Release list

Fluxheim 1.5.4

eldryoth released this 04 Jun 19:13

Immutable

v1.5.4

e6ce685

Fluxheim 1.5.4 Release Notes

Fluxheim 1.5.4 is the TLS backend simplification release. It narrows the
supported TLS matrix to the backend families that Fluxheim fully wires through
listener policy, SNI, upstream TLS, client authentication, and compliance
evidence paths.

Changed

Remove the incomplete tls-boringssl and tls-s2n Cargo feature backends
from the supported build matrix.
Reject backend = "boringssl" and backend = "s2n" as TLS config values.
Keep tls-rustls as the default and recommended backend.
Keep tls-openssl as the supported OpenSSL integration path.
Keep tls-rustls-fips / tls-rustls-iso19790 and tls-openssl-fips /
tls-openssl-iso19790 as the compliance-oriented build aliases.
Simplify TLS backend validation scripts so release checks cover rustls and
OpenSSL only.
Update documentation, feature tables, release checklist, FIPS notes, and
compliance evidence templates to describe the rustls/OpenSSL-only matrix.

Boundaries

1.5.4 does not add new TLS backends, HTTP/3/QUIC, native load-balancer
internals, stream proxy decoupling, or restart-persistent load-balancer state.
Those remain separate roadmap lines.

Checksums And Signatures

Commit: e6ce6852b51f9f0baa169583d96eda8b422c953d
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- e7b2e68356db0b11dd5e4a923afc1d662dab9e686b255580126eccb1577c5fd7 fluxheim-1.5.4.tar.gz
- 460c2f1f40d69332b81054f4289b4be07d8090639d0bfe3dc7bc2fc72cd2f909 fluxheim-1.5.4.zip
Binary checksums:
- x86_64:
  - a4ac89ad8ba3a31af9a2d450add19fab52e88b66e18a6c09eb4b585fe8f9a8da fluxheim-1.5.4-full-x86_64-linux.tar.gz
  - b436def657279c8ffd1f7232be0ff12d11faaf3d0c1194c287b44bf37d324a61 fluxheim-1.5.4-cache-x86_64-linux.tar.gz
  - 9619debf8bf9a80ee9c3318610c919b2d179099059ca1e1dd2e7407c692b337a fluxheim-1.5.4-proxy-x86_64-linux.tar.gz
  - 50f87a9baa3bcddbf3d2f30e4a4c5247ff23aa925c601ceaaf89b30acf3e5153 fluxheim-1.5.4-php-x86_64-linux.tar.gz
  - 560edb889d753b3ad489bcae9fbc1e578bc50f731a1ff24c51a25e7986755298 fluxheim-1.5.4-load-balancer-x86_64-linux.tar.gz
  - a414305e7c0ff8c1227171f09bd13816ef6956682840a9ff19f617106417332c fluxheim-1.5.4-config-tester-x86_64-linux.tar.gz
- aarch64:
  - 851be652856b1cc8b4b7dfab818fda5eae3e86c69621af9025ab2e2d7872fb6d fluxheim-1.5.4-full-aarch64-linux.tar.gz
  - cba10aee20337ea5319f793877a3ced7e252907714085342e02c76af9f6aeab3 fluxheim-1.5.4-cache-aarch64-linux.tar.gz
  - 05953cdbd791914e570bc5a545a69f9239ddc4483d53822bb693fdf02239aaee fluxheim-1.5.4-proxy-aarch64-linux.tar.gz
  - 6cb2843ad33d51ea97fcd1edd439798a507758b2c46ca34c014d833d8b6484ed fluxheim-1.5.4-php-aarch64-linux.tar.gz
  - 15cf5a0c67b2546bd4ddde3d4561c05e10c8154dcb90d7f4c0d32f76641c46af fluxheim-1.5.4-load-balancer-aarch64-linux.tar.gz
  - e39cc094681ac8113038b9f2b49bbb660b9b501a25e7b4d72cc4f4ff198444c0 fluxheim-1.5.4-config-tester-aarch64-linux.tar.gz
- macos:
  - d561c2637db05629b66620014ffb1ec0df02007e6274ea262c3ac01af61bb79c fluxheim-1.5.4-dev-aarch64-macos.tar.gz
SBOM checksums:
- 7dc16596ac8ce8e5b5fea441fa80192b5eaf157b72183284053510e4a4be513c fluxheim.spdx.json
- 80a662f58192ff0c8b120ca7b7ebaa61276e40283d7d84bfadf3f6d0369a651b fluxheim.cyclonedx.json
Reproducible build:
- 71156ee8e403ef461e37dc9e4b7c28ae378996bf77eccc39dad4470373b15177 x86_64
- 13defb7d3dfa58464980cc98d934329f4d8e66519e9c77ae6840ab49f0393a6b aarch64
- 6a55d143846a970a9b43546cf213b4917674077a7300817952f9184ec8a81b54 macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1cf03ed5788f91c75262e037bd687cb2bf62beb705b920bdb43f114d12706b46
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:1e9456336d6257ce111fe2fd61027407ee9e5f6b3aad18ff7d29c055faec034a
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:49de3c085c6e5ae0070fbbc9603e4afc9ab1c2ea247214a584477cc08cd79857
- Debian: ghcr.io/valkyoth/fluxheim@sha256:1748ca4ebd405b3a45bf1fe308086faf09207d329dacbb6e92e1bfe215d4dc12
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0fe6ed80b57ec1b2575cf1aefdfc61979d35639ebab8434cbac7ac54a944fa47
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:1ec1e258681d5f093aa79d0841aa12482c2cdfeb973a1b9dbf4c98d9b0be862a
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:449dace244dd9f6af2f7242f794fd004d1894eabe863abcaa71364008c7d3661
- Debian: ghcr.io/valkyoth/fluxheim@sha256:5c49275a32cc91092dad3c9daf7bde5bf72549b4039a1d300c8619a3def58840
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2494ab25116cbe8a658f2e6783cf744de747058e5e8fe0a7ffb9e6b8ee8078ab
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:13e8aff2be143039804ff26e39c6efdb2e7eb2b3d9b571d0a3a3180c965c8ff2
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:72a32aae5dee0d414ca218c5eede0d0e567411983b0af0ab7dba5aaf5a235d5f
- Debian: ghcr.io/valkyoth/fluxheim@sha256:dacdcb6af439f1492a0ea8cfd357e70325363138990e997b77b3b81345362791
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7fb961bfce8a76f2f17f23b20db1956d952c8195add2ef9e61d8240dad2622c6
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:272f71c53be3bef2db8dabc0f639f4dd116ecdeea3f708c795915584a32eb9bd
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5947e00647bbff4ba5363f24a48ba635ad985ceb58ff73b9f88765186dff0084
- Debian: ghcr.io/valkyoth/fluxheim@sha256:8a19dc225aad5c72b8e236e5ae6d145e04f82acba85ff9d8a3a90daf690d46ab
Load Balancer Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:33b3ae9150d31454e102f556a59d763d8a6673c4664942dda39b69b3af63e030
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:8cbef1ba1cbee4c078f5bdb24b88808433a5462ca28cf447a6e034a232ca116a
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:d47f005a4342baf6bb333baa9e40a008f32142f790393a2980f43350d9488ad2
- Debian: ghcr.io/valkyoth/fluxheim@sha256:47eb3b015c796380568fdd9d1bf91a125fe7d057a8f9af476f1e2f9fcb801c0a
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 16

0 Join discussion

Fluxheim 1.5.3

eldryoth released this 04 Jun 15:58

Immutable

v1.5.3

ae4f15c

Fluxheim 1.5.3 Release Notes

Fluxheim 1.5.3 is the managed affinity-cookie load-balancer release. It starts
from the stabilized 1.5.2 runtime weight-control surface and adds a
Fluxheim-owned sticky-cookie option for HTTP load-balanced routes.

Changed

Add proxy.load_balance.persistence.mode = "managed-cookie".
Managed-cookie mode emits a signed/opaque Set-Cookie value on eligible
2xx/3xx backend responses and validates that cookie on later requests.
Managed cookie values map to the existing bounded local persistence table and
do not expose backend addresses, aliases, or weights to clients.
Rotate local managed-cookie signing keys daily and verify cookies against the
current or previous key generation.
Bind managed-cookie HMAC tags to the configured cookie name so tokens minted
for one managed-cookie name cannot validate under another name.
Enforce ASCII-only managed-cookie domain/path attributes and zeroize retired
managed-cookie signing keys on rotation/drop.
Add configurable managed-cookie attributes:
managed_cookie_domain, managed_cookie_path, managed_cookie_secure,
managed_cookie_http_only, managed_cookie_same_site, and
managed_cookie_max_age_secs.
Keep load-balancer persistence rejected in privacy-mode builds.
Add docs/load-balancer-ha.md as the active-active cookie-mirroring and
persistence-state design boundary for future 1.5.x HA work.
Number the remaining 1.5.x roadmap through restart-persistent state,
runtime backend-set mutation, service discovery/control-plane integration,
and scoped UDP/GSLB exploration.

Boundaries

Managed-cookie state and signing keys remain process-local in 1.5.3.
Restart-persistent persistence state is planned for 1.5.4, runtime backend-set
mutation for 1.5.5, service discovery/control-plane integration for 1.5.6, and
UDP/GSLB exploration for 1.5.7.

1.5.3 does not add cross-node cookie mirroring, active-active state sync,
runtime add/remove-member, WAF, VPN/firewall appliance behavior, or Wasm/iRules
scripting.

Checksums And Signatures

Commit: ae4f15c10dc2b74ad272f09c70d3f6a7deb264b0
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 0aa8ba1f1791eb8e1a956da0817695fd4c18c897a07e8e85b152941a8e5f971c fluxheim-1.5.3.tar.gz
- 7171b925904127bffe2a3b56d3e1c4a35545a76798f373ee0551b3cf48cc6e3d fluxheim-1.5.3.zip
Binary checksums:
- x86_64:
  - 14085e57a1fa9211c3988a567aa2d35cb24c1294a22d43a48c4141d04b9bcc00 fluxheim-1.5.3-full-x86_64-linux.tar.gz
  - 5748e358f6cb1cd737e7042b3db34bf159fd68d5cf901c5b7e7a3601b8ae896b fluxheim-1.5.3-cache-x86_64-linux.tar.gz
  - f93d06625bfc30998c1f81adff1656bffaf5ae19adff3ea58133b295e3f705ad fluxheim-1.5.3-proxy-x86_64-linux.tar.gz
  - 209fdda8da4011853809f98784c12e7d26aacc71918ecfb7641539abfb69b282 fluxheim-1.5.3-php-x86_64-linux.tar.gz
  - 2f995ebc9f287bf73506b23dad54c24b2b8391b1cddddbdc1f3271545cfce7bd fluxheim-1.5.3-load-balancer-x86_64-linux.tar.gz
  - ab6ff1716dbe3f502ab22a114e40d57cee2843466a0f74856fecab65e7f80f05 fluxheim-1.5.3-config-tester-x86_64-linux.tar.gz
- aarch64:
  - 5579a0e55b2dcf89a2896279611821909e525e7c98edafeddf13f56407cdcfc8 fluxheim-1.5.3-full-aarch64-linux.tar.gz
  - c1a5d719d63d3f7317a24080f95cb27ea8fe4bba381fcaf9dd10724b8df65ed7 fluxheim-1.5.3-cache-aarch64-linux.tar.gz
  - ac3e51e8f412fdaa9b24f2a77250b761b42651dbe965c0a557374dd3526c2603 fluxheim-1.5.3-proxy-aarch64-linux.tar.gz
  - 393b1a9cfa0fbbb4e95e35429eab0a2b30690ec9423f41bc9799efa3ffb7de2d fluxheim-1.5.3-php-aarch64-linux.tar.gz
  - 3327b10c6d50257123dfcdca0fae7b88d4b59469916db17909054a5a5593cec1 fluxheim-1.5.3-load-balancer-aarch64-linux.tar.gz
  - ffaddd8a81295ec2d634bc4b5c9677d2413b7f06be89a72d38e554581534e3b4 fluxheim-1.5.3-config-tester-aarch64-linux.tar.gz
- macos:
  - ce0d82c3610d73fe01b3727c86272f0c91998cf24f45ccca3bb307dd83122e82 fluxheim-1.5.3-dev-aarch64-macos.tar.gz
SBOM checksums:
- 877fa14c5babeba02d90e9aa68abff022103582b4c98e687ac89fa014dbf680f fluxheim.spdx.json
- 85e8bfdabc118251675eed4d6daa49786be82f593e8816367a5005a4fe5be305 fluxheim.cyclonedx.json
Reproducible build:
- 427f3a06825ed6733b281a0a2fe03ef0e921e4bffb60664369fbed9a584303ed x86_64
- e1825566eddd30059cbec670967844cecbfca11bce0c680593c3c535938d66c6 aarch64
- f59090c864ec11aac884f850278bafe6ed9fd523fd61536074aa30b757e0ac68 macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:d88b902603d9dec25218c8d26dc64b19d70304c38e02a587046c48161064a23b
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:21d386f59aa2bf5069211070c5481124b32c72f6287112759952026da7144317
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:40562ff7c7f9e8ffd9f0fecfc57c88697db57dffa68ae25bbe55107fb8710440
- Debian: ghcr.io/valkyoth/fluxheim@sha256:3bb0bb086c3d15c44f21f2d9fba99af64d4f60232c0887169ccf1f5ef1ca1b8a
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5e75ae917f5bfa21eb9d07a83030ed82bbb12a056a68265d31fe90863a84536c
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:ec76ab9afc46934cf2fa9b0531c63f2774d2c8cd27e6f69391bb92f723ce14fb
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1b083e22f097e38e01b6869ed6424b2e9cd0180d203c4ed947f45d1f854bbcb1
- Debian: ghcr.io/valkyoth/fluxheim@sha256:160fb14f2c3a0a98081cfef420da971c007cf494eb8ce539ff15f250153e259f
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2a3272cc71105e4f0154809da7fa1ad9958208670b2c017176421f5c1661b104
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:3c0e594b4913a506b625f3828a8f6b842f8e4b4f061c4ef6158d6767cf30cec3
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2ce8c2cb673f6c48eb3371a1a230d0a853dee4c735bae8d13a8e6c68390583c7
- Debian: ghcr.io/valkyoth/fluxheim@sha256:e3a9c4dc556e2aa57de20f0cc413202b46b32ca5bf87a00eaadd640b94978fc9
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:29acd9ae7409907d3ce598afd05668a53b70eae90527595c372a7c412a5ac30c
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:5bde0525b6e332cadceb799f0457bbc2d79591563c01ec91eb2ceab2e431f9ab
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:a49a7c3bea6c418393d8f991230ffa3b21df95c519e881bc400f9e2447bd9e0b
- Debian: ghcr.io/valkyoth/fluxheim@sha256:481d02e5f5e54fc6902eca3e8ad203cb238b2f93ed4b43168524a35cd251f03b
Load Balancer Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:3f82e4a29971bda1d39c1ff54e87ed827075caa0ace8e417c14db88847f6a50a
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:b081b1d6042e51d970694d08fb8281bda27e183c7dfe2691497a3b5947b2cf85
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b6f6def9bdda82a6fd8bcf9117368229f296e7bec3cff539f252bc025059827f
- Debian: ghcr.io/valkyoth/fluxheim@sha256:3316126925b31e1beaa44ef2b5ef093b13fb3d237cc69298809716c0206eef35
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 16

0 Join discussion

Fluxheim 1.5.2

eldryoth released this 04 Jun 12:21

Immutable

v1.5.2

cc19b8c

Fluxheim 1.5.2 Release Notes

Fluxheim 1.5.2 is the runtime load-balancer weight-control release. It starts
from the stabilized 1.5.1 load-balancer surface and focuses on authenticated
runtime weight overrides for already configured members.

Changed

Add POST /_fluxheim/load-balancer/member-weight for authenticated runtime
weight overrides on already configured members.
Runtime weights are supported for round-robin, least-connections,
least-sessions, and least-time pools.
Use weight=default, reset, clear, or configured to remove the runtime
override and return to the configured upstream weight.
Load-balancer backend status now reports configured weight,
effective_weight, runtime_weight_override, and
runtime_weight_changed_at_unix_secs.
Runtime member-weight operations emit bounded audit/metrics events:
member_weight, member_weight_invalid, and member_weight_not_found.
Successful runtime member-state and member-weight mutations are emitted to
the fluxheim::audit log target as privileged admin operations.
privacy-mode builds omit backend addresses from member-state and
member-weight mutation responses and structured mutation logs.
Non-privacy metrics keep backend attribution for unaliased member mutations;
privacy-mode keeps alias-only attribution.
Static configured load-balancer pools reject backend identity-key collisions
during config validation.
Retained runtime override state is bounded, and runtime weight overrides stay
attached to disabled or forced-down dynamic members across discovery churn.

Test Coverage

Unit tests cover runtime weight selection behavior, unsupported hash-selector
rejection, runtime status fields, stale dynamic-backend cleanup, retained
override bounds, and the authenticated admin endpoint.

Boundaries

The 1.5.2 release should not add managed affinity-cookie insertion,
restart-persistent load-balancer state, cross-node state synchronization,
runtime add/remove-member operations, UDP/GSLB, WAF, VPN/firewall appliance
behavior, or iRules/Lua/Wasm scripting.

Checksums And Signatures

Commit: cc19b8ce9014d266056dc76ce07a5423b775d388
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 1195e34ab193153b69b987966139442bd637f8e1a665ad0f1e21b7f962cbb287 fluxheim-1.5.2.tar.gz
- 08a3a84fb18d22330c52ff293a8e0a22e48a903aa5f513302bf2e6d1111cd19e fluxheim-1.5.2.zip
Binary checksums:
- x86_64:
  - 6506e35e8244da2821b6a7cd99f42156b69ed48a210518bc48b9e76ef43561fa fluxheim-1.5.2-full-x86_64-linux.tar.gz
  - 2f104463ad37bf9efba60d7016071348e1571ef60b59e82a0ebcfcb318b3dd5e fluxheim-1.5.2-cache-x86_64-linux.tar.gz
  - ace81ec07f7d75a8c12867d5ab58d1c78e4105eea8e8ec4bd275ba45a99387e4 fluxheim-1.5.2-proxy-x86_64-linux.tar.gz
  - 312ab7e27523f51061fe8059646c8c30d9da5ea2a83b25bae58b7e6087a3278c fluxheim-1.5.2-php-x86_64-linux.tar.gz
  - d1834ce79e86aaf0593c77d6d90b1a016443f947259e67e9291cba7bcdcfe8e1 fluxheim-1.5.2-load-balancer-x86_64-linux.tar.gz
  - 488fda4f901d2e1e4e6a8c98914bcd01fc7715284aa46fd68d2fc13a16aa50c3 fluxheim-1.5.2-config-tester-x86_64-linux.tar.gz
- aarch64:
  - 5b9924ea5d8b280db2683f9396f8ac88e107b2b9dbde26c4e0d7ac5db2ce6741 fluxheim-1.5.2-full-aarch64-linux.tar.gz
  - b5a7b098264b0164929218394899f08e151bdecd7c986c09e221a54071a86057 fluxheim-1.5.2-cache-aarch64-linux.tar.gz
  - 9ee963b62143217863428654af5197495724d217cfc656a5d46c0820d61ad0b9 fluxheim-1.5.2-proxy-aarch64-linux.tar.gz
  - ef86a51197c1796f129fd64ef2358ea840c9f919e1a137b640248312507940cf fluxheim-1.5.2-php-aarch64-linux.tar.gz
  - b7150fe452e1c0c4b765a372ca5fbc7a046d87894df6bdf2f065a0bbc7766a53 fluxheim-1.5.2-load-balancer-aarch64-linux.tar.gz
  - 0819f59f756ea44938a4391e9de4c2f866101acbf06861ae778518aa067f90e3 fluxheim-1.5.2-config-tester-aarch64-linux.tar.gz
- macos:
  - 6dcb2d4ba6a1467537ef8ea0ff037fb1223af05c1a89e4e1017f325040af02ea fluxheim-1.5.2-dev-aarch64-macos.tar.gz
SBOM checksums:
- 642a2b62531a464f05fbc2e8c8992918de7f759f32a3882b31bf3dbab33b377e fluxheim.spdx.json
- 0b3761c54470c756dcf3238425922814c3b451e6a7553bc00f362bd2dc68dd8e fluxheim.cyclonedx.json
Reproducible build:
- cc52ef0c191685c152b8058b246d6683581205209cdfc9ebdd5e1ace3720869f x86_64
- c26dcb910161335f5398ce8081bb7e1b2e3d8ae4e447f0e8fa3f55f08df0e1d7 aarch64
- da57ec87b470a24d6f8e3c62e721332962f183c1bf5e9d4a0ddb72211b793743 macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0972c2703eb23e33a3d992226085753e34b9263e8d64b85a14cdc219ae6f6ac5
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:2bbaf8ae624236ffb0bcad33f78ad7e7d446ad895b1b188dec0fb3caea519380
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3197234caed4b9e108269052bffce9dc69088453351323992914fe21e549a010
- Debian: ghcr.io/valkyoth/fluxheim@sha256:ab93f7389fd140db270b0abba9deac4519eb43bbe34c3f644679f7d6e69128dd
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:299805e8d3395252dab421b2e1e272a077e0eb60d3d8520622f9d3874c293981
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:289d810209819208217ac469ff224b10d0bf51ad1a5fa41688377f80011c12f3
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:50a7c06ec95e47b3258e5c794e935fa8ea7d80b9869c0f02fc9e48df13a52c26
- Debian: ghcr.io/valkyoth/fluxheim@sha256:559e497860e279f02acdd925b610c62969e48a35605daca40bf7fdef2f1d5a9b
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7cd967c6b4dce97b127274add66362eeac3b0cb87c30a8e331b46c82f7c6667e
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:6e8564c6408ea644669b3322f07cda249f4510a89e62dfc0a8c9ad026985f200
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b754c89bc62d098265ec024a0911f5a91feaf42e942b52b5d9806063cb720875
- Debian: ghcr.io/valkyoth/fluxheim@sha256:5284b55314240e089ee1c4d2a96c9c02d505a77a75b644cfc00edde0564b9203
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:58e0e6a239bfae6a545dfdfb4f9fb949f96e895de46181344e4c44970594ee30
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:3339ac097dd23294812e602642498b01298ea14dcf2110e93da1131647e526c8
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:a1049047404d9c249cafb8b57cdb085d98dfe604e48abdc05914336d550220f0
- Debian: ghcr.io/valkyoth/fluxheim@sha256:2947129bbc6f8d398f27b3f494486ec6eb8c18cec8e6c1ec7ceb0c2b5837274a
Load Balancer Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:9c15c7cdf83414ef68dac43571077448ad0ea2deac17304301fe8c47b646a75b
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:2f79edd56c0a049278356e7de95c06317f13e0e83096539ab733cfa00e8dea1a
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:afb786723de9be8517dd361a4c2276bd596250cdd31284d6df1bec469b7a44bd
- Debian: ghcr.io/valkyoth/fluxheim@sha256:0027c1365358662714577649783dd9c9bb934dca297f85eb30e288b8e3669428
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 16

0 Join discussion

Fluxheim 1.5.1

eldryoth released this 03 Jun 20:23

Immutable

v1.5.1

242bb57

Fluxheim 1.5.1 Release Notes

Fluxheim 1.5.1 is an enterprise load-balancer stabilization release. It keeps
the 1.5.0 feature surface intact and focuses on metrics clarity, dynamic-pool
cleanup, persistence-table correctness, release smoke coverage, and operator
documentation.

Changed

Load-balancer persistence-clear metrics now use dedicated bounded events:
persistence_clear, persistence_clear_invalid, and
persistence_clear_not_found. They no longer share member-state mutation
labels.
Dynamic DNS/file discovery pools now prune stale transient runtime drain
overrides when removed backends disappear from the live pool. Runtime
disabled and forced_down overrides are preserved until explicit admin
action clears them.
Local persistence tables now prune entries pinned to removed dynamic-discovery
backends from the periodic backend-state cleanup path, while runtime status
and least-sessions counts use read-only table scans.
README, configuration, migration, and container documentation now describe
the current 1.5.x load-balancer boundaries instead of tying the local
persistence/runtime override limits only to 1.5.0.
The focused load-balancer image now uses
packaging/container/load-balancer.toml, a load-balancer-shaped container
config with aliases, least-connections selection, health checks, retry,
queueing, and bounded source-IP persistence.

Test Coverage

Admin tests cover invalid and not-found load-balancer persistence-clear
metrics separately from member-state metrics.
The local load-balancer smoke now exercises route-scoped header persistence,
authenticated persistence-table clear, and the persistence_clear metrics
event.
The load-balancer container config is validated through the load-balancer
config-tester profile, while the focused profile-load-balancer-edge
release profile remains covered by cargo check/clippy and image builds.

Boundaries

The 1.5.1 release does not add new large control-plane surfaces. These remain
future 1.5.x or later roadmap items:

managed load-balancer affinity cookie insertion;
restart-persistent load-balancer runtime state;
runtime upstream weight mutation;
runtime add/remove-member operations;
active-active cross-node load-balancer state synchronization;
UDP, GSLB/DNS load balancing, WAF, VPN/firewall appliance behavior, and
iRules/Lua/Wasm scripting.

Upgrade Notes

Existing 1.5.0 load-balancer configuration remains compatible.
Operators using load-balancer metrics should update dashboards if they were
grouping persistence clear operations together with member-state mutation
events.

Checksums And Signatures

Commit: 242bb57ce3808ab7ff98e0bed662b1a88481ae75
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 7e7f2285a1c7e49a5180828f72d37ea22a0f41ddf7ce74421bfa791779ef0984 fluxheim-1.5.1.tar.gz
- cb03625bb0f176dbfa513238a9d91bdb7056ec7289bc90f0de0739ed6762062b fluxheim-1.5.1.zip
Binary checksums:
- x86_64:
  - d3e3cebcf75ffb27c6d07682c3a04cbee7b9e85258e2d81651920083a5ab3a14 fluxheim-1.5.1-full-x86_64-linux.tar.gz
  - 50288e0e72969b6dae843bc37cc637ff58806531f87f25ef288b4d0da5accda1 fluxheim-1.5.1-cache-x86_64-linux.tar.gz
  - 5435a8818104f829a653d66b9b2c7e09b5e755a53a75173c15f1f80d8b9b0fe9 fluxheim-1.5.1-proxy-x86_64-linux.tar.gz
  - ae973251b4821e6c90a64f3c87e4c538f8030692888ea8ef473a3d06b3dd855e fluxheim-1.5.1-php-x86_64-linux.tar.gz
  - 19e5591aa95d04dc90ce8ec5fcceecc45abfbb716c507e88c030724ea883fca4 fluxheim-1.5.1-load-balancer-x86_64-linux.tar.gz
  - fc6c3fe7d7b2c665735ab33f494f0aea5af66c8be5c4f981fe027519c83907ed fluxheim-1.5.1-config-tester-x86_64-linux.tar.gz
- aarch64:
  - 46638b87d04263655f5165f3fa745297116d2be302c9082f9c3c3dd6a2e60b4c fluxheim-1.5.1-full-aarch64-linux.tar.gz
  - 96d6e24002e56e5100b4078e46c4a1c7afca7e5b1a4145a90fff2e4f0107651f fluxheim-1.5.1-cache-aarch64-linux.tar.gz
  - 443a10ab70f3762b1ce4e7f8ad36687c95b0be942182f0e86ddcfd54a2c057c6 fluxheim-1.5.1-proxy-aarch64-linux.tar.gz
  - 97a32a9c308f2deae037ed8e81ceef7a589b3713ac1713114824b40af32f8353 fluxheim-1.5.1-php-aarch64-linux.tar.gz
  - 0df54981ce8916d76092f31544729c5a3c49f5e19c4cc9f4b462c41f32f5dd46 fluxheim-1.5.1-load-balancer-aarch64-linux.tar.gz
  - cbaf36eecdd6e712f6be4b4a67a00eda78d923aae307c6592cb3d0261da16250 fluxheim-1.5.1-config-tester-aarch64-linux.tar.gz
- macos:
  - ca74b77c62934e7b3942a7a14e2bcef0597c212f761b71b74785e0221a70d1a8 fluxheim-1.5.1-dev-aarch64-macos.tar.gz
SBOM checksums:
- d3e8de9c868790acf2f50d64e39c407de2b502e9fb8765687c139be7f068c1d0 fluxheim.spdx.json
- 3246b89cfbc47de5aa39a22bb54cba77752d3bc9850c62bf2a6ae7e267f22b3b fluxheim.cyclonedx.json
Reproducible build:
- 4b5d499c3686a246918eec718f58af30da9c03df8ce2ef67a4178a66bae7b4b6 x86_64
- 6b474b43a0bbdbdf5b4fe1f0807078819546662b038b9086a02f771251a2f64e aarch64
- 4215b6ea9c51ed4a96fcbf35a54054eab4220efe9316ee8ff19472db624f62f2 macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1c59206f5b9a19f8be9ad48a2afd97674d2ea8224d6e4867f44fcc36504a5bc6
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:92ac65439aba1ebac112228222bfd6763671cd539040d64369d8d8f2f47b96e8
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0da562f2a4086cefe65465ddfeab73506cc6f385dde6334cf51e2f6cb8c8ad95
- Debian: ghcr.io/valkyoth/fluxheim@sha256:2904093d1ae076dd9f5766146b73f680bd37cd0b266be2af6216e8edc630958b
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:142a7aaf5b08b28fde1429733c6c199836f822d4f73e86dc78941997f540d083
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:54df63e3799da2b3db3a2a2d90715bc607a54818f808f0e42ce70b9475c1457b
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:d7d20a8e47d17a9084d225da22c0a9b3269672448c6995513fa87177a2e0c41c
- Debian: ghcr.io/valkyoth/fluxheim@sha256:2dcec92146657c2e2fc30a48837b50b02a8c7999460e4f2242a21d9366663d64
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0fbd426046b4dd294fa6aa6f2d919e16fba5c63cf5c19d2855ed6f752f25117a
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:0376d543b789270f9d4b093a40a5e807617ecdc901489550dea72b46d8fc5356
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:02210a0f0fe1a0b2247e746df92c6ea2970f65c8e0d44cf2e9069ec6b867cd29
- Debian: ghcr.io/valkyoth/fluxheim@sha256:24aaa597c732660782bab9b2e1cb7e7e40167f316632813d55f5d25e5eb9afdd
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:95ed849cd2c4507b4967af7493d4d5e8464b42a66efb01c3e6ab3de7878e9ca3
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:38a58881ce2bc47e5d4fd8e3490959cc29b688b5e692ae2b52522aea1d668d59
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3d65b004b842d4376f3224c181fdd2ad5dedb1f425add4292c8e09830643ae24
- Debian: ghcr.io/valkyoth/fluxheim@sha256:a0b35fe96d40b16d9d678980c0d4ea5d0670a06d5d562ac8f2fd9e175dafcc5f
Load Balancer Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:763df4bdba0ec374af90d8737b07fe2b3fb76b5fa5d94cd0dae5b07b07a4d328
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:39781f8f23ef4a15eeaa088bbd00d952b493209ef4d08eb9d691173f0357a019
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:92db871b73215d0b3633471d2b7a974e99810e7d0ea0d15f4eabc4d7ba13efdd
- Debian: ghcr.io/valkyoth/fluxheim@sha256:91d630bbb922dcd1d70eaa5c9cf257e93db21860d458584a882dc42904d1ca95
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 16

0 Join discussion

Fluxheim 1.5.0

eldryoth released this 03 Jun 13:22

Immutable

v1.5.0

6b72eba

Fluxheim 1.5.0 Release Notes

Fluxheim 1.5.0 is the enterprise HTTP/TCP load-balancer control-plane release.
It promotes the focused load-balancer image profile and documents the migration
surface for F5 LTM, HAProxy, nginx, and Envoy-style pool operations.

Added

Focused load-balancer release profile and container image line:
profile-load-balancer-edge and v1.5.0-load-balancer-*.
Load-balancer runtime member controls for drain, disable, force-down, normal,
and manual-resume state.
Load-balancer-only admin status endpoint and persistence-clear endpoint.
Advanced selection coverage for weighted round-robin, least connections,
weighted/ratio least connections, least sessions, least-time EWMA,
power-of-two, hash, consistent hash, bounded-load consistent hash, static-pool
Maglev, priority groups, locality preference, backups, and per-member caps.
Local persistence modes for source IP, request header, and application or
upstream-issued request cookie.
Passive health, ejection/circuit status, slow start, retry budgets, bounded
queueing, all-down status policy, and load-balancer audit visibility.
Validated enterprise migration fixture:
examples/load-balancer-enterprise.toml.
Load-balancer module split into focused src/load_balancer/* files for
health checks, backend state, persistence, selection, policy/status,
discovery, and orchestration.

Hardened

Bounded backend runtime state maps for high-churn DNS/file discovery pools.
Pruned passive-health state for stale backend keys while preserving active
ejections.
Feature-profile tests now distinguish load-balancer, default, and
privacy-mode validation paths.
Documentation now states the 1.5.0 load-balancer boundaries explicitly for
operators and migration reviewers.

Boundaries

The following are intentional 1.5.0 boundaries, not hidden shipped behavior:

Fluxheim does not yet insert or sign managed affinity cookies.
Load-balancer persistence and runtime overrides are in-memory and local to one
process.
Runtime weight changes and runtime add/remove-member are future work.
Active-active cross-instance load-balancer state sync is future work.
UDP, GSLB/DNS load balancing, WAF, VPN/firewall appliance behavior, and
iRules/Lua/Wasm scripting are separate future roadmap tracks.

Upgrade Notes

Existing 1.4.x proxy, cache, PHP, stream, GeoIP, and compression
configuration remains compatible.
Use docs/load-balancer-migration.md and
examples/load-balancer-enterprise.toml as the starting point for
load-balancer migrations.
The full profile includes the load-balancer module; the focused
load-balancer image omits cache, static web serving, PHP-FPM, GeoIP, stream
proxying, and traffic mirroring unless a custom build enables them.

Checksums And Signatures

Commit: 6b72ebafc5aff677e1dbc53029f2ffc0dd18e332
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 62c1ca816f11119f249661b63788e3d041a8c46c37a763608393ebb8f893d3fb fluxheim-1.5.0.tar.gz
- 87d4ce4720a4b41e1ac0deaf489955f8e4a39c182acdbd47a132a53831801636 fluxheim-1.5.0.zip
Binary checksums:
- x86_64:
  - 123bc002f1fad0de53c42388d19511b0b2fb9ca69b8e13072a00fa4c20afc9bf fluxheim-1.5.0-full-x86_64-linux.tar.gz
  - 06582b2d68e8bdc66a2b77fddca186cdcc330773fcc3d4ae9413fb1cd4e78811 fluxheim-1.5.0-cache-x86_64-linux.tar.gz
  - 5f18efb8ca0c1c20ee9bdd95e3c721d0f8c7631dadf059692360cc9e9b272fd3 fluxheim-1.5.0-proxy-x86_64-linux.tar.gz
  - 2a559e7da430be5426bf21bd145f82d9b18392aefe4e60769c5b1eada9887071 fluxheim-1.5.0-php-x86_64-linux.tar.gz
  - 1dd08a9c553106ddc58414a029206d9c56e98524691ac040e0cb1906bb228bc0 fluxheim-1.5.0-load-balancer-x86_64-linux.tar.gz
  - 5bfb3b006f9a1043f6ebfc457bf9366b9805c5eecba6f3bdbe5f6eb3280e3e3c fluxheim-1.5.0-config-tester-x86_64-linux.tar.gz
- aarch64:
  - 8d1ebff8b8dc981fcc9e5251a7bbc879cb20e1bad3b46c4d09a5698f3e9d66f0 fluxheim-1.5.0-full-aarch64-linux.tar.gz
  - f697835808edfef4c1ce60689bb73ec6a8a097429e7add2ca2100a497b397b5c fluxheim-1.5.0-cache-aarch64-linux.tar.gz
  - 27ccb3162a2f86af39583ef99a49b84d8bdb66bd13c03e9245733c9850e264b2 fluxheim-1.5.0-proxy-aarch64-linux.tar.gz
  - 6d0631e7914f1acbf1a829cdbf38c893cd7da0e3e56a5b96882d457ec3619aa2 fluxheim-1.5.0-php-aarch64-linux.tar.gz
  - b06df3738a4c4fb4bcdd1ddb95b25f74fe88598f4cd189f0881ba0ede5c7ab02 fluxheim-1.5.0-load-balancer-aarch64-linux.tar.gz
  - a1dae8253afaf733aa9cef413869d18157ccd3c2e9e0da6f256ef2f53b7625bb fluxheim-1.5.0-config-tester-aarch64-linux.tar.gz
- macos:
  - bfbb789a2e2c1fae528e514666fea9a6f4c69a3ebfbfe7df3b4f98df81976c64 fluxheim-1.5.0-dev-aarch64-macos.tar.gz
SBOM checksums:
- ee6f6a9bf335c113278b5cbc5df616eaeae1bfadfd0f254e3a4f4384fba5c861 fluxheim.spdx.json
- d7d539a19cda76911954595f201ba890a07f5127c9fd46409fd2439755d7e69f fluxheim.cyclonedx.json
Reproducible build:
- 69db3f94fa7d26e7b4e1a0cdeca8035a84fbb5461b10ae0c38331a0b185e27d2 x86_64
- 1febff7f1fdc4fca82d774e01dd40b34b285b7a971f7e58781fbbef4a6217313 aarch64
- e1f2688a755d926e2524f29f507de83c166b978e8316ec8661b5b644cd9f887c macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:77beef70d290e6641e084db25c839f2a356de8d27a7202caef5947b30b51f16d
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:187baed810f43b1e1c1451658c221d4c3f7dd517581eae820a1d53863261774b
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4842c9e701519f040cac0ff3bc6acbf3f6f8954cbc44988fbbf7afb8fcacb5a6
- Debian: ghcr.io/valkyoth/fluxheim@sha256:aa45848a48abea87be471aa83197a625469d4df8d210ac1f50f51c986c68f6a0
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1250f2f72195f5afb19d4d78fd7ef6f04033fedbbb0c68e7276e36e046133e6c
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:19c57745a9d8f0de012791560e2403b5109af86de84551d267ec11ab7d723642
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1965326fe6e2f74bb4eca30eaa10dfb79b5898207242819622854b00ed514d81
- Debian: ghcr.io/valkyoth/fluxheim@sha256:3b0c915ab9cf9555ed90749ed8d166a97b7bdeea62fab2e3cb0bcd6ba14974d0
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:451f78a01303c0877a40926547892953c1fc9357e62fcda500f121d1e491bbb8
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:84f35a15927d3aa7db009535ea0e41d9bae25e13899c9b81224105335b47a34e
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:23f624df54a6dfbee48fee0582142658138506fac756ec004227fca57414079f
- Debian: ghcr.io/valkyoth/fluxheim@sha256:7dbec820a1ce5e94dae367c47aaf4148d58b59b0c368a245d0ded4593ecbfc2a
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:9143075f9807dd85c0baac015e876253c544490ef1abfc779212d0bd70c93801
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:e20cc57d9b23d8e540cc721bf663f1ed1cdede4b6abc6a5c705655b408c384e6
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6045c3165d14e00a330b2130e9b9302965154bee8107dac964ff89246ee5e5a9
- Debian: ghcr.io/valkyoth/fluxheim@sha256:6a796d815400e4b8b25019ec21ec11c1231c738517adc49750f9436ab25cf32f
Load Balancer Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:91d85d43852b3f187d53128e9d5d1448b2838a5201eafc7fe6c89434957f876f
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:09b5b040e99fe9174368eecdb2865938f1f53ec5896d400dee721e64d0897aa7
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:566bb732d0d0602838707829febb833d20426691e5062b3f3f7514c0b09d1c92
- Debian: ghcr.io/valkyoth/fluxheim@sha256:b720010d0bba5c4937be7f8335403b9df4dc2dbe24a3ac231f0f3006aec39b35
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 16

0 Join discussion

Fluxheim 1.4.7

eldryoth released this 31 May 12:29

Immutable

v1.4.7

40dcd20

Fluxheim 1.4.7 Release Notes

Fluxheim 1.4.7 is a TCP stream hardening follow-up to the 1.4.6 stream proxy
foundation.

Added

True per-read stream idle timeout. idle_timeout_secs now resets whenever
either direction transfers bytes.
Optional max_connection_secs remains available as a separate wall-clock
lifetime cap.
Stream upstream TLS controls, including SNI, certificate/hostname
verification policy, one alternative certificate name, route-local CA bundles,
and upstream mTLS client certificate/key material for rustls, OpenSSL, and
BoringSSL builds.
Stream-local upstream selection policy for weighted TCP selection, safe
aliases, drained upstream exclusion, and backup upstream connect fallback.
Local stream smoke coverage for raw TCP forwarding, drained/backup fallback,
upstream PROXY protocol v1 send, and downstream PROXY protocol v1 receive
from trusted sources.
Stream unit coverage for wall-clock lifetime caps and upstream PROXY
protocol v2 framing.
Stream hardening for TLS DNS timeout coverage, stalled write/shutdown
deadlines, RFC 6066-safe SNI derivation, and temporary upstream mTLS
private-key zeroization after parsing.

Out Of Scope

UDP proxying.
DNS-specific UDP load balancing.
HTTP cache, compression, auth subrequest, PHP, header mutation, or body
policy on stream routes.
TLS passthrough SNI routing.
Combining stream upstream_tls with upstream_proxy_protocol; PROXY must be
written before the TLS handshake and needs a dedicated pre-TLS connector.
xDS/Kubernetes/Consul discovery.
Wasm/Lua stream filters.

Checksums And Signatures

Commit: 40dcd202c3b08ac4850fb9f44021c321f82c6c68
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 5dfe24f21600715b8da6fc90a0db220ab12de64af82bd20eca1b038a4edd0f4a fluxheim-1.4.7.tar.gz
- c57c714cf50922216c1d29710d85cf4e33d749414662680481bb9cb538ac13a1 fluxheim-1.4.7.zip
Binary checksums:
- x86_64:
  - 21a8ca73835f7a548bb5dd8c19d53943d28fd506c18a7a62e26199575ed9aaa1 fluxheim-1.4.7-full-x86_64-linux.tar.gz
  - 2e0b1a5f3bd6fea2a860eed18dfd925e3199f6176e94be664f077597c32437ac fluxheim-1.4.7-cache-x86_64-linux.tar.gz
  - 6b1ce0f2c024d5825e7e3d55298481b96c8b42c9b6b4bf48eeec2fefd385da4f fluxheim-1.4.7-proxy-x86_64-linux.tar.gz
  - dd7c3e38be4fcf82d8aa79bc04337c534034db701c88fe9d60ea88640f458be6 fluxheim-1.4.7-php-x86_64-linux.tar.gz
  - 40b73fb6128b9b4c5f44740e069da5378fc455de57148b15813ab6d3f0ae7bea fluxheim-1.4.7-config-tester-x86_64-linux.tar.gz
- aarch64:
  - bcbfefbc63cdd529c7194776c9cb5f02aabfe61c34d35ebf0cb132be75c83088 fluxheim-1.4.7-full-aarch64-linux.tar.gz
  - 6f86529b2104c94ee340652c27b451cc1c31c95687f7733db80be665e1639cce fluxheim-1.4.7-cache-aarch64-linux.tar.gz
  - cfa8e8310106ba50e1e38602d8fae05f2a87d206f27444aa1e6a80c6eb441de3 fluxheim-1.4.7-proxy-aarch64-linux.tar.gz
  - 9764bd2b57234d9a28e8304c497f29e353cfb8a9a8f182051f89cd42568737f1 fluxheim-1.4.7-php-aarch64-linux.tar.gz
  - c2fb147d2950d7684b9727ab905679281180b1d285b47b4686a6f760d2bd2e86 fluxheim-1.4.7-config-tester-aarch64-linux.tar.gz
- macos:
  - 55269b72bb5da193940d8a404a758c1505969cb0416e4c0c4fe8456c221a38ac fluxheim-1.4.7-dev-aarch64-macos.tar.gz
SBOM checksums:
- 26e09dcbcb8782a4623870c5ffd66f83255e2fb0633b9e4f93cd9c73b78b817a fluxheim.spdx.json
- 4e81fd1a2a6a71f899e5741ed14cde7c026d251bb7412f9a3cb1e07453199e75 fluxheim.cyclonedx.json
Reproducible build:
- 59462f89737e972c790f692dfe7dfa418dcd784ef366c1c2674dcb3b6c2cf217 x86_64
- f0cb6cbc7b701f3bacbbc448e87d368ad84bc5e411f374b8524110e94807d734 aarch64
- e7650c123902fb527cedc666a97aa7538f25d5a8811ea385879a2b55b3abe03c macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:267d0df30535caea1ffbf419b54f7eb358d39f5e3215bc6c461dc404783fa8c6
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:7a67ef32ff585fbf9b7e5d416d597ca6c6f85aade0f8db4ff33511723a3f6bc2
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:13fbf4e72fc371a1dd72d3096b61f38375ea5944ce8952634cbfa0dee176ddba
- Debian: ghcr.io/valkyoth/fluxheim@sha256:821f900c08300cd93e6558fbf9786bc7fe7436ba0f54480dcee917871725c293
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:e126772f8f144d5da1f722f9144aa9e0ae407073df2d93e913931b53a1ef8e4a
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:1199e446048bcf00f13df8372ef869c52ad4e2ddf799ebf71a97448bca554462
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:02547fb78f04b7641c3bebad0d4dc58a31bfaf6071be980b085fb5ad2c02d4cb
- Debian: ghcr.io/valkyoth/fluxheim@sha256:b3bcf74ed70c4795557c39c3a81c2e3e625d531a0ec8e4c0c514243e72b49f4d
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:277eb42484422035ead6bb3d0e98bee19761708951acfa8d9f8379cd288b8716
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:265af42ff52dc3d12ba42802748f4e8a90ae82fc51b8fc3f1285da782749d80b
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5d1dabcf179ef8b4b6b9737b415c4bddf76349094b31a33f21d2763be08caf59
- Debian: ghcr.io/valkyoth/fluxheim@sha256:7da47a8eb3bddc90c39216756f451700ee86f521c9ef6383a3d11ec729e6c2d3
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:709acb6866bc5ca0c79ff29495b3fca476fefe49a6a6ddb093f097ec3de60996
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:0660e728399cb656f54d499643e5abbae36cb36cd1c7be7a2d69a03543b5fbf8
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1281e63c0e54a83bc7d7496f49a6d126ac652ce016b01e60067a5a7f95c53bea
- Debian: ghcr.io/valkyoth/fluxheim@sha256:0aaad7028dec2320afe2fa091c9cdd3eb143c12d8bee4aee9187dd74ade29675
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 14

0 Join discussion

Fluxheim 1.4.6

eldryoth released this 30 May 18:46

Immutable

v1.4.6

b2b3861

Fluxheim 1.4.6 Release Notes

Fluxheim 1.4.6 is the TCP stream proxy foundation release.

Added

New optional stream-proxy Cargo feature.
New [stream] config domain with [[stream.routes]] raw TCP services.
Port/listener-based stream routing to one or more host:port upstreams.
Round-robin upstream selection for multi-upstream stream routes.
Bounded bidirectional Tokio byte copy with connect timeout, wall-clock
max_connection_secs, optional max_connection_bytes per-direction caps,
and per-route concurrent connection limits.
Per-connection debug logging with downstream/upstream byte counts and
duration.
Optional Prometheus metrics for stream connection outcomes and per-direction
byte totals when metrics is compiled.
Upstream PROXY protocol v1/v2 send where configured.
Route-local listener-side PROXY protocol v1/v2 receive on stream services
through stream.routes.downstream_proxy_protocol and route-local
stream.routes.trusted_proxies.
Dependency evidence tracking for transitive RUSTSEC-2024-0388
(derivative) with a scheduled release-metadata review gate.

Out Of Scope

UDP proxying.
DNS-specific UDP load balancing.
HTTP cache, compression, auth subrequest, PHP, or header policy on stream
routes.
Generic HTTP load-balancer policy on stream routes.
Stream upstream TLS/mTLS.
TLS passthrough SNI routing.
True per-read idle timeout; max_connection_secs is a lifetime cap.
xDS/Kubernetes/Consul service discovery.
Wasm/Lua stream filters.

Checksums And Signatures

Commit: b2b3861af61b2ef3d66aa78df6e94396f6abd944
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- f60eced536a5b3de83041d2bc91f14fb15050aad31345748a5e644f98bf03435 fluxheim-1.4.6.tar.gz
- cad334b8ee9f238198326ac0bb7a835625168a97e03739722cb3b56c4e988cf9 fluxheim-1.4.6.zip
Binary checksums:
- x86_64:
  - c2480dbeed0b7ce6636571c63bc066bf8951d27a56d941762718e4ad5c611fc1 fluxheim-1.4.6-full-x86_64-linux.tar.gz
  - a6f95cf1828107f138cdaab7461f094562b4ec14d8f4abc86ff519cb20ffd8d5 fluxheim-1.4.6-cache-x86_64-linux.tar.gz
  - 4c876a8a10f1a5f8f2e7bf6277a5985a700d491f9dbe6d23837e8f06a46880a7 fluxheim-1.4.6-proxy-x86_64-linux.tar.gz
  - 55e1d049233b5cf5ee11d7f2445e3642f10dc15be5f72a853cfeeaf21a538915 fluxheim-1.4.6-php-x86_64-linux.tar.gz
  - 30d95ca26c620ca31f987b4bcc649b8dcb83e1e561a6c4a667c94392047b2f18 fluxheim-1.4.6-config-tester-x86_64-linux.tar.gz
- aarch64:
  - 96665dfdf74ea918379ac2812c055a941982e07420ecd170f047889340dcad27 fluxheim-1.4.6-full-aarch64-linux.tar.gz
  - 06cae482582d6ce8fcc97f6e0097df98162cc50a87cf67077639731b1a1ec87d fluxheim-1.4.6-cache-aarch64-linux.tar.gz
  - d8f084e8e9eb1aa701d7ff0ca07bdacd36529b08e7e4c9c41b529e4ed0ca0acf fluxheim-1.4.6-proxy-aarch64-linux.tar.gz
  - 7cc17a92e9f55388b88d70ea0651471cdfaf04d7c1f30abbb46fa86a2044be31 fluxheim-1.4.6-php-aarch64-linux.tar.gz
  - 441a99b34c56567dd0815c20b98894a3f0aa9b48d728db830b9d7a35a65c7abb fluxheim-1.4.6-config-tester-aarch64-linux.tar.gz
- macos:
  - 9be77a9c74db1f1c596c5b1c38466f631022ee8cf7c35a36db8d33684aa7a542 fluxheim-1.4.6-dev-aarch64-macos.tar.gz
SBOM checksums:
- ce356ab811e7b1c6ada4f639a188a4f8637bd0a2e33585935725aaeb9b8c916a fluxheim.spdx.json
- f674a847328bb81aea40713402008b2426c4908a7f3cc3212edce2c2b9ced5c5 fluxheim.cyclonedx.json
Reproducible build:
- 16ab31b6f85443cc160f1473faa8c90a85cd597f3fcd46b63b5cf3abb1633f7d x86_64
- b61874055e7e6b7a8375dc2f440a73c9821a5619f11690ff60a53205eea538fd aarch64
- a434658ec972ed9484ca0b6584a56aeb0792ec1c1b7403b164987f9fec862f29 macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:146263111faf749d9395e682c44c61883c5861b13a854ec19a10103e568a6802
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:43890f68b7fbd2f17d99a888cdc5321ebb613c29fd50f6fb5385f8b33e9a90d9
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:01c535453a9c4d92c2e6cc1ec277fd5e693b95daefa97d0e04f80d3931185bfb
- Debian: ghcr.io/valkyoth/fluxheim@sha256:05b04a050733e29b252571538866d1a14499c231c7f757a583a42b3005368bce
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:58f70241406da54f81dc11ba125727dcbfa12e49835a6a01a3be6da2fb67eb3a
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:40227f554a62b7fc5c423b4157cacf2f267281b3fac09ca7fdfe3fb855459174
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:18d80f3ea37492c42a8ecac88abce06a54ff79dcb76de191d80e999e1e156d53
- Debian: ghcr.io/valkyoth/fluxheim@sha256:619cf4eca2f14857e4d17d01f93cf6dc8c90c161fcfde9b3942675bbfb9f354b
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:d22ffd82df48e774fc4a52b551f6a39fdd7bed80f22b1155be3d9e6bdd37ffac
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:7e8a6744993dba801431e0ca7bd77987ac89ad781049317ae205e01562003e38
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:36893da7a59fc3a3eb053d4b75577d2f400c627620d7c5d2af320c096070f6ed
- Debian: ghcr.io/valkyoth/fluxheim@sha256:957c22760ce46dc9b0bf6205cd68ef3bc81164996285e9dca9c12c9e9564d3ca
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:92369ceced75879c0f066c868003f18a045ea5f928d36193c080d272b9432693
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:1a91378946ef4f20541341ac121598010d8ae0f5257ce0f14691ecd3b07faf29
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:54c6918bf3968bb837eb27cdc0d7497cbd084b5431a5212c053e22f337824e66
- Debian: ghcr.io/valkyoth/fluxheim@sha256:cb1b9f3130353512d4eb0028aa98cac664f9444ee11f9ca889f5f01417eb958a
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 14

0 Join discussion

Fluxheim 1.4.5

eldryoth released this 29 May 21:03

Immutable

v1.4.5

9b77e20

Fluxheim 1.4.5 Release Notes

Fluxheim 1.4.5 is the bounded GeoIP/Geo-Context release.

Highlights

Development starts with the pinned Rust toolchain and minimum supported Rust
version raised from 1.95 to 1.96.
Container builder images and RPM build requirements are aligned with Rust
1.96.
New optional geoip feature for local MMDB Geo-Context lookup.
Provider labels cover MaxMind GeoIP2/GeoLite2 and European CIRCL Geo Open
MMDB-compatible datasets through the same reader path.
Ordered local database fallback can fill missing country or ASN fields from a
later MMDB file when geoip.fallback_enabled = true.
Vhost and route access policies can now allow or deny by country code and
ASN.
Structured access logs include geo_country and geo_asn when the geoip
feature is compiled and a lookup resolves those fields.
GeoIP database loading now enforces the 512 MiB per-file limit at the read
layer and caps a single runtime's loaded MMDB data at 1 GiB.
Startup emits security warnings when country or ASN access policy is
configured but the loaded MMDB database types do not appear to provide that
record family.

Scope

GeoIP is local-only. Fluxheim does not download, poll, or refresh MMDB files
by URL in-process.
Database files are opened as regular files and symlink leaf paths are
rejected.
Keep GeoIP update jobs atomic: write a new MMDB beside the old one, verify
it, then rename it into place before reloading Fluxheim.
Geo allow lists fail closed when no Geo-Context is available for the client
IP. Geo deny lists deny only on a resolved match.
High-cardinality GeoIP data such as city, latitude/longitude, or raw provider
fields is intentionally not exposed in metrics.

Compatibility Notes

Linux remains the production support baseline.
macOS developer support remains Level 1 from 1.4.4.
privacy-mode and geoip cannot be compiled together.

Checksums And Signatures

Commit: 9b77e209e1febae004a28783b0c8b9f8fef29579
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- d122c21946632760b568cad3506811a870733977d4d945ee255cf88bca6a0139 fluxheim-1.4.5.tar.gz
- 0b11efd5ac5867ceb8038229b2bb39c40846598edec834ce053bb366f45bb54f fluxheim-1.4.5.zip
Binary checksums:
- x86_64:
  - 4e44a9b762c029414ef7bc148e433ed5fa5c14371961a584b637d5b239be4f1c fluxheim-1.4.5-full-x86_64-linux.tar.gz
  - 1073f1df630ac30b42a2670f640475d895ad227c038c3900ca8d65dc16ba1cd1 fluxheim-1.4.5-cache-x86_64-linux.tar.gz
  - 55a129c3d31dd4bd3adb8e48010b5bfa3b2aa48a7d570f19e475a6ae0364951d fluxheim-1.4.5-proxy-x86_64-linux.tar.gz
  - 3fe12162a099dea60d4bd27fabeb48201693bcbc8b828c7a556253bbe774d2b6 fluxheim-1.4.5-php-x86_64-linux.tar.gz
  - 70dd9a6d95f47ad73a4aa670ee39b4c37305e257643482c4261c37d85e754a67 fluxheim-1.4.5-config-tester-x86_64-linux.tar.gz
- aarch64:
  - ee19a2d62f0b58ef1cc5a15702e0c07d63fa5c8ab20d6b2c7a57f200f1dde26b fluxheim-1.4.5-full-aarch64-linux.tar.gz
  - 24daa99993acdb8d14a68862261c02b5978532a36764e8c18fad1b61a25b3df2 fluxheim-1.4.5-cache-aarch64-linux.tar.gz
  - 8ddf0fdaeea94b83f4cd03246236679399fb2d6b5d272fdf63b4e2d67a292a45 fluxheim-1.4.5-proxy-aarch64-linux.tar.gz
  - d767c06fd35bd8d2a9fb2ffb643fe97ea309a0981e65b6731a085dcfefe550d2 fluxheim-1.4.5-php-aarch64-linux.tar.gz
  - 420b7465ab236cbd0a19a6808544f030a399301d4175f4027aa9ef46ca4dacaf fluxheim-1.4.5-config-tester-aarch64-linux.tar.gz
- macos:
  - f7ce90c11a17880024c73135575f2d14fc8a282368e7e7c6328e4cc3d895e4a9 fluxheim-1.4.5-dev-aarch64-macos.tar.gz
SBOM checksums:
- df5cb9fbbd1fa9a3da7e3d1a2731886cf6b723b117ba03fef28a04df327b4a16 fluxheim.spdx.json
- 0eccd447fef64f061c75a0b9f69c95f0e1ae547ed70e7a92335ef3a4dd7d6b59 fluxheim.cyclonedx.json
Reproducible build:
- f5687b945ed67fb0242f37c22ceb3038026f5c1ee6f5734c0b08ef33d77fd6f4 x86_64
- 3c8ff2635231fcd9b2407fac985973db7d602dedc2e17108aab5f9bc663aa1fa aarch64
- f4d0d95b85e802f83c7b812195bbca44121ecaec414e659d884e689b25473338 macos
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2d44214aa50db34ae8839f2b279c13a56b31379676c11b9d8f1f397a945f35fa
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:56b659d3854beceabf9040569b9bd262318eb28881af720fb7d1c8d44a242ee9
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:db199de2a32bf78a3a282e009e397dbec63dac0e9949e12e3f5acdecce304772
- Debian: ghcr.io/valkyoth/fluxheim@sha256:2077951c3810c07886924c5da896097e5e4f43fd106493ad8d749d11eea51f87
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6a2a296f0c3418dd41114b0a0a204b475fb398211f656a9aab0fbd613102f1e8
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:63ebd1e913c10a317bf63e1e4f2a586977fe2727ce17896a9d238de66e2fa8f3
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:60c92b849747ab02b369acae82bba004e6d6f8d88b27a2ef99466080fbaf104b
- Debian: ghcr.io/valkyoth/fluxheim@sha256:5a0af5403604f012014f6d672120a13b3ebfbc100992f8580d91837bb7c1f57e
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:30c676926c4915180c0378be6f7ac46bad0bd91ef019238a8b0e6c82151473c6
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:afc934e8bfd79cf545636887a0271b735e5913983521564485a03a3d21514d12
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:666ec3183d564fe0436266df3d818bf37ebafbe0ed62ade8e8f3d2bac9ea8338
- Debian: ghcr.io/valkyoth/fluxheim@sha256:12356a7b3f31a3aaf53f30e72b65ae4d5937d0550c9d8a76fd32e9221b1fe97c
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:3c80b4ba2df1050d2c298b28c0f442d66f35f6fba43c5ff5c8406b1f038bfe6e
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:78ca81e4a15773884b3fcb2bce1ed254e209bbaf3f965da40a35a6211c159dd9
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:9fb1558f45686b4fb924bb76471fe8c62d62bfac6dde23d89d12f94d6321e5eb
- Debian: ghcr.io/valkyoth/fluxheim@sha256:0b877194ffdb6bd158d4186b55547689953214b5fac1894c0da7d0052df452cf
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 14

0 Join discussion

Fluxheim 1.4.4

eldryoth released this 28 May 19:35

Immutable

v1.4.4

0453d5e

Fluxheim 1.4.4 Release Notes

Fluxheim 1.4.4 is the Apple Silicon macOS Level 1 developer-support release.
It is scoped to local contributor builds, Mac-safe runtime paths, and a small
macOS developer smoke gate.

Highlights

Add a macOS developer support document covering Apple Silicon and Intel Mac
target triples, local prerequisites, build commands, smoke testing, and
release-asset naming.
Add examples/macos-dev.toml, which keeps pid files, sockets, snapshots,
ACME storage, cache, logs, and web roots under .fluxheim-dev.
Add scripts/smoke_macos_dev.sh, a local static-site runtime smoke that
writes all state under target/ by default.
Add a GitHub Actions Apple Silicon developer gate on macos-15 for the
supported development profile checks.
Document macOS developer release artifacts as target-triple tarballs rather
than Linux production packages.
Add scripts/build_release_assets.sh so release archives use normalized
platform labels such as x86_64-linux, aarch64-linux, and
aarch64-macos.

Compatibility Notes

Linux remains the production support baseline.
macOS support is developer-level only in this release. It is not a FIPS/ISO
evidence claim, not a launchd/Homebrew packaging milestone, and not a
notarized-binary support claim.
ARM release artifacts are target-specific: aarch64-macos for Apple Silicon
macOS developer builds and aarch64-linux for Linux ARM64 production
builds.

Checksums And Signatures

Commit: 0453d5eca9342f5569acd4c47f4b78b411c478e7
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 4a447f4d81dfa5188528b9c8f1954fa6536b9154b151fa11eb3814992c4f1891 fluxheim-1.4.4.tar.gz
- 17fe8a6e74578fed98cda16a8246eb6593e355dd422e65e4ee9ad3116e6c0854 fluxheim-1.4.4.zip
Binary checksums:
- x86_64:
  - 692c0253c70ca282132045aed80983d65b2de5a684ae8561098b22180b6f94f1 fluxheim-1.4.4-full-x86_64-linux.tar.gz
  - 371c19125de54b48a733d0fd9e1959d06a3d27d229efb0062fba758d4d13e028 fluxheim-1.4.4-cache-x86_64-linux.tar.gz
  - 3dd045844c78ae933801d38501ac2af566989d4bc1d6f28606ab3b7109263693 fluxheim-1.4.4-proxy-x86_64-linux.tar.gz
  - 184bf1fd7ebd38505f159ca2c092c0b18f8c10ca9488267f86076507f070ab3d fluxheim-1.4.4-php-x86_64-linux.tar.gz
  - 992a3e52af3c9f6a113d88a4db6081afc34d487b01a0bf357772fb325ca1dd3b fluxheim-1.4.4-config-tester-x86_64-linux.tar.gz
- aarch64:
  - ffafe5c7edef9908b2338842180d0e2fcc62833135cfd43f30893b76c0d2be78 fluxheim-1.4.4-full-aarch64-linux.tar.gz
  - c722ce99573955d19e3aec2c4aa0ff94fdb3f727a510b5e256ae1357e31f5189 fluxheim-1.4.4-cache-aarch64-linux.tar.gz
  - e9ca9c3365bb425411836d0409d2545b131cf7bc605057352ff7a4e107b8679a fluxheim-1.4.4-proxy-aarch64-linux.tar.gz
  - dca297f186118eead4497f5c920771eb813480edd68ad4d87bc04a25227c21f6 fluxheim-1.4.4-php-aarch64-linux.tar.gz
  - 84b48a1e2915e02dfbab5a946f22741997f2365a97f3e3a7c853570217025c95 fluxheim-1.4.4-config-tester-aarch64-linux.tar.gz
- macos:
  - 2b10f9216bd9786102ca4c3fac15661d1fd84b3d1154901ac71d64ab619cc477 fluxheim-1.4.4-dev-aarch64-macos.tar.gz
SBOM checksums:
- a50fe84794ab7a5e544789b0acc1ca9807e056448218097147c52cc4f3c78d5a fluxheim.spdx.json
- 832602936c4319ea326e181c56e93fef0ee61ce6992bcb1fcbf84b8fc8b274a6 fluxheim.cyclonedx.json
Reproducible build:
- 8ffa653bdc6c5b60b3e2b792f591e1d9685c4e2375879f41055db6912ea6b278 x86_64
- 5059372c28c685f8ed29e9701feb1fb25d539fb4c0bec90d16eaae6c8f14f1bf aarch64
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:153caa6277c15f27bff7acacda9d627e42950f3fb41f79a5533905303b8b692b
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:7fee5d3c438deb323d8ab92cfdb9e46376324116188e532b84a6ffafb9f3b7b7
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4dba6f80ec3828e97f87b7b67b750d95bfd69b0159ec64366cb436473ab614c3
- Debian: ghcr.io/valkyoth/fluxheim@sha256:518e68a36238f2f17ca77fa4d99298af3dd63a0139d0c757e073b90a14bec3a6
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2420deabfb547fde0114e49725ac43b042643d14b6c5bca5bc1625903814ce57
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:0cd42283a5a783a9ea4430905138cd3bbb905c657ebc0c6036c4b2f3c1814cc1
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4e37f57e1aef641fa315779bade1b6acdb63143b3cafe9b4f120a57ed03809a4
- Debian: ghcr.io/valkyoth/fluxheim@sha256:4693e78d52706ecadeba0d162633839436e907dd4f390a910c0387a97f3f77c7
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:bfd83c15fcf248a04ed9fd8317005d564c29405c6a0c6ed12e7983eefaab581a
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:07db94030ee5bbf7b765b28d5732286da7ac4792f09cbf8cb7489231c6ffd06e
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:96fc9494c41d6fdc6e5264c7d534f4652c200276e467553cde24a328527161f8
- Debian: ghcr.io/valkyoth/fluxheim@sha256:a07304e943b14ab09ed22eb266e772e717757e1ada9d1cde725e1f93cc0a16f1
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:71b2ca5b7217bbf4a4357baea885f10edef07c68fa212d4253141c92fb9e7d4c
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:0ae85adec28ee5d98ffd9fb15a7ab7c2f8ab647b0af23092787ca358928e88c5
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2e81aba59b1fa3d3e54b9b5bf4884f21173fdd58518852d20c51223c301aa1d4
- Debian: ghcr.io/valkyoth/fluxheim@sha256:c36ba23a27a5a5768c399b3c18ff0011cc4d5415028603a6f2d5b70042c50508
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 14

0 Join discussion

Fluxheim 1.4.3

eldryoth released this 27 May 19:30

Immutable

v1.4.3

19b2d40

Fluxheim 1.4.3 Release Notes

Fluxheim 1.4.3 is a maintenance architecture release. It does not add a new
operator-facing feature family; it splits the large configuration surface into
focused modules before the next 1.4.x policy features.

Highlights

config.rs is reduced to the top-level serde facade, config merge and
validation orchestration, shared ConfigError, and stable re-exports.
Domain config now lives in focused files: config_admin, config_acme,
config_access, config_cache, config_compression, config_header,
config_http, config_load_balance, config_logging, config_net,
config_observability, config_path, config_php, config_proxy,
config_route, config_server, config_tls, and config_web.
The large config unit-test module moved to config_tests.rs, keeping
production config.rs small enough to review while preserving the same test
coverage.
Existing crate::config::* type paths are preserved for runtime modules and
downstream internal callers.

Security Hardening

Path forwarding safety now rejects traversal that only appears after a third
percent-decode pass, while still bounding decode work.
Auth-request copied forwarded header values now use zeroizing storage after
the subrequest completes.
Admin auth throttling now evicts the stalest tracked source when the
per-source table is full instead of immediately escalating a new source to a
global lockout.
Cache purge path validation now uses the same shared multi-pass encoded path
safety check as proxy forwarding paths.
A private admin path helper was renamed so maintainers do not confuse the
empty-path check with full traversal/symlink path validation.

Compatibility Notes

No configuration migration is required from 1.4.2.
Operator-facing validation behavior is intended to be unchanged.
This release intentionally does not add GeoIP, macOS production support,
stream proxying, or new policy syntax.

Checksums And Signatures

Commit: 19b2d40fe7da5b743f81a8dd9bd29bfcc51807d8
Local gate: GitHub CI green before tag; local release metadata checks passed
CodeQL/code scanning: no open release-blocking alerts before tag
Source archive checksums:
- 1d8fd0b141c0c90049326df431d72aa846c5eeb9120d7aa20d5b2f455f4407df fluxheim-1.4.3.tar.gz
- 6c2fa7fe47bef634c4e2f460d76a94615180964332ce454503ef21dfb440dae2 fluxheim-1.4.3.zip
Binary checksums:
- b5c9d1baf81b62343d8b9cfe43142efb03caa270167f69dc809341a409b47e7f fluxheim-1.4.3-full-x86_64-linux.tar.gz
- a31543f05b2c22f6ae30c5080eaa5c0e55c7e414177663418840604341018190 fluxheim-1.4.3-cache-x86_64-linux.tar.gz
- a96e8ab848af0c5311cf59ed366aa80efb13db7d3b9394c840443b1bd02fb2a8 fluxheim-1.4.3-proxy-x86_64-linux.tar.gz
- e316e3d9ee30edda3c693ffc37b81e99fca345bfd028c7011dbf64f149704138 fluxheim-1.4.3-php-x86_64-linux.tar.gz
- 4c107d1310c265439423595af40670ff45af7336d600bcd576d21f632ada1227 fluxheim-1.4.3-config-tester-x86_64-linux.tar.gz
SBOM checksums:
- 2626d639cb2de17ceb2ce8640e31a48c8c4f293b5cdeb36fc4e135571229a519 fluxheim.spdx.json
- 9420f68753b1d7855f365fbc5c95953e9d704a66e1c3d9dfabfd208f1f3c4146 fluxheim.cyclonedx.json
Reproducible build:
- d7daa50d519800be5f573b821180a1f543199119fc61228fee2be3630446f8ea
Full Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:61962c432e28fc6e0840a5ab1ca6ef05b078d2843a94da5b0a56445127bb688b
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:327c306956d9204de395f140b8b6b0a3dfc28ec91bdbda870e423682359541ee
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0c61c4262ed57ba673ccd604bd1df6b04957a12179db8be5936809f044602a80
- Debian: ghcr.io/valkyoth/fluxheim@sha256:444e31008d6c21702b1bd651f835161111d64bfcca03d8501b8d6a5297da06ee
Cache Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0e07abdf494a856b8fef61d34b0fb5a8a18c96ee56e9389d6cfc153b54f41526
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:4380883fb3a18cc34831e6763492eb3b176334d344ea19ad4c9dba0f8f7b1776
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ac18cac0300e8105b9edbddd17cbd53bf92a0424bbaf24fab46d1b5ec4390b1f
- Debian: ghcr.io/valkyoth/fluxheim@sha256:3f608e83eb9cb7d3d032e6a845e52ad380b2c804469cee813831389941eac098
Proxy Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:bb5e5422dcab7afc2e320b2582beb04a1bb6c20f0713b1a650332e6bdf85aca0
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:3cc4efb92fd3cac1cb961767abb9f4342c8e02bcf236e628aefada7af752071a
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6deb4e212ea2d1f66bdc28d0aa08ea9deb2c2d45e9330f0a34d0a930b98e3fc3
- Debian: ghcr.io/valkyoth/fluxheim@sha256:423dede5cf9bb85890c4c0a1fa1d4f3aab68862a5d690078a5ba319c2cb2aa88
PHP Build Container digests:
- Wolfi: ghcr.io/valkyoth/fluxheim@sha256:322ab3a3b57aa3a9173634745589fe336e4448a0d0a53d1a3b8a5b05fcb5259d
- Alpine: ghcr.io/valkyoth/fluxheim@sha256:89864f245da0c341f4da6e3c0f3bae914cbadf24fb212b5bfd19f5614e73d983
- SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:691178a20607d379faf65c2fbe45437425baca9b481517e3553c3e24dff6bb61
- Debian: ghcr.io/valkyoth/fluxheim@sha256:37651a011fe10efb966cfddd480260a74e0d0e1ca14b445914f5615de7a90ab8
Tag signature:
- Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Assets 8

0 Join discussion

Uh oh!

Uh oh!

Releases: valkyoth/fluxheim

Release list

Fluxheim 1.5.4

Fluxheim 1.5.4 Release Notes

Changed

Boundaries

Checksums And Signatures

Uh oh!

Fluxheim 1.5.3

Fluxheim 1.5.3 Release Notes

Changed

Boundaries

Checksums And Signatures

Uh oh!

Fluxheim 1.5.2

Fluxheim 1.5.2 Release Notes

Changed

Test Coverage

Boundaries

Checksums And Signatures

Uh oh!

Fluxheim 1.5.1

Fluxheim 1.5.1 Release Notes

Changed

Test Coverage

Boundaries

Upgrade Notes

Checksums And Signatures

Uh oh!

Fluxheim 1.5.0

Fluxheim 1.5.0 Release Notes

Added

Hardened

Boundaries

Upgrade Notes

Checksums And Signatures

Uh oh!

Fluxheim 1.4.7

Fluxheim 1.4.7 Release Notes

Added

Out Of Scope

Checksums And Signatures

Uh oh!

Fluxheim 1.4.6

Fluxheim 1.4.6 Release Notes

Added

Out Of Scope

Checksums And Signatures

Uh oh!

Fluxheim 1.4.5

Fluxheim 1.4.5 Release Notes

Highlights

Scope

Compatibility Notes

Checksums And Signatures

Uh oh!

Fluxheim 1.4.4

Fluxheim 1.4.4 Release Notes

Highlights

Compatibility Notes

Checksums And Signatures

Uh oh!

Fluxheim 1.4.3

Fluxheim 1.4.3 Release Notes

Highlights

Security Hardening

Compatibility Notes

Checksums And Signatures

Uh oh!