v1.7.6

Watchdog v1.7.6

Added

• Added opt-in HTTP transport support for private CA bundles and mutual TLS (mTLS) client authentication.
• Added per-check HTTP(S) proxy support for standard HTTP checks, liveness checks, and readiness checks.
• Added proxy authentication through paired environment variables, keeping credentials out of YAML and curl command-line arguments.
• Added validation for certificate paths, client certificate/key pairs, proxy URLs, environment variable names, and forbidden embedded proxy credentials.
• Added a ready-to-adapt mTLS and authenticated proxy example configuration.
• Added regression coverage for templates, liveness/readiness transport settings, validation failures, and secret non-disclosure.

Security

• TLS hostname and certificate verification remain enabled by default.
• Proxy credentials are written only to a temporary mode-0600 curl configuration file and are never stored in logs, state, metrics, history, or status pages.
• Encrypted client private keys are intentionally not supported, preventing passphrases from being exposed through process arguments.