os-blocky-greelan changelog

1.4_13 - 2026-10-10

A query log connection string cannot name a file for Blocky to read, such as allowAllFiles or sslkey; such options go in a file: value.
Redis and query log settings refuse line breaks; hosts file sources are trimmed and refuse control characters.

Stopping Blocky and importing a configuration through configd take calls from root and the web interface only.

Importing a zone file whose first record has no name keeps it as written.
Switching on or deleting an entry Blocky could not start with is refused with the reason; a dialog edit that leaves no "default" upstream, or repeats a rewrite or schedule, says so on the entry.
NULL as a dropped query type, a zero flush interval, a block type that is no address, a resolver with a trailing dot and a stamp without pinned addresses are refused on save.
A signing request cannot be chosen as the certificate.
A list entry starting with http, such as httpbin.org, is an inline entry, not a download.
An import keeps the selected certificate, takes durations, weekdays, log levels and hosts lines as Blocky does, and keeps a secret's spelling, e.g. 0000.
A file: secret is not refused as missing when the web interface runs without root.
A CSV or SQLite log target kept from 1.3 is cleared.
Many host overrides or conditional forwards render far faster.

Host overrides, conditional forwards, client groups and client names given in more than one entry are combined instead of stopping Blocky from starting.
Group names made of digits, and quotes in rebinding allowed domains, no longer stop Blocky from starting.
Duplicate rewrites or schedule names, over-long durations, and PROXY protocol on a listener with no port are refused on save.

Settings Blocky would refuse at startup, including an unparsable zone file, are refused on save.
Zone file names end with a dot unless an $ORIGIN line comes first.
Importing negative cache times no longer fails.

Upstream resolvers are checked when saved, so a mistyped one no longer stops Blocky from starting.
A custom zone whose first line starts with a space no longer stops Blocky from starting.

The Redis passwords and query log target have a button to show what is being typed.

The saved Redis passwords and query log target can be removed with the Remove link under them; typing a new value replaces them.

Blocky no longer reads or connects to what free text names: zone $INCLUDE lines, resolv files outside the list directory, and Unix sockets for Redis (other than the Redis plugin's) or dnstap are refused, and removed or switched off on upgrade.

The unauthenticated HTTP API is off by default, as upstream has it, and the old default port 4000 is switched off on upgrade.

A quote in a cache exclude pattern or query log ignored domain no longer stops Blocky from starting, and neither field can add settings to the generated configuration.
Importing a config.yml respects read-only accounts and no longer races other saves.
Download cache directories and CSV or SQLite query log targets must be under /var.

A list entry holding several lines no longer breaks the generated configuration.
An unquoted MAC address in config.yml is reported rather than imported as a number.

The exported certificate now carries its issuing chain, so clients can validate it.
Certificate file paths are hidden when a trust store certificate is selected.
The certificate written to disk is recorded in the log.