CDNLite v1.6.0

CDNLite v1.6.0

CDNLite v1.6.0 focuses on production operations, managed SSL onboarding, DNS correctness, and reliable edge configuration publishing.

Highlights

Automated data retention

A new retention scheduler keeps high-volume operational tables bounded without requiring external cron configuration.

• Added the retention-scheduler service to the root, starter, and split deployment configurations.

• Extended cdn:usage:prune with --all, --dry-run, and configurable batch sizes.

• Added independent retention periods for:

  • Usage rollups
  • Security events
  • Successful DNS synchronization events
  • Completed or failed SSL jobs
  • Usage-ingest idempotency keys
  • Expired edge request nonces

• Pruning runs in bounded batches to avoid large transactions and long-held table locks.

• Added environment settings for enabling pruning, scheduling intervals, batch sizes, and per-table retention periods.

Review the output of the following command before enabling automatic pruning on an existing production database:

php artisan cdn:usage:prune --all --dry-run

Safer managed SSL onboarding

Managed certificate issuance now follows the domain verification lifecycle more closely.

• Initial managed SSL issuance is queued only after nameserver verification.
• Initial certificates cover the domain apex and wildcard hostname.
• ACME issuance now requires both an active domain and verified nameservers.
• Domains without an apex DNS record can temporarily use a system-managed SSL bootstrap record during issuance.
• Bootstrap records are uniquely tracked through the new managed_by field and are removed after issuance, including failure paths.
• Duplicate initial SSL jobs and leftover bootstrap records are prevented.

DNS and GeoDNS improvements

• Proxied customer apex records are documented and published using direct managed A/AAAA answers or PowerDNS Lua edge-pool records instead of ALIAS records.
• Proxied subdomains continue to use stable CDN CNAME targets.
• Proxied records may include a default-only GeoDNS payload without being incorrectly rejected.
• Explicit country or continent GeoDNS routing remains mutually exclusive with proxy routing.
• Origin validation now accepts single-label service names such as Docker or internal service hostnames.
• DNS records now include ownership metadata through the managed_by column.
• Added a partial unique index to ensure only one SSL bootstrap record can exist per domain.

Reliable configuration snapshot versioning

Configuration publishing has been hardened to distinguish no-op rebuilds from genuine republishes.

• No-op rebuilds reuse the currently active snapshot when its content is unchanged.
• Republishing content that matches an older, inactive snapshot now creates a new version instead of incorrectly reactivating the historical version.
• Removed the unique constraint on snapshot content hashes so identical content can appear in separate historical versions.
• Snapshot activation and publication auditing now occur only in the appropriate publishing paths.
• Rebuilds no longer clear active_snapshot_version before generating the replacement snapshot.
• Conditional configuration requests continue to return not_modified when the active version already matches.

Correct edge host publication

• Edge configuration no longer publishes the bare domain host unconditionally.
• Hosts are generated from the domain’s active proxied DNS records.
• Apex traffic is included when an active proxied apex record exists.
• This prevents DNS-only domains or unrelated hostnames from being unintentionally exposed through the edge configuration.

PowerDNS secondary-server preparation

Added deployment configuration for authoritative DNS replication and secondary-server notifications.

• Configurable AXFR allow lists through PDNS_ALLOW_AXFR_IPS.
• Configurable PowerDNS notifications through PDNS_ALSO_NOTIFY.
• PostgreSQL WAL sender, replication-slot, WAL-retention, and TLS certificate settings.
• Updated root, starter, split-deployment, and production environment examples.

Testing and diagnostics

• Edge status checks now bypass cached responses during end-to-end validation.

• Failed edge readiness checks report the final HTTP status and response body.

• Added regression coverage for:

  • SSL issuance after nameserver verification
  • SSL bootstrap cleanup
  • Default-only GeoDNS proxy records
  • Single-label origin service names
  • Snapshot version reuse and republishing
  • Per-record edge host publication
  • Retention and DNS replication deployment contracts

Upgrade notes

Database migrations

Apply all pending migrations before restarting application services. This release includes migrations that:

• Add dns_records.managed_by.
• Add the unique SSL-bootstrap ownership index.
• Remove the unique constraint from config_snapshots.content_hash.

Retention configuration

Automatic retention remains opt-in in the general development and root configuration. The production example enables it with production-oriented defaults.

Run a dry-run and review the reported matching rows before enabling pruning:

php artisan cdn:usage:prune --all --dry-run

Relevant environment variables include:

CDNLITE_RETENTION_PRUNE_ENABLED=false
CDNLITE_RETENTION_INTERVAL_SECONDS=86400
CDNLITE_RETENTION_BATCH_SIZE=5000
CDNLITE_ANALYTICS_RETENTION_DAYS=30
CDNLITE_SECURITY_EVENT_RETENTION_DAYS=90
CDNLITE_DNS_EVENT_RETENTION_DAYS=30
CDNLITE_SSL_JOB_RETENTION_DAYS=180
CDNLITE_INGEST_KEY_RETENTION_DAYS=7

Edge host behavior

The domain apex is no longer automatically included in edge configuration merely because the domain is active. Deployments that expect apex traffic at the edge should ensure the domain has an active, proxied apex DNS record.

Secondary DNS

Operators using secondary authoritative servers should configure:

PDNS_ALLOW_AXFR_IPS=SECONDARY_DNS_IP
PDNS_ALSO_NOTIFY=SECONDARY_DNS_IP:53

Do not expose AXFR to untrusted networks.

Included commits

• 71568a3 — Add retention scheduler and related deployment configuration.
• 6b14417 — Correct snapshot activation and publication auditing.
• feaef13 — Improve managed SSL and GeoDNS handling.
• 5d6f45a — Clarify Lua-based apex DNS publication.
• 7628470 — Add DNS record ownership migration and SSL-bootstrap index.
• ca901f1 — Support single-label origin service names.
• e067836 — Refactor snapshot version management and remove content-hash uniqueness.
• f55ba25 — Improve active snapshot reuse.
• d39dfe8 — Improve edge status checks and failure diagnostics.
• d94ea9f — Publish edge hosts from proxied DNS records.
• 52c01ed — Preserve the active snapshot while rebuilding.

Full Changelog: v1.5.0...v1.6.0