dash 4.1.1 → 4.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb6c271cec9b9ab118649ffeaf503aa5ba31bd8d0f8057ce0a61adb93e130ef4
-  data.tar.gz: ce7f60b8e4a764e06ab868663f825134d8f73cac0e11f663793e6a12471ab490
+  metadata.gz: 17c99f41669956c79ffd4272e4fd524171c4ff9a37f26d885bd4b4cdc084be85
+  data.tar.gz: 8fa42e665988fd8d343b0d0141438096635e6059566767bb3d63375fe975e324
 SHA512:
-  metadata.gz: 35204403e1680a42ce0b0726225d68c55119a74b387a9cd45189822499e5aa225c250ad82190944cbd4a5ff7aa976b3dcf02600e44b92a8a4ed165f86123c96b
-  data.tar.gz: cb520eb7f9028fad75e4537afcdcc1c7aea71aa6cb58c35a33b9c8d185781a4de9ad7a9f3d1f1f8daba8b73390b279bbd292ac1a82d531a303f34086c69c28d3
+  metadata.gz: c12f97e422182fba7128f2c27094dc824b0c76825273b89f70d10563c4acc6a59a1d22fe10c22c47b7e0456a6a50c30de0343a6c42de1e0ebd677e5a602c19f7
+  data.tar.gz: 897652d67bb727025f490d7ee8ca1b719c77c13a2fb896826742c6fc34f5ff3968384925dccd01e00d6493a07c98e75212e76933c97d36323e03c20fb3436d46

data/lib/dash/configuration/docs/proxy.yml

@@ -328,11 +328,13 @@ proxy:
   # `interval` is the poll interval in seconds (proxy default 300, minimum 10).
   #
   # Authentication tokens live in the PROXY's environment, not the app's: polls
-  # send `KAMAL_PROXY_REDIRECTS_TOKEN` as a bearer token when set, and
+  # send `DASH_PROXY_REDIRECTS_TOKEN` as a bearer token when set, and
   # `POST /.dash-proxy/redirects/refresh` nudges an immediate re-poll when
-  # authenticated with `KAMAL_PROXY_REFRESH_TOKEN`. Set both via
-  # `proxy.run.options.env`, next to `KAMAL_PROXY_DOMAINS_TOKEN` — never as
-  # deploy flags, which leak into process listings and audit logs.
+  # authenticated with `DASH_PROXY_REFRESH_TOKEN`. Set both via
+  # `proxy.run.options.env`, next to `DASH_PROXY_DOMAINS_TOKEN` — never as
+  # deploy flags, which leak into process listings and audit logs. The
+  # `KAMAL_PROXY_`-prefixed names are still read as a fallback, so a proxy
+  # container that already carries them keeps working.
   #
   # When a loadbalancer is configured the map answers at the loadbalancer, same
   # as `ssl_domains` and `canonical_host` — the per-host proxies never see it.
@@ -422,10 +424,11 @@ proxy:
   # proxy default) issues per-domain certs; 2-25 enables stable SAN batching.
   #
   # Authentication tokens for the poll endpoint and the refresh nudge are
-  # read by the proxy from the `KAMAL_PROXY_DOMAINS_TOKEN` and
-  # `KAMAL_PROXY_REFRESH_TOKEN` environment variables. Set them on the proxy
-  # container via `proxy.run.options.env` — never as deploy flags, which
-  # leak into process listings and audit logs.
+  # read by the proxy from the `DASH_PROXY_DOMAINS_TOKEN` and
+  # `DASH_PROXY_REFRESH_TOKEN` environment variables (the `KAMAL_PROXY_`
+  # names are still read as a fallback). Set them on the proxy container via
+  # `proxy.run.options.env` — never as deploy flags, which leak into process
+  # listings and audit logs.
   ssl_domains:
     source: /api/v1/kamal/domains
     interval: 300
@@ -834,7 +837,7 @@ proxy:
                                    # below already embeds its ghcr.io host
     repository: ghcr.io/zoolutions/dash-proxy # Container repository for the
                                    # dash-proxy image (this is the default)
-    version: v1.1.0.1              # Version tag of the dash-proxy image to use.
+    version: v1.1.0.3              # Version tag of the dash-proxy image to use.
                                    # Defaults to the minimum version this gem
                                    # requires - only pin it to roll forward early,
                                    # never below the default
@@ -876,6 +879,16 @@ proxy:
     # supports one, and `http_fallback` falls back to an HTTP-01 challenge when
     # DNS-01 fails. Both default to true in the proxy.
     #
+    # For `host`/`hosts` names the proxy infers the zone from the name itself.
+    # Names learned from `ssl_domains` are tenant-owned and may sit in a zone you
+    # do not run DNS for, so from proxy v1.1.0.2 they collapse into a wildcard
+    # only where the hash form of `dns_provider` maps their zone explicitly -
+    # mapping a zone is you asserting DNS control over it. Under a mapped zone
+    # every single-label name is ordered as that zone's wildcard, while the apex
+    # and deeper names ride the same order as concrete identifiers. `default` and
+    # `auto` assert nothing about a specific zone, so they never collapse a
+    # dynamic name.
+    #
     # `directory` overrides the ACME directory URL - point it at Let's Encrypt's
     # staging environment while you are working out a DNS setup, so you do not
     # burn production rate limits on failed attempts.

data/lib/dash/configuration/proxy/run.rb

@@ -1,5 +1,5 @@
 class Dash::Configuration::Proxy::Run
-  MINIMUM_VERSION = "v1.1.0.1"
+  MINIMUM_VERSION = "v1.1.0.3"
   DEFAULT_HTTP_PORT = 80
   DEFAULT_HTTPS_PORT = 443
   DEFAULT_LOG_MAX_SIZE = "10m"

data/lib/dash/version.rb

@@ -1,3 +1,3 @@
 module Dash
-  VERSION = "4.1.1"
+  VERSION = "4.1.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dash
 version: !ruby/object:Gem::Version
-  version: 4.1.1
+  version: 4.1.3
 platform: ruby
 authors:
 - Mikael Henriksson