1.6.0 — Vhost kinds, blocklists as data, packaged node plane

2026-08-08

Vhosts are typed — api, site, site_api, redirect — each with its own template and knobs. IP and user-agent blocklists become rows you can watch before enforcing. The node-side tooling ships in the package. Contains two breaking changes: the vhost kind values, and the edge log location.

Breaking

• Vhost.kind re-keyed to api / site / site_api / redirect. Old kind strings are now rejected with a 400 — update anything that writes vhosts before upgrading.
• Edge access and watch logs move under EDGE_LOG_DIR. Repoint logrotate and any log shipping (OSSEC and similar) as part of the upgrade.

Added

• Per-kind nginx templates with per-kind knobs, a rendered HTTP base, named upstream blocks and a managed include graph.
• Blocklists as rows at edge/blocklist — kinds ip and ua, modes allow / off / log / enforce.
  • Log-first: start in log, watch what a rule would have caught in a dedicated watch log carrying the matching row id, promote to enforce when you believe it.
  • Allow rules render first, so an explicit exemption always beats a broad pattern below it.
  • IP values are stored normalised; user-agent values pass a whitelist that makes breaking out of the rendered string unspellable, re-checked at substitution.
  • Fleet-scoped: global security grants only.
• POST vhost/claim_reserved — the one sanctioned override for serving a deployment's own reserved hostname. Platform admin only, audited, and re-checked on save so it cannot turn a fail-closed rule into a fail-open one.
• The node deploy plane ships inside the package: certificate sync, node checks, the job runner, node setup and their templates.
• Seven template-plane settings, with static and clamped semantics documented.

Changed

• Existing hand-written sec.d blocklists are migrated in as rows in log mode — nothing starts enforcing on upgrade. A large bot-matching rule is split into one row per token so individual entries can be seen and disabled.
• Both return-444 guards are now structural in every kind's 443 block.

Fixed

• Edge list tenancy (shipped in 1.5.1).

Upgrade notes

Read the template contracts and the node migration order before upgrading a live node. The failure mode worth knowing: a bootstrap missing the edge includes converges "successfully" and serves nothing. The claim_reserved cutover also needs retire-and-claim in one window — a conflicting server name reverts every converge until the file-managed block is gone.