v2.5.10

Features

• Add Quick Setup to site creation and editing with validated redirect and reverse-proxy configuration templates.
• Show live progress while upgrading child-node authentication.
• Add an option to disable authoritative DNS propagation checks during certificate issuance.

Bug Fixes

• Keep long-running certificate issuance WebSocket connections alive and report when the connection closes before completion.
• Preserve the configured DNS propagation delay before ACME validation when active propagation checks are disabled.
• Honor separate Cloudflare zone and DNS API tokens when resolving zones and updating records.
• Automatically migrate legacy certificate paths and expose migration results in certificate management.
• Complete TLS-aware upstream health checks without sending application requests to HTTPS backends.
• Allow site TLS certificates and keys defined through included NGINX configuration files.
• Clarify the DNS zone and DDNS record workflow and display fully qualified record names.
• Show the underlying error when a remote node is unreachable.
• Build cluster WebSocket URLs without rewriting unrelated http text.
• Emit forwarded maps independently of the WebSocket toggle in Quick Setup.
• Avoid splitting multi-byte UTF-8 characters when truncating LLM-generated session titles.
• Stop upstream comments from being repeated on following directives.
• Correct NGINX log-level constants so error entries are classified correctly.
• Prevent a panic when an S3 backup path points to the bucket root.
• Keep dateext logrotate files grouped with their source log.
• Point Debian nginx.conf documentation links at the current branch.

Contributors

@0xJacky
@VXNCXNX
@ugurcsen

v2.5.9

Features

• None.

Bug Fixes

• Stop site health checks from flooding the logs with expected record not found messages for configurations without database records, including backup files, while preserving remote namespace deployment status.
• Keep the database path synchronized when a stream is renamed, so deleting the renamed stream also removes its database record instead of leaving orphaned metadata.

Contributors

@0xJacky

v2.5.8

Features

• Explain why a node is unreachable directly in the node list. A failed connection now carries the underlying error, and the controller recognises a clock skew between itself and the node — the case where TLS rejects the certificate as not yet valid before node authentication ever runs — and answers it with the commands that fix it instead of a generic failure.
• Show MiniMax model parameters and endpoints in the model metadata.

Bug Fixes

• Index the nginx default access log even when the configuration declares no access_log directive. The log preview resolved the path from nginx.AccessLogPath (falling back to the --http-log-path reported by nginx -V), but indexing only ever considered paths scanned from access_log directives, so a setup whose directives are commented out — the Homebrew default — could preview its logs while the indexer reported nothing to index (#1787).
• Keep the log paths discovered from the nginx configuration across an indexing restart. Turning advanced indexing off destroyed the manager that owned them and turning it back on built an empty one, so a rebuild started before the next periodic config scan found zero log groups (#1787).
• Enumerate log groups before clearing index metadata during a full rebuild, so a group that is only known from a previous index can still be rebuilt (#1787).
• Reset the task scheduler when indexing services stop, so automatic indexing of unindexed logs resumes after advanced indexing is turned off and on again (#1787).
• Report a rebuild that found no access log group as a warning with diagnostics instead of a misleading Successfully completed, and describe both ways a log path can be discovered instead of pointing only at access_log directives (#1787).
• Stop the search cache from panicking with send on closed channel when advanced indexing is disabled while a shard hot swap is still clearing it.
• Log why a node authentication attempt was rejected, including the credential type, request method and path, and the remote address. A signature or legacy secret failure previously returned an error with nothing recorded to explain it.
• Add the X-Forwarded-Proto and X-Forwarded-Host headers to a bundled nginx-ui.conf that predates them. The self check only rewrote those headers when they already existed, so an installation created before they were introduced stayed unfixed.
• Extract the interface strings introduced in v2.5.7 so they can be translated: the one-time-code fields, the site health check failure reasons, and the certificate record persistence error.

Contributors

@0xJacky, @octo-patch

v2.5.7

Features

• Run the public demo on Cloudflare Containers, with a browser-simulated terminal and fabricated state so every screen can be explored without configuring a provider.
• Cover the demo with an end-to-end Playwright suite, including the site navigation socket and classified site health reasons.

Bug Fixes

• Test the configuration with nginx -t before keeping a saved file, and restore the previous content when the test fails. An invalid config can no longer be left on disk to break the next nginx start. Covers the config editor, config creation, cluster sync, stream saves, and the MCP add tool (#1797).
• Write renewed certificates back to the paths nginx actually loads, and stop the post-renewal database write from failing silently. Renewals no longer land in a new directory while the vhost keeps serving the expiring certificate (#1794).
• Accept the WebSocket token from the query string on /api/site_navigation_ws and /api/code_completion, fixing the immediate 403 that broke the site navigation sidebar (#1793).
• Bound index rebuilds with a global task limit and derive CPU and memory budgets from cgroup limits instead of host specifications, preventing memory and CPU exhaustion after upgrading inside a container (#1792).
• Stop site health probes from failing on self-signed certificates, and show a classified reason on the site card. Probes that carry custom headers or a request body still validate the certificate chain (#1790).
• Make the segmented one-time-code inputs discoverable by password managers by wrapping them in a real form with stable names and autocomplete="one-time-code" (#1786).
• Remove the enabled symlink when nginx -t or the reload rejects a stream or a configuration that was just enabled, so a broken configuration is no longer left active for the next nginx start.
• Write ACME private keys with owner-only permissions, and tighten keys that earlier versions created world-readable.
• Let nodes in the recycle bin be recovered or permanently deleted (#1796).
• Keep account and secure-session routes on the controller when a remote node is selected, so administrator actions work again through the cluster switcher (#1788).
• Skip the searcher hot swap until the first indexing task creates a shard, removing the no healthy shards available errors when advanced indexing is first enabled (#1787).
• Use the node host for proxied cluster requests, and diagnose proxy rejections without echoing the upstream response body back to the caller.
• Require an interactive administrator to create, modify, or test an external notifier, and localize certificate expiry alerts.
• Stop the analytics stream spinning on errors and leaking goroutines after a client disconnects, expire idle HTTP connections, and coalesce site sweeps triggered by configuration scans.
• Encode filesystem paths correctly in log entry queries instead of sending them raw in the query string.
• Prevent network spikes on the dashboard after a reconnect, and limit the initial range of the structured log view.

Contributors

@0xJacky

v2.5.6

Features

• Include all deployment sources and application improvements introduced in v2.5.3 through v2.5.5.
• Publish the official Helm chart, signed OpenWrt 25.12 APK repository, and Unraid templates through Nginx UI-managed sources.

Bug Fixes

• Parse OpenWrt binary-mode checksum entries correctly when resolving SDK archive filenames.
• Verify all six actual OpenWrt SDK archives from GitHub-hosted runners before release.

Contributors

@0xJacky

v2.5.5

Features

• Include all deployment sources and application improvements introduced in v2.5.3 and v2.5.4.
• Publish the official Helm chart, signed OpenWrt 25.12 APK repository, and Unraid templates through Nginx UI-managed sources.

Bug Fixes

• Download OpenWrt SDKs through an independently served official OpenWrt infrastructure mirror, with the public download and archive hosts retained as fallbacks.
• Verify all six supported OpenWrt target indexes from GitHub-hosted runners before release.

Contributors

@0xJacky

v2.5.4

Features

• Include all deployment sources and application improvements introduced in v2.5.3.
• Publish the official Helm chart, signed OpenWrt 25.12 APK repository, and Unraid templates through Nginx UI-managed sources.

Bug Fixes

• Retry OpenWrt SDK downloads and fall back to the official archive.openwrt.org host when the primary download edge is temporarily unavailable.

Contributors

@0xJacky

v2.5.3

Features

• Add an official Helm chart with a self-hosted repository at https://cloud.nginxui.com/helm.
• Add a signed, self-hosted OpenWrt 25.12 APK repository for six supported architectures.
• Add official standalone and SWAG templates for Unraid through nginxui/unraid.
• Add scoped CLI remote management for sites, streams, certificates, backups, and Nginx operations (#1771).
• Add a unified health-check control plane, configurable alerts, and multi-node configuration synchronization.

Bug Fixes

• Prevent Nginx log index corruption and reduce search, indexing, and analytics resource usage.
• Restore the Cloudflare DNS production API base URL.
• Keep cluster directory synchronization working when a directory contains unsupported configuration names.

Contributors

@0xJacky

v2.5.2

Important

If an installation ever ran NGINX UI 2.3.6 or earlier, or restored a backup from such an installation, upgrading alone does not invalidate credentials that may already have been exposed. Upgrade every instance to v2.5.2 first. In a cluster, use HTTPS for any relationship that still reports Legacy shared secret, and confirm that each node relationship shows Paired signature before rotating the shared secrets. Then:

• Replace [node] Secret (NGINX_UI_NODE_SECRET) on every instance with a new, unique random value and restart the instance.
• Replace [app] JwtSecret (NGINX_UI_APP_JWT_SECRET) and restart NGINX UI to invalidate previously issued JWTs.
• Rotate downstream credentials stored in NGINX UI, and review administrator accounts and access logs for unauthorized activity.

Do not manually replace Crypto.Secret: it protects persisted encrypted data and requires a supported migration. Backup archives use one-time encryption material; rotate the credentials contained in any exposed backup instead.

This hotfix includes all changes and release notes from v2.5.0.

Features

• Introduce signed node requests and automatic migration from the shared node secret to per-controller Ed25519 credentials, with credential status, rotation, recovery grace, and revocation controls.
• Add site traffic and QPS statistics to the dashboard.
• Add Azure DNS and Huawei Cloud DNS providers, AliDNS line selection, DNS record grouping, and multiple site links per DNS record.
• Improve AliDNS, Cloudflare, and Tencent Cloud DNS integration efficiency by replacing heavyweight provider SDKs with focused API clients.
• Add ACME certificate support for IP addresses and configurable renewal based on remaining certificate validity.
• Add scheduled automatic backups with on-demand execution.
• Add support for controlling Nginx in external containers and isolated namespaces.
• Add custom OpenAI-compatible base URLs and improved reasoning-model session titles.

Bug Fixes

• Prevent a site-check initialization race from interrupting Gin route registration and leaving later API and WebSocket endpoints unavailable; log startup panics locally when SLS is not ready (#1766).
• Restore rolling-upgrade connectivity between v2.5.1 controllers and pre-v2.5.0 child nodes by retaining legacy X-Node-Secret authentication until each relationship is automatically upgraded to Ed25519 credentials.
• Fix generated Homebrew formula URLs so Homebrew derives the version consistently from tagged release URLs.
• Verify signed upgrade artifacts before applying an update.
• Preserve destination-owned secrets and instance identity during portable backup restores.
• Enforce passkey-only authentication across login paths and protect privileged Nginx commands.
• Recover successful Nginx restarts when the proxy connection drops before the response is returned.
• Validate TLS certificate and private-key pairs before saving settings or restarting the service.
• Fix dashboard memory leaks and improve node availability and deletion handling.
• Recover unindexed access logs on startup and improve log indexing, storage, and search efficiency (#1757).
• Preserve an explicitly disabled upstream on first creation (#1758).
• Improve WebSocket self-check reliability (#1759), skip-install password handling (#1755), and preference-save error handling (#1753).
• Auto-detect the browser language on first visit and add the Ukrainian date locale (#1754).

Contributors

@0xJacky
@chrstphe
@renovate
@sdjnmxd

v2.5.1

Important

If an installation ever ran NGINX UI 2.3.6 or earlier, or restored a backup from such an installation, upgrading alone does not invalidate credentials that may already have been exposed. Upgrade every instance to v2.5.1 first. In a cluster, use HTTPS for any relationship that still reports Legacy shared secret, and confirm that each node relationship shows Paired signature before rotating the shared secrets. Then:

• Replace [node] Secret (NGINX_UI_NODE_SECRET) on every instance with a new, unique random value and restart the instance.
• Replace [app] JwtSecret (NGINX_UI_APP_JWT_SECRET) and restart NGINX UI to invalidate previously issued JWTs.
• Rotate downstream credentials stored in NGINX UI, and review administrator accounts and access logs for unauthorized activity.

Do not manually replace Crypto.Secret: it protects persisted encrypted data and requires a supported migration. Backup archives use one-time encryption material; rotate the credentials contained in any exposed backup instead.

This hotfix includes all changes and release notes from v2.5.0.

Features

• Introduce signed node requests and automatic migration from the shared node secret to per-controller Ed25519 credentials, with credential status, rotation, recovery grace, and revocation controls.
• Add site traffic and QPS statistics to the dashboard.
• Add Azure DNS and Huawei Cloud DNS providers, AliDNS line selection, DNS record grouping, and multiple site links per DNS record.
• Add ACME certificate support for IP addresses and configurable renewal based on remaining certificate validity.
• Add scheduled automatic backups with on-demand execution.
• Add support for controlling Nginx in external containers and isolated namespaces.
• Add custom OpenAI-compatible base URLs and improved reasoning-model session titles.

Bug Fixes

• Restore rolling-upgrade connectivity between v2.5.1 controllers and pre-v2.5.0 child nodes by retaining legacy X-Node-Secret authentication until each relationship is automatically upgraded to Ed25519 credentials.
• Fix generated Homebrew formula URLs so Homebrew derives the version consistently from tagged release URLs.
• Verify signed upgrade artifacts before applying an update.
• Preserve destination-owned secrets and instance identity during portable backup restores.
• Enforce passkey-only authentication across login paths and protect privileged Nginx commands.
• Recover successful Nginx restarts when the proxy connection drops before the response is returned.
• Validate TLS certificate and private-key pairs before saving settings or restarting the service.
• Fix dashboard memory leaks and improve node availability and deletion handling.
• Recover unindexed access logs on startup and improve log indexing, storage, and search efficiency (#1757).
• Preserve an explicitly disabled upstream on first creation (#1758).
• Improve WebSocket self-check reliability (#1759), skip-install password handling (#1755), and preference-save error handling (#1753).
• Auto-detect the browser language on first visit and add the Ukrainian date locale (#1754).

Contributors

@0xJacky
@chrstphe
@renovate
@sdjnmxd