Back to all posts

Ferron 3.0.0-rc.8 released

Published on: Category: Releases

Today, we’re releasing Ferron 3.0.0-rc.8, the eighth release candidate of Ferron 3.

This release improves configuration semantics (host isolation for handlers), bcrypt hashes for HTTP Basic Auth, as well as some other improvements and bug fixes.

This release also brings a new installation method: using a NixOS module (although community-maintained packages for Ferron 2 on Nixpkgs exist).

Nix flake (packages + NixOS module)

Nix fixes this

Ah, we get it… 😅

I have packaged Ferron 3 for NixOS. The Nix flake can be used to set up and configure Ferron using declarative Nix configuration files. This could be useful for example in GitOps scenarios where Nix files are on a Git repository (in fact, I have seen some Nix file repositories on GitHub).

For example, this Nix configuration snippet (when using the Nix flake):

services.ferron.hosts."example.com" = {
  root = "/var/www/example";
  index = [ "index.html" "index.htm" ];
  spaFallback = true;
  headers = {
    set.Content-Security-Policy = "default-src 'self'";
    add."X-Client-IP" = "{{remote.ip}}";
    unset = [ "Server" ];
  };
  cache = {
    enable = true;
    maxResponseSize = 2097152;
  };
};

generates this ferron.conf host block:

example.com {
    root /var/www/example
    index index.html index.htm
    cache {
        max_response_size 2097152
    }
    header Content-Security-Policy "default-src 'self'"
    header +X-Client-IP "{{remote.ip}}"
    header -Server
    rewrite r"^/.*" "/" {
        last
        directory false
        file false
    }
}

Read “Installation on NixOS” documentation to learn more about it.

Improved config semantics

Backend/handler selectors (proxy, fcgi, fcgi_php, cgi, scgi, forward_proxy, root, index, basic_auth, rate_limit_backend, static-file tunables, client_ip_from_header, trace_id_header, https_redirect, trailing_slash_redirect, disable_symlinks, directory_listing) no longer inherit from the wildcard * host into named hosts, while global-scope defaults and location-from-host inheritance keep working.

For example, previously, * { proxy ... } would unexpectedly reverse-proxy a named host that only set root.

Note: a named host no longer inherits root from *, so give each host its own root (or set it globally).

I did this to improve user experience while configuring Ferron, and to prevent a pitfall where an operator expects reverse proxy directive to not be inherited into static file serving configuration (but it is).

bcrypt for HTTP basic auth

bcrypt hash formats $2a$, $2b$, $2x$, $2y$ are now supported for Basic Auth. This allows using Ferron with control planes and services that expect bcrypt password hashes.

I added this when I wanted to use Ferron 3 as an ingress proxy for Coolify, and saw Coolify used bcrypt hashes. Many modern web server programs, system administration, web development environments also support bcrypt password hashes.

Improved cache purge visibility

Observability is still getting some improvements, in this case, what purges with zero results are now visible via a ferron.cache.zero_purge metric, which can help debug or monitor cache purge requests that did not match any entries.

Bug fixes

Ferron 3.0.0-rc.8 also brings few bug fixes along the way.

Configuration

  • Spurious configuration file hot-reload fix: previously, the server would sometimes hot-reload the configuration even when no changes were made to the configuration file (something would just read the file). This has been fixed.

Admin API

  • Admin API listen fail fix: previously, when configuration is reloaded very frequently, the admin API listener would sometimes fail to bind to the configured address due to a race condition.

Observability

  • Prometheus reload listen fail fix: previously, when configuration is reloaded very frequently, the Prometheus listener would sometimes fail to bind to the configured address due to a race condition.

Ferron 3 stable coming soon

Ferron 3 is continuing to stabilize as we approach the first stable release. The release candidate phase focuses on correctness, resilience, and making Ferron easier to operate in production.

As always, I welcome feedback, bug reports, and testing results.

I think I would need to freeze Ferron 3 for a while for it to stabilize and to “soak test” it…

Full changelog

You can see the complete changelog for Ferron 3.0.0-rc.8 in the release notes.

Try it

Install Ferron 3 using the installer:

sudo bash -c "$(curl -fsSL https://get.ferron.sh/v3)"