---
title: "1.6.0 — Vhost kinds, blocklists as data, packaged node plane"
description: "Vhosts are typed — api, site, site_api, redirect — each with its own template and knobs. IP and user-agent blocklists become rows you can watch before enforcing. The node-side tooling ships in the package. Contains two breaking changes: the vhost kind values, and the edge log location."
date: "2026-08-08"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-6-0/"
---

Vhosts are typed — api, site, site_api, redirect — each with its own template and knobs. IP and user-agent blocklists become rows you can watch before enforcing. The node-side tooling ships in the package. Contains two breaking changes: the vhost kind values, and the edge log location.

### Breaking

- **`Vhost.kind` re-keyed** to `api` / `site` / `site_api` / `redirect`. Old kind strings are now rejected with a 400 — update anything that writes vhosts before upgrading.
- **Edge access and watch logs move under `EDGE_LOG_DIR`.** Repoint logrotate and any log shipping (OSSEC and similar) as part of the upgrade.

### Added

- Per-kind nginx templates with per-kind knobs, a rendered HTTP base, named upstream blocks and a managed include graph.
- **Blocklists as rows** at `edge/blocklist` — kinds `ip` and `ua`, modes `allow` / `off` / `log` / `enforce`.
  - Log-first: start in `log`, watch what a rule would have caught in a dedicated watch log carrying the matching row id, promote to `enforce` when you believe it.
  - Allow rules render first, so an explicit exemption always beats a broad pattern below it.
  - IP values are stored normalised; user-agent values pass a whitelist that makes breaking out of the rendered string unspellable, re-checked at substitution.
  - Fleet-scoped: global security grants only.
- `POST vhost/claim_reserved` — the one sanctioned override for serving a deployment's own reserved hostname. Platform admin only, audited, and re-checked on save so it cannot turn a fail-closed rule into a fail-open one.
- The node deploy plane ships inside the package: certificate sync, node checks, the job runner, node setup and their templates.
- Seven template-plane settings, with static and clamped semantics documented.

### Changed

- Existing hand-written `sec.d` blocklists are migrated in as rows in `log` mode — **nothing starts enforcing on upgrade**. A large bot-matching rule is split into one row per token so individual entries can be seen and disabled.
- Both return-444 guards are now structural in every kind's 443 block.

### Fixed

- Edge list tenancy (shipped in 1.5.1).

### Upgrade notes

Read the template contracts and the node migration order before upgrading a live node. The failure mode worth knowing: **a bootstrap missing the edge includes converges "successfully" and serves nothing.** The `claim_reserved` cutover also needs retire-and-claim in one window — a conflicting server name reverts every converge until the file-managed block is gone.