v0.5.1

What's Changed

• Stamp the image version and gate the chart version bumps by @byjg in #2

Full Changelog: v0.5.0...v0.5.1

v0.5.0

HTTPS that a client can actually trust, and that survives a restart — plus the ability to put
static-httpserver in front of a backend that only speaks HTTP.

Certificates

• The self-signed certificate now carries SubjectAltName entries (localhost, 127.0.0.1, ::1,
  the hostname and the address it listens on). It previously carried only a CommonName, so it failed
  hostname verification in every modern client even when explicitly trusted — curl --cacert and a
  trusted browser exception now work instead of only -k.
• The certificate is saved to the certificate directory and reused, instead of being regenerated on
  every start. It is only replaced when it expires (30 day margin) or stops covering the requested
  hosts. If the directory cannot be written it stays in memory, as before.
• --tls-cert-dir now defaults to /certs for root and ~/.static-httpserver/certs otherwise, so
  an unprivileged process has somewhere to write. The image pins TLS_CERT_DIR=/certs and ships that
  directory owned by the runtime user, so a named volume on /certs keeps the certificate.
• --tls-cert-file / --tls-key-file for certificates that do not follow the cert.pem /
  key.pem convention — Let's Encrypt writes fullchain.pem and privkey.pem. Pointing
  --tls-cert-dir at a certbot directory used to fall back to a self-signed certificate silently.
• --tls-selfsigned-hosts adds names the server cannot discover, such as a public DNS name.

Listeners and proxying

• --bind (env BIND_ADDRESS) restricts both listeners to one address.
• --only-https (env ONLY_HTTPS) disables the HTTP listener even when a port is set — the way
  to run an HTTPS-only container, since the image sets PORT=8080.
• / is now a valid proxy prefix. It matches every path and strips nothing, so the whole site
  can be handed to a backend while static-httpserver terminates TLS:
  --proxy /=http://127.0.0.1:3000. Routes are matched most specific first, so a catch-all never
  shadows a specific route.
• Proxied requests carry X-Forwarded-Proto and X-Forwarded-Host. Without them a backend
  behind the TLS terminator reports http, drops secure cookies and builds http:// redirects.
  Values set by an upstream proxy are preserved.
• examples/serve-https.sh wraps the local-development case, for use as npm run serve-https.

Breaking change: the built-in endpoints moved

/health and /headers are now /_health and /_headers, so an application's own
/health is proxied through untouched instead of being shadowed.

Point Kubernetes probes, uptime monitors and load balancer checks at /_health, or restore the old
path with --health-path /health (env HEALTH_PATH). --headers-path does the same for the
headers endpoint. The Helm chart follows parameters.healthPath and defaults to /_health.

Also

• Helm chart 0.3.0 — probes follow parameters.healthPath.
• CI runs make lint and make test before building the image.

Full changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

New: Proxy backend TLS configuration

Added two new flags for configuring TLS when proxying to HTTPS backends:

• --proxy-ca / PROXY_CA_FILE — CA certificate file (PEM) for verifying backend TLS. Use when the backend uses a private or self-signed CA.
• --proxy-insecure / PROXY_INSECURE — Skip TLS verification for proxy backends. Use only on trusted internal networks (e.g. WireGuard mesh).

If both are set, --proxy-ca takes precedence.

Example: Hardened OIDC proxy

static-httpserver \
    --root-dir /var/www/empty \
    --tls-port 443 \
    --tls-cert-dir /etc/letsencrypt/live/nimbus.example.com \
    --proxy /.well-known/openid-configuration=https://10.106.103.1:8443/.well-known/openid-configuration \
    --proxy /keys=https://10.106.103.1:8443/keys \
    --proxy /authorize=https://10.106.103.1:8443/authorize \
    --proxy /oauth/token=https://10.106.103.1:8443/oauth/token \
    --proxy-ca /var/lib/nimbus/ca.crt

v0.3.0

What's New

Reverse Proxy Support

The server can now forward requests matching a path prefix to a backend service, useful for:

• Avoiding CORS issues by serving frontend and API from the same origin
• Hiding backend services from direct client access
• Replacing nginx/caddy as a reverse proxy sidecar in Kubernetes

static-httpserver --root-dir ./dist --spa \
    --proxy /api=http://backend:3000 \
    --proxy /auth=http://auth-service:4000

New flags:

• --proxy / PROXY_ROUTES — define proxy routes (repeatable flag, comma-separated env)
• --proxy-timeout / PROXY_TIMEOUT — upstream response timeout in seconds (default: 30)

Other Changes

• Renamed /api/headers endpoint to /headers to avoid conflicts with proxy routes

v0.2.0

What's New

Complete rewrite of the static HTTP server with major new features.

Server

• Rewritten in modern Go 1.26 with CLI flag support (--port, --root-dir, --spa, etc.)
• HTTPS by default with auto-generated self-signed certificate (custom certs via --tls-cert-dir)
• SPA mode for React/Angular/Vue apps (--spa or SPA_MODE=true)
• In-memory LRU file cache with configurable size limits
• /health endpoint for Kubernetes probes
• /api/headers endpoint to display request headers (--show-headers)
• HTTP server timeouts (read/write/idle) to prevent slowloris attacks
• HTTP is optional — only enabled when --port or PORT is set

Packaging

• deb/rpm packages available via GoReleaser
• CLI binary for linux/darwin (amd64/arm64)
• Makefile for standardized builds

Docker

• Self-contained parking page — single HTML file, no external dependencies (removed jQuery, Bootstrap 3, Font Awesome 4.7.0)
• Non-root user (appuser, UID 1000)
• Pinned base images (golang:1.26, alpine:3.23)
• Removed tiny variant (no longer needed)
• Helm chart updated to v0.2.0 with all new parameters

Breaking Changes

• --root-dir (or ROOT_DIR) is now required
• --port (or PORT) no longer defaults to 8080 on CLI (Docker image sets PORT=8080 via ENV)
• Removed Dockerfile-tiny and basic/ directory