0.4.2

Added

• An opt-in Certbot deploy hook in DEB/RPM packages that validates and atomically
  publishes a restricted PEM bundle for automatic TLS certificate reloads.
• A Let's Encrypt webroot setup guide covering first issuance, service
  permissions, and unattended renewal.

Full Changelog: v0.4.1...v0.4.2

0.4.1

Changed

• Consolidated shared CLI option handling and configuration fragment validation
  while preserving public APIs, help output, error messages, and exit codes.
• Reduced routing allocations by checking path segment boundaries without
  temporary strings and parsing request hosts only for host-specific routes.
• Replaced linear WebSocket registry lookups and removals with set operations.
• Removed a redundant filesystem metadata lookup when resolving static files,
  retaining canonical path and symlink boundary checks.

0.4.0

Added

• Top-level enable: false for excluding individual configuration files before
  listener grouping and validation.
• A consistent Server: Via identity header on all responses.
• Route-level request and response header set and remove rules for HTTP and
  WebSocket proxying.
• Optional route-level strip_prefix rewriting for HTTP and WebSocket upstream
  requests.
• Route-level return directives for immediate status responses and redirects,
  with safe $host and request-time $query expansion.
• Configurable upstream connect, read, and write timeouts with listener defaults
  and per-route overrides for HTTP and WebSocket proxying.
• Graceful SIGINT and SIGTERM shutdown that drains active HTTP requests,
  gives WebSockets a configurable grace period, and then closes upstream pools.

Full Changelog: v0.3.1...v0.4.0

0.3.1

Changed

• The packaged systemd service can read root-managed TLS certificates, including
  Certbot's default paths, while continuing to run as the unprivileged via
  user. Inaccessible TLS files now produce a configuration error instead of an
  unhandled exception.

Fixed

• Removed the process-wide CAP_DAC_READ_SEARCH permission added to the
  packaged service in 0.3.1. TLS files must now be explicitly readable by the
  via account, preventing TLS access from also bypassing static-file
  permissions.

0.3.0

Added

• Transparent WebSocket proxying over HTTP and HTTPS upstreams, including
  subprotocols, extensions, bidirectional frame relay, and ordinary HTTP
  rejection responses.
• via check command for validating a configuration without starting listeners.
• Per-listener debug mode through debug: true in YAML configuration.
• Native DEB and RPM release packages with checksums, an example configuration
  and welcome page, and automatic systemd service setup.
• A one-line installer for supported Linux distributions that selects and
  verifies the matching package from the latest GitHub release.
• A small multi-stage Alpine image for running Via as an unprivileged container,
  with automated x86-64 and ARM64 publication to GitHub Container Registry.

Changed

• Restructured the documentation around installation, configuration, proxying,
  and operations; removed maintainer-only architecture, development, release,
  and website deployment pages from the user guide.
• Release assets now use distribution-independent Linux names and are published
  as RPM, DEB, and .tar.xz binary packages for x86-64 and ARM64.
• Proxy startup now uses via run; both run and check load /etc/via/ by
  default and accept -c/--config overrides.

0.2.0

Added

• Numeric proxy_pass targets from 200 through 599 for routes that return
  a fixed HTTP status without contacting an upstream.
• Built-in HTML status pages, including a dedicated 403 Forbidden page, for
  fixed response routes.
• log_file and log_level configuration options with append-mode file
  output, severity filtering, and hot reload support.
• --log-level CLI override with support for DEBUG, INFO, WARN, and
  ERROR.
• Multiple independent HTTP and TLS listeners in configuration directories.
• Top-level host routing for the short proxy_pass form, including safe
  $host substitution from the configured route host.
• config_file context on every operational log record.

Changed

• Startup summaries now show fixed response targets and the effective logging
  destination and level.
• --log-level takes precedence over --debug, which takes precedence over
  log_level from YAML.

0.1.1

Added

• Logs

0.1.0

v0.1.0

ci: install bundled Crystal in release containers