yusing/godoxy v0.29.0

on GitHub

Full migration guide: https://docs.godoxy.dev/docs/godoxy/migration/v0.29.0

Breaking Changes

• Embedded Web UI: Drop any frontend / godoxy-frontend service from Compose; the main GoDoxy image serves the dashboard. Set webui.aliases (and related webui fields) as in config.example.yml—see migration guide.
• Socket proxy environment variable: SOCKET_PROXY_LISTEN_ADDR → LISTEN_ADDR (see migration guide for Compose snippets).
• Docker image tags from CI: Compat workflow/tags are gone; compat-style tags are no longer published. If you pinned them, switch to latest, nightly, or v… as documented in the migration guide.

Security

• Access logging after hijacking: Hijacked connections are handled so error paths do not blindly emit extra HTTP status lines or treat hijack like an ordinary proxy failure in misleading ways.

New Features

Proxy, routes, and TLS

• Shared HTTPS listener with TLS SNI routing: Multiple TCP/stream backends can share the proxy HTTPS port by matching ClientHello SNI to route aliases. Optional tls_termination terminates TLS with autocert (when configured) before plaintext upstream; otherwise traffic can stay encrypted end-to-end. Listener matching respects wildcard and IPv6 listen forms. Until the first TCP SNI route registers, ordinary HTTPS on that listener keeps a direct accept path (no ClientHello sniffing or SNI queue), so typical HTTPS sites avoid that overhead. Implemented in PR #230; tracks issue #218 (SNI-based passthrough) and issue #223 (TCP TLS termination).
• HTTP rule actions:
  • serve_file serves a single existing file (non-directory); distinct from serve, which serves a directory.
  • handle dispatches to an in-process registered handler by name.
• Upstream connection cap: max_conns_per_host limits concurrent connections per upstream host on the HTTP transport when set (YAML/API and Web UI).

Web UI

• New root-level webui field and /settings: Config adds optional webui (WebUIConfig) for the built-in Web UI route—aliases, file-server-style options, and optional rules that merge with presets from webui.yml / webui_dev.yml. Theme, dashboard options, route-list filters, and this webui block are edited on /settings, not in the config editor or apps-grid popover (WebUIConfig / top-level webui, settings page).
• Web UI embedded in GoDoxy (single image): The Vite dist bundle is built into the GoDoxy binary and served from an embedded filesystem; published GoDoxy images ship the proxy and Web UI together—there is no separate Web UI container image. Non-production builds can still load assets from a local webui/dist/client tree when present (embed helper, production vs dev embed). GoDoxy reads webui from config (legacy frontend env aliases still apply when unset), merges preset metadata and rules when assembling the built-in route, and serves the SPA with file-server + SPA fallback behavior.
• Stream routes: Editor toggle and copy for tls_termination next to TCP relay_proxy_protocol_header, clarifying autocert termination versus SNI passthrough (stream TLS termination UI; same TLS/SNI behavior as PR #230, issue #223).
• HTTP routes: Form field for max_conns_per_host (HTTP editor).
• Agents: Adding or verifying agents can add_to_config and refresh the sidebar from the verify response instead of editing config.yml locally (agents via verify).
• Rules playground: Searchable quick reference card backed by generated cheatsheet JSON (quick reference).
• Rules authoring: Types, CodeMirror keywords, and cheatsheet text for serve_file and handle (serve_file in UI, handle in UI).
• Schema fixes: MiddlewaresMap keys are optional where appropriate so generated config matches real YAML (types fix).

Agent and tooling

• Agent verify supports add_to_config to append verified hosts under providers.agents, suppresses one matching config reload while persisting, and returns the current agents list on success.
• Install scripts: OpenRC service layout (e.g. Alpine), sh shebang with POSIX-safe patterns, and portable release timestamp checks (no GNU-date-only usage).
• USE_SONIC_JSON: Register Sonic at init only when true (default). Set false on hardware where Sonic is unsupported to avoid SIGILL; documented in env examples and agent logs.

ACME

• Optional certificate_key_type chooses the ACME leaf key algorithm/size (defaults unchanged; invalid values fail validation). Motivated by issue #227 (RSA vs elliptic-curve leaf keys and related autocert flexibility).

Improvements

• gRPC, SSE, streaming HTTP/2 and h2c: Flush/copy and trailer handling behave more reliably through rules and reverse proxy paths; streaming and upgrades see fewer stalls or spurious errors.
  • Fixed netbirdio/netbird#5542 (comment)
• Pre-only rule sets: When rules need no post-phase work, responses use a passthrough modifier so upstream writes and flushes reach clients without unnecessary buffering.
• Apps dashboard: Homepage icon manifests load concurrently with a concurrency-safe cache for faster tiles.
• Benchmarking: Richer bench_server, h3bench, benchmark.sh profiles (smoke/stable/stress), warm-up and repeated-run stats, and raw TCP HTTP/1.1 bench mode for steadier throughput reads.
• Web UI stack: TanStack Start/Router, Fumadocs, Zod, Nitro, and related tooling updates (recent bump).

Bug Fixes

• Treat HTTP/2 cancel and closed response body like other expected stream teardowns so they do not surface as unexpected proxy errors.
• Metrics period poller omits failures when the error is context.Canceled (timeouts/shutdown no longer inflate error history).
• Route load skips nil entries in route maps instead of risking panics or missed validation.
• Agent: Stricter cached release epoch parsing avoids false “up to date” reads from corrupt files; root check uses id -u instead of bash-only $EUID.
• Docker API client: Uses github.com/docker/docker with API negotiation so older Docker engines work without a separate compat build of GoDoxy.
• Socket proxy: LISTEN_ADDR defaults to 0.0.0.0:2375 when unset.

Configuration Changes

API Changes

• Agent verify: Request flag add_to_config; responses list current agents after successful persist (OpenAPI/Swagger regenerated).

Contributors

Thanks to everyone who contributed feature requests, testing and feedback for this release.

Full Changelog

• GoDoxy (core): v0.28.1…v0.29.0
• Web UI submodule (highlights): WebUIConfig / webui, settings & navigation, agents via verify, vite dev host allowance