v2.3.0

FRP Auto Deploy v2.3.0

Feature-complete release on pinned FRP 0.71.0.

Feature-complete product release on pinned FRP 0.71.0. Does not move or
retag published v2.2.1 or earlier tags. Feature Freeze remains active after
this release.

Access Control Pack

• Named reusable Access Lists (IPv4/IPv6 CIDR)
• Service modes: PUBLIC (default) and ALLOWLIST
• Optional temporary sources with absolute expiry (expires_at / TTL)
• Fail-closed authorization when policy or registry is missing
• Unmapped proxy deny for ALLOWLIST enforcement
• Bounded connection ALLOW/DENY access log
• frpctl access ... interactive menu and scriptable CLI
• FRP 0.71.0 NewUserConn plugin enforcement (loopback-only)

Target Health Check

• TCP and HTTP FRP health checks as a thin product wrapper
• Distinct CLIENT / TUNNEL / TARGET status reporting

Support Bundle

• Sanitized diagnostic archive for support/troubleshooting
• Secrets and private keys are excluded from the bundle

Service Profiles

• Reusable server-owned service creation templates
• Profile edits do not live-inherit into already-created services
• New services created after a profile edit reflect the updated template

Platform / lifecycle improvements

• Windows Access Control host_id mapping alignment
• Windows Real E2E improvements (including release cleanup after uninstall)
• macOS Apple Silicon full Real E2E coverage
• Service release / client sync E2E correctness
• Canonical repository moved to xdr-labs/frp-auto-deploy

Compatibility and scope notes

• Server remains Linux only; Windows and macOS are client platforms
• Amazon Linux 2 is portability/CI validated, not current Real-host
  qualification
• Intended operating scale remains approximately 1–50 clients
• Already enrolled 2.2.x clients remain compatible during a server-first
  upgrade window. Do not upgrade clients ahead of the server. FRP remains
  0.71.0.

Audit closure

• FINAL AUDIT CLOSURE hardening and release-documentation sync for prepared
  2.3.0 (recreate or move the premature GitHub v2.3.0 tag onto final
  audit-closure HEAD; no new product features)

v2.2.1

Highlights

Maintenance / hardening release on pinned FRP 0.71.0. Does not move or retag v2.2.0.

• macOS / libedit frpctl Tab completion (backend detection + PTY coverage)
• FRP compatibility gate fail-closed (digest-before-extract; atomic PASS report)
• Public documentation metadata sanitization + scanner
• Docs currency for post-v2.2.0 install URLs and residual supply-chain signing risk

Platforms (Real E2E unless noted)

• Ubuntu 24 physical
• Rocky Linux 8.10 / 9.4
• Amazon Linux 2023
• Amazon Linux 2 — container / CI portability (no live host)
• macOS Apple Silicon
• Windows 10 PS5.1 (PS7: CI; same real host skipped when pwsh absent)

FRP

Pinned FRP: 0.71.0 (exact pin; not follow-latest)

Supply chain

SHA256 verified distribution. Cryptographic release signing is not yet enabled (signing: false).

Validation

• Double Full Real E2E PASS on tree-identical candidate 2140be5… / tag 19d4b6f…
• MACOS_REAL_LIBEDIT_COMPLETION=PASS
• PASS_HEADS_IDENTICAL=YES
• Unresolved P0/P1/P2 = 0

v2.2.0

Highlights

• Zero-Touch improvements (short URL / enrollment hardening)
• macOS Apple Silicon support
• Windows lifecycle improvements
• Group MVP
• public_hostname access alias
• lifecycle / reconcile hardening
• backup / restore hardening
• Rocky Linux 9 qualification
• FRP upgrade 0.70.1 → 0.71.0

Supported / tested

• Ubuntu 24 physical
• Rocky Linux 8.10
• Rocky Linux 9.4
• Amazon Linux 2023
• Amazon Linux 2 portability
• macOS Apple Silicon
• Windows (PowerShell 5.1; CI also covers PowerShell 7)

FRP

Pinned FRP: 0.71.0

FRP is intentionally pinned, not auto-updated. Future FRP bumps require explicit qualification.

Validation

Double Full Real E2E PASS (identical candidate HEAD)
P0 / P1 / P2 unresolved = 0

FRP Auto Deploy v2.1.3

FRP Auto Deploy v2.1.3

Feature release on top of published v2.1.2. Official FRP remains pinned to 0.70.1.

Highlights

• Zero-Touch Short URL via optional bootstrap_hostname and an operator-owned reverse proxy
• Much shorter Linux enrollment command: curl -fsSL https://<bootstrap-host>/i/<ticket> | sudo bash
• Public TLS entrypoint with stock OS trust (operator owns DNS, certificate, and reverse proxy)
• Existing Private CA management trust preserved
• Transitional zt1. package fallback preserved when bootstrap_hostname is unset
• No DNS automation, no ACME automation, and no product-owned certificate manager
• No re-enrollment required for a normal server-first upgrade from 2.1.2

Scope

• Stable scope remains Linux/systemd
• macOS and Windows are not stable-supported in this release
• Designed for a few to a few dozen systems (not 100+ fleet orchestration)

Security notes

• The complete /i/<ticket> URL is a short-lived credential; do not log or share it
• Operator reverse proxies should disable or redact access logging for /i/
• GET /i/<ticket> does not consume or bind the ticket; binding occurs at POST /bootstrap/redeem

See docs/ZERO_TOUCH_SHORT_URL.md and docs/SECURITY.md.

FRP Auto Deploy v2.1.2

FRP Auto Deploy v2.1.2

v2.1.2 is a maintenance and reliability release focused on lifecycle correctness, safe in-place upgrades, backup/restore safety, audit hardening, and a shorter Zero-Touch enrollment workflow.

Official FRP remains pinned to 0.70.1.

Highlights

• Safe in-place upgrade path from v2.1.1
• Server-first mixed-version upgrade support
• Transactional Server and Client upgrades with rollback
• CLIENT ID, management identity, CA, FRP token, Service IDs, public ports, and metadata preserved across upgrades
• Lifecycle correctness fixes for service release and Client selection
• Hardened Zero-Touch ticket completion and audit handling
• Safer same-version backup/restore policy
• Shorter Zero-Touch bootstrap command
• Rocky Linux 8 regression coverage

Upgrade from v2.1.1

Recommended order:

1. Upgrade the Server
2. Confirm existing v2.1.1 Clients remain connected
3. Upgrade Clients individually

Normal project upgrade does not require re-enrollment and preserves existing Client identity and public port assignments.

A newer incompatible Client is prevented from mutating an older Server.

Lifecycle fixes

• Releasing a Client's final Service no longer removes the Client record.
• CLIENT ID and unique CLIENT ID prefixes take precedence over label/hostname shortcuts.
• Zero-Touch completion fails closed if ticket state cannot be persisted.
• Audit coverage and bootstrap-ticket redaction were hardened.

Backup / Restore

• Same-version backup/restore is supported.
• Cross-version restore fails closed unless an explicit migration path exists.
• Audit state is included in the protected backup/restore lifecycle.

Zero-Touch

v2.1.2 introduces a shorter bootstrap form using an opaque Zero-Touch package/token while preserving TLS verification, high-entropy tickets, single-use semantics, first-machine binding, multi-service enrollment, and management-only enrollment.

The future /i/<ticket> public short-URL bootstrap model is not part of v2.1.2.

Validated Platforms

Real upgrade/E2E validation includes:

• Baseline supported Linux
• Amazon Linux 2023
• Rocky Linux 8.10

macOS and Windows remain outside the v2.1.2 stable platform scope.

Versions

FRP Auto Deploy: 2.1.2
Official FRP: 0.70.1

FRP Auto Deploy v2.1.1

FRP Auto Deploy v2.1.1

FRP Auto Deploy v2.1.1 is a stable maintenance and operational UX release built on official FRP 0.70.1.

Highlights

• Improved frpctl operational CLI and command consistency
• Hardened Zero-Touch enrollment UX
• Improved update and release integrity validation
• Public Hostname / DNS alias support for published services
• Expanded real-environment Linux validation
• Improved repeatable Real E2E automation

Public Hostname

Administrators can optionally configure a user-facing hostname for published services.

Example:

ssh -p 6000 user@fw.example.com
http://fw.example.com:6001
https://fw.example.com:6002

The Public IP remains the primary infrastructure/control endpoint.

Public Hostname is an optional service-access alias only.

IP-based access remains available as fallback.

FRP Auto Deploy does not automatically manage DNS providers or application TLS certificates.

Validated Client Platforms

v2.1.1 Real E2E validation includes:

• Baseline supported Linux
• Amazon Linux 2023
• Rocky Linux 8.10

Validation includes:

• Zero-Touch enrollment
• service publication
• persistent public ports
• reboot/reconnect
• DNS/Public Hostname access
• IP fallback
• backup/restore
• multi-client isolation

Platform Scope

macOS Apple Silicon and Windows Client support are not part of the v2.1.1 stable scope.

They remain separate future platform work.

Versions

FRP Auto Deploy: 2.1.1
Official FRP:     0.70.1

Upgrade / Integrity

Release artifacts are validated with:

• release manifest verification
• SHA256 validation
• source/dist parity checks
• automated test suite
• distribution matrix
• exact-artifact Real E2E