Changelog

[Unreleased]

Added

• Automatic certificates (ADR-0020): routes with tls: auto whose hosts no configured certificate covers get a certificate from Let’s Encrypt (or acme.ca) through HTTP-01, answered on every plain-HTTP listener before routing. One certificate per name, or one per route with tls.domains; each with a new ECDSA P-256 key; stored in $RDOCK_DATA_DIR/acme (mode 0600, atomic writes, a lock against a second process) and served without a reload; renewed when a third of the lifetime is left; failures retried with backoff from 1 minute to 24 hours. tlsserver is ordered when the CA offers it. acme.ca_root trusts an internal CA’s endpoint. Names public CAs do not certify (localhost, .internal, private addresses …) are reported instead of ordered. Tested end to end against Pebble.
• TLS-ALPN-01 (RFC 8737): certificates can also be validated on a TLS listener, without a plain-HTTP port. A handshake offering only acme-tls/1 gets the validation certificate for its name and is closed without HTTP; no validation certificate is ever served otherwise. acme.challenges sets the order of preference, and after a failure the next attempt starts with the next challenge type.
• Configuration for automatic HTTPS (ADR-0020): acme: false turns automatic certificates off; acme.dns_provider names a default DNS provider for every route; DNS providers exec (a program run without a shell) and webhook (JSON to an https:// endpoint) next to cloudflare, which gains zone_id; observability.alerts.webhook for certificate alerts. Webhooks must use https:// (plain http:// only for localhost), exec commands must be absolute paths, and tokens should be ${file:…} references. Public IP-address hosts are flagged unless acme.profile: shortlived, and DNS-01 for an IP address is refused. Issuance itself arrives with the following v0.3 changes; until then rdock run still refuses acme settings and webhooks with “planned for v0.3”.

Changed

• tls: auto routes now get certificates. In v0.2 a route asking for automatic HTTPS without a matching certificate was refused (“planned for v0.3”); now ReverseDock orders one from Let’s Encrypt production, which accepts its terms of service. Set acme: false to keep v0.2’s behaviour, or acme: { staging: true } to try it first. ca: buypass is refused: Buypass stopped issuing certificates on 2025-10-16.

[0.2.0-alpha.1] — v0.2 “Docker-native”

Added

• Extra configuration files (providers.file.paths): files or patterns such as conf.d/*.yaml (relative to the main file) add routes, services, middlewares, TCP objects and certificates to the main file. A name defined twice is an error naming both files; other sections belong in the main file. They are watched like the main file, and a file added next to a pattern is loaded without a restart. rdock validate reads them too.
• rdock migrate traefik (F-MGMT-03): turns the Traefik labels of a Compose file, or a Traefik dynamic configuration, into routes, services and middlewares for rdock.yaml, through the same translator as the Docker provider. What cannot be migrated is listed at the top of the output. --expose-by-default follows Traefik’s default for services without traefik.enable.
• Zero-config mode (B-CFG-11): rdock run with no configuration file (none given and none at /etc/rdock/rdock.yaml) and a Docker socket at /var/run/docker.sock serves labelled containers over HTTP on :80; the admin listener keeps its default. Without the socket it exits with a hint. HTTPS joins it in v0.3.
• The Docker provider (providers.docker, ADR-0018): routes, services and middlewares from container labels, native rdock.* and a Traefik v3 subset (64 conformance fixtures in tests/conformance/traefik-labels). Containers are opt-in; replicas share a service; unhealthy containers leave the pool. A container Docker is stopping leaves its pool as soon as Docker signals it (the kill event), so new requests go to the other replicas while its open requests finish. Changes apply within about a second of the Docker event; if the Docker socket is lost, the last routes stay in service and the provider reconnects. Unix sockets and tcp:// socket proxies; rdock status shows the provider’s state. The docker cargo feature (on by default) builds it.
• The public website and documentation in apps/website (Astro + Starlight, ADR-0017): a landing page and 69 pages of guides, install and migration guides (from Traefik and NGINX), concepts, operations and reference. The configuration and CLI reference are generated from the schema and the binary; every complete configuration in the docs passes rdock validate --strict in CI, and “planned for vX.Y” badges are checked against what rdock refuses.

Changed

• A file route that refers to another provider’s object (name@docker) that does not exist is left out with a warning; the rest of the configuration applies (ADR-0018). The error for a missing service or middleware now reads “x does not exist”.
• New logo, “Berth”: a container moored in an amber dock bay. It replaces the two-arrow mark in the README banner, the website and docs header (with a dark-theme version), and the favicon; the website gains the full web icon set and a manifest. Master files and usage rules are in docs/assets/logo/.

Fixed

• rdock validate no longer warns that a route without Host needs a host name for automatic HTTPS when defaults.certificate serves it.
• The Compose example mounts the config directory instead of the single file (editors replace files on save, which broke reloads), and starts after the backend so its name resolves on the first request.

[0.1.0-alpha.3] — v0.1 “hello proxy”

Breaking

Configurations that worked with 0.1.0-alpha.2 may need changes:

• Unknown configuration keys are errors (they were ignored); the error suggests the nearest valid key. Keys starting with x- are still ignored, for YAML anchors.
• redirect.permanent defaults to false (302/307), as in Traefik. Set permanent: true for 301/308.
• security.limits defaults are 64 KiB of request headers, 100 headers and no body limit; set max_body_bytes to limit bodies.
• rdock validate --strict turns warnings into errors.

Added

• The proxy (rdock run): Pingora 0.9 HTTP engine behind our own listeners (ADR-0012). HTTP/1.1, HTTP/2 over TLS (ALPN), h2c on plain listeners and to backends, WebSocket, server-sent events and gRPC with trailers; backends by IP, DNS name (re-resolved every 10 s) or Unix socket, over HTTP, HTTPS (verified, custom CA, or verify: false) or h2c; smooth weighted round-robin and weighted random.
• Routing with the Traefik v3 grammar: priorities, normalised paths (forwarded as normalised), host/path/method/header/query/client-IP matchers; automatic HTTP→HTTPS redirect for HTTPS hosts; branded 404/5xx pages with the request ID (HTML or JSON).
• TLS: manual certificates with SNI (exact, one-label wildcard, defaults.certificate), encrypted PKCS#8 keys (key_password), modern (TLS 1.3) and intermediate policies, session tickets, reload when the files change.
• Middlewares: headers (with HSTS on HTTPS only), redirect, rewrite, strip_prefix, add_prefix, replace_path, basic_auth (argon2id, bcrypt; Apache MD5 and SHA-1 with a warning), forward_auth, ip_allow, ip_deny, rate_limit, cors, compress (streaming gzip), errors, maintenance.
• Security: forwarding headers trusted only from security.trusted_proxies; header, header-count, target and body limits (431/414/413, chunked bodies counted); HTTP/1.1 without Host, bare-LF line endings and unknown Expect refused; 10 s request-header deadline; request IDs.
• Operations: reload on file change, SIGHUP, rdock reload or the admin API, without dropping requests; listener changes without a restart; configuration history and last-known-good copy in $RDOCK_DATA_DIR/state, used at start when the file is broken; drain on shutdown (lifecycle.drain_timeout); systemd readiness (Type=notify).
• Admin listener (127.0.0.1:2080): /healthz, /readyz, /metrics (Prometheus), and with a token /api/v1/status and /api/v1/config/reload; rdock status, rdock reload, rdock healthcheck.
• ${NAME}, ${env:NAME} and ${file:/path} references in the configuration; secret fields stay references (ADR-0016).
• JSON (or text) access log and JSON application logs; Prometheus metrics for requests, latency, upstream errors, connections, TLS handshakes, reloads and certificate expiry.
• Packaging: Dockerfile (CMake added), Dockerfile.release and multi-arch GHCR images on tags (signed, attested), deploy/docker Compose example, deploy/systemd/rdock.service.
• Tests: end-to-end suites against the real binary (protocols, middlewares, smuggling vectors, limits, slow clients, reload under load, listener changes, drain, last-known-good, certificate swap); fuzz targets in tests/fuzz (differential HTTP/1 framing, rule parser, configuration loader) and a weekly fuzz workflow.
• rdock hash [--user NAME]: creates an argon2id hash (or a user:hash entry) for basic_auth, reading the password from stdin.
• Weekly weekly workflow: RustSec advisories for both lockfiles, and a tokio canary that tests past the tokio cap.
• ADRs 0012–0016; the v0.1 research notes in docs/research/.

Changed

• rdock validate also compiles the configuration and lists settings this version cannot honour yet (“planned for vX.Y”); rdock run refuses them.
• Rules: matcher names are case-insensitive, one-argument Query(k) matches an empty value, Host accepts a trailing dot and unbracketed IPv6, Method compares in upper case (Traefik parity).
• Model: new listeners.*.timeouts, routes.*.timeouts, defaults.certificate, certificates.*.key_password, headers.hsts, lifecycle.drain_timeout.
• TLS uses rustls with the ring provider (ADR-0013); tokio is capped below 1.54 until Pingora supports it.

[0.1.0-alpha.2] — first published pre-release

Fixed

• Release workflow: in the checksum step, # inside a plain YAML scalar started a comment and cut the shell command short, so v0.1.0-alpha.1 was tagged but never published. Checksums and the SBOM are now produced on every pull request that touches the build, and only the publish job (tags) holds write permissions.

Added

• actionlint with shellcheck in the required docs check and in just ci.

[0.1.0-alpha.1] — M0 foundations (tagged, not published)

Added

• Cargo workspace with all crates of the architecture; skeleton crates document their milestone.
• rdock-rules: Traefik v3 compatible rule parser (HTTP and TCP matchers, !, &&, ||, parentheses, backtick and double-quoted strings), validation, canonical printing and property tests.
• rdock-model: configuration types for listeners, routes, services, middlewares, TCP, certificates, ACME, providers, security, admin and observability; typed values (durations, sizes, addresses, networks); semantic validation with paths and hints; JSON Schema (schema/rdock.v1.json).
• rdock-config: YAML (serde-saphyr, YAML 1.2 booleans) and JSON loading, unknown-key warnings with suggestions, --strict mode.
• rdock validate, rdock schema, rdock version.
• CI: rust (fmt, clippy pedantic, nextest, doc), msrv (1.89), cargo-deny, Docker build, Semgrep; release workflow with signed checksums, SBOM and provenance; static non-root Dockerfile.
• ADR-0011 (YAML parser and MSRV).

Earlier

• Design plan: vision, verified research, feature-parity matrix, requirements, architecture, roadmap, Harbor UI design system, ADR-0001…0010.
• Repository governance: contributing guide, code of conduct, security policy, support and governance docs, issue forms, PR template, CODEOWNERS, docs/DCO/PR-title CI checks, protected main and release tags.