gofix/portal-tunnel-rs
Watch
1
0
Fork
You've already forked portal-tunnel-rs
 0
Code Issues Pull requests Projects Releases 22 Packages 1 Wiki Activity Actions
22 releases 88 tags
  • v2.6.4+rs.1 1de6279f7a

    v2.6.4+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 6m58s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 46s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 5m48s
    Details
    Stable

    ada released this 2026-10-15 08:24:01 +00:00 | 2 commits to master since this release

    Rust relay compatibility release for upstream portal-tunnel v2.6.4.

    See PR #116 for the ported changes and the documented support boundary (docs/unsupported-features.md).

    Verification:

    • PR #116 CI and the linux/arm64 image workflow passed for the release revision.
    • The exact v2.6.4+rs.1-dev.1 image passed the public live gate on the production relay: official v2.6.4, v2.6.3, v2.6.1 native nonce round-trips (v2.6.4 clients accepted the Host-bound SIWE registration challenge), --overlay direct fallback, v2.6.4 browser/WASM nonce round-trip with checksum-pinned assets, relay-served WASM asset checksums, release/health, and no overlay advertisement.
    • Production reports v2.6.4+rs.1; long-running official expose services were upgraded to v2.6.4 and passed public endpoint checks.

    Image: code.rly.best/gofix/portal-tunnel-rs:v2.6.4-rs.1
    Digest: sha256:048ac2c416de7ae5cb991e4dcb47c48070b88d79078429fe7a80b60acd95bb48
    Revision: 1de6279f7a
    Upstream: https://github.com/gosuda/portal-tunnel/releases/tag/v2.6.4

    Downloads
  • v2.6.3+rs.1 3b7e5c0900

    v2.6.3+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 7m20s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 18s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 5m46s
    Details
    Stable

    ada released this 2026-10-12 14:48:30 +00:00 | 5 commits to master since this release

    Rust relay compatibility release for upstream portal-tunnel v2.6.3 (includes v2.6.2).

    See PR #113 for the ported changes and the documented support boundary (docs/unsupported-features.md): unnamed address-only services, hashed canonical labels for service names longer than 22 characters, rejection of names shaped like canonical labels, and reported-IP canonicalization.

    Verification:

    • PR #113 CI and the linux/arm64 image workflow passed for the release revision.
    • The exact v2.6.3+rs.1-dev.1 image passed the public live gate on the production relay: official v2.6.3, v2.6.1, and v2.6.0 native nonce round-trips, --overlay direct fallback, v2.6.3 browser/WASM nonce round-trip with checksum-pinned assets, relay-served WASM asset checksums, release/health, and no overlay advertisement.
    • Production reports v2.6.3+rs.1; long-running official expose services run v2.6.3 and passed public endpoint checks.

    Image: code.rly.best/gofix/portal-tunnel-rs:v2.6.3-rs.1
    Digest: sha256:80ed33a0d8b03393f6559f454b89d52fe09d456cf98dacfe32081cff6c86413a
    Revision: 3b7e5c0900
    Upstream: https://github.com/gosuda/portal-tunnel/releases/tag/v2.6.3

    Downloads
  • v2.6.1+rs.1 6e4ff4dcf6

    v2.6.1+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 6m46s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 14s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 5m16s
    Details
    Stable

    ada released this 2026-10-08 18:47:46 +00:00 | 8 commits to master since this release

    Rust relay compatibility release for upstream portal-tunnel v2.6.1.

    Highlights:

    • Registers identity-bound canonical hostnames (<name>-<40-hex address>.<root>) and returns hostname and canonical_hostname from /sdk/register, which official v2.6.1 clients require (protocol stays 10).
    • Honors allow_canonical_fallback: a v2.6.1 client whose friendly hostname is held by another identity keeps only its canonical hostname; older clients still receive hostname_conflict. SNI routes both names; TCP/UDP addresses use the canonical name.
    • /api/state and /api/policy/state leases carry address and canonical_hostname.
    • Access decisions now also apply to live raw TCP/UDP lease ports.
    • Pins the v2.6.1 browser WASM asset by its published checksum.

    Compatibility:

    • Official v2.6.1, v2.6.0, and v2.5.0 clients verified end to end on the deployed image. sni_port is still returned for v2.5.0/v2.6.0 UDP clients.
    • Names longer than 22 characters are rejected for every client, matching upstream.
    • Not ported (documented in docs/unsupported-features.md): the upstream IVNP revision bump (overlay is not offered on this deployment) and admin transport-policy HTTP 400 validation.

    Verification:

    • PR #110 CI and the linux/arm64 image workflow passed for the release revision.
    • The exact v2.6.1+rs.1-dev.1 image passed the public live gate on the production relay on the first attempt: v2.6.1/v2.6.0/v2.5.0 native nonce round-trips, --overlay direct fallback, v2.6.1 browser/WASM nonce round-trip with checksum-pinned assets, relay-served WASM asset checksums, release/health, and no overlay advertisement.
    • Production reports v2.6.1+rs.1 / protocol 10; all long-running official expose services were upgraded to v2.6.1 and passed public endpoint checks.

    Image: code.rly.best/gofix/portal-tunnel-rs:v2.6.1-rs.1
    Digest: sha256:33a49de47d3b86c2819fe55bc9d38b3cfdd2c7a12cd987d32bdccafe836fd902
    Revision: 6e4ff4dcf6
    Upstream: https://github.com/gosuda/portal-tunnel/releases/tag/v2.6.1

    Downloads
  • v2.6.0+rs.1 ec663de48a

    v2.6.0+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 5m38s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 20s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 6m25s
    Details
    Stable

    ada released this 2026-10-08 17:18:41 +00:00 | 9 commits to master since this release

    Rust relay compatibility release for upstream portal-tunnel v2.6.0.

    Highlights:

    • Retargets the compatibility baseline to upstream v2.6.0 (protocol 10), including the WebSocket carrier used by the browser/WASM client.
    • Serves /sdk/certificate-chain with CORS headers so browser/WASM clients can complete keyless registration (PR #109).
    • Scopes the release gate to the deployed runtime: overlay (IVNP) is shipped but not enabled on this deployment, so the public gate covers direct paths and verifies that --overlay requests fall back to direct and that no overlay endpoint is advertised (PR #107).

    Compatibility:

    • Official v2.6.0 and v2.5.0 clients: native direct HTTP and browser/WASM verified against the deployed image.
    • Official v2.6.1 clients do not register yet (relay did not return canonical hostname). This is not a regression: the previous production release behaves the same way. Tracked for the next retarget (PR #108 non-regression rule).

    Verification:

    • PR CI and the linux/arm64 image workflow passed for the release revision.
    • The exact v2.6.0+rs.1-dev.4 image passed the public live gate on the production relay: v2.6.0/v2.5.0 native nonce round-trips, --overlay direct fallback, browser/WASM nonce round-trip with checksum-pinned assets, relay-served WASM asset checksums, release/health, and no overlay advertisement.
    • Earlier dev candidates were rolled back automatically: dev.2 exposed the missing CORS header; dev.3 failed only because post-swap re-registration from co-located clients exhausted the shared pre-auth budget, which the live procedure now waits out before gating.
    • Production reports v2.6.0+rs.1 / protocol 10; all long-running official expose services were upgraded to v2.6.0 and passed public endpoint checks.

    Image: code.rly.best/gofix/portal-tunnel-rs:v2.6.0-rs.1
    Digest: sha256:31839d1a55c07e6ee33e6dc41eaf4b53ca2cdf4c576a2e522a51940dba27a7c9
    Revision: ec663de48a
    Upstream: https://github.com/gosuda/portal-tunnel/releases/tag/v2.6.0

    Downloads
  • v2.5.0+rs.1 45ff7746ee

    v2.5.0+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 2m32s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 10s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 7m53s
    Details
    Stable

    ada released this 2026-09-20 18:41:33 +00:00 | 22 commits to master since this release

    Rust relay compatibility release for upstream portal-tunnel v2.5.0.

    Highlights:

    • Retargets the compatibility baseline to upstream v2.5.0 and protocol 10 while retaining protocol-9 discovery and the documented scoped legacy paths.
    • Implements authenticated, lease-bound, single-use TLS reverse bindings and TLS 1.3 transcript signing.
    • Retargets official-client HTTP/keyless, lifecycle, TCP, UDP, API-shape, lease-JWT, IVNP capability, and deterministic Axis B fixtures.
    • Documents the supported keyless algorithms and unsupported reputation / peer release-map behavior.

    Compatibility:

    • Full current-client interoperability is v2.5.0. Older v2.4.x protocol-9 clients are outside the full end-to-end window after the protocol-10 bump. The scoped v2.3.8 direct-token/protocol-8 extension remains tested.

    Verification:

    • PR #96, target-branch CI, dev7 image CI, and production image CI passed.
    • The exact dev7 image passed the official v2.5.0 direct HTTP gate and the strict protocol-9-discovery IVNP Axis B candidate/control gate.
    • Production reports v2.5.0+rs.1 / protocol 10. All nine checksum-verified v2.5.0 official expose services, including the code tunnel, reattached and passed their public endpoint checks.

    Image: code.rly.best/gofix/portal-tunnel-rs:v2.5.0-rs.1
    Digest: sha256:8c22c309fe0d12f3a202d06923e4d227b2c3897bcc4a6bc74acb7340d909ee64
    Upstream: https://github.com/gosuda/portal-tunnel/releases/tag/v2.5.0

    Downloads
  • v2.4.2+rs.1 a2800a2d19

    v2.4.2+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 2m35s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 9s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 6m7s
    Details
    Stable

    gofix released this 2026-09-16 08:41:18 +00:00 | 24 commits to master since this release

    Rust relay compatibility release for upstream portal-tunnel v2.4.2.

    Highlights:

    • Retargets the compatibility baseline to upstream v2.4.2 while retaining protocol 9 and the existing IVNP revision.
    • Returns lease_not_found for valid credentials whose relay lease state is absent or expired, enabling official-client re-registration.
    • Routes canonical SNI-less ingress to the API and separates advertised public ports from local listener ports.
    • Updates official-client HTTP/TCP/UDP/lifecycle, API-shape, JWT, IVNP, and Axis B verification fixtures.

    Verification:

    • Forgejo PR and master CI passed, including linux/arm64 image startup.
    • Official v2.4.2 direct HTTP and Axis B multi-hop production gates passed.
    • Production relay, eight long-running v2.4.2 expose services, and all advertised endpoints were verified.

    Image: code.rly.best/gofix/portal-tunnel-rs:v2.4.2-rs.1
    Digest: sha256:75c579a969a7d33fcca838432ff0c842d56323a555bc386f129d4cd1133a64d0
    Upstream: https://github.com/gosuda/portal-tunnel/releases/tag/v2.4.2

    Downloads
  • v2.4.1+rs.1 8913edcae9

    portal-tunnel-rs v2.4.1+rs.1
    Some checks failed
    Rust CI / Format, lint, and test (push) Successful in 3m52s
    Details
    Rust CI / Build and start linux/arm64 image (no push) (push) Successful in 16s
    Details
    Build and publish container image / Build linux/arm64 image (push) Failing after 12s
    Details
    Stable

    ada released this 2026-09-12 10:25:17 +00:00 | 25 commits to master since this release

    portal-tunnel-rs v2.4.1+rs.1

    Rust relay-server compatibility release targeting upstream gosuda/portal-tunnel v2.4.1 at commit c644d4b37b0a70c2e7b045ca92ce0de3b42e4299.

    Highlights

    • Protocol-9 discovery and IVNP gateway/ingress interoperability for the v2.4.1 relay contract.
    • Exact upstream application connection-selection semantics retained.
    • Fail-closed deterministic native ARM64 Axis-B gate with signed RouterInfo mesh, active runtime semantic parity, Rust marker correlation, bounded cleanup, and secret-safe evidence.
    • Official upstream v2.4.1 client compatibility; v2.4.0 retained end-to-end because both use protocol 9. The v2.3.8 window remains wire-scoped as documented in docs/unsupported-features.md.

    Provenance and validation

    • Revision: 8913edcae9b10fa54e6e5849a22c1a8924b73c2a
    • Verified dev tag: v2.4.1+rs.1-dev.5
    • Production tag: v2.4.1+rs.1 at the same revision
    • Exact-head CI and native Linux ARM64 IVNP_AXIS_B_PASS
    • Deployed-image public HTTP E2E with official v2.4.1 and v2.4.0 clients
    • Production /healthz and /sdk/domain verified
    • Preserved raw bearer count: zero

    See PR #91 for the upstream retarget and PRs #92/#93 for the deterministic Axis-B release gate and connection-semantics correction.

    Downloads
  • v2.3.8+rs.1 3217a6a3e1

    v2.3.8+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 1m33s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 4m56s
    Details
    Stable

    gofix released this 2026-08-25 14:11:29 +00:00 | 28 commits to master since this release

    Rust relay release retargeted to upstream portal-tunnel v2.3.8 (f73614e2fd51481e62fd7cbcb928d349e45eb6f0).

    Changes:

    • Isolates unverified discovery candidates until direct authoritative target verification, caps candidates per signing identity, and evicts candidates before verified relays.
    • Shares the upstream-compatible per-source announce budget across discovery announces and hop-route POSTs.
    • Matches the v2.3.8 /sdk/domain ENS provider response shape and explicitly rejects the unsupported embedded authoritative DNS provider.
    • Retargets version metadata, compatibility documentation, fixtures, and official-client/API/JWT smoke defaults to v2.3.8 and Go 1.27.
    • Preserves tunnel/discovery protocol 8 and legacy v2.1.8/v2.1.9 hop-route signature acceptance.

    Artifacts:

    • Git tag: v2.3.8+rs.1
    • OCI image: code.rly.best/gofix/portal-tunnel-rs:v2.3.8-rs.1
    • OCI digest: sha256:a57b2eaf6c84614927f34be4b67a0715f9570cd4d1c23bf4c16607199e01e171
    • Revision: 3217a6a3e179a305b3c29ec2c9a28e932cb081cc
    • Verified dev image: v2.3.8-rs.1-dev.1 at sha256:60f8e7fac24b95bfedd556c04e16d4f690c3f849837bda435b8f0f3d20574b82

    Verification:

    • PR #89 CI run #154 and target-branch CI run #155 passed; dev image run #156 and production image run #157 passed.
    • Formatting, Clippy with warnings denied, 151 tests (3 capability-dependent ignored), Go/Rust API shape, Go-issued JWT, and official v2.3.8 HTTP/lifecycle/TCP/UDP smokes passed.
    • Relay-host registry realm resolution/reachability and authenticated manifest lookup passed before dev tagging.
    • Dev and production direct official-client HTTP gates passed.
    • Canonical protocol-8 Axis B three-hop gates passed with rly.best as the middle relay for both dev and production wire releases.
    • The checksum-verified official arm64 v2.3.8 CLI was installed; all eight production expose services, including the code tunnel, were restarted/reattached and verified.
    • Local/public relay health and release surfaces passed. A first production switch was automatically rolled back on recovery-metadata validation; the metadata was corrected, the same immutable image redeployed, and all final gates passed.
    • Verification fixtures and stopped backup containers were cleaned; no certificate/identity volumes were removed.
    Downloads
  • v2.3.7+rs.1 1b81484729

    v2.3.7+rs.1
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 1m16s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 10m29s
    Details
    Stable

    ada released this 2026-08-17 12:44:36 +00:00 | 30 commits to master since this release

    Rust relay release retargeted to upstream portal-tunnel v2.3.7.

    Changes:

    • Adds upstream-compatible GET/HEAD /llms.txt relay connection guidance with configured relay URL substitution.
    • Retargets version metadata, compatibility documentation, fixtures, and official-client/API/JWT smoke defaults to v2.3.7.
    • Preserves protocol 8 behavior and the documented legacy v2.1.8/v2.1.9 hop-route signature compatibility window.

    Artifacts:

    • Git tag: v2.3.7+rs.1
    • OCI image: code.rly.best/gofix/portal-tunnel-rs:v2.3.7-rs.1
    • OCI digest: sha256:9fcfc74e2059cddaa53245c6007d46f54bcbe376174372aba5e2f38e5089d814
    • Revision: 1b81484729

    Verification:

    • Forgejo PR and target-branch Rust CI passed.
    • Tagged dev.2 arm64 image passed authenticated registry verification and live relay checks.
    • Official v2.3.7 clients reattached all eight production expose services; representative direct HTTP checks passed.
    • Canonical protocol-8 Axis B three-hop gate passed with rly.best as the middle relay.
    • Production image, public/local relay version, API health, /llms.txt contract, and private inventory health passed.
    Downloads
  • v2.3.5+rs.2 6a3e82bb0c

    v2.3.5+rs.2
    All checks were successful
    Rust CI / Format, lint, and test (push) Successful in 1m11s
    Details
    Build and publish container image / Build linux/arm64 image (push) Successful in 5m38s
    Details
    Stable

    ada released this 2026-08-13 19:21:53 +00:00 | 32 commits to master since this release

    v2.3.5+rs.2

    Port patch fixing the default Docker Compose startup path.

    Fix

    • Omit PORTAL_FRONTEND_DIR when it is unset so Clap receives None and the built-in landing page fallback remains active.
    • Add a regression test for the default Compose environment.

    Validation

    • PR #85 and post-merge Rust CI passed.
    • 144 tests passed, 3 ignored; formatting and Clippy -D warnings passed.
    • Isolated default docker compose up: container running, built-in landing page HTTP 200.
    • Official portal v2.3.5 direct HTTP and 45-second lifecycle/renew/unregister gates passed.
    • Multi-hop with the Rust relay as ingress, middle, and exit returned HTTP 200 in all three positions.
    • Production ARM64 image digest: sha256:2ba2b60987b67b282ddeea2612d8931130b68a4de479d6c64f048518ea70fbc4.
    • Production relay reports portal-relay v2.3.5+rs.2; eight official portal v2.3.5 expose services are active and public health gates pass.
    Downloads