingora status/header adapter.
  • Moved cache-key component formatting and the temporary HEAD cache bypass
    predicate into crates/fluxheim-cache::request, keeping root compatibility
    wrappers for existing proxy callers.
  • Moved multipart slice range policy sizing into
    crates/fluxheim-cache::request, leaving root crate::proxy_cache as the
    config adapter.
  • Moved cache Prometheus label classifiers into crates/fluxheim-cache,
    keeping root crate::metrics as recorder wiring.
  • Moved cache purge-index state, purge-entry DTOs, storage-local purge result
    counters, and cache-key path matching helpers into
    crates/fluxheim-cache::purge_index. Root crate::cache keeps the existing
    compatibility type names while the Pingora storage implementations remain in
    the root runtime adapter.
  • Started the fluxheim-web crate boundary by moving static directory-listing
    data/rendering helpers into crates/fluxheim-web. The root crate::web
    module re-exports the same types and renderer while keeping Pingora response
    serving in the root adapter.
  • Moved static byte-range parsing into crates/fluxheim-web, keeping
    crate::web compatibility re-exports for the existing static response
    planner and tests.
  • Moved static response planning, conditional request evaluation, weak ETag
    construction, and range response plan DTOs into crates/fluxheim-web.
    crate::web keeps the existing StaticRequestConditions compatibility
    adapter so proxy call sites and cache-refresh semantics are unchanged.
  • Moved safe relative path and directory-listing path helpers into
    crates/fluxheim-web, leaving root static serving responsible for filesystem
    canonicalization and symlink checks.
  • Moved configured web-root symlink detection into crates/fluxheim-web,
    keeping root StaticFileServer construction as the filesystem adapter.
  • Moved static cache identity formatting into crates/fluxheim-web, keeping
    root StaticFile as the filesystem metadata adapter.
  • Started the fluxheim-php-fpm crate boundary by moving PHP-FPM timeout
    classification and bounded error-outcome helpers into
    crates/fluxheim-php-fpm, with the root PHP-FPM module re-exporting the same
    names for existing runtime and test code.
  • Moved managed PHP-FPM restart-backoff and sanitized PATH fallback helpers
    into crates/fluxheim-php-fpm, again keeping the root module as the
    compatibility surface for existing code.
  • Moved managed PHP-FPM config rendering and its config-value validators into
    crates/fluxheim-php-fpm, leaving root PHP-FPM process supervision as the
    compatibility adapter.
  • Moved PHP-FPM effective timeout calculation, retry attempt/deadline policy,
    retryable status matching, and retryable error classification into
    crates/fluxheim-php-fpm, with root crate::php_fpm retaining the
    StatusCode compatibility adapter.
  • Moved PHP-FPM endpoint selection and endpoint DTOs into
    crates/fluxheim-php-fpm, with root crate::php_fpm keeping compatibility
    re-exports for the proxy runtime and tests.
  • Moved PHP-FPM response-header name/value safety guards into
    crates/fluxheim-php-fpm, keeping root response parsing as the Pingora
    header adapter.
  • Moved PHP-FPM response split, Status parsing, ASCII trimming, and header
    colon splitting into crates/fluxheim-php-fpm, leaving root response parsing
    as the Pingora response-header adapter.
  • Moved managed PHP-FPM instance-name generation and metric-pool sanitization
    into crates/fluxheim-php-fpm, leaving root process supervision as the
    Unix runtime adapter.
  • Started the fluxheim-geoip crate boundary by moving GeoContext and the
    optional local MMDB runtime into crates/fluxheim-geoip, with root
    crate::geo_context and crate::geoip compatibility re-exports.
  • Started the fluxheim-compression crate boundary by moving response
    compression encoder lifecycle and output-limit accounting into
    crates/fluxheim-compression, while keeping Pingora header selection and
    response mutation in the root adapter.
  • Moved Accept-Encoding token and qvalue parsing into
    crates/fluxheim-compression, keeping root response-header selection as the
    Pingora adapter.
  • Moved compression response policy string matching for Cache-Control directives
    and Content-Type eligibility into crates/fluxheim-compression, leaving root
    response-header iteration as the adapter.
  • Moved active Content-Encoding classification and compression input-size bounds
    into crates/fluxheim-compression, keeping root response headers/config as
    adapters.
  • Started the fluxheim-observability crate boundary by moving W3C Trace
    Context parsing, generation, and traceparent normalization into
    crates/fluxheim-observability, with root crate::trace_context kept as a
    compatibility re-export.
  • Moved the shared OTLP HTTP agent and symlink-safe custom CA bundle loader into
    crates/fluxheim-observability behind its otlp-http feature, while keeping
    the root crate::otlp_http module as the metrics/tracing adapter.
  • Moved OTLP HTTP endpoint parsing into crates/fluxheim-observability,
    keeping the Prometheus metrics payload conversion in the root metrics adapter.
  • Moved the Prometheus-to-OTLP metrics payload builder into
    crates/fluxheim-observability behind its otlp-metrics feature, leaving
    root metrics OTLP as exporter lifecycle and HTTP post wiring.
  • Moved access-log helper logic for request-id validation/generation,
    shared low-cardinality status classes, response byte counting, and Unix
    nanosecond timestamps into crates/fluxheim-observability, while the root
    access-log module keeps Pingora request-header integration and JSON event
    assembly and Prometheus metrics reuses the shared status-class helper.
  • Moved shared JSON string escaping for access logs and runtime JSON logs into
    crates/fluxheim-observability, keeping both root log schemas unchanged.
  • Moved proxy metrics outcome, method, and status-class label bucketing into
    crates/fluxheim-observability, keeping root crate::metrics as the
    Prometheus registry/recorder adapter.
  • Moved general Prometheus label classifiers for host-routing, admin-auth,
    compression, edge-policy, load-balancer event/queue/upstream, stream, ACME,
    PHP/PHP-FPM, and metrics-OTLP exporter events into crates/fluxheim-observability,
    further narrowing root crate::metrics to recorder wiring.
  • Moved Prometheus numeric helper logic for bounded ratios and saturating gauge
    conversions into crates/fluxheim-observability, leaving root metrics as the
    registry/recorder adapter.
  • Moved LoadBalanceSelection metric-label mapping into fluxheim-config,
    keeping root crate::metrics as a compatibility wrapper.
  • Moved config-derived cache and load-balancer metrics summary aggregation into
    fluxheim-config, leaving root metrics to only publish the Prometheus
    gauges.
  • Moved the OTLP trace exporter and trace-span payload builder into
    crates/fluxheim-observability behind its otlp-trace feature, with root
    crate::otel_otlp kept as a compatibility re-export.
  • Started the fluxheim-protocol crate boundary by moving PROXY protocol v1/v2
    upstream header framing into crates/fluxheim-protocol, while the root
    crate::proxy_protocol module keeps the Pingora L4 connector adapter.
  • Moved route method matching and prefix-boundary helpers into
    crates/fluxheim-protocol, keeping root crate::route_policy as the config,
    regex-capture, and Pingora request adapter.
  • Started the fluxheim-snapshot crate boundary by moving the durable config
    snapshot store, metadata validation, rollback pointer handling, and
    symlink-safe filesystem writes into crates/fluxheim-snapshot, with root
    crate::snapshot kept as a compatibility re-export.
  • Moved reload-impact classification into crates/fluxheim-config, with root
    crate::reload kept as a compatibility re-export for admin and CLI reload
    reporting.
  • Moved load-balancer runtime/member weight parser helpers into
    crates/fluxheim-load-balancer, leaving root admin as the HTTP/query
    endpoint adapter.
  • Moved cache admin summary math helpers into crates/fluxheim-cache::api,
    leaving root admin JSON assembly as the response adapter.
  • Moved runtime cache-purger usize metric saturation into
    crates/fluxheim-observability, keeping root runtime as the background-task
    adapter.
  • Moved downstream PROXY-protocol trusted-source parsing into
    crates/fluxheim-protocol, leaving root runtime as the Pingora listener
    adapter.
  • Moved HTTP Upgrade token grammar validation into crates/fluxheim-protocol,
    leaving root proxy as the Pingora request-header adapter.
  • Moved Fluxheim Via header value formatting into crates/fluxheim-protocol,
    leaving root proxy as the Pingora header mutation adapter.
  • Moved multipart cache Content-Type sanitization into
    crates/fluxheim-cache::headers, leaving root proxy as the slice response
    assembly adapter.
  • Moved cache slice metadata first-header extraction into
    crates/fluxheim-cache::headers, leaving root proxy as the slice identity
    adapter.
  • Moved hop-by-hop Connection option token validation onto the shared
    crates/fluxheim-protocol HTTP token grammar helper.
  • Moved response header rewrite prefix authority-boundary matching into
    crates/fluxheim-protocol, leaving root header policy as the mutation
    adapter.
  • Moved cache CLI header-name validation onto the shared
    crates/fluxheim-protocol HTTP token grammar helper.
  • Moved config HTTP token validation onto the shared
    crates/fluxheim-protocol grammar while preserving method-specific
    uppercase checks.
  • Moved cache object lookup summary formatting into crates/fluxheim-cache,
    leaving the CLI as the command/output adapter.
  • Moved cache-warm count summaries and bounded status labels into
    crates/fluxheim-cache, leaving the CLI to print the prepared summaries.
  • Used the shared crates/fluxheim-cache storage-tier helper directly from
    admin cache status JSON.

Fixed

  • Hardened the vendored HTTP/1 request parser to reject requests that carry
    both Transfer-Encoding and Content-Length, matching Fluxheim's raw
    request-framing release smoke and avoiding ambiguous downstream body
    framing.
  • Documented the shared protocol HTTP token grammar as case-permissive and
    added a warning when accepted IPv6 trusted-proxy CIDR entries are broader
    than /32.
  • Fixed cache-only builds after shared cache stats moved purge-index and
    activity fields into the always-present cache API shape.
  • Allowed real provider IPv6 trusted-proxy ranges such as Cloudflare's
    2a06:98c0::/29. The 1.5.19 config-crate split preserved runtime IPv6
    CIDR support but made config validation too strict by rejecting trusted proxy
    IPv6 prefixes broader than /32.

Checksums And Signatures

  • Commit: f1ff4e5a8b2515b32997cd6bc2b4788e4770e347
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 87edcb7ca2c82b199005e1a8f12e3e4a680a312215261e444368ead36d83e129 fluxheim-1.5.20.tar.gz
    • 5936819e9d3ed041f760d508c4a086843f45db6841fc0b5474f6305ef2be2b6b fluxheim-1.5.20.zip
  • Binary checksums:
    • x86_64:
      • cf191f8d810c9029024b84f1302fbfc80bccc36a20dda7b1ce6121fa950be84f fluxheim-1.5.20-full-x86_64-linux.tar.gz
      • cb967723db55a214dcc75b970914d998c92d06e2303416ef5f49b6d79ea60d74 fluxheim-1.5.20-cache-x86_64-linux.tar.gz
      • f11528de9e9c9c4b29d56ef34fa6b43c2be6850babeb1747812580ba459fd309 fluxheim-1.5.20-proxy-x86_64-linux.tar.gz
      • b3a942a574c9b0a2f92bceb87006dffc53f192025cfe79698a8d386e10dfaf5c fluxheim-1.5.20-php-x86_64-linux.tar.gz
      • bc3a22d666175d690ed062b2a67ab770eb0059036034574fbf0e71655aeb0238 fluxheim-1.5.20-load-balancer-x86_64-linux.tar.gz
      • f24609ba5fa716afd55382c0e27c902981f3718cecaef3108f45c8a437dfe165 fluxheim-1.5.20-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • ba70529ce476daef4e77b63dbeb9d1605a0c8a2be9133a1fd7023f320591f6e4 fluxheim-1.5.20-full-aarch64-linux.tar.gz
      • 2b238423349c8f9b36f8c81a2df673b439be91f1cb30a0e902f16a722348effd fluxheim-1.5.20-cache-aarch64-linux.tar.gz
      • a7872ebb6bc23aa953c169cc51bae35b3877f55a0b6f993914272b8778237ed9 fluxheim-1.5.20-proxy-aarch64-linux.tar.gz
      • 037434ece52cdf32967de339f4f0c41c8fec101f4f8471b4766bd63b87d833e5 fluxheim-1.5.20-php-aarch64-linux.tar.gz
      • 04b0c5e424c91e57008fc961ad40240be2bc4c0c3e11969590941a4cdf49d096 fluxheim-1.5.20-load-balancer-aarch64-linux.tar.gz
      • fd073fa44d21d2074f5103dc385df37823e1b915b46abb885f0465df64b49279 fluxheim-1.5.20-config-tester-aarch64-linux.tar.gz
    • macos:
      • fdb7d9e4283ff5177ce81ef0ae257893e89e54b892e937614a4c4176b5916672 fluxheim-1.5.20-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • b1643f5918530ec251090da162607960bb6a957a4946e4824262591b15115318 fluxheim.spdx.json
    • 60e1bd8e1052c88ad3595c4c1229269f4200604405c8cca75f305c51bc705faf fluxheim.cyclonedx.json
  • Reproducible build:
    • 6789d24dcae9782bcdffe37eabb471f56037e97f82ca22c1cd8b38090c12ce5c x86_64
    • 0df961f7b80dcc0d8f6993b46e83c987c94c8ac801c6385f35f8614fcb7cc626 aarch64
    • 2e2478f4ec43fa46bab73d79eacca414ebb57912109c640bf8f39d40142d2956 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:72a7354e1e3417bf3ea2ddf909259d9cbc429fb58220f4343416e74f97149f53
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:7cef30fc7a5aeb059acff05ba105e95d04894f30ef120ef1f6e632a65e6773bd
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:9fc52f20b99efd31bed4d2f00fafb6ffc6152f473ea6d24f488923f57f9424fb
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0044966fdd84794b2f85c4fd233bd68ece6656ff549d0de5b2129c95ca95fa4f
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:65859fab41f2acf31afb47f894a7e3396bb5ca357c7707da6d4dce2125d4f4cd
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0353f497786e873e43c582ee869c67e6264e289fa8284269bd64f5ce103452b8
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:031d6b9767c6c2d545fa9e74fc36dcc7e20f285e67d3baf29467a18e58481744
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:9902758d800d6d6abe153bda23e4a3f3928c34c4e0210194209397f4d86dd62d
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:203d6b4216289c592b68f1f60bc3d0d7ae2c64c1db872e05ecddabebbcfd367c
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:48e2b11f27a4f1d123d65554ed3d48348de9003a124adca802eccf688c4ed6ab
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1386ef820876d1a1672e416f3cc632ff5141cba89237f5f21eac444d58c37a2e
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:6527002b27e7aabb77a9c8f1abd522d3388f30985fd5196aae1736415986b68e
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7c57319cf4c33a0e460b1921531798dab8a5cc30b2f00cb9d6c6473a09d88b9b
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:310355ef01b51b004d1be1e4eb0ed786ac59c6c2c09940dd6da8329e09ccc0d1
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b648760c98a5fea0996b0eeaa6c2ddef470a732fbeef51338a182cf1422dc887
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:300f572649b05e495e1167eb84b03dd6c14bd7df403f66383803d3f49feb95c9
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:52f081db705e38f8cfa381d5b76ff230885a4f5f1146dd8ef5bcf79cc1e1747b
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:08ef797b008d8e3ea80e2ffca7d7131cae2ef6ee1b09144b3b71e8594fadf755
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:88c81d2ce5565c969ac302f8f8fbcdebcfc95a8bad348b916b7c4a30a213162b
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:2f88b0560c14f82726ec0f753ede3f35e36a459c9b2ea0ead2a908fb1ee2ffd3
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion