rl-nginx v0.1.0

Breaking

• API keys must use credential format 1. The locked C-client dependency is
  now v1.0.0, which intentionally rejects legacy unversioned credentials and
  unknown format versions. Reissue every API key before deploying this
  rl-nginx revision; a legacy value fails nginx -t instead of reaching a
  worker.

• Latency tracker identity, guards, and reporting are now separate. Define
  tracker state with ratelimitly_tracker, reference it from
  ratelimitly_guard tracker=... threshold=..., and opt into exactly one
  post-response sample with ratelimitly_report <tracker>. Guards no longer
  report implicitly. A report can be used without a guard or admission rule,
  and ratelimitly_report off suppresses inheritance.

• ratelimitly_timeout is removed. There is no alias: a configuration that
  still uses it fails nginx -t with unknown directive.

  ratelimitly_timeout <T> made T the entire admission budget (it set the
  client's attempt timeout with zero retries). ratelimitly_policy replaces it
  with a multi-round policy, so the migration is not a one-for-one textual
  substitution:

  Old	Equivalent	Worst-case admission wait
  ratelimitly_timeout T;	ratelimitly_policy single_round unit=T;	T — unchanged
  ratelimitly_timeout T;	ratelimitly_policy standard unit=T;	3 * T — three units
  ratelimitly_timeout T;	ratelimitly_policy standard unit=T/3;	T — unchanged, using the new default shape

  Choose single_round to preserve the previous behaviour exactly, or
  standard with a third of the old value to keep the same worst case while
  adopting the replay/final-receive shape. Writing standard unit=T with the
  old value triples the budget.

• The derived policy horizon is now validated against the API key. A
  unit= that was previously accepted can now be rejected at configuration
  load when unit * (sum(replay_gap) + final_wait_units) exceeds the
  credential's dedup_ttl_ms_max. See
  configuration.

• ratelimitly_policy rejects duplicate occurrences. ratelimitly_timeout
  was last-wins, so a base configuration plus an environment-specific override
  include is no longer valid for this directive and fails nginx -t. This
  matches ratelimitly_tenant, ratelimitly_auth_key, ratelimitly_bind and
  ratelimitly_debug, which already rejected duplicates.

• Latency-tracker identity now depends on the credential when buffer_size
  is omitted. The effective buffer_size falls back to the API key's
  latency_buffer_size_max, and that value is part of the tracker ID. Rotating
  to a credential whose quota differs re-identifies every guard that relies on
  the fallback, discarding accumulated latency history. Set buffer_size
  explicitly on each ratelimitly_tracker in any configuration expected to
  survive a key rotation.

Changed

• updated the supported public rl-c-client dependency to v1.0.0; resource
  requests now inherit the client's local enforcement of the API key's
  rate_window_size_ms_max before DNS, serialization, or UDP transmission;

• updated the supported public rl-c-client dependency to v0.6.0 and
  allowed a ratelimitly rule to contain one or more latency guards without a
  resource zone or group;

• updated the supported public rl-c-client dependency to v0.5.0 and
  replaced ratelimitly_timeout with ratelimitly_policy: standard exposes
  the locked three-unit default, single_round provides a literal one-round
  policy, and custom exposes the complete request-policy parameter set;

• derive resource-bucket IDs from the rendered bucket, window, and rate, and
  derive latency-tracker IDs from the rendered service plus all tracker-state
  settings, using the canonical length-aware C-client helpers; and

• removed the obsolete direct-DNS fallback description because v0.5.0
  requires valid SRV membership; and

• restructured the public documentation around the RateLimitly operation
  model, concrete nginx examples, an explicit nginx/client ownership boundary,
  and version-locked links to the authoritative C-client documentation.

  This dependency update changes the wire IDs of existing buckets and latency
  trackers. During a rolling upgrade, old and new workers therefore address
  separate server state until old resource windows and tracker TTLs expire.

Verifying this release

sha256sum -c SHA256SUMS

rl-nginx-0.1.0-manifest.json records the exact nginx releases, compilers, and locked rl-c-client revision every gate ran against. This is a source-only release; build the module from the archive against your own nginx release.

rl-nginx v0.1.0-rc.3

Public source-only preview release.

Highlights:

• updates the rl-c-client dependency to published v0.4.0 at commit 8ce572d48499ebca99e6b8bddda2dd4d149b68d8
• documents compatibility with NGINX stable release-1.30.2 and mainline release-1.31.1
• full make check passed, including the public lifecycle suite
• dynamic relocation and three sanitizer runs passed locally before merge

rl-nginx v0.1.0-rc.2

Source-only public preview release candidate.

This candidate is immutable at commit 05cb877e16b066fabb9029a9e81207e69adeddf2.
It includes the complete B10 hardening disposition, bounded UDP ingress, the
independent steering/latency-report contract, and the architecture-portable
fairness regression.

Validation evidence:

• post-merge main workflow passed;
• all 17 required hosted PR checks passed on the final changes;
• both nginx releases, static/dynamic builds, native aarch64, public behavior,
  sanitizers, hygiene, and CodeQL passed;
• clean anonymous checkout passed static and relocated dynamic validation after
  initializing its pinned public nginx submodule;
• local focused UDP fairness, dynamic relocation, CI-gate, and specification
  consistency checks passed.

See CHANGELOG.md in the tag for the full change list. This remains preview
software and is not an ABI-stable release.