Tags give the ability to mark specific points in history as being important
-
v0.3.3
protectede4fb01a1 · ·v0.3.3: fix release-pipeline registry auth (re-release of v0.3.2) v0.3.2's release pipeline built all artifacts but failed pushing the Docker image to the GitLab registry ('denied') due to a ci-catalog component bump changing the DOCKER_* credential contract. This tag carries the same code as v0.3.2 plus the CI fix (log in with CI_JOB_TOKEN / CI_REGISTRY*). Content is identical to v0.3.2: DNS DoS hardening (bounded caches, rate limiting, recursion depth/bailiwick guards), upstream-pool failover fix, 501 for unenforced controls, /metrics auth, systemd sandboxing, go1.26.4. -
v0.3.2
protected89705879 · ·v0.3.2: DNS DoS hardening and security audit remediation Security + reliability release closing a full appsec (OWASP 2025 + CIS v8.1.2) and multi-domain audit, plus the upstream-pool failover fix. Hardening: - Bound the DNS forwarding cache and recursive NS/addr caches (fixes a confirmed remote OOM via unique-subdomain / water-torture floods). - Per-client + global DNS rate limiting with a count-capped tracking map. - Cap pipeline worker goroutines (stream.Scaler.Max). - Recursive resolver: bailiwick validation + recursion depth guard (cache-poisoning and stack-exhaustion defenses). - Upstream pool: bounded attempts + per-upstream failure cooldown; route OTel export errors through slog. API / ops: - Return 501 for unenforced blocking/CIDR controls; drop misleading MCP tools. - Require API-key auth for /metrics. - Fail loud on unimplemented JWT auth and non-udp listeners. - Periodic remote blocklist sync with last-good retention. - systemd sandboxing; CI goreleaser checksum + docker --password-stdin. - Pin go1.26.4 toolchain to clear reachable stdlib advisories.
-
v0.3.0
protectedb029eb1f · ·v0.3.0 — Runtime configuration management, persistence, auth, and MCP - Runtime configuration API (genapi, TLS): add/remove/replace allow/local/block entries and reload files without a restart; atomic Swappable updates (no dropped queries); persisted in an embedded bbolt store. - Authentication: argon2id API keys with scopes + short-TTL verify cache; mTLS-gated key management; secure-by-default TLS. - CLI + admin socket: void apikey create/list/revoke/delete, void reload; SIGHUP/endpoint reload. - Env-seeded admin key (VOID_ADMIN_API_KEY / _FILE) + offline void apikey generate for Docker/first-boot. - void mcp: MCP server (official SDK; stdio + streamable-HTTP) for LLM agents, bridging to the management API with the same auth + scopes. - Documentation refreshed with Mermaid architecture diagrams (docs/ARCHITECTURE.md).