v0.82.0

Highlights

Changed edge.mss now actually takes effect — #461

The VPN-robustness option introduced in v0.81.0 is a create-time container setting: kernel sysctls and the edge network MTU cannot be changed on a running container. Because the edge container deliberately survives redeploys (so the maintenance page stays reachable), a changed edge.mss never reached a running deployment — and there was no way to tell from the outside.

Redeploy and upgrade now re-apply it:

• Both re-read the manifest edge: block and compare the configured tuning against the one the live edge container was created with (new container label rsgo.edge.mss). On a mismatch the edge container is recreated once, before the product stacks are touched.
• An edge container from a version before the option counts as off and is switched to the configured mode (pmtu by default) on the next redeploy or upgrade.
• The background reconciler still never restarts the front door on its own — recreation only happens on an explicit operator action.

Verifiable at the customer site. The edge now logs one line at startup with the values it reads from its own kernel:

$ docker logs <deployment>-edge 2>&1 | head -1
rsgo-edge: client-facing MSS tuning mode=pmtu verdict=ACTIVE (expected: tcp_mtu_probing=1 | tcp_mtu_probing=1 tcp_base_mss=1024 iface_mtu: eth0=1500)

ACTIVE = in effect · DISABLED = mss: off · INACTIVE = the container does not run the configured tuning (predates it, or a fixed MTU could not be applied to an existing network) → run a redeploy.

Robustness fixes in the same area

• An edge: block that no longer resolves (removed, or unresolved variables) keeps the running edge config instead of tearing down the product's front door — on redeploy and when upgrading to a target version whose block does not resolve.
• After the edge container is replaced, the cached Caddy config is invalidated, so the fresh container gets the live config instead of staying on its bootstrap maintenance page.

No migration and no manifest change required; deployments without an edge: block are unaffected.

Documentation: Maintenance edge proxy → VPN robustness — new sections on when a change takes effect and how to verify it.

Full changelog: v0.81.0...v0.82.0