Release v19.18.0

Added

• Cleartext HTTP/2 behind a proxy. Tls.Enabled=false is now honored as an explicit opt-in: the kernel serves cleartext HTTP/2 (h2c) only, behind an HTTPS-terminating reverse proxy. TLS stays enabled by default. With TLS enabled, a missing or invalid certificate still stops startup and never falls back to cleartext. A dedicated health port with TLS still requires a certificate. Authenticated h2c requires an explicit HTTPS external authority, because Chronicle's internal /connect/token is not served over cleartext. (#3681)
• Trusted proxies setting. New options forwardedHeaders.knownProxies and forwardedHeaders.knownNetworks list the reverse proxies whose X-Forwarded-* headers the kernel trusts. This also holds when ASPNETCORE_FORWARDEDHEADERS_ENABLED=true is set. (#3681)

Changed

• Forwarded headers are trusted only from loopback or configured proxies. Before, they were trusted from any caller, which let anyone spoof the client IP and scheme. Existing TLS deployments behind a proxy keep working; the only difference is that RemoteIpAddress becomes the proxy's address until the proxy is configured. h2c deployments, and a shared cleartext health port reached through a proxy, need the proxy configured before upgrading. (#3681)
• Ignored identity-provider certificate. identityProvider.certificate has never been applied. The kernel now logs a startup warning when it is set, and the documentation explains that the top-level tls certificate serves /connect/token. The setting will be rejected in the next major. (#4204)
• SDKs can't obtain tokens from an external authority yet, so SDK ClientCredentials mode doesn't work with authenticated h2c. (see #4350)