v0.32.2

Bug Fixes

• Core/Idlewatcher: Shared dependencies stay awake until their last running dependent sleeps. (0fc5a6a, 1af0a65)
  • With stop_method set to kill, dependencies remain running until the runtime confirms sleep; a stop_timeout expiry leaves them running.
  • Delayed stop events no longer mark a reawakened route as sleeping.

New Features

• Core/Routes: Route APIs expose configured public URLs. (e0da069, #276, #277)
  • Route list, detail, and WebSocket responses include an optional public_urls field derived from match_domains and listener settings.
  • Homepage links use the first derived URL unless explicitly overridden, including configured domains for dotted short aliases.
  • Derived URLs include nondefault listener ports but do not account for external port or protocol translation.
• Core/Docker: Podman Compose dependencies are discovered automatically. (ff03924, 432cc77, #279)
  • Explicit proxy.depends_on labels are honored ahead of Compose metadata and native discovery on Docker and Podman.
  • Recursive discovery includes dependency services without an idle timeout.
  • Native Podman dependencies use service_started; service_healthy must be requested explicitly through proxy.depends_on.

Improvements

• Core/Proxmox: Proxmox startup retries transient connection failures. (7592ab7, #280, #281)
  • Session creation and cluster discovery retry within the existing 30-second initialization deadline.
  • Credential rejection, certificate verification failures, and invalid API responses fail immediately.
  • If initialization still times out, reload configuration or restart GoDoxy after connectivity returns.

Security

• Core/API: Machine clients can authenticate with a restricted read-only bearer token. (18aeec4, 892b1ad, #278)
  • Set GODOXY_API_READONLY_TOKEN before startup; restart GoDoxy to rotate or revoke it.
  • The token permits only HTTP GET route-list and route-detail requests; WebSocket upgrades are denied.
  • Browser authentication must remain enabled; the unauthenticated local API ignores this token.
  • JSON access logs redact Authorization credentials even when headers are configured to be kept, including rejected requests and redirects. (892b1ad)

Full Changelog

• 1af0a65 fix(idlewatcher): confirm kill completion and preserve timeout causes
• 0fc5a6a fix(idlewatcher): retain dependencies needed by running routes
• 55833ba docs: update wiki for certificates and Proxmox retries
• e0da069 feat(routes): derive public URLs from runtime domains and listeners
• 3fa2a78 fix(update-wiki): generate implementation links under /docs
• 892b1ad fix(api): protect bearer credentials at access-log serialization
• 18aeec4 feat(api): add read-only bearer authentication for machine clients
• 432cc77 fix(podman): discover Compose dependencies automatically
• 7592ab7 fix(proxmox): retry transient startup connections
• ff03924 fix(docker): read proxy.depends_on before it is consumed

webui

• ab74e0f docs: update idlewatcher lifecycle reference
• 2ea4a05 docs: update shared dependency lifecycle wiki
• 5c1ce9f docs: sync certificate and Proxmox wiki updates
• f5a475d feat(routes): expose computed public URLs in API response types
• 4628ef6 fix(docs): sync implementation link prefixes
• 2946db5 docs: sync API examples and credential logging guidance
• d5666f9 docs: sync read-only API authentication wiki
• 7d4504f docs(podman): update automatic dependency guide