🚀 XC_VM v2.7.2

🚀 Major load balancer, cluster and streaming improvements

This release introduces a new PHP-free operating mode for load balancers, advances the cluster architecture with a standalone Go frontend, and delivers extensive improvements to security, streaming reliability, installation, and administration.

✨ Major Changes

🚀 PHP-Free Load Balancers

• Serve-only mode — load balancers can now run without PHP, using a standalone Go frontend as their sole HTTP listener.
• Simplified runtime — removes the HTTP nginx backend and PHP-FPM from serve-only nodes while preserving RTMP, supervisor, and CLI functionality.
• Safer provisioning and recovery — improves installation, service startup, rollback, and transitions between serve-only and standard configurations.
• Standalone node operations — introduces a root-owned helper with restricted privileged operations and dedicated contract tests.

🌐 Cluster Architecture

• Signed node configuration — adds sealed, signed per-node gateway policy replicas and XCVT v2 support for pinned load-balancer configurations.
• Portable stream runtime — introduces portable transcoding specifications and runtime directives for serve-only nodes.
• Improved recovery — strengthens node lifecycle recovery, stream runtime reconstruction, state reconciliation, and cluster admission handling.
• More reliable synchronization — improves node identity handling, activation-key persistence, RPC execution, and cleanup of deleted-server enrollments.

📺 Streaming and Gateway

• Expanded gateway integration — adds integration work for VOD, timeshift, subtitles, and thumbnails.
• Provider previews — allows channel previews and source probing before adding providers.
• Ministra playlist support — adds an optional playlist block for Ministra users.
• Improved VOD matching — handles series names in multiple languages, accents, and TMDb metadata more reliably.
• Stream lifecycle fixes — improves restart scheduling, runtime recovery, viewer statistics, and handling of stalled segment reads.

🛠 Fixes

• Fixed nginx port updates, duplicate listeners after IPv6 upgrades, and configuration repair concurrency.
• Improved HTTPS certificate synchronization with restrictive permissions, validation, temporary files, and atomic replacement.
• Fixed serve-only startup and downgrade edge cases, including unnecessary PHP-FPM watchdog restarts and stale configuration files.
• Improved cluster recovery from incomplete lifecycle records and missing runtime state.
• Fixed dashboard active-user totals and reseller stream-client counts.
• Improved Ministra device binding, user-agent restrictions, reseller authorization, and serial-number guessing protection.
• Fixed administration table menus overflowing the visible window and restored the EPG Force Reload action.
• Added defensive checks for missing activation keys, null values, and unavailable server mappings.

🔒 Security

• Restricted privileged sysctl operations to explicitly authorized keys.
• Added an argument-restricted root helper and narrowly scoped sudo permissions for serve-only nodes.
• Hardened certificate handling against truncated files, unsafe permissions, and partial updates.
• Restricted node crontab modifications to an allowlist.
• Improved cluster configuration validation and fail-closed behavior when required node data is invalid.

♻️ Refactoring

• Moved serve-only runtime execution toward a standalone Go frontend without an nginx/PHP-FPM fallback.
• Improved separation between MAIN-managed cluster configuration and node-local runtime state.
• Expanded portable stream specifications to reduce dependencies on MAIN-specific state.
• Improved reseller controller organization and runtime configuration handling.

🔧 Maintenance

• Updated the required PHP version to 8.3, matching the shipped runtime.
• Improved load-balancer binary updates and release artifact ordering.
• Updated PHPStan and GitHub Actions artifact upload dependencies.
• Expanded automated coverage for serve-only provisioning, privilege boundaries, downgrade recovery, cluster activation, and nginx configuration.
• Improved streaming test fixtures and CI documentation.

📚 Documentation

• Added the Xtream Codes OpenAPI 3.1 reference, organized into separate API specifications.
• Added the PHP 8.3 upgrade guide.
• Expanded documentation for serve-only load balancers, cluster provisioning, XCVT v2, and xcvm_core.
• Clarified CI prerequisites, local extension coverage, and translation workflows.

XC_VM v2.7.2 focuses on a more independent load-balancer runtime, stronger cluster security, and more reliable streaming infrastructure. The commit history also contains work associated with the planned v2.8.0 gateway phase; this summary does not imply that every planned feature is complete.