Skip to content

Veil 0.9.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 17:42
· 259 commits to main since this release
v0.9.1
e5e39cb

veil v0.9.1

veil is now installable from package managers, each of which installs a default configuration and page so that
veil answers on http://127.0.0.1:8080/ right after installation: apt and dnf repositories, Homebrew, winget,
BSD ports, cargo binstall, a Docker Hub mirror and a Helm chart. Every GitHub release now carries the binaries,
packages, checksums and signatures for all platforms, built and tested in CI. This release also adds migration
guides from nginx and Envoy, a Grafana dashboard, and fixes three bugs found along the way.

About 0.9.0. veil 0.9.1 has the same code as 0.9.0. The 0.9.0 crates, Python packages, container images and
Helm chart were published, but its GitHub release was not created because a test job of the release workflow
timed out. 0.9.1 fixes the release workflow and is the first 0.9 release with binaries, packages and
repositories. It also fixes the BSD ports in veil-0.9.1-bsd-ports.tar.gz: the NetBSD package looked for
/usr/pkg/etc/veil/veil/config.toml and the OpenBSD port did not link; all three now build, install and run
as a service in CI.

Install
Debian, Ubuntu signed apt repository, apt install veil (the service starts)
RHEL-compatible, Fedora, Amazon Linux signed dnf repository, dnf install veil, systemctl enable --now veil
Homebrew (macOS, Linux) brew install aofusa/tap/veil, brew services start veil
Windows winget install Aofusa.Veil (MSI, x64 and arm64)
FreeBSD, OpenBSD, NetBSD ports for each tree (veil-0.9.1-bsd-ports.tar.gz, packaging/bsd/ports)
Rust cargo binstall veil-proxy (prebuilt, minisign-verified) or cargo install veil-proxy --locked --features full
Container ghcr.io/aofusa/veil and now docker.io/aofusa/veil (same digests and signatures)
Kubernetes helm install veil oci://ghcr.io/aofusa/charts/veil --version 0.9.1

Where each one puts the configuration and how veil finds it:
docs/guide/running.md#configuration-file.

Changes

  • Configuration file (F-247). veil reads -c FILE, then the new VEIL_CONFIG environment variable, then the
    default path: /etc/veil/config.toml, and on Windows %ProgramData%\veil\config.toml. Source builds can set
    their own default path at build time (VEIL_DEFAULT_CONFIG_PATH, used by the BSD ports). veil has no built-in
    configuration: without a file it stops with an error that names the path it looked for. --help is in English
    and shows the default path.
  • Release archives (F-247). The .tar.gz / .zip archives contain the binary, the licenses, a README and an
    example configuration and page in examples/ (./veil -c examples/config.toml). They are built in CI for Linux
    (glibc 2.28 and musl, x86_64 and aarch64), macOS (universal2), Windows (x86_64, aarch64) and FreeBSD, OpenBSD and
    NetBSD (x86_64), and each one is started and checked on its platform before the release is drafted.
  • Signatures and provenance (F-247, F-249). SHA256SUMS is signed with Sigstore (keyless, by this
    repository's release workflow), every asset has a GitHub build-provenance attestation, and the archives have
    minisign signatures that cargo binstall checks.
  • deb and rpm (F-251). The default configuration is /etc/veil/config.toml (a conffile /
    %config(noreplace), never overwritten), the page is /usr/share/veil/www/, and the default listens on
    127.0.0.1:8080 (plaintext). The packages no longer generate a self-signed certificate and no longer depend on
    openssl. On Debian and Ubuntu the service is enabled and started on install; on RPM systems it is not (Fedora
    policy). Upgrading no longer disables the service.
  • Helm chart (F-254). oci://ghcr.io/aofusa/charts/veil (cosign-signed): TLS from a Secret, HTTP/3 on a
    separate UDP Service, metrics with a ServiceMonitor, the Grafana dashboard as a ConfigMap, HPA, PDB and
    NetworkPolicy; non-root, read-only root filesystem, RuntimeDefault seccomp.
  • Docker Hub mirror (F-248). docker.io/aofusa/veil has the same tags, digests and signatures as
    ghcr.io/aofusa/veil.
  • Migration guides (F-255). From nginx
    and from Envoy (English and
    Japanese): concepts, directive tables including what veil does not have, examples, operations. Every complete
    example passes veil -t in CI, and representative examples are run side by side with nginx / Envoy and compared.
  • Grafana dashboard (F-256). examples/grafana/veil-overview.json and a docker compose example with veil,
    Prometheus and Grafana. A test queries every panel, so a renamed metric is caught.

Fixes

  • The proxy cache never stored small responses (B-162). Responses whose body arrived with the headers were
    never cached, so for most small responses every request went to the backend. Note that the proxy cache applies
    to HTTP/1.1 clients and http:// upstreams only; HTTP/2 and HTTP/3 requests and https:// upstreams always go to
    the backend (now documented; F-257).
  • Static files under a relative File path returned 403 on HTTP/1.1 (B-160). A route such as
    path = "examples/www/" answered 403 for every file over HTTP/1.1 on Linux (HTTP/2 worked).
  • A failed startup exited with status 0 (B-161). Configuration or bind errors now exit with status 1, so
    systemd's Restart=on-failure, rc.d and scripts see the failure.

Upgrade notes

  • deb / rpm users of 0.8.x (configuration in /var/etc/veil/config.toml): the package keeps using that file
    (it writes VEIL_CONFIG=/var/etc/veil/config.toml to /etc/default/veil or /etc/sysconfig/veil). To move to
    /etc/veil/config.toml, copy your settings there, delete that line and restart veil. The self-signed
    certificate the 0.8.x package created in /var/etc/veil/ssl/ is left as it was.
  • Windows: veil without -c now reads %ProgramData%\veil\config.toml (it used to look for
    /etc/veil/config.toml).
  • Scripts that start veil and relied on exit status 0 after a startup error now get 1.
  • Route paths: a path without * is an exact match ("/" matches every path); use "/api/*" for a prefix.
    This was already the behavior; the migration guides now say it explicitly.

Known limitations

  • Prebuilt BSD binaries are x86_64 only (aarch64 BSD: build from the ports or from source).
  • macOS binaries are not signed with a Developer ID or notarized. Homebrew and cargo binstall installs are not
    affected by Gatekeeper; an archive downloaded with a browser may need xattr -d com.apple.quarantine veil.
  • winget: the first version is submitted to winget-pkgs by hand; later versions are proposed automatically.

Default configuration by install method

Install method Configuration and page Notes
Container in the image (/etc/veil/conf.d/config.toml) docker run --rm -p 8080:8080 ghcr.io/aofusa/veil:musl-v0.9.1
deb (Debian, Ubuntu) /etc/veil/config.toml, /usr/share/veil/www/ the service starts on install
rpm (RHEL-compatible, Fedora, Amazon Linux) /etc/veil/config.toml, /usr/share/veil/www/ sudo systemctl enable --now veil
Homebrew $(brew --prefix)/etc/veil/config.toml brew services start veil
winget / MSI %ProgramData%\veil\config.toml
BSD ports FreeBSD /usr/local/etc/veil/, OpenBSD /etc/veil/, NetBSD /usr/pkg/etc/veil/
cargo binstall, cargo install not installed: provide your own configuration and page
Archives (.tar.gz, .zip below) not installed: ./veil -c examples/config.toml examples/ is not read automatically

With a package's default configuration, veil serves a page on http://127.0.0.1:8080/. How veil finds its
configuration file (-c, then VEIL_CONFIG, then the default path):
running.md.

Assets

File Size
veil-0.9.1-1.aarch64.rpm 8.8 MB
veil-0.9.1-1.x86_64.rpm 9.9 MB
veil-0.9.1-aarch64-pc-windows-msvc.msi 7.2 MB
veil-0.9.1-aarch64-pc-windows-msvc.zip 8.8 MB
veil-0.9.1-aarch64-unknown-linux-gnu.tar.gz 8.8 MB
veil-0.9.1-aarch64-unknown-linux-musl.tar.gz 8.9 MB
veil-0.9.1-bsd-ports.tar.gz 0.0 MB
veil-0.9.1-universal2-apple-darwin.tar.gz 18.3 MB
veil-0.9.1-x86_64-pc-windows-msvc.msi 8.1 MB
veil-0.9.1-x86_64-pc-windows-msvc.zip 9.8 MB
veil-0.9.1-x86_64-unknown-freebsd.tar.gz 9.9 MB
veil-0.9.1-x86_64-unknown-linux-gnu.tar.gz 10.0 MB
veil-0.9.1-x86_64-unknown-linux-musl.tar.gz 10.0 MB
veil-0.9.1-x86_64-unknown-netbsd.tar.gz 9.4 MB
veil-0.9.1-x86_64-unknown-openbsd.tar.gz 9.5 MB
veil_0.9.1_amd64.deb 7.1 MB
veil_0.9.1_arm64.deb 5.8 MB

SHA256SUMS:

6259a4ff6cbc338419fa1665f834d8d56af5abfc709d8084066d1678d3ee03d0  veil-0.9.1-1.aarch64.rpm
40f02c54935ef0d7bd8ef3d21eff892ed4d8e09b7e4ae150e1b8d7d17b435adc  veil-0.9.1-1.x86_64.rpm
1f26b611ea56400b8b6b8ff9cd05ccd30c7747cd2202188b7d026ad924c8c551  veil-0.9.1-aarch64-pc-windows-msvc.msi
5c732d4a14e90725a729b0ef4e2ece68d174fc17484b4938060c4cb5c6f0f6a1  veil-0.9.1-aarch64-pc-windows-msvc.zip
d349002b455ea1ccbc2e7092a77e3511cb294f11af83b6ee0696ed1e6592f67a  veil-0.9.1-aarch64-unknown-linux-gnu.tar.gz
4a044bc61b633893ba74619dcc7fd428daae32a8aa91c71cfec68adb5e0a8866  veil-0.9.1-aarch64-unknown-linux-musl.tar.gz
ed7ece8e3d0271a165d4bc1ab7a05dfc4d2280a702a644af1274f42901b71376  veil-0.9.1-bsd-ports.tar.gz
1958db6a6379596487502e9df0b0c704bcb98cb737537e0296f1d07c67c4bc31  veil-0.9.1-universal2-apple-darwin.tar.gz
09da8c1c5469613cf9f76dd6a6f44acd24a6f97a1f5a02ddaca75380984c69b3  veil-0.9.1-x86_64-pc-windows-msvc.msi
ae21c0bd6066b1b75250217ebf6ae6404827b68c016ecbe157672643d794a35c  veil-0.9.1-x86_64-pc-windows-msvc.zip
1b2a6e90c46a79e58aa290ed3ef1430c2da4dfca01edc0b38ceb61ebd6d52fad  veil-0.9.1-x86_64-unknown-freebsd.tar.gz
355f5feb17c3ba6b8e862078c2bd33a26ede334af99b48e71d89554c9a0eee69  veil-0.9.1-x86_64-unknown-linux-gnu.tar.gz
c789e5bc64f348b73901d882a45073701476f4f919c82e7d63215efb9bdcf9c2  veil-0.9.1-x86_64-unknown-linux-musl.tar.gz
f586e409ca225a9b99720a1e01bce4de0278f8d01a441df51a0316c0a1d941d3  veil-0.9.1-x86_64-unknown-netbsd.tar.gz
e0f1c7c3fd195bfd3370aef76fea377d661c317ecffcdd551f75ef224d2c0964  veil-0.9.1-x86_64-unknown-openbsd.tar.gz
089a3ab1e18ec83dd1ab229675d8268c35cd0026dae09e8d20ef02850a4a432c  veil_0.9.1_amd64.deb
b709a4e7efb60068fbdb3abd9615e9b651f1569dc63f71e2e42ca08b5c88cb31  veil_0.9.1_arm64.deb

Verifying

# The checksums' signature (Sigstore keyless, signed by this repository's release workflow)
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/aofusa/veil-proxy/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing
# Where an asset was built (GitHub build-provenance attestation)
gh attestation verify veil-0.9.1-x86_64-unknown-linux-gnu.tar.gz --repo aofusa/veil-proxy
# The container image's signature
cosign verify ghcr.io/aofusa/veil:musl-v0.9.1 \
  --certificate-identity-regexp '^https://github.com/aofusa/veil-proxy/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

When the release is published, the archives also get minisign signatures (<archive>.sig), which cargo binstall checks.

Container images

ghcr.io/aofusa/veil:musl-v0.9.1  sha256:3856cba85a931fa59746068fad8e175eeffd3c2faae05f8638d2cd026d599c86
ghcr.io/aofusa/veil:glibc-v0.9.1  sha256:f856acaef38fa6871861a10ad3969248039b1a5e7845ee7dd89c684b9257ee4e
Assets 34
Loading