v1.9.0

Mostly an internal release. The codebase was split up so it is easier to work on and harder to break, and a test suite now runs on every change. Nothing changes in the API or the config format.

Internal

• Test suite (@chr0nzz) - 137 tests covering the config write path: route saves for HTTP, TCP and UDP, the multi-backend safeguard that protects older clients, the guided-preset ownership ledger and its refuse-to-overwrite guard, git backup and its hardening, middleware saves, backups, auth and CSRF. Tests assert the YAML actually written to disk rather than the HTTP status. Runs on every pull request alongside a pyflakes lint and a build and vet of the Go agent.
• JavaScript split (@chr0nzz) - the ~7,000 lines of JavaScript that lived inside templates/index.html and the other templates now live in static/js/, one file per area. templates/index.html went from 7,650 lines to 617 and contains no inline application JS. Pages are unchanged; the JS is now separately cacheable.
• CSS regression tests (@chr0nzz) - a fixed min-width overrides max-width in CSS, so a hard pixel floor survives every responsive override a media query can apply. Nothing in CI covered stylesheets, so that class of bug could only be caught by eye. Three checks now run over app.css on every pull request: no unshrinkable width or height floors at or above phone width, and resize always paired with a scroll context.
• Development guide (@chr0nzz) - a new Development page documenting the project layout, the core/ module graph, how to run the tests, what the suite covers, and what is expected of a pull request.
• Python split (@chr0nzz) - the shared logic in app.py moved into sixteen core/ modules (settings, config I/O, auth, git backup, Traefik client, agents, geoip, crowdsec, and more), each with its own tests. app.py shrank by 28%, from 6,660 lines to 4,812.

Features

• Several acme storage files (#121) - ACME_JSON_PATH now accepts a comma-separated list, or a directory whose .json files are all read. Traefik writes one storage file per certificate resolver, so anyone running more than one resolver previously saw certificates from only the first file. Certificates from every file are listed together, each tagged with its source file. Works the same on the Host and on remote agents.

• Interface settings follow you across browsers (@chr0nzz) - the navbar toggles, stat card options, route icons and the card/list view on Routes, Middlewares and Services were stored in the browser, so every browser, device and private window started from scratch. They are now saved with the rest of your settings and apply everywhere you log in. Existing browser settings are adopted automatically on first load, and the card/list choice now survives a refresh at all, which it previously did not. Things that genuinely describe one device - the active server, dismissed notices, notification read markers - deliberately stay local.

• Modals can be dragged wider (#124, thanks @maca134) - the Route, Middleware, Settings, TLS profile, Client IP diagnostic, Trusted IPs, Route Groups and Edit Route dialogs can be resized horizontally by dragging the bottom-right corner, up to 95% of the window. Useful for long rules, raw YAML and wide certificate tables. Every dialog still opens at exactly the width it did before, and the width resets when you reopen it.

• Shared services (#125) - several routes can now point at the same service, each with its own middlewares. A new Backend toggle in the route modal switches between Manual (enter a target, exactly as before) and Existing service (pick any service already in your config). A referencing route writes only its router, so the shared service is never duplicated, modified, or deleted by it - and deleting a route never removes a service another router still uses. Useful for putting different auth in front of the same app per hostname, or fanning several domains into one downstream Traefik.

Fixes

• Traefik update notifications were labeled "Traefik Manager" - the notification for a new Traefik release said "Traefik Manager v3.x is available", conflating the proxy's version with the manager's. It now says Traefik.

• TCP and UDP route saves could write an unusable backend (#122) - a client that sent a single targetIp for a TCP or UDP route had it silently ignored, and the route was saved pointing at address: ':' with no error. The save is now refused with a clear message unless a backend is actually given.

• TCP and UDP saves could write an address with no port - a client that sent the host and port joined together in targetIp, leaving targetPort empty, had the route saved as host:port:. Mobile app builds before v1.6.0 did this on every TCP or UDP route edit, and the save reported success. The combined form is now split back apart, and a genuinely missing port is refused with a clear message instead of being written out.

• TCP routes appended the base domain to an already-qualified hostname (#123) - saving a TCP route with db.other.tld produced HostSNI(\db.other.tld.example.com`)`, an unreachable router. TCP now treats a hostname containing a dot as complete, matching how HTTP has always behaved.