Skip to content

v1.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Apr 23:38
· 130 commits to master since this release
v1.9.0
c0972a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

SNI/IP mismatch warning at startup (#461 — upstreamed)

The SNI-DNS check from mtg doctor now also runs at proxy startup. If the secret hostname does not resolve to this server's public IP, a warning is logged so operators notice the misconfiguration before DPI silently blocks the proxy. The check requires every detected IP family (v4 and/or v6) to match — a partial match (e.g. AAAA matches but A is wrong) no longer hides the problem. Best-effort: if the public IP can't be detected or the hostname can't be resolved, it logs a brief warning and starts normally.

Refs: 9seconds/mtg#444, 9seconds/mtg#458.

PROXY protocol v2 — outbound to fronting hosts

mtg can now forward the real client IP to the domain-fronting backend using PROXY protocol v2, so the upstream HTTPS service sees the real client address instead of the proxy's IP.

contrib/docker-sni-router/

Drop-in example for fronting mtg behind HAProxy with SNI routing — docker-compose.yml, haproxy.cfg, Caddyfile for ACME, and a placeholder www/index.html. Includes ACME HTTP-01 passthrough so Let's Encrypt renewals work alongside the proxy.

Docker

  • Published Docker images via a new docker-publish.yml workflow.
  • Dockerfile now sets the explicit binary name (was breaking after the mtg → mtg-multi rename).

Docs

  • Documented the firehol_level1 RFC1918 gotcha in the default blocklist — the list rejects LAN ranges, which surprises users running mtg behind a NAT/private network.
  • Clarified blocklist rejection-vs-pass behavior in the description text.

Upstream sync

Caught up with 9seconds/mtg master through commit e5ce720.

Full changelog: v1.8.0...v1.9.0

Assets 7
Loading