Changelog

All notable changes to Aegis are documented here.

[1.0.0] — 2026-05-19

Initial release

Gateway

• Envoy xDS control plane — manage listeners, clusters, filter chains, secrets via UI
• Visual filter chain editor with domain/SNI routing, TLS, WebSocket, and HTTP extension support
• Usage badges on clusters and extension configs showing how many filter chains reference them
• Import/export gateway configuration as JSON
• Topology view showing gateway layout

Security

• Real-time IP blocking with manual and automatic modes
• Detection rules: rate flood, 404 scan, path scan, bad user-agent, 5xx flood, attack path instant response
• Trusted IP whitelist (never auto-blocked)
• Delegated analysis mode — forward IPs to an external analysis server

AI & Intelligence

• Background IP classification using Gemini, Claude, GPT, DeepSeek, or Ollama
• Per-IP profiles with threat score, confidence, classification reasons, and AI summary
• IP enrichment: ASN/ISP, PTR record, VPN/proxy/Tor detection, AbuseIPDB reputation
• Owl AI chat assistant — ask about traffic, threats, and gateway configuration in plain language
• Owl Patrol — autonomous scheduled threat sweep with configurable notification on findings
• Ask Owl buttons on every dashboard card and config form for contextual AI help

Certificates

• ACME automation: Let's Encrypt, ZeroSSL, custom ACME CAs
• HTTP-01 and DNS-01 (Cloudflare, Route53, GoDaddy) challenges
• Manual PEM upload
• Auto-renewal 30 days before expiry, pushed to Envoy via SDS (zero downtime)

Analytics

• Live request feed with method, path, status, latency, country, user-agent
• Traffic timeline chart
• Top IPs panel with geo, ASN, and block status
• World map with request density
• Device type and HTTP status code breakdowns
• Domain traffic distribution
• Historical mode (daily summaries) for 30d, 90d, 180d, 1y ranges

Notifications

• Telegram bot and webhook (Discord, Slack, generic) channels
• Per-event toggle: IP blocked, DDoS pattern, error spike, cert expiry, daily digest
• Notification suppression / dedup with follow-up summary
• Event log with retry-on-failure
• Daily digest with optional AI narrative

Auth

• Built-in username/password login
• OIDC/SSO (Google, Authentik, Keycloak, any OIDC provider)
• Optional: disable password login (SSO-only mode)

Geo

• Remote geo lookup via ip-api.com (free, 45 req/min)
• Local geo lookup via MaxMind GeoLite2-City.mmdb (no rate limits)

Other

• Three UI themes: Dark, GitHub, Slate (light)
• Responsive design — works on mobile
• System resource monitor in sidebar (CPU, memory, network)
• WebMCP browser extension support (18 registered tools)
• Multi-arch Docker image: linux/amd64 + linux/arm64