Alighieri v0.2.0

Alighieri's biggest release yet. Since v0.1.x it learned to manage its own HTTPS
certificates, ships as a container and on ARM, can sit behind load balancers and
external auth systems, shapes bandwidth more gracefully — and closes a security
hole worth upgrading for.

🔐 Automatic TLS certificates from Let's Encrypt

Point the TLS listener at a domain and Alighieri obtains and renews certificates
for you — no certbot, no cron, no port 80, no DNS API:

tls.acme.domains: proxy.example.com
tls.acme.email:   you@example.com
tls.acme.cache:   /var/lib/alighieri/acme
# tls.acme.staging: on   # use Let's Encrypt staging while testing

Validation uses the TLS-ALPN-01 challenge answered on the listener itself, so it
just needs to be reachable on port 443. On Linux, scripts/alighieri.sh
sets up the hardened systemd unit automatically (writable cert cache +
CAP_NET_BIND_SERVICE so the non-root service can bind 443). There's a
step-by-step VPS walkthrough in
doc/acme-tls-test.md.

📦 Run it anywhere

• Official container image — multi-arch (amd64 + arm64), distroless,
  non-root, --read-only-friendly:

  docker run --rm -p 1080:1080 \
    -v "$PWD/alighieri.conf:/etc/alighieri/alighieri.conf:ro" \
    ghcr.io/wiresock/alighieri:0.2.0

• ARM64 binaries — aarch64 Linux and Windows are now attached to every
  release alongside the x86-64 builds.

🧱 More access control & traffic shaping

• PROXY protocol (v1/v2) — run behind HAProxy / nginx / AWS·GCP NLBs and have
  rules, limits, metrics, and logs key on the real client, not the balancer
  (proxyprotocol, honoured only from trusted upstream CIDRs).
• External auth hook — verify credentials against LDAP / OIDC / PAM /
  anything via a script (auth.command; the username/password go on the
  command's stdin, exit 0 allows).
• Hostname rules — socks to: selectors now match names: .example.com
  (the domain and all subdomains) or an exact example.com, matched on the
  requested name before DNS resolution (so it's DNS-rebinding-resistant).
• Smoother bandwidth limits — ratelimit.byterate is now a token-bucket
  throttle that slows a flow instead of dropping it, plus a new per-rule
  bandwidth: selector to throttle individual CONNECT sessions.

🛡️ Security fix — please upgrade

A client could reach blocked loopback/private addresses by requesting their
IPv4-mapped IPv6 form (e.g. [::ffff:127.0.0.1]), slipping past a
dns.deny: loopback private … policy and to: 127.0.0.0/8-style CIDR rules.
Addresses are now canonicalised before every policy decision and the outbound
connection. Upgrade is recommended if you rely on dns.deny or CIDR rules for
network segmentation. (Hostname-allowlist deployments were never affected.)

🪟 Windows service reliability

The installed service now auto-restarts on crash (the Windows equivalent of
systemd's Restart=on-failure) and stops gracefully on an OS shutdown/restart.

---

⚠️ Upgrade notes (read before bumping)

• ratelimit.byterate changed meaning. It used to be a hard cap that
  dropped traffic once the per-window budget was spent; it's now a sustained
  rate (BYTES / WINDOW, burst up to BYTES) that shapes TCP (slows it via
  backpressure) and polices UDP. The same value now throttles smoothly instead
  of cutting connections — re-check yours if you relied on the old hard-cap.
• Building from source now needs Rust 1.88 (was 1.85), pulled in by a
  security-patched dependency. Prebuilt binaries and the container image are
  unaffected — only cargo build needs the newer toolchain.

Getting it

Download a prebuilt binary for your platform from the assets below, pull the
container image above, or build from source with Rust 1.88+. New here? The
README's quick start and the built-in alighieri config wizard will get you a
first config in a minute.

Full changelog: v0.1.1...v0.2.0