Skip to content

v3.0.0

Choose a tag to compare

View all tags
@guided-traffic-bot guided-traffic-bot released this 27 Jul 08:52
v3.0.0
e7148d0

3.0.0 (2026-07-27)

⚠ BREAKING CHANGES

  • in-app rule editing (CRUD API and web UI) is off by
    default and needs GSSH_MANUAL_RULES=true. A domain configured with
    GSSH_HOST_RULES_FILE / GSSH_CI_RULES_FILE is reconciled by the server
    every 30s and rejects all API writes (CRUD and apply) with 403.

  • feat(ui): gate in-app rule editing on server-reported editability

Serve grants_editable/ci_grants_editable in /v1/ui/config, computed from the
rules provisioning config, and hide Add/Edit/Delete on the rule pages unless
the server would accept the write. Document the blocked writes (403 with a
machine-readable code) in the OpenAPI spec. The service-account kill switch
stays available — it is not part of the declarative rules.

  • feat(helm)!: provision rules from ConfigMaps, in-app editing off by default

config.rules adds a global manual-provisioning switch and a per-domain
ConfigMap source for host and CI rules. Configured ConfigMaps are mounted
with an items: projection (no subPath, so updates reach the pod) and set
GSSH_HOST_RULES_FILE/GSSH_CI_RULES_FILE; manualProvision combined with a
ConfigMap fails the render. Adds helm template golden checks (make
helm-test, wired into CI) and a helm test pod for the /v1/ui/config flags.

  • in-app rule editing (UI + CRUD API) is now off by default.
    Set config.rules.manualProvision=true to restore the previous behavior.

  • docs(rules): document GitOps rule provisioning in README, grants.md and flux example

  • refactor(server): extract graceful shutdown to keep serve() under the complexity gate

  • fix: helm render test

Features

Assets 13
Loading