# Changelog

All notable changes to nxdns are recorded here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).

Sections are written by hand. Nothing here is generated from commit messages:
the point of the file is to say what changed for an operator, which a commit
subject rarely does.

## [Unreleased]

## [0.0.1] - 2026-08-09

First release. Everything below is new.

### Added

- **Forwarding DNS server.** UDP and TCP listeners with a wire-format parser and
  encoder written against RFC 1035 and EDNS(0), a bounded worker model, per-client
  rate limiting and a `pause` control that stops filtering without stopping
  resolution.
- **Encrypted upstreams.** DNS-over-HTTPS and DNS-over-TLS clients over a pool
  that tracks per-upstream health and fails over, with SNI and certificate
  verification driven by a per-upstream TLS name.
- **DoH and DoT endpoints.** nxdns also answers as an encrypted resolver, with a
  certificate store that reloads on disk changes and through the API, so renewals
  do not need a restart.
- **Blocklist filtering.** Subscriptions in hosts, plain-domain and
  Adblock-Plus-style formats, compiled into a compact matcher; per-group allow
  and block rules with wildcards; safe-search enforcement.
- **Per-client policy groups.** Clients are identified by address and assigned to
  groups, so the filtering a device gets depends on which device it is.
- **Local DNS.** Local A/AAAA/CNAME/PTR records and conditional forwarding of
  internal zones to another resolver.
- **Cache.** A bounded in-memory cache that respects upstream TTLs and expires
  entries rather than serving them stale.
- **Query log.** Queries land in SQLite under a retention policy in both rows and
  days, with disk-full self-protection that degrades instead of corrupting, and a
  live SSE stream of the same events.
- **Web UI and REST API.** A React single-page admin UI embedded in the binary,
  a REST API with a served OpenAPI document, session authentication, API rate
  limiting and Prometheus-style `/metrics`.
- **Configuration.** A ZON configuration file seeds the database on first boot;
  after that the database is the truth, and `nxdns export` / `nxdns import` move
  configuration in and out. `nxdns check` validates a file without starting.
- **CLI.** `run`, `check`, `export`, `import`, `version` and `help`.
- **Packaging.** A hardened systemd unit with a sysusers fragment, and a
  `FROM scratch` container image holding the binary, a CA bundle and the licence
  files, assembled by a builder stage pinned to `alpine:3.22` by digest. Nothing
  from Alpine ships in the published image except that CA bundle.
- **Releases.** Tags publish five assets — static musl tarballs for
  `x86_64-linux-musl` and `aarch64-linux-musl`, `IMAGE-DIGEST.txt` naming the
  multi-architecture container image by digest, `SHA256SUMS.txt` over those
  three, and `SHA256SUMS.txt.asc`, a detached signature over the checksum file.
  `zig build dist` and `zig build verify-dist` produce and check the same
  artifacts on a laptop.
- **Licensing.** EUPL-1.2, with a `THIRD-PARTY-NOTICES` file in every tarball and
  image assembled from a reviewed inventory of what the artifacts contain.
- **Documentation.** A Diátaxis split — tutorial, how-to, reference, explanation —
  with drift guards that fail the build when the reference pages fall behind the
  code.