Changelog

All notable changes to Aegis are documented here.

[1.1.0] — 2026-05-23

Styled error pages — 403 (RBAC block) and 429 (rate limit) responses now serve a dark HTML page instead of a bare status code. Customisable contact / appeal message. Can be previewed inline before saving.
Maintenance mode — Put any listener (or individual SNI filter chains) into a 503 "We'll be back shortly" page with one click. Full per-domain granularity: https_listener:app.example.com puts only that domain into maintenance while leaving every other domain online.
Dynamic preview — Block page and maintenance page previews render in an inline iframe that auto-refreshes as you type the contact message. No save required to see the result.
Multi-SNI display — Maintenance panel now shows all SNI names for each filter chain (e.g. nas, nas.example.com) so multi-SNI chains are fully visible.
Protection section moved above Topology in the Gateway navigation.

gateway_set_maintenance now understands three key formats:
- ["*"] — every listener
- ["<listener>"] — every filter chain in that listener
- ["<listener>:<sni>"] — a single filter chain by SNI/domain
gateway_list_listeners returns filter_chains with per-chain sni_domains so Owl can discover exact SNI keys before targeting a domain.
MCP tool descriptions and incident response procedure updated; setup-specific defaults removed.

Fixed Envoy NACK caused by invalid ResponseFlagFilter flag values ("RBAC", "RL") not present in Envoy 1.35's allowlist — replaced with StatusCodeFilter matching by HTTP status code.
Fixed SubstitutionFormatString deprecation warning in Envoy 1.35 — migrated from text_format to text_format_source / DataSource_InlineString.

All hardcoded hex colors in the Gateway panel replaced with CSS theme variables — Protection cards, rate limit panel, block pages panel, and maintenance panel now adapt correctly to dark, dim, slate, and light themes.

Gateway

Envoy xDS control plane — manage listeners, clusters, filter chains, secrets via UI
Visual filter chain editor with domain/SNI routing, TLS, WebSocket, and HTTP extension support
Usage badges on clusters and extension configs showing how many filter chains reference them
Import/export gateway configuration as JSON
Topology view showing gateway layout

Security

Real-time IP blocking with manual and automatic modes
Detection rules: rate flood, 404 scan, path scan, bad user-agent, 5xx flood, attack path instant response
Trusted IP whitelist (never auto-blocked)
Delegated analysis mode — forward IPs to an external analysis server

AI & Intelligence

Background IP classification using Gemini, Claude, GPT, DeepSeek, or Ollama
Per-IP profiles with threat score, confidence, classification reasons, and AI summary
IP enrichment: ASN/ISP, PTR record, VPN/proxy/Tor detection, AbuseIPDB reputation
Owl AI chat assistant — ask about traffic, threats, and gateway configuration in plain language
Owl Patrol — autonomous scheduled threat sweep with configurable notification on findings
Ask Owl buttons on every dashboard card and config form for contextual AI help

Certificates

Analytics

Notifications

Telegram bot and webhook (Discord, Slack, generic) channels
Per-event toggle: IP blocked, DDoS pattern, error spike, cert expiry, daily digest
Notification suppression / dedup with follow-up summary
Event log with retry-on-failure
Daily digest with optional AI narrative

Auth

Geo

Other