release: v1.5.2

New: HTTPS for the panel. The reverse proxy serves the UI over TLS on 443
alongside plain HTTP on 80 (a cert issue can't lock you out). A per-install
leaf is signed by a local PiTun CA, generated before nginx starts
(scripts/gen-cert.sh) with the box's LAN IP + pitun/pitun.local in the SAN;
Settings offers the root CA for download to drop the browser warning. WS / log
streams upgrade to wss:// automatically. gen-cert runs from 03-deploy so
existing boxes pick it up on the next deploy.

New: NodeCircle "shrank by refresh" highlight. A subscription refresh that
removes a circle member records a circle.pruned event (Recent Events) and the
NodeCircles page flags circles with a missing member or <2 nodes with a "check
members" badge — the provider-moved-a-node-to-a-new-address case (new id, not
auto-re-added).

Changed: host IPv6 disabled by default on a CLEAN install (disable_ipv6=true
seeded for fresh DBs only; INSERT OR IGNORE leaves existing installs alone).
Dark-theme blue pills use a desaturated grey-blue.

Housekeeping: sanitized example identifiers in a few comments and test
fixtures (no behaviour change).

Frontend build + 82 tests green; changed backend suites (config_gen,
route_explain, routing_import_export) pass. No schema migration.

Author: DaveBugg

CHANGELOG.md

@@ -4,6 +4,44 @@ All notable user-facing changes to PiTun. Full per-release detail lives in the
 [GitHub Releases](https://github.com/DaveBugg/PiTun/releases); this file is the
 committed summary.
 
+## v1.5.2 — 2026-08-06
+
+Adds HTTPS for the panel (per-install cert + downloadable local CA), disables
+host IPv6 by default on clean installs, and surfaces NodeCircles that a
+subscription refresh shrank.
+
+### Added
+
+- **HTTPS for the panel.** The reverse proxy now serves the UI over TLS on
+  **443** alongside plain HTTP on 80, so a cert issue can't lock you out. A
+  per-install certificate is signed by a local **PiTun CA**, generated before
+  nginx starts (`scripts/gen-cert.sh`), with the box's LAN IP + `pitun` /
+  `pitun.local` in the SAN. **Settings → HTTPS** offers the root CA for
+  download — trust it once to drop the browser warning. WebSocket / log
+  streams upgrade to `wss://` automatically. Existing boxes pick it up on the
+  next deploy.
+- **NodeCircle "shrank by refresh" highlight.** When a subscription refresh
+  removes a node that belonged to a circle, PiTun records a `circle.pruned`
+  event (Recent Events) naming the affected circle(s), and the NodeCircles
+  page flags any circle with a missing member or fewer than 2 nodes with a
+  **check members** badge. Covers the case where a provider moves a node to a
+  new address — it comes back as a new id and isn't auto-re-added.
+
+### Changed
+
+- **Host IPv6 is disabled by default on a CLEAN install** (`disable_ipv6=true`
+  seeded for fresh DBs only). PiTun's TPROXY is IPv4-only, so this avoids a
+  class of IPv6-path surprises; existing installs keep whatever they had
+  (`INSERT OR IGNORE` — an upgrade never flips it). Client-side IPv6 leaks
+  were already closed by `dns_query_strategy=UseIPv4`.
+- **Dark-theme polish.** Blue type/mode pills (rules / vmess / src_ip) use a
+  desaturated grey-blue in dark mode instead of the saturated blue-900 wash.
+
+### Housekeeping
+
+- Sanitized example identifiers in a few source comments and test fixtures
+  (no behaviour change).
+
 ## v1.5.1 — 2026-08-06
 
 Fixes the active node reporting no speed on a general sweep, adds a REALITY

backend/app/api/subscriptions.py

@@ -684,6 +684,7 @@ async def _fetch_subscription_unlocked(sub_id: int) -> None:
         # the circle enabled lets it spring back to life automatically
         # if the operator re-adds nodes to the panel.
         circles_pruned: list[int] = []
+        pruned_summary: list[str] = []  # "'name' (-N)" per affected circle
         if removed_ids:
             import json as _json
             all_circles = (await session.exec(select(NodeCircle))).all()
@@ -709,6 +710,7 @@ async def _fetch_subscription_unlocked(sub_id: int) -> None:
                 circle.node_ids = _json.dumps(surviving_ids)
                 session.add(circle)
                 circles_pruned.append(circle.id)
+                pruned_summary.append(f"'{circle.name}' (-{len(ids) - len(surviving_ids)})")
             if circles_pruned:
                 logger.warning(
                     "Subscription %d refresh: pruned dangling refs from "
@@ -779,6 +781,24 @@ async def _fetch_subscription_unlocked(sub_id: int) -> None:
                 ),
             )
 
+        # Surface pruned circles in the Recent Events feed so the operator
+        # notices a circle that shrank — especially the "provider moved a node
+        # to a new address" case, where the node returns as a NEW id and is
+        # not auto-re-added to the circle.
+        if pruned_summary:
+            from app.core.events import record_event
+            await record_event(
+                category="circle.pruned",
+                severity="warning",
+                title="NodeCircle membership changed by refresh",
+                details=(
+                    f"Subscription {sub_id} refresh removed node(s) from circle(s): "
+                    f"{', '.join(pruned_summary)}. A node removed from the panel — or "
+                    f"moved to a new address, which returns as a new id — is not "
+                    f"auto-re-added; check the circle membership."
+                ),
+            )
+
         await _reload_if_config_nodes_touched(
             session,
             touched_ids=changed_ids | removed_ids,

backend/app/config.py

@@ -5,7 +5,7 @@
 # OpenAPI metadata, `/health` response, and `/system/status` so the
 # frontend can display it next to the xray version. Bump this on each
 # release — frontend keeps its own version in `frontend/package.json`.
-APP_VERSION = "1.5.1"
+APP_VERSION = "1.5.2"
 
 
 class Settings(BaseSettings):

backend/app/database.py

@@ -200,7 +200,13 @@ async def init_default_settings():
         # Health check
         "health_interval": str(settings.health_interval),
         "health_timeout": str(settings.health_timeout),
-        "disable_ipv6": "false",
+        # Disabled by default on a CLEAN install: PiTun's TPROXY pipeline is
+        # IPv4-only, so turning host IPv6 off avoids a whole class of
+        # IPv6-path surprises (the DNS engine already returns IPv4-only to
+        # clients via dns_query_strategy=UseIPv4). INSERT OR IGNORE means
+        # existing boxes keep whatever they already have — only a fresh DB
+        # picks up this default, so upgrades never flip it silently.
+        "disable_ipv6": "true",
         "dns_over_tcp": "false",
         # LAN proxy authentication (since v1.3.0-beta.6). Applies to
         # the explicit SOCKS5 + HTTP inbounds (not TPROXY — that one

backend/app/models.py

@@ -722,7 +722,7 @@ class ProxyChain(SQLModel, table=True):
 
     A `ChainClient` is one logical user — when created it spawns N
     panel-side clients (one per channel), so the user gets N VLESS
-    URIs (e.g. "VPN-VK" / "VPN-MAX" / ...) all backed by the same
+    URIs (e.g. "VPN-A" / "VPN-B" / ...) all backed by the same
     exit IP. Importing any of them as a `Node` makes PiTun route
     through that chain end-to-end.
     """

backend/tests/test_config_gen.py

@@ -349,19 +349,19 @@ def test_global_mode_skips_user_routing_rules(self):
         catch-all to active node. This is the contract the new
         Routing-page banner (frontend 1.3.5) tells the user about."""
         node = _make_node(id=11)
-        # A user rule that would normally send vk.com direct
+        # A user rule that would normally send ru-site.example direct
         user_rule = RoutingRule(
             id=99, name="bypass vk", rule_type="domain",
-            match_value="vk.com", action="direct", order=0, enabled=True,
+            match_value="ru-site.example", action="direct", order=0, enabled=True,
         )
         cfg = generate_config(
             node, [node], [user_rule], "global", _default_settings(),
         )
-        # No rule mentions vk.com
+        # No rule mentions ru-site.example
         for r in cfg["routing"]["rules"]:
-            assert "vk.com" not in str(r), (
+            assert "ru-site.example" not in str(r), (
                 "global mode must NOT emit user RoutingRule rows; "
-                f"found one referencing vk.com: {r}"
+                f"found one referencing ru-site.example: {r}"
             )
 
 
@@ -652,7 +652,7 @@ def test_doh_uses_https(self):
     # ── DNS-upstream outboundTag pinning (since v1.3.5) ────────────────
     #
     # Pinning DNS servers to `outboundTag: direct` is the fix for the
-    # 192.168.1.4 burn-in lockup. The contract these tests pin: every
+    # DNS burn-in lockup. The contract these tests pin: every
     # DNS server entry must end up as a dict with outboundTag=direct,
     # regardless of whether the operator configured it as a bare
     # upstream, a per-domain object, or a fallback. The only exception
@@ -717,7 +717,7 @@ def test_per_rule_dns_pinned(self):
         outboundTag=direct without losing their existing fields."""
         from app.models import DNSRule
         rules = [DNSRule(
-            id=1, name="r", domain_match="vk.com",
+            id=1, name="r", domain_match="ru-site.example",
             dns_server="77.88.8.8", dns_type="plain",
             enabled=True, order=10,
         )]
@@ -732,7 +732,7 @@ def test_per_rule_dns_pinned(self):
         assert yandex is not None, cfg["dns"]["servers"]
         assert yandex["outboundTag"] == "direct"
         # Existing fields preserved
-        assert "vk.com" in yandex.get("domains", [])
+        assert "ru-site.example" in yandex.get("domains", [])
 
     def test_ru_bypass_dns_pinned(self):
         """`bypass_ru_dns=true` adds a Yandex-DNS server for RU domains.

backend/tests/test_route_explain.py

@@ -386,9 +386,9 @@ def test_parses_arrow_separator(self):
     def test_parses_legacy_doublearrow(self):
         from app.core.route_explain_probe import _read_chosen_outbound
         import tempfile, os
-        log = "2026 accepted tcp:vk.com:443 [probe-in >> direct]\n"
+        log = "2026 accepted tcp:ru-site.example:443 [probe-in >> direct]\n"
         fd, p = tempfile.mkstemp(); os.write(fd, log.encode()); os.close(fd)
         try:
-            assert _read_chosen_outbound(p, "vk.com") == "direct"
+            assert _read_chosen_outbound(p, "ru-site.example") == "direct"
         finally:
             os.remove(p)

backend/tests/test_routing_import_export.py

@@ -26,7 +26,7 @@ def _seed_global(session, *rules):
 class TestImportPreview:
     def test_new_rules_into_global(self, client, session, auth_headers, default_settings):
         r = client.post("/api/routing/import/preview", headers=auth_headers, json={
-            "rules": [_r("domain", "youtube.com", "proxy"), _r("domain", "vk.com", "direct")],
+            "rules": [_r("domain", "youtube.com", "proxy"), _r("domain", "ru-site.example", "direct")],
             "destination": {"kind": "global"},
         })
         assert r.status_code == 200, r.text

backend/tests/test_subscriptions.py

@@ -174,7 +174,7 @@ class TestSubscriptionRefreshUpsert:
     `active_node_id` across a refresh. Drives the same code path as
     the real `_fetch_subscription` but with the network fetch stubbed
     to a deterministic URI list. Mirrors the real-world failure mode
-    the user hit on 192.168.1.4 with a 1256-node subscription."""
+    seen with a 1256-node subscription."""
 
     def test_active_node_survives_refresh_when_node_returns(
         self, client, admin_user, auth_headers, session,

docker-compose.yml

@@ -127,8 +127,12 @@ services:
     restart: unless-stopped
     ports:
       - "80:80"
+      - "443:443"
     volumes:
       - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      # Per-install TLS cert + local CA, generated by scripts/gen-cert.sh
+      # BEFORE nginx starts (listen 443 ssl aborts without them).
+      - /etc/pitun/certs:/etc/nginx/certs:ro
     extra_hosts:
       # backend uses network_mode:host, so it's not on the Docker bridge.
       # host-gateway resolves to the host IP so nginx can reach it.