v1.1.1

v1.1.0 起，Kiln 会自行解析并固定每个上游地址。宿主机整机启用 TUN 或 fake-IP DNS 时，任何进程都拿不到真实地址，回源因此全部失败。这一版补上开关。

🔧 修复

• 新增 [egress] trust_proxy_dns（默认 false）。开启后，经过代理的请求把域名原样交给代理解析，恢复 v1.1.0 之前的行为；直连请求仍然本机解析并固定拨号。
• 开启后仍然拒绝 localhost、.local、.internal 与 metadata 主机，字面 IP 也照常校验；不再校验的只有解析结果。代理成为信任边界，请只指向可信代理，并在代理端阻止访问私网目标。
• 节目单源与连通性测试也遵守该开关，此前它们绕过了配置。

未使用代理、或宿主机能正常解析域名的部署不受影响，无需改动配置。

---

Since v1.1.0 Kiln resolves and pins every upstream address itself. On a host where TUN or fake-IP DNS applies system-wide, no process can obtain a real address, so every upstream fetch fails. This release adds the escape hatch.

🔧 Fixes

• New [egress] trust_proxy_dns (default false). When enabled, proxied requests hand the hostname to the proxy, restoring the behavior from before v1.1.0. Direct requests are still resolved and pinned locally.
• With it enabled, localhost, .local, .internal and metadata hosts are still refused and literal IPs are still validated; only the resolved address goes unchecked. The proxy becomes the trust boundary, so point it at a trusted proxy and block private destinations there.
• EPG sources and the connection test now honor the switch as well; they previously bypassed it.

Deployments without a proxy, or on hosts with working DNS, are unaffected and need no configuration change.

---

🐳 安装 · Install

docker pull ghcr.io/babywbx/kiln:1.1.1        # full, includes ffmpeg
docker pull ghcr.io/babywbx/kiln:1.1.1-core   # native packager, no ffmpeg
docker pull ghcr.io/babywbx/kiln:1.1.1-lite   # stateless low-memory variant

二进制包见下方附件，请对照 SHA256SUMS 校验；配置说明见在线文档。

Binaries are attached below. Verify them against SHA256SUMS, then see the documentation for configuration.

v1.1.0

✨ 主要更新

• 控制台 HTTPS 与分离监听：内置 TLS，证书留空时自动生成并复用；也可以让控制台与播放各用一个监听。
• 所有代理 scheme 固定拨号目标：目标由 Kiln 本机解析并校验，再以固定 IP 拨号，同时保留原始 Host 与 TLS SNI。
• 按需拉取轨道：只回源正在观看的轨道，并新增清单重试与失速分片上限的可调项。
• EPG 流式入库：XMLTV 边解析边写入 SQLite，不再整份读进内存。
• Range 感知的媒体代理：转发 Range 与 If-Range，上游 404、410、416 保留状态码透传。
• 连通性测试实测吞吐：可达但带不动播放的线路判定为不足，而不是报成功。

⚠️ 行为变更

• 明文 HTTP 上游不能再经 HTTP 或 HTTPS 转发代理，请改用 HTTPS 上游或 SOCKS5 线路。
• socks5h 不再由代理侧解析域名，TUN 或 fake-IP 环境需要为回源域名配置真实 DNS。
• 自动生成的控制台证书改为 leaf 证书，1.0.x 生成的会在首次加载时替换。
• 播放列表中指向被阻止目标的条目，会让整份清单以 502 拒绝。
• playlist_policy = "auto" 下，配置了自定义 User-Agent 或上游请求头的频道会全量改写。
• 配置文件中声明的出站设置会在每次启动时同步进数据库。
• 连通性测试目标 bing 更名为 public，API 仍接受旧值。
• 安装脚本的 SHA256SUMS 恒从 github.com 获取，镜像只承担发行包传输。

---

✨ Highlights

• Console HTTPS and split listeners — Built-in TLS with an auto-generated certificate, plus an optional second listener that separates the console from playback.
• Every proxy scheme pins its destination — Kiln resolves and validates the target itself, then dials the pinned address while keeping the original Host and SNI.
• On-demand renditions — Only the tracks a viewer is watching are pulled, with new knobs for manifest retries and stalled segments.
• EPG streams into SQLite — XMLTV is parsed straight into the database instead of being held in memory.
• Range-aware media proxying — Range and If-Range are forwarded upstream, and 404, 410 and 416 pass through with the upstream status.
• Throughput in the connection test — A route that connects but cannot carry media is reported as too slow instead of passing.

⚠️ Behavior changes

• Plain HTTP upstreams can no longer go through an HTTP or HTTPS forward proxy. Use an HTTPS upstream or a SOCKS5 route.
• socks5h no longer defers DNS to the proxy. TUN and fake-IP deployments need real DNS for upstream hostnames.
• The generated console certificate is a leaf, not a CA. One generated by 1.0.x is replaced on first load.
• A playlist entry pointing at a blocked host now fails the whole playlist with 502.
• With playlist_policy = "auto", channels that set a custom User-Agent or upstream headers have every entry rewritten.
• Egress settings declared in the configuration file are synced into the database on every start.
• The connection test target bing is now public; the old value is still accepted by the API.
• The install script always fetches SHA256SUMS from github.com; mirrors only carry the archive.

---

🐳 安装 · Install

docker pull ghcr.io/babywbx/kiln:1.1.0        # full, includes ffmpeg
docker pull ghcr.io/babywbx/kiln:1.1.0-core   # native packager, no ffmpeg
docker pull ghcr.io/babywbx/kiln:1.1.0-lite   # stateless low-memory variant

二进制包见下方附件，请对照 SHA256SUMS 校验；配置说明见在线文档。

Binaries are attached below. Verify them against SHA256SUMS, then see the documentation for configuration.

v1.0.0

Kiln 的第一个正式版本。

自建上游最麻烦的地方不在于搭起来，而在于搭起来之后：HLS 和 DASH 格式各走各的，鉴权基本等于没有，拉流还得一直挂着。Kiln 站在上游和播放器中间，把这些收成一个入口，输出一份带鉴权的 M3U 播放列表和随取随用的 HLS。

DASH 的解密与重封装是 Go 原生实现的，默认不需要 FFmpeg。整套服务是单个二进制，最小的镜像 3.84 MB，在 1 CPU、64 MiB 的容器里跑得起来。

✨ 这个版本带来什么

媒体管线：HLS 同源分片代理；DASH 按 kid:key 本地解密后重封装为 HLS，全程不依赖 FFmpeg。支持 LL-HLS（CMAF part、delta playlist、blocking reload）、ABR、多音轨，以及 TTML 到 WebVTT 的字幕转换。

按需与自愈：on_demand 在无人观看时回收上游连接，autostart 为常看频道预热。媒体停滞会被探测到并按指数退避重启，发布代际相互隔离，播放器自动换代，不需要手动刷新。

鉴权与审计：bcrypt 口令、Ed25519 会话 JWT、只展示一次的管理员 API Token、路径式播放密钥。播放密钥可限定频道范围，播放访问与 API Token 操作都有审计记录。

分发：生成按范围过滤的 M3U 并自动关联 XMLTV，内置多组台标候选源，支持 M3U 批量导入导出。

出站代理：按域名或频道路由 HTTP 与 SOCKS，频道编辑页可以直接新建线路并测试连通性。

管理控制台：响应式 Web UI，频道预热与预览，搜索同时支持拼音、粤拼与简繁互通，静态资源压缩传输。

运行时：按容器实际内存与 CPU 自动收紧内存预算和并发，只下压、不上调。可观测面包括 /v1/status、Prometheus /metrics、可选 OTLP traces，以及 /healthz 与 /readyz。

📦 三个变体怎么选

变体	镜像	负载后 RSS 中位数	适合
Lite	3.84 MB	13.01 MiB	内存吃紧的小机器，无状态低内存部署
Core	13.27 MB	25.17 MiB	完整控制台与数据库，且确认 DASH 频道都能被原生引擎处理
Full	66.41 MB	25.21 MiB	输入兼容性优先，需要保留 FFmpeg 回退

数字来自 2026-07-23 在 linux/arm64 上的受控实测，三个变体在相同宿主机、相同容器限制、相同配置与相同媒体 fixture 下各跑 5 轮、共 100 次完整链路，成功率 100/100。Lite 另在 1 CPU、64 MiB 的容器中完成 10 次链路，负载后 RSS 为 12.80 MiB，无 OOM。

需要说明的是，实验用的是小体积确定性 fixture，不是真实码率，因此它不能用来判断 1080p 或 4K 的吞吐、多频道并发容量或首帧时间。真实部署请对目标频道单独做端到端验收。完整方法与复现步骤见变体对比。

🐳 安装

docker pull ghcr.io/babywbx/kiln:1.0.0        # Full，含 FFmpeg 回退
docker pull ghcr.io/babywbx/kiln:1.0.0-core   # 原生打包器，不含 FFmpeg
docker pull ghcr.io/babywbx/kiln:1.0.0-lite   # 无状态低内存变体

也可以直接下载下方的二进制包。Linux 覆盖 amd64、arm64、armv7、armv6，macOS 覆盖 amd64 与 arm64，Windows 覆盖 amd64 与 arm64 并自带服务安装与失败重启。Core 镜像同样提供四个 Linux 架构，Full 与 Lite 镜像提供 amd64 与 arm64。

下载后请对照 SHA256SUMS 校验：

sha256sum --check --ignore-missing SHA256SUMS

📖 上手

docker run -p 8080:8080 ghcr.io/babywbx/kiln:1.0.0

服务默认监听 0.0.0.0:8080，管理界面在 /admin。逐项配置、部署方案与 API 细节见在线文档。

首次上线前请务必替换示例口令，并生成自己的 JWT 密钥。

🙌 后续

问题与建议都欢迎走 Issue，动手之前请先看一眼贡献指南。安全问题请按安全策略私下报告，不要开公开 Issue。

本项目以 AGPL-3.0-only 授权。

---

English

The first stable release of Kiln.

Running your own upstreams is rarely hard to start and often hard to live with: HLS and DASH speak different dialects, authentication tends to be an afterthought, and something has to keep pulling the stream around the clock. Kiln sits between the upstreams and the player and folds all of that into a single entry point, serving one authenticated M3U playlist and HLS on demand.

DASH decryption and repackaging are implemented natively in Go, so FFmpeg is not required by default. The whole service is a single binary; the smallest image is 3.84 MB and runs comfortably in a 1 CPU, 64 MiB container.

✨ What is in this release

Media pipeline. Same-origin HLS segment proxying. DASH is decrypted locally against kid:key and repackaged into HLS without touching FFmpeg. LL-HLS (CMAF parts, delta playlists, blocking reload), ABR, multiple audio tracks, and TTML to WebVTT subtitle conversion are all supported.

On demand and self-healing. on_demand releases upstream connections when nobody is watching; autostart keeps frequently used channels warm. Stalled media is detected and restarted with exponential backoff, and publication generations are isolated so players roll over on their own without a manual refresh.

Authentication and auditing. bcrypt passwords, Ed25519 session JWTs, admin API tokens shown exactly once, and path-scoped play keys. Play keys can be restricted to a subset of channels, and both playback access and API token operations are audited.

Distribution. Scope-filtered M3U generation with automatic XMLTV association, several built-in logo candidate sources, and bulk M3U import and export.

Egress proxying. Route HTTP and SOCKS per domain or per channel. New routes can be created and connectivity-tested directly from the channel editor.

Admin console. A responsive web UI with channel warmup and preview, search that handles Pinyin, Jyutping, and simplified/traditional equivalence, and compressed static asset delivery.

Runtime. Memory budgets and concurrency tighten automatically based on the container's actual memory and CPU, and only ever downward. Observability covers /v1/status, Prometheus /metrics, optional OTLP traces, plus /healthz and /readyz.

📦 Choosing a variant

Variant	Image	Median post-load RSS	Best for
Lite	3.84 MB	13.01 MiB	Memory-constrained hosts, stateless low-memory deployments
Core	13.27 MB	25.17 MiB	Full console and database, once every DASH channel is known to work natively
Full	66.41 MB	25.21 MiB	Input compatibility first, FFmpeg fallback retained

These figures come from a controlled run on linux/arm64 dated 2026-07-23. All three variants ran on the same host under identical container limits, configuration, and media fixtures, five rounds each for 100 complete chains, at a 100/100 success rate. Lite additionally completed 10 chains in a 1 CPU, 64 MiB container with a post-load RSS of 12.80 MiB and no OOM.

One caveat worth stating plainly: the fixture is small and deterministic rather than a real bitrate, so it cannot rank 1080p or 4K throughput, multi-channel capacity, or time to first frame. Validate your own channels end to end before relying on any of this. The full method and reproduction steps are in the variant comparison.

🐳 Installation

docker pull ghcr.io/babywbx/kiln:1.0.0        # Full, includes the FFmpeg fallback
docker pull ghcr.io/babywbx/kiln:1.0.0-core   # native packager, no FFmpeg
docker pull ghcr.io/babywbx/kiln:1.0.0-lite   # stateless low-memory variant

Prebuilt binaries are attached below. Linux covers amd64, arm64, armv7, and armv6; macOS covers amd64 and arm64; Windows covers amd64 and arm64 and ships with service installation and failure restart. Core images are published for all four Linux architectures, Full and Lite for amd64 and arm64.

Verify downloads against SHA256SUMS:

sha256sum --check --ignore-missing SHA256SUMS

📖 Getting started

docker run -p 8080:8080 ghcr.io/babywbx/kiln:1.0.0

The service listens on 0.0.0.0:8080 and the admin console lives at /admin. Configuration reference, deployment topologies, and API details are in the documentation.

Replace the sample credentials and generate your own JWT key before exposing anything.

🙌 What's next

Questions and proposals are welcome as issues; please read the contributing guide before writing code. Report security problems privately per the security policy rather than opening a public issue.

Kiln is licensed under AGPL-3.0-only.