1.4.4

Patch release — large-APK download fix.

Problem: big APKs (100s of MB) could be cut mid-download on slow clients (NS_BINDING_ABORTED / truncated file), with nothing in the app logs, when a proxy in the chain buffered the response to a temp file that filled up.

Changes

• Bundled nginx: /fdroid/ and /r/ now use proxy_buffering off + 3600 s read/send/client timeouts → downloads stream client-paced instead of being buffered to a size-limited temp file.
• New opt-in X_ACCEL_REDIRECT_ENABLED (on by default in the reference compose): local-storage APK downloads are handed to nginx via X-Accel-Redirect to an internal /_protected/ location — sendfile, real Content-Length, native Range/resume, no Python nor backend read-timeout in the byte path. Requires the serving nginx to define /_protected/ + mount the storage volume (already true in the reference compose). Set to 0 if your front nginx lacks that location.

⚠️ Operator note: if you run your own reverse proxy / CDN in front (nginx, BunkerWeb, Traefik, Cloudflare, …), you must also disable response buffering (or give its temp dir room) and raise its timeouts for the download route — a short timeout or a small proxy temp filesystem there still truncates large downloads regardless of these app-side changes.

Images (backend / worker / frontend) are published to GHCR by CI for this release — pull :1.4.4 and redeploy. Reminder: the worker service must use the *-worker image (bundles the JDK for index signing).