Release v1.1.0

CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to **NX9-WG (`nx9-wg`)** are documented here.
 
+## [1.1.0] — 2026-09-02
+
+### Added
+- **Interface Roles**: Explicit `InterfaceRole` discriminator (`Overlay` vs `Upstream`). Primary interface `wg0` is protected from deletion and disabling.
+- **Optional Third-Party Upstream Interfaces**: In-process parser and validator for standard third-party WireGuard `.conf` files (validated against ProtonVPN), creating managed `Upstream` interfaces (e.g. `proton0`) with exactly one provider peer.
+- **REST API Endpoints**: Added `POST /api/v1/interfaces/upstreams/preview` (dry-run configuration validation with secret redaction), `POST /api/v1/interfaces/upstreams/import` (atomic SQLite persistence and reconciliation), and `POST /api/v1/interfaces/{id}/restart` (link teardown and re-synchronization).
+- **Native CLI Commands**: Added `nx9-wg interface upstream` command suite (`list`, `show`, `import`, `status`, `enable`, `disable`, `restart`, `delete`) and `nx9-wg interface restart`.
+- **Read-Only SPA CLI Console**: Embedded web-based CLI runner enforcing a strict read-only command allowlist and output secret scrubbing.
+- **Reconciliation Hardening**: Added orphan kernel interface detection and removal during `apply()`, backed by empty-desired-state safety guards preventing destructive cleanup on database read failures.
+- **Provider AllowedIPs Preservation**: Upstream provider peers retain full-tunnel AllowedIPs (`0.0.0.0/0, ::/0`) in WireGuard Cryptokey Routing without modifying or hijacking host Linux FIB default routes.
+
+### Changed
+- **Optional Local Listen Ports**: Changed `Interface.listen_port` to `Option<u16>` across domain models, Netlink device configuration, REST API, and SQLite database (`0005_optional_listen_port.sql`).
+- **Dynamic Port Web UI**: Unspecified listen ports are rendered as `Auto (Dynamic)` rather than a fabricated `51820`.
+
+### Fixed
+- **Local Listen Port Collision (errno=-98 / EADDRINUSE)**: Fixed upstream interfaces defaulting omitted `ListenPort` to `51820`, which collided with `wg0`. Omitted listen ports now remain `None`, allowing Linux WireGuard to bind an ephemeral dynamic UDP port.
+- **Reconciliation Dynamic Port Drift**: Suppressed false listen-port drift when desired `listen_port` is `None` and the kernel reports a dynamic port.
+- **Provider Endpoint Port Independence**: Ensured remote destination `[Peer] Endpoint` port (e.g. `37.19.199.155:51820`) is strictly preserved and never assigned as the local interface listen port.
+
+### Interoperability Status
+- **ProtonVPN**: ProtonVPN WireGuard `.conf` files import and synchronize cleanly into Linux kernel devices (`proton0`) with dynamic local listen ports. Upstream connectivity status is classified as `interop_pending_external_validation` (pending external provider session/endpoint resolution, not an NX9-WG implementation defect).
+
 ## [1.0.0] — 2026-08-18
 
 NX9-WG 1.0.0 is the first production release of the native Linux WireGuard + network control plane.