Fluxheim 1.6.0

Fluxheim 1.6.0 Release Notes

Fluxheim 1.6.0 starts the Pingora-exit foundation line. This release is the
baseline and guardrail release for the 1.6 series; runtime behavior is intended
to remain unchanged while the project records the evidence and policy needed to
remove Pingora safely in later 1.6.x releases.

Added

• Added the first 1.6 modularity policy and legacy exception inventory. New or
  newly split Rust implementation files should target 300 lines and stay under
  500 lines; existing oversized files are tracked explicitly so the exception
  list can shrink across the Pingora-exit line.
• Added scripts/validate-modularity-policy.sh to report and validate the
  current oversized Rust-file inventory against
  docs/modularity-exceptions.md.
• Added docs/runtime-baseline.md and
  scripts/capture-runtime-baseline.sh to record locked dependency trees,
  per-profile Pingora dependency presence, release metadata, and default
  release-binary size before the runtime cutover work begins.
• Added scripts/capture-runtime-performance-baseline.sh and wired it into
  release-mode runtime baseline capture. It records local startup time, idle
  RSS/file descriptors, static HTTP latency, cache MISS/HIT latency,
  load-balancer route timing, keep-alive throughput, and fresh TLS connection
  timing.
• Added docs/pingora-dependency-exceptions.tsv and
  scripts/validate-pingora-dependency-policy.sh so the 1.6 line has a
  release-gated inventory of allowed Pingora crates per official profile.
• Added docs/runtime-parity-fixtures.md,
  docs/runtime-parity-fixtures.tsv, and
  scripts/validate-runtime-fixtures.sh to pin the smoke scripts, examples,
  and TLS fixtures that define runtime parity before HTTP/cache/LB/TLS
  cutovers begin.
• Added initial fluxheim-runtime and fluxheim-server workspace crates for
  Fluxheim-owned shutdown, background task, listener, and server-runner
  boundary traits. The current Pingora runtime path is unchanged.
• Added typed PolicyEpoch, PolicyProof, RuntimeFact, decision, reason,
  and visibility primitives in fluxheim-runtime for later policy-proof
  adoption. They are not wired into request handling in this release.
• Added docs/extraction-dependency-graph.md to record the intended split
  order for snapshot, protocol, tracing/observability, headers, ACME,
  runtime/server, cache, proxy, and admin modules before the Pingora cutover.
• Added the runtime-facts and policy-proofs planning model. The goal is typed,
  bounded, redacted evidence for Fluxheim decisions such as config promotion,
  route policy, cache admission, load-balancer selection, and admin mutation
  without putting a database in the request path.

Changed

• Updated project version surfaces to 1.6.0.
• Updated documentation language so the 1.5.x line is treated as closed and
  future load-balancer health-check work is no longer described as a later
  1.5.x item.
• Refreshed ROADMAP.md so 1.6.x is consistently documented as the
  Pingora-exit line, shared Wasm extensibility is moved to 1.7, and HTTP/3
  remains after the runtime boundary is stable.
• Hardened scripts/validate-pingora-dependency-policy.sh so documented
  Pingora removal targets are enforced against the current Fluxheim version
  instead of acting as a set-membership inventory only.
• Tightened release-gate scripts by requiring modularity exceptions to be
  listed as structured table rows and by giving the UDP smoke negative
  assertion a longer observation window.

Notes

• This is not yet a Pingora-removal release. It establishes the baseline,
  modularity gate, and security model for the staged 1.6.x migration.
• The legacy modularity exception inventory is intentionally large at the
  start of the line. The purpose is to make oversized files visible and reduce
  them release by release rather than hide the debt.

Checksums And Signatures

• Commit: e7a877c0c5795038b061918cb72ac769ea09b98a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • b1ad465cc4cf2f974026652463c9a5f9642f5bb00501bae861ce14a8e24290f8 fluxheim-1.6.0.tar.gz
  • b8ea622c0ac422e8cc21653ed3e4f8e75470e63947b7a6f055a91d64b294cbcf fluxheim-1.6.0.zip
• Binary checksums:
  • x86_64:
    • 06e79e0f55f8a1d3eec9706d515eada500dd9467037e1433189b49383806e9ae fluxheim-1.6.0-full-x86_64-linux.tar.gz
    • 9d53b83faa5660a4a076a3f7242af9d8fc7d8e400dfc56f4c560564866571877 fluxheim-1.6.0-cache-x86_64-linux.tar.gz
    • 76fb55f9b92be790a0e0f1b87fc90a1c89ef2c34c7b3b1a7c9bd9e4dc65be760 fluxheim-1.6.0-proxy-x86_64-linux.tar.gz
    • 84a560583c989729141f395c62861b6c2c539a54f11f2be7f9afa37dbd8d2046 fluxheim-1.6.0-php-x86_64-linux.tar.gz
    • b95a1287dd4f75249de5acca81a5ba32198c9b8aa9fd7e00e3a25f66f216657d fluxheim-1.6.0-load-balancer-x86_64-linux.tar.gz
    • a79d6314494a79904dfec8303b687469714de0314b0ce1e1fc65ffedeb442b23 fluxheim-1.6.0-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 400a0052eab623d18648737ecf2b040784c277634ade69c5c39c48eaf8f5bf2a fluxheim-1.6.0-full-aarch64-linux.tar.gz
    • c93641096cdc73b1dfa51befe3c546d9360ad68e382fcc6b921b3753812f5a68 fluxheim-1.6.0-cache-aarch64-linux.tar.gz
    • 3e75cd88746dcf5f49a5ef54c0dce1b4f6253aa87afa424197b9f8940252933a fluxheim-1.6.0-proxy-aarch64-linux.tar.gz
    • ac5dfb98ad9899acafeaf32507ad14fef00fd09e1e49845b85a26107372b293a fluxheim-1.6.0-php-aarch64-linux.tar.gz
    • a9d8c920e89b42d606956b21951864fb2d83328f86fb93c05f2b8550d0cd690b fluxheim-1.6.0-load-balancer-aarch64-linux.tar.gz
    • 01048c9c8c42d4f59690de54f58e0ff419060646be1ee76681f65006f27b5d86 fluxheim-1.6.0-config-tester-aarch64-linux.tar.gz
  • macos:
    • 54cf354be32f54f8bdc6af45330749bbbcd183db32d992922b29e1bdd0bcdb09 fluxheim-1.6.0-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 9e35709c936277d9215df6ba99f008a70fee7380ee8691c04a26307e83ebfb3e fluxheim.spdx.json
  • c7c50c3f6a175da9169d67f4e18abeed645dfdc6639633282659acdd2fac18ee fluxheim.cyclonedx.json
• Reproducible build:
  • be9bf213c90d99751102edba6c5a280aa61407cf936a5cf5f8640e3863a3467a x86_64
  • 869eaea4d8923417185d5c76037870921dd221984a164bfadef06c85f7b5acec aarch64
  • 1752b5ab8ed9dceb592899449aee5440ff1ad73772869338dddb2a2ba1c9ada1 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4c6862453e272acae0f554566d697adaaf6aa85d6f17bea928eeec44bd5c2f34
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:076ff3e24df120075b5778c63888ba2ca4370bbde890789f6e19b7c6ebec551e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:18c7798e227d36b751b52014341c0a5d3563393e8e0778e65cd6505de50f1280
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:10e999b52b6d17d39d03429a70933046780c4c8121bf85b9d376769fca614814
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:75f2845a1477ce83d67a09688e66d6735ffca9681ee955b6ab96d18b9ec152bf
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:999cf2a1c057f40709920210068a2aabcd537f48d556b878550d6ae5594adc33
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7dd894d3d986db530a4a3757219abc2b7c6490a1f16152ae67e4d0b600080fb4
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1c9d946730eaa79f2b147c570690779222ca130fce894dd6dbaf40a09000d719
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:26906c17a0137414959cfd7229eb9fa75d7ccdbd6e214add856799ef93c3e333
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:74db31fa8d36f9669befb87321abd5c71a31232355c4c8ae62c41f43419950dd
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:61f65b0969861b7c8bb115aab0db42cb99c32410eb269bf8046e196c1fcd5e92
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:140b43f59d748985a0e47d2df539ecf4898726bc247a2a872830ab1e606f4c04
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6172dc9d37e50167c576eceaf828369c2a03683e869eaa6b3d18c5207998f554
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2cf37a853e712c444f6747f33f17d5516c69f900c0ff994cd7761087bd70deda
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1adefe8bd370790bc868e5930fc325c565de5b013e12284e30f6297e8c013732
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3ab02af49fe41092aa0878100daae8bb0aea9e6853bdfd071b13457ed8f52165
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.23

Fluxheim 1.5.23 Release Notes

Fluxheim 1.5.23 starts the cache-aware origin-protection line with a narrow,
operator-controlled origin-fill budget for Fluxheim-owned cache fill paths.

Added

• Added [cache.origin_protection], [vhosts.cache.origin_protection], and
  route-scoped origin_protection.
• Added max_concurrent_fills to bound concurrent protected origin fills per
  vhost or route cache policy. The first protected path is range slice fill.
• When a protected range slice is missing and the origin-fill budget is
  saturated, Fluxheim returns a bounded 503 instead of falling through to the
  normal origin path.
• Added cache status fields and metrics for origin-protection rollout:
  fluxheim_cache_origin_protection_enabled_policies,
  fluxheim_cache_origin_protection_max_concurrent_fills, and the bounded
  cache policy activity event origin_protected.
• Extended fluxheim cache-key and fluxheim cache-lookup previews with
  origin-protection policy state plus
  --expect-origin-protection-enabled and
  --expect-origin-protection-max-concurrent-fills release-gate checks.

Changed

• Consolidated slice-fill, peer-fill, and origin-fill cache concurrency permits
  into one shared limiter implementation so future hardening of the cache-fill
  DoS budget primitive applies uniformly.

Notes

• Origin protection is disabled by default.
• Existing cache locks still coalesce same-key fills. Origin protection is a
  separate vhost/route budget across distinct protected fills.
• This release intentionally does not rewire Pingora's generic proxy cache miss
  lifecycle. Broader miss/revalidation integration belongs to the follow-up
  cache/runtime boundary work.

Checksums And Signatures

• Commit: d67aba9eec119829f4e0cd8f7b4e32cd0796109a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • f63897c91c7e358fab5b366618ab4f12b31bca2746a224ba05bdfcd2c326cd3d fluxheim-1.5.23.tar.gz
  • 0ae48723311f58bbf34337d6c96cfb32b10acb2f75353754759eda8b145431bd fluxheim-1.5.23.zip
• Binary checksums:
  • x86_64:
    • 46667ae5ca978e417424e8993826caf9f6012e8e786b3e66f45f04eaa763d35e fluxheim-1.5.23-full-x86_64-linux.tar.gz
    • 47d6e7f1a6a9d4621c412b283f9570cc41b6d4449852443de40fbb5a8eabf0d6 fluxheim-1.5.23-cache-x86_64-linux.tar.gz
    • 0d1e2426491629346bb47e8b184c941dd7b01a5e4b225cce3b66774373a618b4 fluxheim-1.5.23-proxy-x86_64-linux.tar.gz
    • bd6ab74e902d3d258ca5b6ed9dea8d45d071a4390969c1d01d8b7d893649a052 fluxheim-1.5.23-php-x86_64-linux.tar.gz
    • 0c36707dfacc6ffcf4cee479e83d38c83c430c9fe4acf6d34e7554581415be48 fluxheim-1.5.23-load-balancer-x86_64-linux.tar.gz
    • e596775fca01564d94beeae31511f5903b3e268dc2a50540c6858107ba125ea7 fluxheim-1.5.23-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 4b84bcea1d350ab790d7644965284dba8707130c5164fc99281fefb22d23650d fluxheim-1.5.23-full-aarch64-linux.tar.gz
    • 659038e46d2abcc1ed1d00d0afd0b8088b4c4f51e8957bbf2cf7c19f1d55ae23 fluxheim-1.5.23-cache-aarch64-linux.tar.gz
    • db3b464d9ff00871cd9b4151af943bf97d3f8c435dc983cfa1fc8cd9abc05a1b fluxheim-1.5.23-proxy-aarch64-linux.tar.gz
    • 4bea06ce48647a74083fe339f5580f18fc1d15cc851e45ea234034c248849c16 fluxheim-1.5.23-php-aarch64-linux.tar.gz
    • eff4ef4410533d6a6fc9a2afabe08e25215a5e8cae082fc9398c6ec54384fcf4 fluxheim-1.5.23-load-balancer-aarch64-linux.tar.gz
    • 85aae2076417b9fe926d120e8ac4fb43bcbf07e319f59fa6971b93cf7ec29a9d fluxheim-1.5.23-config-tester-aarch64-linux.tar.gz
  • macos:
    • 606a397cf25fcd931d86afc49ff5e9197424216070182428172e259d4ef62ef4 fluxheim-1.5.23-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 2467cd8122f76a438197fa1fa3593c522e99203cb0f8e533f2ab6dc485e72aed fluxheim.spdx.json
  • 75095881f3a27ce2283d3ab6e72ad9286cdc09976ebb23b7abe248fcff399cae fluxheim.cyclonedx.json
• Reproducible build:
  • e21f5d0bf494f020444788e6277f8ec2937e826ea914bf0b095eff1640b20263 x86_64
  • c81bdb8a238475077eaa60ea858a425c9e394d2c1fc7caaaa39f8f125732f917 aarch64
  • eeb64a9ab57f98b7f2dabc42d814529ac8ca42cd274a690242b22c6f3e520b25 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1a738837e17e33d172408bf07acaabcc1411e884a6232e9901ed27d46dc3b708
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8d84fb0560a365d8978abd065fc053242025ed7dda04a56414d6171d135c2421
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:36ce151bad497a70f0bc244110f502765202c1d6f9908e21605ef3f4778ac7cd
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:9733ba05497a73cf6bb6e6bd34943fc6558125c0633e176c0bcd733194c8615c
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8094d859339953f6e62945f0d5d894b8101fde9398f265dc1d1c7c1f692955ce
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0c46337322fb0776951310a61a0f79dad6274bdbc33586d2326b30f4cc5ab16e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2debd1b750c5b5cf8443a8bfc61cc062caccd8292ba462778622eb18c17fa49c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:d91de7eafc242380af568839473b3e298f8424674a6f4279575f925725c066bc
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8d9dc4b3ba2744388189669087db0b22ca49fd2c0d1f03f6cea19f984f8bba90
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3a2d490f171e6429efa5e19d3cf42aa6af51a7ca16d9ca0797598f0bc4edd300
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:49e9b08ec497d8c5b9da8da569b51460bbb820bb844f537a9b1cfb1aa765c5bb
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:220b656437d0ff7db1fadc35eb0ba734b84b663330c9c0b7c153942f52a64592
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:39ddcf5bfea9ea2b2a5153335f9e32cde826b898a82aedf61fe6745244e8dbc4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1388aabf2da3650d4cb033138723c7240bb662ac528a5910fb8a5a58e2a979da
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8a74abc322d3b6a1574880c69feadd3dfb93b62220b4d6ac657c292a92bcbfb2
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:51cdfba9c74974a80ee0efd5f84b03ba7d3b733f0c5cbaf331a3e7a30974eceb
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0787d6ec282760c633e1e2307b8bf8da7dfb3eae15bd7ea7cf2d64195d278b61
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c30a8a1deb2c77f231a31d4842b43d57fe4be157d7706b091ab224d4091fdb05
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:447b4e3d4ffb369eacf8e97743b341e387be739bac3a28bda100b63ac0d0e18e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:00ad8c7dea87af9dce0565da51e6d36ee4fca5d596f848053df01db784ef10ab
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.22

Fluxheim 1.5.22 Release Notes

Fluxheim 1.5.22 continues the crate-boundary preparation work for the later
1.6.x Pingora-removal line. Runtime behavior is intended to remain unchanged;
the focus is keeping cache/load-balancer domain logic behind Fluxheim-owned
interfaces before the HTTP runtime is replaced.

Changed

• Load-balancer persistence key extraction now consumes a Fluxheim-owned
  request view trait instead of depending directly on Pingora request headers.
• The existing Pingora RequestHeader support remains as an adapter at the
  load-balancer API boundary.
• Managed-cookie persistence tests now run against a local Fluxheim request
  view, proving the persistence module can validate cookies without a Pingora
  request object.
• fluxheim-web symlink-detection tests now use repository-local,
  component-validated test paths from the shared test-support helpers. This
  resolves CodeQL path-expression alerts in test setup/cleanup code without
  changing static-web runtime behavior.
• Cleartext TCP health checks now use a Fluxheim-owned Tokio connect probe.
  TLS TCP health checks intentionally keep the existing Pingora transport
  connector so SNI/TLS handshake behavior stays unchanged in 1.5.22.
• Cache request bypass, client revalidation, and range-selection decisions now
  run through a Fluxheim-owned cache request view. The root proxy cache module
  keeps a small Pingora RequestHeader adapter, so cache behavior is intended
  to remain unchanged while the cache crate owns more policy logic.
• Cache response admission decisions for status, content type, response
  no-store policy, Vary handling, and range responses now live in the cache
  crate. The proxy cache module still exposes the same adapter functions for
  the existing Pingora response path.
• Cache storage interface result enums for purge type and miss completion now
  live in the cache crate. Pingora PurgeType and MissFinishType conversion
  stays in the root adapter layer.
• Range and slice cache-key component construction now uses a cache-crate
  helper, leaving the proxy cache module to adapt only Pingora's cache-key
  container.
• UDP beta passive health now ignores local downstream drop conditions such as
  per-source response-rate limiting and oversized upstream responses. Only
  genuine upstream connectivity/timeout failures can contribute to passive
  ejection, and passive-ejection warning logs are rate-limited.

Compatibility

• No configuration changes.
• No load-balancer persistence behavior changes are intended for source-IP,
  URI, header, cookie, or managed-cookie persistence.
• pingora-load-balancing and pingora-cache remain in the build graph for
  1.5.22; actual dependency removal is reserved for the 1.6.x line.

Checksums And Signatures

• Commit: 7015707b9d77b67ae70d48694fec96f08103b060
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 7714149d689203e79922a7438aecd4f860c0920876e6da84d2ff7048838c53ea fluxheim-1.5.22.tar.gz
  • 5382d877dd2827220fe3e9eb2301e08452d5619b68cb459536b3526c6f342578 fluxheim-1.5.22.zip
• Binary checksums:
  • x86_64:
    • 3dcdfb258e3d0f6322c1128a78a2f1a595e4284101869377499911114b49eb91 fluxheim-1.5.22-full-x86_64-linux.tar.gz
    • b7e7568bb350332825ebd40123c18ce7324848c85296c548d83b4ae19ce26738 fluxheim-1.5.22-cache-x86_64-linux.tar.gz
    • 3018277e5dc7942db7b47097eebedebfdd22428db390ebdb0a5aab687925365c fluxheim-1.5.22-proxy-x86_64-linux.tar.gz
    • e15d4ac9eba3b6a19194bdbe3272ad70e36d6e3754bd90cf3358e9d4e5a2ea6e fluxheim-1.5.22-php-x86_64-linux.tar.gz
    • 33a50a565c2365d13e0a78d337630ff86465cfbadf70723b662931394a544ffc fluxheim-1.5.22-load-balancer-x86_64-linux.tar.gz
    • 324e7c48fd63df5f726d8db31a88c3d823462806cfa8e4fbe1820356fd8004f6 fluxheim-1.5.22-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 587452cee55cd422c6f61586a012ed08428563e1985627ec69d368b151528304 fluxheim-1.5.22-full-aarch64-linux.tar.gz
    • 65bff78fbf710093a3c0a3d0bb933db8c780f299afd4b57328145920ea32a8d3 fluxheim-1.5.22-cache-aarch64-linux.tar.gz
    • df0c07d7292efbcd4f3d947f74aa5afefa1d249af8c412bf4ecccff4d4237fc9 fluxheim-1.5.22-proxy-aarch64-linux.tar.gz
    • 35c993751113c89a837b6b768c86ae1667c6923431168b6633415d0aae9f58fa fluxheim-1.5.22-php-aarch64-linux.tar.gz
    • 4e640850db94935b5f179011de29894bf4ac3bd041dd810f1ec590142604c2c4 fluxheim-1.5.22-load-balancer-aarch64-linux.tar.gz
    • 1bf3ef0fec4263123f6ca1b7865f0bb0b66fdb9787e889380e6235aa7c9e1077 fluxheim-1.5.22-config-tester-aarch64-linux.tar.gz
  • macos:
    • 012881d65aea2ff34b283772a6e6cdafba9c1973adc51342d09d9283f6ce5f14 fluxheim-1.5.22-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 51d63c4b04cff2fdc66490f49957295432b5c00e4c52e1933fe98b9b36c0b0ed fluxheim.spdx.json
  • dbcf34fe55b37a0018f274ed822c2c1dc7f07485436fe5199f84f67598f26a6f fluxheim.cyclonedx.json
• Reproducible build:
  • 6afa46e0273b906f6e2a6b9d4defcb57e04ca881603a155dd1e50ae4f1e14555 x86_64
  • 4b3a61fd7cfdda7aeb6f0724eefbd525eabfc18daeb2e718aea0dac0fe05fc94 aarch64
  • ac42491093fc4f2c9c0412e018534a8137edb1b1175db10889b86e5dbc35e942 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2bd1abff3252bc95977b01e9571671d0fa033d622874ccf73686e3b17caeb51f
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8d0039f81e471663831200780c34b4941044a30580322fcd0b3fa0090ad9e139
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0a6d59ae92dbdf165334d94b7c84909c08b8e8b142dbaeee57442546d5105c7f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:189d8fa9d8e36a963dee965ae20f637b412a97e3ec23ebafad7ce7c7359be3fe
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:49a1f6489c8567f85588481a01d02243ab6d8798f2b2acceb6ff305b83117e36
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:332643bfdcc9441bff81bde08448ab9f32751b0e9665596b9d74b0d9126d1bf3
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:47a057c5aaf1a15114a45e54e5a689102a7ca3ac83ad7b6f7cda77d9e56107aa
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:e9cb1739ef543f4f1f8bbeea8c1a0725f8c59d32b8a5a9c7958e027b2c98aa83
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2dd8e485a93ca4a13cd830a19be1540c2f9cb535ab046c0e6ce9d3813cc51681
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:10eec7895d90036c3e7bd3d9bbe0928f9fa824ba5335926726609a1af97ba8a8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:cbb99ded198ea7c2d784bf9447a6840ce22c900edd5bf90a54bcf60dfcef735a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0b903b9df6f8d4391aa839f2ad45819854d183cc9fd03439cf7c895864bcd25d
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0e065ca7bbd29a8bdd99cf4e06ca7f4339dd9920a805c8ec2a1a8b4c708a8335
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:664c80a8e8e9851372dbd81e7c5b5c8c428fec1d4a8da8edfd56c37effa4b2dd
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:019975106bb007353fde90a0c1b771e321de08787857ad8c32b7edde739e0596
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:5c24ff9a0c3a15b062a8781d78a236a051c0777d4ee1a8ad6d217604f1384f93
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:3e49f6f77e9995fd9fe8797f7cb362585d4a6b46fe6a83c2d6f9e759d36b1053
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:132f0f34d27799ae574cb1cfceb97ce268c551424904013cc5a704c2985121f4
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:04d5c340af54863b34920a5a06a69ff1a4424e52908f355e323374adf35cb884
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:44eeec586042018aef12a3d704dfca4d983803c3584a7a32bbbd13cd5b83ec15
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.21

Fluxheim 1.5.21 Release Notes

Fluxheim 1.5.21 continues the UDP beta production-readiness line. The UDP
feature remains compile-gated behind udp-proxy, but DNS-style
request/response forwarding now has explicit pressure and observability
controls for safer testing.

Added

• Added udp.routes.max_sessions_per_source to cap concurrent in-flight UDP
  datagram sessions per source IP.
• Added udp.routes.max_responses_per_source_per_second to cap UDP responses
  per source IP per one-second window.
• Added UDP Prometheus metrics:
  fluxheim_udp_datagrams_total, fluxheim_udp_drops_total, and
  fluxheim_udp_active_sessions.
• Added admin UDP status at GET /_fluxheim/udp/status.
• Added UDP passive upstream health controls:
  passive_health_enabled, passive_health_failures, and
  passive_health_ejection_secs.

Changed

• dns-load-balance UDP routes now log a security warning when a beta route
  listens on a non-loopback address.
• UDP request/response pools skip passively ejected upstreams while at least
  one ready member remains, with fallback behavior when the full pool is
  unhealthy.
• UDP beta docs and smoke tests now describe and exercise the explicit
  per-source pressure controls.
• UDP smoke coverage now verifies exact-cap responses are accepted and
  oversized downstream datagrams are dropped before reaching upstreams.
• The stable release gate can run the UDP beta smoke with
  FLUXHEIM_GATE_UDP=1; set FLUXHEIM_UDP_SMOKE_ITERATIONS for longer local
  soak runs.
• UDP response-rate limiting no longer scans the full tracked-source map on
  every response. The route now uses a current-window generation and clears it
  only when the second changes.
• UDP passive-health fallback selection now scans at most the configured
  upstream count instead of the total weighted slot count when members are
  ejected.

Compatibility

• Existing UDP beta configs continue to load; the new fields have bounded
  defaults.
• udp-proxy is still not part of the normal release profiles.

Checksums And Signatures

• Commit: bf0526b4fb1b37cfc33cf72ad41a47e3fa0056db
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • d128c0284cc99c88388e00e27725564be6de00c850ff03b512ba87f5e9584de4 fluxheim-1.5.21.tar.gz
  • 4e36064675ac371da3f6a4fffccdd05d987891f02090cbd44e15d12092296301 fluxheim-1.5.21.zip
• Binary checksums:
  • x86_64:
    • 37edf500c563d55b4e69f1d82224e4b8a55d3583ef14121a719190276d026392 fluxheim-1.5.21-full-x86_64-linux.tar.gz
    • cde0905803d07d46249d3e395a579a8d039a7e640558015b62a83942bf68f0bd fluxheim-1.5.21-cache-x86_64-linux.tar.gz
    • f2aff758cef9d714b2eb76390be07b2e293619a90d4a28bf757fa3ba44022e08 fluxheim-1.5.21-proxy-x86_64-linux.tar.gz
    • bf5b91da53fb75538b6064f09c942ae6b907da5276561cdd89911f5f75674132 fluxheim-1.5.21-php-x86_64-linux.tar.gz
    • 3fb5df5ed378e138b9a5f3fca3aa82f3ec5bb0b44420a483d55ba09fcfea40b4 fluxheim-1.5.21-load-balancer-x86_64-linux.tar.gz
    • f8eff05670b45d3c8ff3fefe9c5299bd88bdea041b021c56e8928654445f76f3 fluxheim-1.5.21-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 2c43737a3c2b51b1558b59dd1ef8c37c2c16c77e0e258f2dcba132cd6257baf3 fluxheim-1.5.21-full-aarch64-linux.tar.gz
    • fc915ef30ff614c3d3167de1bac5dc8f094afa4c715d013c9904f5467c18900f fluxheim-1.5.21-cache-aarch64-linux.tar.gz
    • 560d7b5a88419d51cdf844112d22a2d203a6fe787b61112b776150c72907c1d9 fluxheim-1.5.21-proxy-aarch64-linux.tar.gz
    • f9fb9d59cd655bfd00b940e943e950c3056faa348aaa840230e1a579c651b7a7 fluxheim-1.5.21-php-aarch64-linux.tar.gz
    • aa6dac83302318f57a6fcad6c5f11903e03397864856d8715d623bf460bccd46 fluxheim-1.5.21-load-balancer-aarch64-linux.tar.gz
    • 2b3c336c6f20bf5309d32cec885db258a2df3b554bc45a9cd6a2e85b998a5e6b fluxheim-1.5.21-config-tester-aarch64-linux.tar.gz
  • macos:
    • 533f8252989f9a8d455f6f82259e965f1add011f8ab2ba744cb92277e305784c fluxheim-1.5.21-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 108dc44377694cbe7c4bf840c257adfb907f52bb58921b1b8042803d62e41999 fluxheim.spdx.json
  • 24e1663976f7e61ad2596ca97bd5ce6227c9c06f6d45c547075f870f5351e746 fluxheim.cyclonedx.json
• Reproducible build:
  • a1dad755b60e8f667ac98ff9352754ef706dc4b34e7900e5983b1100f052f38d x86_64
  • 2716cbf04f68988867a6672c7ec57cb4808ee7d4630e2b889b7a05aff77abe18 aarch64
  • 8210aea73ded9732fb325255e743121405f20dece920634f347cc209c4765193 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a12cb63ecefa0e092dc9ba514415df3b4620099cc870e19d37a45cb64b0869ff
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:16e7b8a6098d89e97e9f1a597917b7cdab1c349a60520b1a1faf06637709debc
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:227ddeb1c775d312add505d2c67ba18ce23532ca1d60b3ee5ff3085fc9bc5eb9
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1c1f851e33c24a40630627fcc002e8e22536afc4e0cdc0da255ddf64e7575552
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7bacfde825a546f8a25de3c1dbd7cac547d78a1b76afc153f9d62db31c4e115b
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:141c42b8c376b711e1d1f6ee3165b83c9a73e5de5bf9cc73fb2599e218b558cc
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:38ed5c049d5d88889a86b9c552427e204605d8c342154edb676f332c522ba018
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:7e1a4bbbfb58495abead6d925d39592b056c949fb0eaf9538772360d09b0fe57
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4114ce3111ea00761a0d90940a96b9c8ef1034dd12f363e2f4ed637db3ee1fdb
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0743771e19a8c87f3372442a35eb18505fb40220849eab56ee6bf04d5e12c3ac
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4c130f0d5488dfa9ad98817e7697f47cdadbce5eb0354a2c4846711a1d0f18c0
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:93cc24371dc6997f1f996a52e4dac31e3a3478ce86f71e7e1fe6cda8eccc8b65
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:e33c2645fcdc16bc4ea0bee1272d90f5cd90273c40d626fc64eb868e591cb8d9
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3c20c579182e4cb65e9eec11f890ba45ea93fb08f9d17d0b4af21ecf4f59e129
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:118af8a61276086b56355f9ed766398d692bf1ecbc77ec49c5d98cbab446978c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0f8d7f6c3884aa22c1a1961285972339ea60c2c369f6405d6afefa19830b2b0f
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:61775fea830a5aa7036f3d4cdbeda235788f62c9019662c55b64717bf8933084
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:46fa14eb73aad7a4714192649bfc19f43ea05963918be74dbc1a6d0a1dafad93
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:172fd21c2b76d84c8493ba9de6d52fcb1e934a91c323d888e044928c753a06d7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:52015279849002ce6bb11f29191c51fe720cfa682ef0ea85dfa7ef568d90219d
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.20

Fluxheim 1.5.20 Release Notes

Fluxheim 1.5.20 starts the web, PHP-FPM, and cache boundary-preparation line
and carries forward the post-1.5.19 trusted-proxy validation fix.

Changed

• Started the fluxheim-cache crate boundary by moving shared cache-header
  request/response directive parsing into crates/fluxheim-cache. The root
  crate keeps crate::cache_headers as a compatibility re-export, so runtime
  behavior and call sites are unchanged.
• Moved pure cache admin request/result/preview DTOs into
  crates/fluxheim-cache::api, with root crate::cache_api and
  crate::proxy re-exports kept for compatibility. Pure runtime totals and
  activity-reset DTOs also moved.
• Moved cache object metadata, activity stats, tier stats, object lookup, and
  vhost/route runtime stats into crates/fluxheim-cache::api. Root
  crate::cache and crate::cache_api keep compatibility re-exports so admin,
  CLI, metrics, and proxy call sites are unchanged.
• Moved cache storage-plan DTOs into crates/fluxheim-cache::plan, keeping
  root crate::cache re-exports while the Pingora storage adapters remain in
  the root cache runtime.
• Moved cached object DTOs and CacheStoreError into
  crates/fluxheim-cache::object, keeping root crate::cache re-exports for
  memory-cache and test call sites.
• Moved cache request/key DTOs into crates/fluxheim-cache::request, with root
  crate::cache re-exports and root cache-key builders preserving the existing
  behavior.
• Moved cache range/slice request DTOs, single-range parsing, client range
  parsing, client-range resolution, and required-slice planning into
  crates/fluxheim-cache::request, leaving root crate::proxy_cache as the
  Pingora request-header and cache-key adapter.
• Moved Content-Range parsing into crates/fluxheim-cache::request, so
  range-cache admission and slice-object reconstruction share one pure parser.
• Moved pure cache freshness helpers for remaining TTL and synthesized
  Cache-Control freshness directives into crates/fluxheim-cache::headers.
• Moved Vary header parsing and configured request-header variance policy into
  crates/fluxheim-cache::headers, keeping root crate::proxy_cache focused
  on Pingora request hashing and adapter logic.
• Moved Vary request hash material framing into
  crates/fluxheim-cache::headers; root crate::proxy_cache now only adapts
  Pingora request headers and calls the Pingora hash function.
• Moved cacheable response Content-Type matching into
  crates/fluxheim-cache::headers, leaving root cache admission as the
  status/header adapter.
• Moved cache-bypass cookie and query-string matching, including
  percent-decoded query comparisons, into crates/fluxheim-cache::headers.
• Moved cache stale-serving event and status/error allow policy into
  crates/fluxheim-cache::headers, keeping Pingora error classification in
  root crate::proxy_cache.
• Moved response Age and Cache-Control max-age/s-maxage parsers into
  crates/fluxheim-cache::headers, leaving root response helpers as thin
  Pingora header adapters.
• Moved Cache-Control directive merge/replacement into
  crates/fluxheim-cache::headers, leaving root response mutation as a
  Pingora header adapter.
• Moved range response Content-Range and Content-Length validation into
  crates/fluxheim-cache::request, leaving root range-cache admission as the
  Pingora status/header adapter.
• Moved cache-key component formatting and the temporary HEAD cache bypass
  predicate into crates/fluxheim-cache::request, keeping root compatibility
  wrappers for existing proxy callers.
• Moved multipart slice range policy sizing into
  crates/fluxheim-cache::request, leaving root crate::proxy_cache as the
  config adapter.
• Moved cache Prometheus label classifiers into crates/fluxheim-cache,
  keeping root crate::metrics as recorder wiring.
• Moved cache purge-index state, purge-entry DTOs, storage-local purge result
  counters, and cache-key path matching helpers into
  crates/fluxheim-cache::purge_index. Root crate::cache keeps the existing
  compatibility type names while the Pingora storage implementations remain in
  the root runtime adapter.
• Started the fluxheim-web crate boundary by moving static directory-listing
  data/rendering helpers into crates/fluxheim-web. The root crate::web
  module re-exports the same types and renderer while keeping Pingora response
  serving in the root adapter.
• Moved static byte-range parsing into crates/fluxheim-web, keeping
  crate::web compatibility re-exports for the existing static response
  planner and tests.
• Moved static response planning, conditional request evaluation, weak ETag
  construction, and range response plan DTOs into crates/fluxheim-web.
  crate::web keeps the existing StaticRequestConditions compatibility
  adapter so proxy call sites and cache-refresh semantics are unchanged.
• Moved safe relative path and directory-listing path helpers into
  crates/fluxheim-web, leaving root static serving responsible for filesystem
  canonicalization and symlink checks.
• Moved configured web-root symlink detection into crates/fluxheim-web,
  keeping root StaticFileServer construction as the filesystem adapter.
• Moved static cache identity formatting into crates/fluxheim-web, keeping
  root StaticFile as the filesystem metadata adapter.
• Started the fluxheim-php-fpm crate boundary by moving PHP-FPM timeout
  classification and bounded error-outcome helpers into
  crates/fluxheim-php-fpm, with the root PHP-FPM module re-exporting the same
  names for existing runtime and test code.
• Moved managed PHP-FPM restart-backoff and sanitized PATH fallback helpers
  into crates/fluxheim-php-fpm, again keeping the root module as the
  compatibility surface for existing code.
• Moved managed PHP-FPM config rendering and its config-value validators into
  crates/fluxheim-php-fpm, leaving root PHP-FPM process supervision as the
  compatibility adapter.
• Moved PHP-FPM effective timeout calculation, retry attempt/deadline policy,
  retryable status matching, and retryable error classification into
  crates/fluxheim-php-fpm, with root crate::php_fpm retaining the
  StatusCode compatibility adapter.
• Moved PHP-FPM endpoint selection and endpoint DTOs into
  crates/fluxheim-php-fpm, with root crate::php_fpm keeping compatibility
  re-exports for the proxy runtime and tests.
• Moved PHP-FPM response-header name/value safety guards into
  crates/fluxheim-php-fpm, keeping root response parsing as the Pingora
  header adapter.
• Moved PHP-FPM response split, Status parsing, ASCII trimming, and header
  colon splitting into crates/fluxheim-php-fpm, leaving root response parsing
  as the Pingora response-header adapter.
• Moved managed PHP-FPM instance-name generation and metric-pool sanitization
  into crates/fluxheim-php-fpm, leaving root process supervision as the
  Unix runtime adapter.
• Started the fluxheim-geoip crate boundary by moving GeoContext and the
  optional local MMDB runtime into crates/fluxheim-geoip, with root
  crate::geo_context and crate::geoip compatibility re-exports.
• Started the fluxheim-compression crate boundary by moving response
  compression encoder lifecycle and output-limit accounting into
  crates/fluxheim-compression, while keeping Pingora header selection and
  response mutation in the root adapter.
• Moved Accept-Encoding token and qvalue parsing into
  crates/fluxheim-compression, keeping root response-header selection as the
  Pingora adapter.
• Moved compression response policy string matching for Cache-Control directives
  and Content-Type eligibility into crates/fluxheim-compression, leaving root
  response-header iteration as the adapter.
• Moved active Content-Encoding classification and compression input-size bounds
  into crates/fluxheim-compression, keeping root response headers/config as
  adapters.
• Started the fluxheim-observability crate boundary by moving W3C Trace
  Context parsing, generation, and traceparent normalization into
  crates/fluxheim-observability, with root crate::trace_context kept as a
  compatibility re-export.
• Moved the shared OTLP HTTP agent and symlink-safe custom CA bundle loader into
  crates/fluxheim-observability behind its otlp-http feature, while keeping
  the root crate::otlp_http module as the metrics/tracing adapter.
• Moved OTLP HTTP endpoint parsing into crates/fluxheim-observability,
  keeping the Prometheus metrics payload conversion in the root metrics adapter.
• Moved the Prometheus-to-OTLP metrics payload builder into
  crates/fluxheim-observability behind its otlp-metrics feature, leaving
  root metrics OTLP as exporter lifecycle and HTTP post wiring.
• Moved access-log helper logic for request-id validation/generation,
  shared low-cardinality status classes, response byte counting, and Unix
  nanosecond timestamps into crates/fluxheim-observability, while the root
  access-log module keeps Pingora request-header integration and JSON event
  assembly and Prometheus metrics reuses the shared status-class helper.
• Moved shared JSON string escaping for access logs and runtime JSON logs into
  crates/fluxheim-observability, keeping both root log schemas unchanged.
• Moved proxy metrics outcome, method, and status-class label bucketing into
  crates/fluxheim-observability, keeping root crate::metrics as the
  Prometheus registry/recorder adapter.
• Moved general Prometheus label classifiers for host-routing, admin-auth,
  compression, edge-policy, load-balancer event/queue/upstream, stream, ACME,
  PHP/PHP-FPM, and metrics-OTLP exporter events into crates/fluxheim-observability,
  further narrowing root crate::metrics to recorder wiring.
• Mov...

Fluxheim 1.5.19

Fluxheim 1.5.19 Release Notes

Fluxheim 1.5.19 moves the Fluxheim-owned load-balancer core into the internal
fluxheim-load-balancer workspace crate and includes security hardening found
during the v1.5.19 review cycle.

Security Fixes

• Fixed fallback proxy cache auth ordering so cache fallback handling cannot
  run before the configured authorization decision.
• Rejected ambiguous dot-segment proxy request paths before route selection,
  route-local policy checks, cache keying, or upstream forwarding.
• Treated incoming method casing as equivalent for route method filters so
  lowercase HTTP/1 method tokens cannot miss method-scoped route policy.
• Restricted accepted inbound request IDs to an identifier-safe alphabet so
  URL-like or email-like values are regenerated before reaching logs, traces,
  templates, or upstream headers.
• Released response-compression output buffers after each emitted chunk while
  preserving the cumulative max_output_bytes cap.
• Made route prefix matching and prefix stripping path-segment aware so sibling
  paths such as /repoadmin cannot enter a /repo route or rewrite to
  unintended upstream paths.
• Percent-encoded URI-special bytes in route regex capture substitutions before
  applying rewrite templates, preserving slash-spanning captures while removing
  raw matrix/userinfo/list delimiters from rewritten upstream paths.
• Normalized Set-Cookie Domain and Path attribute values before response
  rewrites, covering leading-dot domains, quoted attribute values, and trailing
  ASCII whitespace so alternate cookie syntax cannot bypass configured rewrite
  rules.
• Hardened range slice-cache origin fill so dynamic-only upstream discovery
  cannot fall back to the default loopback upstream, unsafe dot-segment origin
  paths are rejected, and multipart range requests are bounded by range count
  and response-wrapper overhead.
• Resolved exact local-static purge identities through the same route rewrite
  logic used by static serving, including rewrite_prefix.
• Applied decoded route matching to edge policy checks, closing mismatches
  between encoded request paths and policy enforcement.
• Preserved private cache-control directives for status-specific TTL handling
  so restrictive origin cache headers are not weakened by cache policy.
• Hardened PHP-FPM path handling by denying scripts after resolved-path
  normalization and covering directory-index resolution under denied PHP path
  prefixes.
• Fixed proxy-only route decode feature wiring so shared path safety remains
  available in proxy builds without cache.
• Isolated upstream CA bundle material in peer reuse keys to avoid reusing
  upstream TLS peers across distinct trust material.
• Added a default stream proxy connection cap to avoid unbounded accepted TCP
  stream connections.
• Detached self-healing probes from public proxy traffic paths.
• Preserved restrictive PHP cache headers when PHP-FPM responses are converted
  into Fluxheim responses.
• Rejected PHP-FPM PHP_VALUE and PHP_ADMIN_VALUE style ini-control
  parameters so configured PHP params cannot rewrite php-fpm runtime policy.
• Cleaned pending PHP request-body spool files on retry/error paths.
• Added php.max_in_flight, defaulting to 8, to cap concurrent PHP-FPM
  requests before request body buffering and FastCGI dispatch.
• Added proxy.load_balance.passive_health.min_healthy_backends, defaulting to
  1, so passive outlier ejection cannot fail-closed an entire load-balanced
  pool by default. Operators can set it to 0 to retain strict fail-closed
  passive-health behavior.
• Hardened managed-cookie load-balancer persistence so invalid affinity
  cookies no longer create server-side persistence-table entries, while newly
  issued signed cookies immediately record one bounded table entry for the
  selected backend so the next request remains pinned.
• Rejected verified HTTP proxy upstream TLS configs that target an IP-addressed
  upstream without explicit upstream_sni, preventing the Pingora connector
  from falling into empty-SNI certificate-verification bypass behavior.
• Hardened HTTP load-balancer discovery so private, loopback, link-local,
  metadata, multicast, reserved, and documentation IP-literal backends are
  rejected by default unless the operator explicitly enables
  proxy.upstreams_http_allow_private_backends.
• Added proxy.downstream_read_timeout_secs, defaulting to 60 seconds, and
  wired it into vendored Pingora HTTP/2 downstream request-body reads so
  slow-body clients cannot hold proxy forwarding tasks indefinitely while
  withholding DATA frames or END_STREAM.
• Applied the downstream read timeout before PHP-FPM request-body collection and
  drain paths, covering PHP routes that read the body before FastCGI execution
  begins.
• Revalidated managed PHP-FPM binary paths immediately before spawning child
  processes and rejected symlinked binaries at config validation so local path
  swaps cannot replace the supervised executable between reload and spawn.
• Hardened downstream HTTP/2 flow-control defaults by capping per-stream send
  buffering at 256 KiB, keeping DATA frames at 16 KiB, fixing the receive
  window at 64 KiB, and reducing pending-accept reset-stream pressure.
• Removed encrypted filesystem disk-cache fill heap amplification for the local
  provider by committing streamed cache bodies through bounded AEAD chunks, and
  bounded the OpenBao Transit whole-object fallback heap budget.
• Hardened DNS-refreshed upstream discovery against DNS rebinding pivots by
  rejecting private, loopback, link-local, multicast, reserved, documentation,
  metadata, and unspecified resolved addresses unless
  proxy.upstream_dns_allow_private_backends = true is set.
• Hardened HTTP and DNS discovery backend filtering by applying the IPv4
  private address policy to IPv4-mapped and IPv4-compatible IPv6 literals
  before they can be accepted as upstream addresses.
• Hardened split-config trusted-proxy handling by extending
  server.trusted_proxies fragments instead of replacing the main list, and by
  rejecting catch-all or near-global trusted-proxy ranges such as 0.0.0.0/0
  and ::/0.
• Hardened split-config proxy handling by applying field-level [proxy]
  fragment merges so a later timeout-only proxy fragment cannot silently clear
  upstream TLS verification, auth request, mirror, or load-balancer policy.
• Completed recursive split-config merges for [proxy.auth_request],
  [proxy.mirror], and [proxy.load_balance] so partial nested fragments
  cannot reset established auth, shadow-traffic, persistence, health-check,
  retry, or load-balancer selection policy back to defaults.
• Hardened split-config handling for [compression], [cache],
  [cache_purger], [web], and [stream] so partial fragments cannot
  silently drop previously configured compression limits, cache encryption,
  static-file safety policy, or stream routes.
• Hardened split-config admin handling by applying field-level [admin]
  fragment merges so a later ops-socket or health-only admin fragment cannot
  silently disable the admin API or clear token and snapshot-store settings.
• Hardened cache peer-fill request construction so peer lookups use the
  selected vhost's canonical Host, while client-controlled Host headers
  and absolute-form URI authorities cannot pivot peer requests to another
  vhost.
• Added an inbound peer-fill recursion guard so requests marked with
  X-Fluxheim-Peer-Fill: 1 cannot launch another outbound peer-fill fetch in
  cyclic peer topologies.
• Decoded percent-encoded cache bypass query names and values before comparing
  bypass_query_params and bypass_query_values, closing encoded preview or
  private-mode cache bypass evasion.
• Aligned configured cache Vary request headers with the 16-field runtime Vary
  cap and rejected effective origin-plus-configured Vary overflows at cache
  admission instead of dropping variance.
• Hardened auth-request response header handling so allowed auth response
  headers cannot override Fluxheim's upstream request header policy on name
  collisions.
• Hardened auth-request forwarded context handling so allow-listed
  X-Original-URI, X-Forwarded-For, X-Real-IP, X-Forwarded-Host, and
  X-Forwarded-Proto values are synthesized from Fluxheim's trusted request
  context instead of copied from spoofable client headers.
• Matched auth-request split Cookie handling to the origin request path by
  joining repeated Cookie fields with ; instead of , before sending
  the authorization subrequest.
• Hardened Unix admin-token and file-log opening by using rustix
  architecture-correct NOFOLLOW flags instead of hand-coded constants.
• Hardened trusted-proxy X-Forwarded-For parsing so any malformed hop rejects
  the forwarded chain and falls back to the direct peer IP instead of silently
  attributing traffic to a trusted proxy hop.
• Normalized IPv4-mapped IPv6 client addresses before trusted-proxy,
  access-policy, rate-limit, and GeoIP decisions so IPv4 CIDR policy also
  applies on dual-stack listeners that report IPv4 peers as ::ffff:....
• Restricted WebSocket-enabled proxy routes to the websocket upgrade token so
  valid but unrelated protocol upgrades such as h2c are not forwarded to
  upstreams.
• Stripped HTTP/1 Connection and Upgrade request headers when
  proxy.websocket = false, preventing normal proxy routes from tunneling
  upgraded protocols by accident.
• Removed vendored Pingora upstream TLS underscore-to-hyphen hostname
  verification rewriting so certificates are checked against the exact
  configured SNI or alternative name.
• Stripped client-controlled hop-by-hop request headers before forwarding to
  upstreams, including Connection-listed extension headers an...

Fluxheim 1.5.18

Fluxheim 1.5.18 Release Notes

Fluxheim 1.5.18 moves configuration ownership into the internal
fluxheim-config crate and hardens downstream HTTP/2 response handling.

What Changed

• Added crates/fluxheim-config as the internal owner of config structs,
  parsing, validation, config-source loading, and config tests.
• Kept root crate::config and crate::config_* compatibility shims so
  runtime modules and operator-facing behavior stay stable.
• Preserved existing config syntax, config tester behavior, release profiles,
  RPM/container packaging, and artifact names.
• Added a config-crate test-support feature so root tests continue to use
  repository-local process paths while production defaults remain under
  /run/fluxheim.
• Added proxy.downstream_total_response_timeout_secs, an absolute HTTP/2
  response-write lifetime bound that is not reset by partial writes or client
  WINDOW_UPDATE frames.
• Clarified and tested that server.limits.max_request_headers counts
  duplicate request header values, including split HTTP/2 Cookie crumbs,
  before routing.

Compatibility

• Existing config files remain valid.
• Existing feature profiles and release artifact names are unchanged.
• Omitted proxy.downstream_total_response_timeout_secs keeps the secure
  300-second default.
• The root fluxheim crate remains the binary/orchestration crate.
• fluxheim-config is an internal workspace crate and is not published to
  crates.io.

Not Included

• No load-balancer crate extraction yet.
• No cache/web/PHP crate extraction yet.
• No removal of pingora-load-balancing or pingora-cache yet.
• No HTTP proxy runtime replacement, Wasm runtime, HTTP/3/QUIC, WAF, or
  production UDP/GSLB promotion in this release.

Checksums And Signatures

• Commit: afb3e843748800109e9c6b4d239b41264fc436f4
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 26a12cbf74b3a5e299eca7ed9a763402be3bf96cda121823d7430e1ed9592320 fluxheim-1.5.18.tar.gz
  • 294d7327c0da32a0ba241362408ab1f9c7acf18a545f755b9b7c6535f4406e49 fluxheim-1.5.18.zip
• Binary checksums:
  • x86_64:
    • cfc80240ae11c062b202204a2de35e522820c999d82a0f9d4ee9fb1db3f3a2da fluxheim-1.5.18-full-x86_64-linux.tar.gz
    • 3d87306df2c2b3a9ec0830825003a417b35ee5d7625ce57932935e331994dc08 fluxheim-1.5.18-cache-x86_64-linux.tar.gz
    • 2a2b33580a39daecb28dd1175717707b11baa0a9bc061dbf5749c60fc2f0f638 fluxheim-1.5.18-proxy-x86_64-linux.tar.gz
    • 98dee508902cab5547c57065875351b0566150e8a749ce96dfc7c9a335b03033 fluxheim-1.5.18-php-x86_64-linux.tar.gz
    • 6300ebf0aabfe025bc03bd84b383b97e4e2d02659988a90a5bd9257ab17d68c2 fluxheim-1.5.18-load-balancer-x86_64-linux.tar.gz
    • 0d5db8e1bb438bb6e862f6cb8aa3db2d9ede697e5df52b51bf601be2c41df0e2 fluxheim-1.5.18-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • d8586682bfbffb4d7a721947cad56a0ce477a8ef008f0fe1f26a2e73a64da89c fluxheim-1.5.18-full-aarch64-linux.tar.gz
    • 9b1cb492c00422587d702635e61e9eb915e781a842d68430fba0c7a2f00fd5c4 fluxheim-1.5.18-cache-aarch64-linux.tar.gz
    • 47d2dd746a5edc74a1627c076b2b70e0f46cdf2cd174d41c3a85c9a34e2bae7b fluxheim-1.5.18-proxy-aarch64-linux.tar.gz
    • 017e54a513105a1bd7eb3c8a5ea5031b151224c0dc7fc8880f6278bb2b25212b fluxheim-1.5.18-php-aarch64-linux.tar.gz
    • 44c4456166ee2576b08be001843d416db0a496a14048e8f54ed867f4626d1775 fluxheim-1.5.18-load-balancer-aarch64-linux.tar.gz
    • 8d8751024302f8948608774da311adf7e6a99d132787e222ffab692709abf543 fluxheim-1.5.18-config-tester-aarch64-linux.tar.gz
  • macos:
    • 2e7221d4d5413839a767a818e798846ac17f466470d4342c55c19f2dc1a4c8e8 fluxheim-1.5.18-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • a142df15155b77febebe9afdea9fcff857637ca5fffe470ce9fa553315ef9cd5 fluxheim.spdx.json
  • 7c1e10a6fd505078308a8c53760be71c905f956dc168b16dcf55401e39d53097 fluxheim.cyclonedx.json
• Reproducible build:
  • 54f063d56e4cf5c3a1e84df2c12eaadf22e44843473da5763977dc57b0e9f075 x86_64
  • c5afb09966a8afffc2564c92de5a1e5564f9bddf18bec4096822b62cacf5239d aarch64
  • 808a1cfa5a002cdfaff2c087de08c9b8880a2b3dd328a2ad873e9c3eef3d3642 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6acc8c8870c86b356490aa68eaf34724e54b674bb643e19fa4747e9adb2879a2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:396ad71e09a57664c330c182c7758565bac301c0f5fd625bb2e6eb4518dc62f7
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2bad8926f1d7570aeab77bda412d5cfb08325ce6fa98a134184f97e104b67e43
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:8237b237442e0c63a640e5fbc0d658ac86cc98f5f6ba8c41bb032e6706e25b16
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:204fac399b9eb81a92c7a903932f13f7a0ccf691c7f4103b6c0098be3c02c019
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1f244ba9355790ff3b68cb1cbff5c7d5fde1769ca5568df7c383b715975c24a2
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6515ffc8712b7818cb4f1b8d29f24d2f53c8fa71478875b4761c8c9cb2945cdd
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0685eec8efe08db1facd9a678f05916a0314e19992b2f8cdcc65f42186da2b5c
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:02aced54fd7eeffa93461eefe5c67a3ae0ea9bba44bbc5d43d3ab9fa97cf89d7
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c24cdc3149673fde0048b1390c48ad4ede5b097832f6c05ee38b49b31b0e33e1
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:02cf29d923f108f95b473e41aa36bf38bde0dabc0de0c6069e0880f00bb1b9a6
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3ed49695afcf26e4be663207c2e7be3324b7b43431780a2bb9880191359e52ce
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:080b3c147e9374cd811e2649dad4a4566bb0357b54d16343ce769e4d8b0d54d7
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:9e1d9ffe69c8d4ec203e292241002227d8b404ba8bebba2c1fa1d5e3ef840c6e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:172337f83fee1b0976b8498e9db7f7d55f8e314f49952b4f896963e05c5711fc
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:02493d1e9dd942e3b200c7d5e0339914e5fcd41d083e1befd908765d1e75b73a
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1642b3f1f024d59c5bcdc1c6d183bce3a2efb48941f97c361ca41f41f8a517bb
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0bba4f3644310c4c915f2bc9402e21264a9a68b067460b037a0f67c13c156328
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:37ffb9f2d4d0bd6c75a3124d6eca22edb814152584b43aa7b7af189a7e5ca3c7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:043abf15dd0fa6bbaf7bea9bc5a60b1410ea40da0b6546e6e7eb6710e5584fb6
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.17

Fluxheim 1.5.17 Release Notes

Fluxheim 1.5.17 starts the workspace and shared-crate foundation line.

This release is intentionally structural. It creates the first internal
workspace crate without changing operator-facing config, runtime behavior, or
release profiles. The goal is to make later config, load-balancer, cache, web,
PHP-FPM, Wasm, and runtime extractions smaller and safer.

What Changed

• Converted the repository into a Cargo workspace.
• Added crates/fluxheim-common as the first internal shared crate.
• Moved the Fluxheim-owned FluxError and FluxResult boundary into
  fluxheim-common.
• Moved shared forward-path safety validation into fluxheim-common.
• Moved repository-local test path helpers behind the fluxheim-common
test-support feature.
• Kept root compatibility adapters at crate::flux_error and
  crate::path_safety, plus the test-only crate::test_support adapter, so
  existing modules and tests continue to compile without broad churn.
• Kept Pingora-specific error conversion at the root adapter boundary instead
  of moving Pingora dependencies into the common crate.
• Updated regex from 1.12.3 to 1.12.4.
• Added a release-gate crate freshness check for compatible non-Pingora updates
  and stricter release metadata checks for release notes, README,
  build/container docs, and RPM version alignment.
• Copied workspace crates into all container build stages so release images
  build correctly after the workspace split.
• Made scripts/stable_release_gate.sh release require the root image smoke
  plus representative Debian and Alpine variant image smokes before tagging.
• Fixed the vendored OpenSSL FIPS support build script so Rust 1.96 clippy
  accepts the crate under release -D warnings checks.

Compatibility

• No config syntax changes.
• No runtime behavior changes.
• Existing feature profiles and release artifact names are unchanged.
• The root fluxheim crate remains the binary/orchestration crate.
• fluxheim-common is an internal workspace crate and is not published to
  crates.io.

Not Included

• No config crate extraction yet.
• No load-balancer crate extraction yet.
• No cache/web/PHP crate extraction yet.
• No removal of pingora-load-balancing or pingora-cache yet.
• No HTTP proxy runtime replacement, Wasm runtime, HTTP/3/QUIC, WAF, or
  production UDP/GSLB promotion in this release.

Checksums And Signatures

• Commit: 8aecc0127d8f66fa52eed0d130edc352f9eb029b
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 2aec0e974cb2676e8a123b0b815f8e4b14cb57c9e242d584a9602464b94ff0a8 fluxheim-1.5.17-release.tar.gz
  • f2448dc18c29750c55b7a2bbfe0282865a87893f82ee813603f1aae5e1cc6d6e fluxheim-1.5.17-release.zip
• Binary checksums:
  • x86_64:
    • b5be030e537f5e7badaaa54aed12c45989e0320f793261836a3ca37c6dab5a9a fluxheim-1.5.17-release-full-x86_64-linux.tar.gz
    • 020b2b7bdd135335ae1b5838289cce6d30ab489590ff297992fb4db8ce425614 fluxheim-1.5.17-release-cache-x86_64-linux.tar.gz
    • 884f762245a748e6c823dc8969aa9a3dab59a61dace2a57407eec4896afe5a1e fluxheim-1.5.17-release-proxy-x86_64-linux.tar.gz
    • 1f44ff87ac4e99120f18f2f62c4daddfa7a935a2367dc15474e797cb45bfc60d fluxheim-1.5.17-release-php-x86_64-linux.tar.gz
    • 0f5b5c2fad0e97176253ddb58b60da4a7d7325783693d15e9d566bb41efc5eef fluxheim-1.5.17-release-load-balancer-x86_64-linux.tar.gz
    • 0cc5f7ca199e36ec4f467ed4d9a5893f6688d7fc5f1e192bf9f5f24b0d312d3b fluxheim-1.5.17-release-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 0952b1b637b8ba765f866c117a87104de22616bfe26f7ed5f9ed6b9d38a2d3b2 fluxheim-1.5.17-release-full-aarch64-linux.tar.gz
    • f33d8804aed28992f609a3fec62f3c391c8c6b81749902056def11fb0d52b015 fluxheim-1.5.17-release-cache-aarch64-linux.tar.gz
    • 0e9534e7aed2cb551faefb7b8eddee2c1dc1a21c92f5902468cca0c6842cfb90 fluxheim-1.5.17-release-proxy-aarch64-linux.tar.gz
    • 427c420ec5eb626bb4e6f177ec7e6c483d603965c0d2a152ca556bd58bda7dfe fluxheim-1.5.17-release-php-aarch64-linux.tar.gz
    • acd25f0b60203b0ff8ed7e19798dd763dbc6baef728ea1a05bef6b1511705c77 fluxheim-1.5.17-release-load-balancer-aarch64-linux.tar.gz
    • e397a5870f81ebd86ef59ab37f49c704446106b237e13f28ffda341295a0acee fluxheim-1.5.17-release-config-tester-aarch64-linux.tar.gz
  • macos:
    • 28759509ca4d152f46a06fe051a61c1e92e5942f8ee90e96c782cec994858706 fluxheim-1.5.17-release-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • a7ac5f2d3e2b90a49d9682b3cb8f602808514303c552362374764df11c8e0495 fluxheim.spdx.json
  • ff7ad99eb6ea3233b5bc5858bd2408a817350ce6a0cfceccc9e27928434fc030 fluxheim.cyclonedx.json
• Reproducible build:
  • ebfb8bfb1bbc76c61c68e3b9dcfa8bb7bd99e5fc36385e89b17e269c454f3f41 x86_64
  • 79eb5b8841ed1525df4d79c6f24b06c101002ed7a3916cd61fd96ff112d9af89 aarch64
  • 966dcbaf2b59e524f803780133dda5112990a53d526a7934b7339a8f9b99149e macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:271d887fa844f7add56595259e4f28cf15357a2199d1cd895bd55477f98466ed
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:9b8e5c087101a95384d101e42fb3c0d2810a6fba8642f27d0e8c183276c01821
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b61e58b1e50a59f3a16e4affeb4bec7e83bf3eab0763089892988faa58cfea98
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:ec3fd363af5f47dcfd8b9bad3be193173ae24cc4eacf1507872ca673a90637cb
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:450490f53615aad99d1cdbb6cb8ef37f3097321d4791fc567e88e449d632f7f3
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1b5349a6a55e516b1f0eb7ccc5cf1ef63ec43fa4acda704d8e502191dbb408ac
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8dfc760ba3fd383b62ac860cc6fc1ee2cafef6846eb46324ab6b7286d4f91e98
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2154f69de4ac7bbde5535ef6d83608c1fe5c4ed954c71a019b6f58e47493e4f2
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8290267db9f19fa72bfd49f4b677775bf37b6dde425ba274ca90b10cf990fce2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2e20c36edb118c9f34b7f78a108f411edc8d6fea6c672c8ded97a79898b6261c
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:113b0f218e4c6b28e16f7a63f718e74338f148ec5161eb37ae228d07dd9e908e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:405da9d92e5b0900cf50531d1ef28513320c0d39c3b86be62dafa91d0684ffb4
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c388797094e980645f652e00ccba5c24c1a49b2d6d3f8357d1711daa3ad29333
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:babb366231bbbf02386444c3a05fe6113633abf6470aa800567b1315917f932d
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:638d728a47b5ec466f88cd490c94a9bfc3c6efb57d2e0d26e85fb5c654704cd9
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3c04823e3ab91b426230262a1f293d66e8e593a7ee328b689656c169c03302a4
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5c57f8a57ea10a6100ae4f6900b979e2d3e7b42aade3cafc7ccada9b52207973
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6c0fd37d7fef6d63616caee9b12bb1791c5c08c537deda4835388ecd01aba7ba
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:9dff76aed7d8564d9257bcc796fb789b1a7607f84ff1fbccdd907be61f31341b
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:463478446395c3ba04d40cf0227d9a9a09bf8c743223a37400601ac29942936d
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.16

Fluxheim 1.5.16 Release Notes

Fluxheim 1.5.16 starts the UDP/GSLB exploration line.

This release adds the first reviewed boundary for UDP work: a separate beta
[udp] configuration namespace, an opt-in udp-proxy feature gate, and a
small scoped UDP runtime for DNS-style request/response forwarding and
syslog-style one-way forwarding. It does not turn TCP stream routes into mixed
TCP/UDP routes and it does not ship production UDP/GSLB support yet.

What Changed

• Added udp-proxy as a beta feature gate.
• Added [udp] with enabled and routes fields.
• Added [[udp.routes]] with bounded route mode, listeners, upstreams,
  optional weights, optional aliases, idle/session timeouts, datagram caps, and
  session caps. max_sessions defaults to 4096; 0 remains an explicit
  unlimited setting.
• Added beta UDP listener/runtime support for dns-load-balance and
  syslog-forward.
• Added response_timeout_secs for UDP routes. It defaults to 3 seconds and
  keeps unanswered DNS-style datagrams from occupying route slots for the full
  idle timeout.
• Removed the unused beta max_session_secs UDP field before release. Current
  beta modes handle one datagram at a time; response_timeout_secs is the
  effective cap for DNS-style upstream waits.
• Hardened beta UDP forwarding so oversized upstream responses are dropped
  instead of being forwarded as truncated datagrams.
• Rate-limited high-volume UDP drop warnings for oversized downstream
  datagrams and max_sessions pressure.
• Added explicit reserved route modes for future scoped UDP modules:
  quic-pass-through and game-proxy.
• Added config validation for duplicate route names, duplicate listeners,
  duplicate upstreams, invalid listener/upstream authorities, invalid timeout
  values, oversized datagrams, excessive session caps, and invalid
  weight/alias lists.
• Added unit coverage with real local UDP sockets for request/response and
  one-way forwarding behavior.
• Added scripts/smoke_udp_proxy.sh, an optional local smoke that starts
  Fluxheim with a UDP-only config and proves DNS-style response forwarding plus
  syslog-style one-way delivery.
• Refreshed low-risk dependency and workflow pins: base64-ng 1.0.8, http
  1.4.2, manifest log 0.4.32, and exact current GitHub Action tags for
  checkout and Docker image workflows. Pingora was intentionally left unchanged.
• Kept udp-proxy out of the normal full, proxy, cache, php, and
  load-balancer release profiles until the runtime data plane is added and
  reviewed.

Compatibility

• Existing HTTP proxy, cache, TCP stream proxy, and load-balancer configs are
  unchanged.
• Configs that set udp.enabled = true fail with a clear
  udp.enabled requires building Fluxheim with the udp-proxy feature error in
  normal production builds.
• The UDP namespace is intentionally separate from [stream]; TCP stream
  routing remains TCP-only.
• UDP-only beta configs can validate without HTTP/TLS listeners when built
  with udp-proxy.

Not Included

• No production UDP/GSLB support yet.
• No generic catchall UDP proxy.
• No authoritative DNS server or full GSLB control plane.
• No public-Internet DNS reflector hardening yet. dns-load-balance should be
  bound to loopback or internal interfaces unless the surrounding network
  provides ingress filtering; response rate limiting remains future work.
• No QUIC pass-through or game-server UDP session proxying yet.
• No WAF, VPN/firewall appliance behavior, HTTP/3 ingress, or
  Wasm/iRules/Lua scripting in this release.

Checksums And Signatures

• Commit: 2317f400ab629e4f349528df843e1d4ee3887b27
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 4fdbe3dd5d99776a0d7eb70b04890785b8273b243b571733510ee5f1342f833a fluxheim-1.5.16.tar.gz
  • 7652deef9e38aed455bf77d4ad5374dd7e59e24a654179470fc1500072aded7a fluxheim-1.5.16.zip
• Binary checksums:
  • x86_64:
    • 5d49fd8f457b551d609091c18407f0cb91f15f8a0a90ef9f28024cdeafe8c2f2 fluxheim-1.5.16-full-x86_64-linux.tar.gz
    • b01b97dd959eef05dab2f372b99c1f67b784801faa4be578fbc6cea94bed5ba7 fluxheim-1.5.16-cache-x86_64-linux.tar.gz
    • 48972e284761eb1a40bbf9181f374535d4c4f112f1abda4fbb9fe4a4f1a40222 fluxheim-1.5.16-proxy-x86_64-linux.tar.gz
    • d28b873f28945cfa2fa2960110f9d020190ac3c438fc96aa8d78a866c73b0885 fluxheim-1.5.16-php-x86_64-linux.tar.gz
    • 191d621626eded6bc4621dcd59f39ddef60c4effadb3d37c14b81a83de3975f1 fluxheim-1.5.16-load-balancer-x86_64-linux.tar.gz
    • 8970d0fe2cb18faa6333c00a7731368f3e01eb49a3187b1534b66d8162a00cf5 fluxheim-1.5.16-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 2e1ad38570154e1a1bfe70d3ad2c567f972f5783541a07d6adfbf78e4691619b fluxheim-1.5.16-full-aarch64-linux.tar.gz
    • c6090f12ff7c603c26e080c89e97c98d80c5eeb994262b5aec42833445a7ba0f fluxheim-1.5.16-cache-aarch64-linux.tar.gz
    • fc45fef67664a281cc8e58da275537b1f7108f2a6079465cb2a62a51f1da5762 fluxheim-1.5.16-proxy-aarch64-linux.tar.gz
    • 541d67b74cc18fedc8d18d94dec9e573ffd5a2ad6ecfc32b0ea48c85a7b28e66 fluxheim-1.5.16-php-aarch64-linux.tar.gz
    • 785291a89dee9c51a248de4a75c41604a3c1fa79e52547597959cbcd0e26bb2c fluxheim-1.5.16-load-balancer-aarch64-linux.tar.gz
    • d9e4a58628602ae2825dddb53cdfe8aa3366d375b54ea8f17c07d696c1a5dacd fluxheim-1.5.16-config-tester-aarch64-linux.tar.gz
  • macos:
    • c7b31df1f7bfd5e5339f6a845757da59ee7953814b3bc320c3dbde6f936fbf10 fluxheim-1.5.16-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • ec2074d032ce064ef7c377d7b8e75592b60c35cb18a1f0f2b91daf43d50c0ad0 fluxheim.spdx.json
  • 9143362bdf5274204e0fcede86f7881481cf8a186633bdbe78db7dc9ca7fbcfb fluxheim.cyclonedx.json
• Reproducible build:
  • abaf5daa060faa3c5f34f0b1216ae7f3f25202a12a6b2edb6b0973b29fbe7e9e x86_64
  • d82462cb6ea39e567b9d526bdb0431368ccb2f86906c24109a6f9c3c4a00ab2c aarch64
  • d2a676eedbfcb48e78365020ad96d0f5db6d1769e8aedd89d1fe74377693abb7 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0d6de4685d300b15492c3099ca149195f59bbc8b192f8c80b7c2d1d72029e210
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:e41fbc532ba0fdc5ecffa6aff7bb0e21e188d9f0aec449fbcb196b758b73e197
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4f9c863e01c8cfb4e04efd3f761d478fb3eb9c34393892c6fb0191a5b60b1dca
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:621ab66186cedaff4885270d91bdc290d22cfbc3691498b04f9916d887eb49f8
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0b616a70a716dfb569db017825c23554a4819a3412b1363af6e55ef957d4f0ce
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8185980bc380870d79dc09ce6e0da85aa442afe09942fe8437b598ed3af9880a
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8a0a548da76c8e34df233afdb277f2af5b97b25a653054b9fff14d209ecaf10c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:82e08f13eb70256bbc56c1de233ec2cdd23af7385df9d79d21b10a911810d2b6
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:287cdd12dd51482af3d52b98b7e5f0194a8852a9492e4c1175666d41d82c2dc4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:bec8cf76be87b0c3dde7356e017ede8686e311297ef6e52b1c62c3ac2fee8802
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:88edc20a987ee4cc8460d3a80118d0f054d328489cc2649b8650c7bd56d26b02
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2618b670a621d83bc80544cba6b8acce467a63a2864836c621b60a4d1548e65a
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:9ea00069fe707c3c0e99bdb1edf6c21ed164443231236080a693cfa3467e596b
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:33d17779954a3ae77b9a9f53364e31e2eb8fe980c7bce82dc2b319f2ece7f14b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4cbc3483ebced4d4d70f2978a8c6a86782cbeab6707e74917ad31c4976e1b48c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0ccc8714400d3ba7bfaf0af17d2f24052f1a23b5d7e25bdedba0fc4b1c02d4c5
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4c2b5e29762c7da67448e85b6c96a1d8cdc312805889da7704dbd5e514970f66
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:06ef2670f9f0777474543da40ac1e7fa3132376314a3825dbfcfa905b95b8ace
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:96ccdbe5240a2a9cd3e97355171af6ed9c147abc88f4c07c38c64730f88b62a5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:36e0033263a74ece44e81521895c4a6449c0a8b24afa340b0c24ba80c85c7a07
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.5.15

Fluxheim 1.5.15 Release Notes

Fluxheim 1.5.15 starts the database/protocol-aware health-check line.

This release adds bounded Redis PING, MySQL/MariaDB handshake, and
PostgreSQL SSLRequest active health checks for load-balancer pools where TCP
connect is not enough and an HTTP/gRPC endpoint is not available.

Publishing note: the signed git tag v1.5.15 remains the canonical code tag
for this release. The GitHub Release page is published under
v1.5.15-release because the original immutable GitHub Release object for
v1.5.15 was accidentally deleted; GitHub reserves immutable release tag names
and does not allow the original release page to be restored through the normal
release UI/API.

What Changed

• Added protocol = "redis" for proxy.load_balance.health_check.
• Redis checks open a bounded TCP connection to the selected backend, send one
  fixed RESP PING frame, and require a simple-string +PONG response.
• Redis checks now read until CRLF within the existing 64-byte response cap, so
  fragmented +PONG\r\n responses do not falsely mark healthy Redis backends
  down.
• Added protocol = "mysql" for proxy.load_balance.health_check.
• MySQL checks open a bounded TCP connection to the selected backend, read one
  MySQL server greeting packet, and require a protocol-10 handshake without
  sending a login packet or SQL query.
• Added protocol = "postgres" for proxy.load_balance.health_check.
• PostgreSQL checks open a bounded TCP connection to the selected backend, send
  the PostgreSQL SSLRequest pre-auth handshake, and require a one-byte S or
  N response without sending a StartupMessage or SQL query.
• Redis, MySQL, and PostgreSQL checks use connect_timeout_secs and
  read_timeout_secs, inherit the normal consecutive success/failure
  thresholds, and report their protocol in runtime status.
• Redis, MySQL, and PostgreSQL checks reject HTTP/gRPC matchers, request
  headers, port overrides, connection reuse, host overrides, and parallel
  checking.
• Added examples/load-balancer-redis-health.toml as a validated Redis health
  probe example.
• Added examples/load-balancer-mysql-health.toml as a validated
  MySQL/MariaDB health probe example.
• Added examples/load-balancer-postgres-health.toml as a validated
  PostgreSQL health probe example.
• Added scripts/smoke_redis_health_check.sh, an optional Podman smoke that
  starts Valkey, verifies Fluxheim increments Valkey's Redis PING command
  counter, then stops Valkey and checks that Fluxheim marks the backend
  unhealthy.
• Added scripts/smoke_mysql_health_check.sh, an optional Podman smoke that
  starts MariaDB, verifies Fluxheim increments MariaDB's unauthenticated
  handshake counter, then stops MariaDB and checks that Fluxheim marks the
  backend unhealthy.
• Added scripts/smoke_postgres_health_check.sh, an optional Podman smoke that
  starts PostgreSQL, verifies Fluxheim creates a pre-auth connection observed
  by PostgreSQL connection logging, then stops PostgreSQL and checks that
  Fluxheim marks the backend unhealthy.

Compatibility

• Existing TCP/TLS, HTTP, gRPC, JSON, weighted degraded, and exec health checks
  remain compatible.
• Redis, MySQL, and PostgreSQL checks are health probes only. They do not
  authenticate, run Redis commands beyond PING, send MySQL login packets,
  send PostgreSQL StartupMessages, inspect keys or schemas, execute queries, or
  make Fluxheim a database proxy.
• The MySQL/MariaDB probe intentionally disconnects before authentication. On
  non-loopback database connections, repeated idle probes can count toward the
  server host-cache error budget (max_connect_errors) and block the Fluxheim
  host until FLUSH HOSTS or equivalent cleanup. Use conservative intervals,
  raise max_connect_errors, or use an authenticated exec check such as
  mysqladmin ping for credentialed readiness.
• ACME managed-certificate install recovery now logs cleanup and backup-restore
  failures instead of silently discarding those errors.
• Delay-mode rate limiting and load-balancer persistence warning generation
  received small defensive hardening so local invariants are explicit at the
  panic-sensitive call sites.
• Redis TLS, MySQL TLS/authenticated readiness, PostgreSQL TLS/authenticated
  readiness, SMTP/LDAP send-expect, and authenticated agent checks remain
  future work.

Checksums And Signatures

• Commit: 3bc7f5010a97fee80efd00bde2fe912fbb45b3b0
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • a9cdec906b113e61b36a63c14609780f88d66728b79eebddf5b41d9dce25c2fc fluxheim-1.5.15-release.tar.gz
  • 4524d535a35d363a8cb2fdd6a2baa22fa688a9c149e4439239e59a46d8a39966 fluxheim-1.5.15-release.zip
• Binary checksums:
  • x86_64:
    • 423ea3f48a1f977b4eb4ab79d39a6ec4a277021510c935c59174333b55312021 fluxheim-1.5.15-release-full-x86_64-linux.tar.gz
    • d50928d6a92a89d916396e5d5b25f7586f5719e71730652addb7d9d04c5adc54 fluxheim-1.5.15-release-cache-x86_64-linux.tar.gz
    • dc8f86cd4fd11a3ee3823cea6b0b6efa07a5bbdd4f82b90570f8eb62f44275bf fluxheim-1.5.15-release-proxy-x86_64-linux.tar.gz
    • 3ba946e6652a0ed5e0d69a54163748d0fceb9c28097432bb747a18a9b49dc0e1 fluxheim-1.5.15-release-php-x86_64-linux.tar.gz
    • 12eeeda33ed39ce651b316a043708766888f012fe09d8da117feaa9b6f6541ff fluxheim-1.5.15-release-load-balancer-x86_64-linux.tar.gz
    • d5b2366ffac9c3eb104c4f060a3aaba7a7ba750c468658f2a95eed19d285097b fluxheim-1.5.15-release-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 7599b124903122aae325ddffe4d250b1f32f236611f4bc67f746483be16aace9 fluxheim-1.5.15-release-full-aarch64-linux.tar.gz
    • 1564b9b28fc498c9aaf5ad3f7fdfc3f915f76975a99f8a4df88b3bfc7e43e7dd fluxheim-1.5.15-release-cache-aarch64-linux.tar.gz
    • c851fdada917ad09ba5f9e597fb0179b8f8a57b01012d03fed90ebb31712b009 fluxheim-1.5.15-release-proxy-aarch64-linux.tar.gz
    • 9418078f4b9bde10aeeeec0d0a76687aa32c8f2ef5743f401ea601fb051c9a63 fluxheim-1.5.15-release-php-aarch64-linux.tar.gz
    • c78688fc4a8677426157528fef70f616e92a4c26c1b0f924a7f608831c5fca65 fluxheim-1.5.15-release-load-balancer-aarch64-linux.tar.gz
    • 2d3c5781809598a08c0a07f6edcb6e6814fd540f160bf215f3d5948b0a26511a fluxheim-1.5.15-release-config-tester-aarch64-linux.tar.gz
  • macos:
    • 75ef869c5a56d9fb59f29d2d02857bc40c9ec0ffb220a1cd113f88cc71be7876 fluxheim-1.5.15-release-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 17d9af6d19ee2f4fa9ca1538013a3a585b5a18ef24ef70cb7c77e2a84e19506f fluxheim.spdx.json
  • 61b3c9bd0bf5f6de7b40d09859749af268a9686e4c322dd710157065f3ad9c36 fluxheim.cyclonedx.json
• Reproducible build:
  • 96d9ab1b4d59fdeb0438ff2c2bcb296c5e78fac1ce0525c7a1aa4bbd5d3e96c0 x86_64
  • f35ce81a560f0a6b62cbe6cd2f3bb642bcb4748a459cbef814ba4403620e33c4 aarch64
  • 3c1710bc0d0f9c7bc4f50f12d07aba3ca1dc2ccce4a5c80b7167b954f00ef26e macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1c5341434d0c2274148e2bba889d1caabd5c02e6b456ecbf3de9445d817d71fc
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:22498e680ef9d2dd2f7942f8a272a1c22f44eab99c38adeba6c8b6dc080e1198
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:549f461872692b648fc75bcae84df12cdec6d5bbd28b8487d1a0799acbd8c363
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a8de04da8dddb4776d301484cd6733e665a33efc827e1c1d826e92ee27afd926
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4430d1c1f32214db5960a7838350e32d9c738a9a7d287283ae4f8042bd7befdf
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0cb825993e93d6885e5e80846becc1472a60f385a9e76f6191ca6f3d76e42add
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7774613968d23a89a3add8354791366f16acfad8da8ad69b0f693cf60643a17f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a0bd8f74323c9c6161188cba6ac5f05a94ae8e1c9dcc3b0bc3d1ed838e3c39b9
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a842de5a233748fe1dc473d447519b095a4343d2fe5ce2f9dfa29800749e7b24
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4718d0e3ea00dfc3bc09d360f2e12288c12aabbdd40960877c490b4985e110a0
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:60c4d55c88dc70175af81278c3279a360887bdd23ceae84b2a1fbaf6be7f611d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:5fad889700e9cecdb348d34d6938ca2c41b0ed505776ab213e3022b92c098f31
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2569e9dc65ee1684e31c757539c60829037045950efd51b4f50682cc5f41c198
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:08b9bd504f4d40518251ccfa98edd4737885a007cf7204b2bb568c7e8172290b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:96457dbadbe32795ee841d8f7c3e866fa3bb71227b1f9d5f5f1e0149e8d0d645
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:48702d67e990d4afa89866656d73501a3e59af718144402eaa226f0acc4b87eb
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1e29a57985856923c0f4ca684e5aaf7bf6c34938978dafc4c19442953525c10a
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c47776f68b4d2de241487333c6e4ca72ef7101db9fb338aa9d8a428ff9b89362
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:09eefafe60519ab3539df0ae6f167922655444da0b0fc4759017bbe5985d29e2
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:5934523c90aa1409f6e2d202feb37410ba6e0201ee26c3135c17c2665f5675bc
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4