Tags give the ability to mark specific points in history as being important
-
v0.4.0
protectedfe2a71e3 · ·v0.4.0: native OPNsense plugin, network-wide protective DNS and qualification (ENG-5654) Daemon: UDP and TCP listeners, source-CIDR ACL, policy-epoch cache, timed blocking pause, audit rings, capabilities/status/diagnostics APIs, hardened recursion and remote-list fetch, bind-then-drop privileges, goroutine-free cache that also caches EDNS-cookie clients, OTel correlation and alert rules, apic-generated management API. Plugin: os-void for OPNsense 26.7 with transactional apply, DHCP/RA distribution, fail-closed DNS enforcement, HA sync and least-privilege ACLs. Qualified on the OPNsense 26.7 lab and in CI on a KVM runner.
-
v0.3.3
protectede4fb01a1 · ·v0.3.3: fix release-pipeline registry auth (re-release of v0.3.2) v0.3.2's release pipeline built all artifacts but failed pushing the Docker image to the GitLab registry ('denied') due to a ci-catalog component bump changing the DOCKER_* credential contract. This tag carries the same code as v0.3.2 plus the CI fix (log in with CI_JOB_TOKEN / CI_REGISTRY*). Content is identical to v0.3.2: DNS DoS hardening (bounded caches, rate limiting, recursion depth/bailiwick guards), upstream-pool failover fix, 501 for unenforced controls, /metrics auth, systemd sandboxing, go1.26.4. -
v0.3.2
protected89705879 · ·v0.3.2: DNS DoS hardening and security audit remediation Security + reliability release closing a full appsec (OWASP 2025 + CIS v8.1.2) and multi-domain audit, plus the upstream-pool failover fix. Hardening: - Bound the DNS forwarding cache and recursive NS/addr caches (fixes a confirmed remote OOM via unique-subdomain / water-torture floods). - Per-client + global DNS rate limiting with a count-capped tracking map. - Cap pipeline worker goroutines (stream.Scaler.Max). - Recursive resolver: bailiwick validation + recursion depth guard (cache-poisoning and stack-exhaustion defenses). - Upstream pool: bounded attempts + per-upstream failure cooldown; route OTel export errors through slog. API / ops: - Return 501 for unenforced blocking/CIDR controls; drop misleading MCP tools. - Require API-key auth for /metrics. - Fail loud on unimplemented JWT auth and non-udp listeners. - Periodic remote blocklist sync with last-good retention. - systemd sandboxing; CI goreleaser checksum + docker --password-stdin. - Pin go1.26.4 toolchain to clear reachable stdlib advisories.
-
v0.3.0
protectedb029eb1f · ·v0.3.0 — Runtime configuration management, persistence, auth, and MCP - Runtime configuration API (genapi, TLS): add/remove/replace allow/local/block entries and reload files without a restart; atomic Swappable updates (no dropped queries); persisted in an embedded bbolt store. - Authentication: argon2id API keys with scopes + short-TTL verify cache; mTLS-gated key management; secure-by-default TLS. - CLI + admin socket: void apikey create/list/revoke/delete, void reload; SIGHUP/endpoint reload. - Env-seeded admin key (VOID_ADMIN_API_KEY / _FILE) + offline void apikey generate for Docker/first-boot. - void mcp: MCP server (official SDK; stdio + streamable-HTTP) for LLM agents, bridging to the management API with the same auth + scopes. - Documentation refreshed with Mermaid architecture diagrams (docs/ARCHITECTURE.md).