v10.33.4

Backend Connections Block Syntax

Radiator now supports a connections { ... } block for PostgreSQL, MySQL, LDAP, and RADIUS backend server connection settings.

Preferred syntax:

server "primary" {
    host "db.example.com";
    database "radiator";
    username "radiator";

    connections {
        min 1;
        max 5;
        idle-timeout 5m;
        min-timeout 1s;
        min-retry 5s;
    }
}

LDAP server blocks use the same structure, with an additional exclusive parameter for the exlusive connection pool:

server "ldap.example.com" {
    url "ldap://ldap.example.com:389/";

    connections {
        min 1;
        max 5;
        idle-timeout 60s;
        min-timeout 1s;
        min-retry 5s;
        exclusive 10;
    }
}

Configuration

Use max, idle-timeout, min, min-timeout, and min-retry inside the block for PostgreSQL and MySQL backend servers:

connections {
    max 5;
    idle-timeout 5m;
    min 1;
    min-timeout 1s;
    min-retry 5s;
}

Use the same structure for LDAP backend servers, with the additional exclusive parameter:

connections {
    max 5;
    idle-timeout 60s;
    min 1;
    min-timeout 1s;
    min-retry 5s;
    exclusive 10;
}

Use max, idle-timeout, and min for RADIUS backend server and radius-dns-sd server_template connection settings:

connections {
    max 5;
    idle-timeout 60s;
    min 1;
}

Related documentation:

• PostgreSQL backend
• PostgreSQL server
• PostgreSQL connections
• MySQL backend
• MySQL server
• MySQL connections
• LDAP backend
• LDAP server
• RADIUS backend
• RADIUS connections

Password hashing updates

Radiator now supports password_hash(...) in Radconf for all supported hash formats. PBKDF2 and Argon2 also support configurable cost options, which helps phased password rehashing during normal login flows.

Updated documentation in this branch:

• Password hashing guide
• Password rehashing during login guide

Scheduled timers

Radiator now supports top-level timer blocks that fire an @execute pipeline on a recurring schedule. Timers run in the background, and are useful for periodic maintenance, polling, cache refresh, and similar background work.

Each timer takes an interval (a fixed duration or a seven-field cron expression), an optional random jitter, and an @execute body:

timer "DAILY_REPORT" {
    interval {
        cron "0 0 2 * * * *";
        random 30s;
    }
    @execute {
        backend "REPORT_GENERATOR";
    }
}

By default, cron schedules use Radiator's time zone. A specific IANA zone can be selected per timer with the time-zone parameter. See interval for the full syntax.

See:

• timer - block reference.
• interval - shared schedule syntax, including time-zone support.
• Cron and interval timers - usage guide.

TACACS+ over TLS: no session tickets by default

tls13_session_tickets defaults to 0 on TACACS+ over TLS listeners. Set it explicitly on the tls block to enable resumption.

Adding Files to Previously Empty Directories

Previously, an empty directory that already existed in the active configuration (for example a lua directory or db/users-internal) was tracked as a separate "empty directory" change. Creating a new file inside such a directory made it no longer empty, which was incorrectly reported as a deleted directory in the pending changes list and on the Files page. Deploying then failed while trying to remove a directory that now contained the new file.

Empty directories that simply gain files are now recognized as still present, so:

• The new file deploys successfully.
• The Files page and pending review no longer show a phantom deleted-directory entry.
• An empty directory is only reported as deleted when it is actually removed from the pending configuration.

Argon2 cost parameter limits

Stored Argon2 hashes embed their memory, time and parallelism cost parameters, and verification honours whatever values appear in the stored value. To prevent a malicious or corrupted backend entry from exhausting server memory or pinning CPU per Access-Request, Radiator now enforces hard upper bounds on those parameters during both hashing (password_hash("argon2", ...)) and verification of {argon2} stored hashes.

The limits sit several orders of magnitude above current OWASP/RFC 9106 recommendations, so realistic production hashes are unaffected. Hashes whose parameters exceed the limits are rejected at verification time as if the password were incorrect, and password_hash("argon2", ...) calls with out-of-range options return an error.

Updated documentation in this branch:

• Password hashing guide

Configuration Editor Unsaved Navigation

When navigating away from an edited configuration file, choosing Save or Discard in the unsaved-change dialog now resumes the navigation that opened the dialog. Dialog saves also wait for the file upload to complete before leaving the editor.

Execution Context Documentation

The execution context documentation now separates always-available utility namespaces from request-specific runtime namespaces. This makes it clearer which variables can be used in non-request contexts such as @init and timer pipelines.

The server.* namespace now documents and exposes server process metadata, including:

• server.instance_id
• server.cluster_id
• server.hostname
• server.version
• server.build_kind
• server.build_timestamp
• server.git_branch
• server.git_commit
• server.cpu_target

These variables can be used in runtime pipeline expressions and in supported configuration-load expressions, such as file names. This is useful for log file names, per-instance performance logs, and startup or scheduled diagnostic logs.

The documentation also now includes clearer guidance for env.*, vars.*, datetime.*, and util.*, including examples for using default() in file names and deriving date parts from datetime.timestamp.

See Execution Context for the updated namespace reference and examples.

New File Status Icon

New configuration files now use a distinct add-file icon in the file list so their pending status is easier to spot.

ipmap Backend IPv4 Range Formats

ipmap.network now accepts IPv4 address ranges when populating an ipmap backend. Use explicit inclusive ranges such as 192.0.2.10 - 192.0.2.12. You can also use trailing wildcard ranges such as 198.51.100.*, 10.0.*, and 10.*.

Radiator converts each range into exact covering CIDR prefixes before storing it in the map. Existing CIDR prefixes and individual IP address values continue to work.

See ipmap for configuration examples and validation rules.

Log Rotation

File loggers now support built-in rotation with a rotate block. Configure rotation by cron schedule, timer interval, file size, or a combination of schedule and size limit. Default rotated files can also be retained with keep and compressed with gzip by using compress.

file {
    filename "<cwd>/radiator-server.log";
    json_log;

    rotate {
        interval {
            cron "0 0 0 * * * *";
            time-zone "local";
        }
        size 100MiB;
        keep 14;
        compress 5;
    }
}

When rotate is enabled without an interval, Radiator rotates daily at midnight. See file logger configuration and logging for details.

Microsoft Windows PEAP interoperability

PEAP now uses the same EAP identifier for the final PEAP extension request as the outer PEAP request that carries it. This fixes authentication failures with Microsoft Windows supplicants that reject mismatched identifiers at the end of a successful PEAP exchange.

Profile menu username

The Management UI profile menu now shows which username is logged in. This helps operators confirm which account they are using before making changes.

Management UI query cache logout handling

The Management UI now clears cached API data after a successful logout. This prevents stale data from a previous session from appearing after another user logs in.

The UI also stops retrying HTTP 4xx responses from authenticated queries. These responses usually require a different request, permission, or login state instead of another identical retry.

Documentation anchor links

Documentation and release note links that include a section anchor now keep the requested section in view. This fixes links that briefly scrolled to the section and then returned to the top of the page.

Syslog TCP, TLS, and Overflow Logging

Syslog logging now supports remote TCP and TLS delivery, with queued writes so slow syslog receivers do not block normal logging. Configure an overflow-file to keep rows that cannot be delivered fast enough or when the syslog backend is unavailable.

When format is omitted, remote stream transports use RFC 5424 messages with octet-counted framing. TCP uses RFC 6587 framing, and TLS uses the RFC 5425 framing profile. The local Unix socket keeps RFC 3164 for compatibility.

See syslog logger configuration for configuration details.

Application log history preserved across restarts

When the application file logger uses JSON format, recent rows are read back from the file on startup so the in-memory log history (visible through the Management API and UI) survives restarts.

TLS session resumption is now disabled by default

TLS session resumption is now turned off by default on all server listeners, so every connection performs a full TLS handshake unless you opt in. This gives predictable, up-to-date certificate and policy checks out of the box, but existing listeners that relied on resumption will do more full handshakes until you re-enable it.

To allow resumption on a listener, set tls12_session_id_resumption true; for TLS 1.2 or tls13_session_tickets N; for TLS 1.3. Use the new session_cache_size setting to bound the shared resumption cache (default 256 entries).

See docs/configuration/servers.tls.md for the full TLS listener settings.