v1.8.0

Features

• Load balancing in the route form (@chr0nzz) - point HTTP, TCP, and UDP routes at multiple backends, with sticky sessions, health checks, and router priority as fields instead of raw YAML; cards show a +N badge. Docs
• Guided route presets (#116, thanks @fbnlrz) - one-click security headers (per-feature Permissions-Policy, HSTS, nosniff, frame-deny) and optimize for streaming (Jellyfin/Emby/Plex) presets that generate and manage the middleware and transport for you, and never overwrite a middleware you wrote by hand. Works on the Host and on agents (@chr0nzz). Docs
• Client IP Diagnostic (#113, thanks @fbnlrz) - a nav-bar tool showing the client IP this instance actually sees and why, plus source-IP tagging (public / private / CGNAT / loopback) on the Logs tab's Top IPs.
• ipStrategy builder (#114, thanks @fbnlrz) - a Client IP source selector in the IP Allow List wizard so allow-lists match the real client, not your proxy.
• Configurable trusted proxy hops (#115, thanks @fbnlrz) - PROXY_FIX_HOPS sets how many reverse-proxy hops to trust for X-Forwarded-For, so logins and audit logs record the real client behind Cloudflare or Traefik. Docs
• Trusted IPs helper (#118, thanks @fbnlrz) - a guided tool in the Static Config editor that adds forwardedHeaders.trustedIPs (Cloudflare, private ranges, or your own) to an entrypoint, additive and deduplicated with a preview, on the Host and on agents. Completes #112. Docs
• Cert resolvers on remote agents (@chr0nzz) - agents detect cert resolvers from their Traefik API without needing the static config mounted, plus an optional per-agent override field. Docs
• Basic auth for an agent's Traefik API (@chr0nzz, #119) - set TRAEFIK_API_USER / TRAEFIK_API_PASSWORD (or answer the new installer prompt) so agents can reach a Traefik API behind basic auth instead of getting a 401. Docs
• Agent debug logging (@chr0nzz, #119) - TMA_DEBUG=true logs each failed Traefik API call to the journal, so agent-side errors are visible in journalctl. Docs
• Hide the Client IP Diagnostic button (@chr0nzz) - a Settings toggle to hide it from the nav, like the documentation, API, and shortcuts buttons.

::: warning
Only count proxy hops you actually control. Each trusted hop is one more X-Forwarded-For entry a client could forge, so setting PROXY_FIX_HOPS higher than your real proxy chain would let callers spoof their source IP past the login rate-limiter and audit log.
:::

Fixes

• Cert resolver dropdown reset after visiting an agent (@chr0nzz) - the Host's resolver list is now restored when you switch back.
• Client IP Diagnostic layout (@chr0nzz) - fixed the hint line overlapping the divider under Socket peer.
• Native select dropdowns ignored the theme (@chr0nzz) - <select> popups in the route and middleware modals now follow light and dark.
• Agent install reliability (#117, thanks @fbnlrz for the report) - fixed a native (binary) install writing a malformed tma.service and falling through to the Docker path, plus a broken docker-compose fallback. Docs