Important
If an installation ever ran NGINX UI 2.3.6 or earlier, or restored a backup from such an installation, upgrading alone does not invalidate credentials that may already have been exposed. Upgrade every instance to v2.5.2 first. In a cluster, use HTTPS for any relationship that still reports Legacy shared secret, and confirm that each node relationship shows Paired signature before rotating the shared secrets. Then:
- Replace
[node] Secret(NGINX_UI_NODE_SECRET) on every instance with a new, unique random value and restart the instance. - Replace
[app] JwtSecret(NGINX_UI_APP_JWT_SECRET) and restart NGINX UI to invalidate previously issued JWTs. - Rotate downstream credentials stored in NGINX UI, and review administrator accounts and access logs for unauthorized activity.
Do not manually replace Crypto.Secret: it protects persisted encrypted data and requires a supported migration. Backup archives use one-time encryption material; rotate the credentials contained in any exposed backup instead.
This hotfix includes all changes and release notes from v2.5.0.
Features
- Introduce signed node requests and automatic migration from the shared node secret to per-controller Ed25519 credentials, with credential status, rotation, recovery grace, and revocation controls.
- Add site traffic and QPS statistics to the dashboard.
- Add Azure DNS and Huawei Cloud DNS providers, AliDNS line selection, DNS record grouping, and multiple site links per DNS record.
- Improve AliDNS, Cloudflare, and Tencent Cloud DNS integration efficiency by replacing heavyweight provider SDKs with focused API clients.
- Add ACME certificate support for IP addresses and configurable renewal based on remaining certificate validity.
- Add scheduled automatic backups with on-demand execution.
- Add support for controlling Nginx in external containers and isolated namespaces.
- Add custom OpenAI-compatible base URLs and improved reasoning-model session titles.
Bug Fixes
- Prevent a site-check initialization race from interrupting Gin route registration and leaving later API and WebSocket endpoints unavailable; log startup panics locally when SLS is not ready (#1766).
- Restore rolling-upgrade connectivity between v2.5.1 controllers and pre-v2.5.0 child nodes by retaining legacy
X-Node-Secretauthentication until each relationship is automatically upgraded to Ed25519 credentials. - Fix generated Homebrew formula URLs so Homebrew derives the version consistently from tagged release URLs.
- Verify signed upgrade artifacts before applying an update.
- Preserve destination-owned secrets and instance identity during portable backup restores.
- Enforce passkey-only authentication across login paths and protect privileged Nginx commands.
- Recover successful Nginx restarts when the proxy connection drops before the response is returned.
- Validate TLS certificate and private-key pairs before saving settings or restarting the service.
- Fix dashboard memory leaks and improve node availability and deletion handling.
- Recover unindexed access logs on startup and improve log indexing, storage, and search efficiency (#1757).
- Preserve an explicitly disabled upstream on first creation (#1758).
- Improve WebSocket self-check reliability (#1759), skip-install password handling (#1755), and preference-save error handling (#1753).
- Auto-detect the browser language on first visit and add the Ukrainian date locale (#1754).