Skip to content

Fluxheim 1.6.7

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 16 Jun 19:56
· 236 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.6.7
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
f66f874
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.6.7 Release Notes

Fluxheim 1.6.7 starts the server-bootstrap cutover in the 1.6 Pingora-exit line. The active HTTP runtime still uses Pingora for this slice, but the listener inventory and process bootstrap settings now flow through Fluxheim-owned server plan types.

Changed

  • Added config-to-ServerPlan construction in fluxheim-server.
  • Moved HTTP, HTTPS, admin, metrics, stream, and UDP listener inventory into the Fluxheim server plan boundary.
  • Moved daemon mode, PID/upgrade/certificate-reload socket paths, worker/thread settings, keepalive pool sizing, retry count, and graceful shutdown timing into the Fluxheim process plan boundary.
  • Updated the root runtime Pingora adapter to consume the Fluxheim server plan for process configuration and HTTP, HTTPS, admin, and metrics listener registration.
  • Updated root background-service registration gates to consume Fluxheim server-plan task metadata for cache purging, cache metrics, OTLP metrics export, ACME renewal, and certificate reload control.
  • Added Fluxheim-owned foreground service intent metadata for proxy, admin, ops socket, metrics, stream proxy, and UDP proxy service registration.
  • Added an explicit server-plan runtime adapter marker so the current Pingora compatibility runtime is a named adapter boundary before the native server cutover.
  • Added server-plan listener lookup helpers so runtime/admin adapters consume HTTP, HTTPS, admin, and metrics listener addresses through fluxheim-server.
  • Removed duplicated downstream TLS listener-address storage from fluxheim-tls; HTTPS listener addresses now come from the server plan while TLS planning owns certificate selection and policy.
  • Moved downstream PROXY protocol listener policy and trusted-source parsing into fluxheim-server, leaving the root runtime as a Pingora listener-policy adapter.
  • Split fluxheim-server process planning and PROXY protocol planning into focused modules so the new server crate stays under the 500-line modularity target.
  • Moved private Unix listener creation for the certificate reload control socket into fluxheim-server, including stale socket replacement, mode 0600, and nonblocking setup.
  • Split server listener and foreground service inventory types into focused fluxheim-server modules before the native bootstrap work adds more runtime state.
  • Moved downstream HTTP/2 hardening limits into a Pingora-neutral fluxheim-server policy plan, with the root runtime only adapting those values into Pingora H2Options.
  • Moved certificate reload control socket policy into fluxheim-server so the socket path, concurrency cap, and request read timeout are planned outside the Pingora runtime adapter.
  • Added server-plan lookup helpers for foreground services and background tasks, then made the root runtime adapter consume planned names when registering services.
  • Added load-balancer health-check service intent to ServerPlan so load-balancer foreground registration is planned alongside proxy, admin, metrics, stream, and UDP services.
  • Split server service-intent and background-task intent detection into focused fluxheim-server modules, reducing the server crate root while preserving the same runtime plan.
  • Split listener inventory construction into the fluxheim-server listener module, keeping HTTP, HTTPS, admin, metrics, stream, and UDP listener parsing out of the server crate root.
  • Moved certificate reload control-plan construction into the focused fluxheim-server control module beside the control socket policy type.
  • Added listener-protocol ownership to foreground service specs so the server plan can map proxy, admin, metrics, stream, and UDP services back to their planned listeners.
  • Updated the admin and metrics runtime adapters to consume service-owned listener lookups from the server plan.
  • Added protocol-filtered service listener lookup and moved proxy HTTP/HTTPS listener registration onto the service-owned lookup path.
  • Added a background-service adapter helper that consumes planned BackgroundTaskSpec values directly, removing duplicated task kind/name wiring from plan-driven runtime services.
  • Updated admin service construction to consume planned control-plane and ops-socket service names from ServerPlan.
  • Converted the admin self-healing watchdog registration to the typed background task spec path and removed the old name/kind free helper.
  • Added admin self-healing watchdog intent to ServerPlan so the admin adapter consumes the planned RuntimeWatchdog task instead of creating it locally.
  • Split the ServerPlan implementation into a focused fluxheim-server plan module, leaving the crate root as the public export and error surface.
  • Added an admin ops-socket endpoint plan to ServerPlan and updated the admin adapter to consume planned socket path and mode values.
  • Added a first-service-listener lookup to ServerPlan and updated admin service construction/logging to use the planned admin listener.
  • Added borrow-based service listener iterators to ServerPlan, keeping the allocation-based address helpers as adapter conveniences.
  • Updated proxy HTTP and metrics listener registration to consume the borrow-based service listener views directly before adapting into Pingora.
  • Hardened private Unix listener setup by binding under a temporary private umask, using fd-based fchmod after bind, and using rustix path operations for stale socket cleanup.
  • Removed the duplicate admin ops-socket mode parser from fluxheim-server; server planning now delegates to the validated config accessor.
  • Documented that ListenerSpec::proxy_protocol_enabled() reports only the server-level HTTP/HTTPS downstream PROXY protocol policy.

Tests

  • Added focused fluxheim-server tests for listener inventory, background-task intent, invalid listener handling, public-listener detection, and server-runner shutdown behavior.
  • Updated root runtime tests so Pingora ServerConf mapping is exercised through fluxheim-server.
  • Added a live admin-listener smoke test that starts Fluxheim, reaches the normal HTTP listener, checks unauthenticated admin health, checks authenticated admin status, and checks the local read-only ops socket.
  • Verified plan-gated foreground service registration with live admin, observability, stream proxy, and UDP proxy smokes.
  • Kept the new server crate files below the 500-line modularity target by splitting tests into server_tests.rs, listener.rs, service.rs, process.rs, and proxy_protocol.rs.
  • Added a fluxheim-server regression test proving private Unix listener paths replace stale sockets, reject non-socket files, and enforce private permissions.
  • Added a fluxheim-server regression test for the downstream HTTP/2 hardening defaults consumed by the runtime adapter.
  • Added a fluxheim-server regression test for the certificate reload control socket plan and kept the live admin listener smoke in the verification set.
  • Extended fluxheim-server tests to cover planned service and background-task lookup by kind.
  • Added a fluxheim-server regression test for load-balancer service intent and verified the runtime path with the live load-balancer smoke.
  • Kept the split server intent modules covered by cargo test -p fluxheim-server and the release-gated modularity policy check.
  • Verified the listener-planning split with cargo test -p fluxheim-server and the live admin listener smoke.
  • Split private Unix listener regression coverage into a focused Unix-only test module so the main server test module remains well below the 500-line target.
  • Added fluxheim-server regression coverage for service-owned listener address lookup.
  • Added fluxheim-server regression coverage for protocol-filtered service listener lookup.
  • Extended fluxheim-server background-task inventory coverage to include the planned admin self-healing watchdog.
  • Split server background-task inventory tests into a focused module so the main server test file stays comfortably below the 500-line target.
  • Added fluxheim-server regression coverage for admin ops-socket path and mode planning.
  • Added fluxheim-server regression coverage for first service-listener lookup.
  • Added fluxheim-server regression coverage for service listener iterator views.
  • Added proxy,acme-client runtime test coverage for disabled certificate reload control service planning.

Verification

  • cargo test -p fluxheim-server
  • cargo test -p fluxheim-tls
  • RUSTFLAGS='-D warnings' cargo test --lib runtime::tests
  • cargo test --no-default-features --features proxy,acme-client --lib runtime::tests
  • RUSTFLAGS='-D warnings' cargo test --lib admin::tests::admin_services_enable_watchdog_only_when_self_healing_is_enabled
  • RUSTFLAGS='-D warnings' cargo check --workspace
  • scripts/validate-modularity-policy.sh check
  • scripts/validate-pingora-dependency-policy.sh check
  • scripts/validate-pingora-boundary-policy.sh check
  • scripts/smoke_admin_listener.sh
  • FLUXHEIM_SMOKE_SKIP_CORE_MATRIX=1 scripts/smoke_1_0_core.sh
  • scripts/smoke_observability_local.sh
  • scripts/smoke_stream_proxy.sh
  • scripts/smoke_udp_proxy.sh
  • scripts/stable_release_gate.sh
  • scripts/podman_smoke.sh

Checksums And Signatures

  • Commit: f66f874fb1a9f0e75914a99fccd06afefd46cf7b
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 1f39714a85526df3144d2f6c97045dceb0e23cf6dbaf05372f574e73124611dd fluxheim-1.6.7.tar.gz
    • 0cf03e442e9ce76f2253e19309640caecb32eb46821e55821ee2b00808e33336 fluxheim-1.6.7.zip
  • Binary checksums:
    • x86_64:
      • de241831f608ce39d23fe4918028bc872ed9238ba885755642806e4d9ffd6f9a fluxheim-1.6.7-full-x86_64-linux.tar.gz
      • 657102fe68cba1588d729d292aa758eb7e4bc261ca13f65102b70b780af650a7 fluxheim-1.6.7-cache-x86_64-linux.tar.gz
      • e33ac308901a3ce45fa744f36e5da8d0d8b00ea977db8bbd20c2e45c165f2934 fluxheim-1.6.7-proxy-x86_64-linux.tar.gz
      • fc5bf8293fff0372f6a28c3202e2bf18c8960915d8bbe9c3ff51b1c73e9d419d fluxheim-1.6.7-php-x86_64-linux.tar.gz
      • 5c690524371654f5fed23ec06e6c83d262e3dc66c6cec644834564000149747a fluxheim-1.6.7-load-balancer-x86_64-linux.tar.gz
      • 1f31c53bd953586c5e570e2bb3eceb80a42e1f255813505630cfabbe343c37a4 fluxheim-1.6.7-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 03291a9a9d6d2982719294425c1f6f4a6817576f44d26f34bb916b0f4a27559c fluxheim-1.6.7-full-aarch64-linux.tar.gz
      • 995ba058b5e50a4faa4b4c6b6ba297450a61cdf4972bf1f577bbcc2f30f95fbb fluxheim-1.6.7-cache-aarch64-linux.tar.gz
      • 1e65820980bee38ae470d2720e850cc02f3961d92285326eee721d4090f0de02 fluxheim-1.6.7-proxy-aarch64-linux.tar.gz
      • 8257bc890ecc2c1d2a48ebc3641924351210f824798475bd300fd595851979b6 fluxheim-1.6.7-php-aarch64-linux.tar.gz
      • 61d14171f60a69115e325b9c01c431fb8c4522839157f4fe7c7f701d2f023401 fluxheim-1.6.7-load-balancer-aarch64-linux.tar.gz
      • eb00d0a89ce4ad974ddcf0bf7550ff9789b03bca6e0ffc2b5c6762b90b50ad3c fluxheim-1.6.7-config-tester-aarch64-linux.tar.gz
    • macos:
      • bc56f59f553d5df1c40eef40fea395b70dcc46202ae7cd3b1d96605453cb3909 fluxheim-1.6.7-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 4e0ab313943d7cc0d42503de741682c74f3afb6f70a76ebba37394e19d6bac6d fluxheim.spdx.json
    • c2a7211a6032d2909078d0cdde3ffccf2c1e084957172b1640ed566edd10adb9 fluxheim.cyclonedx.json
  • Reproducible build:
    • d2a037bd18f20c3bce5cc8aef8b09280cc5b401f4f2b383afd352c3a5388e42c x86_64
    • eb6b00f16f7634921f07dd00a8ba41e7fdd854646f5b5aeca4a50f960fc3f21b aarch64
    • c2bcdde93f7f1cf9bda2e829c806fceebd9c017f18990a1e4440e69e736e3ae4 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7bc30cf0143f8042b96e79fa21d7d53e9fbdc0761e767e5123b6e9909d579e14
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:068a4d6e2510b6e46ba95b7ed5c55e37d7472f0fd8f0405d992844f4f92c3773
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5c128d368812896dac64e827a3a6cf52ee046d01febe559c58c19194d22a6177
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:2191003c3357243f3e04321dce0e7aad2e9e61c7e9ccd5abc03c8119136af839
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:185b6f1ec484b8ffa49e9047ef6a66d87c2650345a37fd899f90137c04cdc34f
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6c36e6c990db7b746bb2b1091f9b3f50124a46e3e5ed2be4922989c943f2a65c
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:02b25e90c16abdfb90eadaa621daf9bff65bf3e669549f90f885136030fe5b2d
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:1f3db39e3e00422f55adbe07a61b40f6866e3f3bc095c9132e7d8276ab26e7fe
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8b08362e0bf8ac69354e069344a57b9acefde01f13f7eea8bda21c19fc925fcd
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:96f0856d08a2f3a83487ab05884217f41f44c76f85e0a5c1947ee7599d8a1faa
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:a0e120f069d65d03946e579796269c11b84c67b3f9560cb189acb1c8b65b4d24
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:9234f9e3feb7ae64f2150b4e2ef0f280bb03c944ff4417ca5dd66c9985f24ca2
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a6446551c9cfbb41b886225e39c37bec06d2ee96142ef43f49e044569a2b5c68
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:761cb9f973d67ef9df5981c0f881a465ffabb43d809ad33533ffb268c89bab28
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4dbdad85dd7d65010a4fd7dfca1e83b447cb687df1ce924e281d0d20798db099
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:1a5a41d7fb0f1782eaa854f06746671675ef350d593482727ac668829af5fce0
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4bbd10232a9945aede23529c03b6d129239a7a89155982fd6c07c26c884aa066
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:98acfe9ec875310686cc745fba76cc2cb1290077188980445e74a53d3fb0fb22
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2ce7f40f0eac879f818ffb0d37aa11fb10215d6e33b31eafd2faffe2eae4ed7b
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:d8b1660d8158ab8116c532813e7bc46dae1d1ca5277a017d69e9edbfab4bc482
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion