v0.32.5

README.md

@@ -1,4 +1,4 @@
-# RustProxy 0.32.4
+# RustProxy 0.32.5
 
 **0.31.0 panel/cache additions:** browser-negotiated Zstd/Brotli/gzip for HTML, JS and CSS (Settings → Administration); optional HTTP BAN/PURGE restricted to explicit IP/CIDR allowlist (Settings → Cache, disabled by default); System information Refresh button beside the API badge. See [Settings](docs/SETTINGS.md) and [Cache](docs/CACHE.md).
 
@@ -7,7 +7,32 @@ streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhos
 
 **0.31.9 Certificate API management: inspect and edit credential settings without exposing/rotating the current token, or regenerate one existing token with one-time display. Rust/Cargo and live testing required.**
 
-## What changed in 0.32.4
+## What changed in 0.32.5
+
+- **Dynamic DNS/DDNS ACL allow rules:** reusable ACL profiles, host policies,
+  inline vhost/location ACLs, and Docker ACL assignments now accept `allow
+  office.example.ddns.net` in place of a static client IP/CIDR. Existing IP,
+  CIDR and country-based controls retain their previous precedence.
+- DNS answers (A and AAAA) are refreshed every **60 seconds**, with up to
+  **128 distinct hostnames**, **32 unique addresses per hostname**, **8 parallel
+  lookups** and a **4-second timeout**. A failed/empty/invalid resolution is
+  removed from the allowlist (fail closed); successful entries expire within
+  180 seconds if refresh tasks stall. Initial access is denied until the first
+  successful lookup. No DNS lookup or locks on the proxy request path.
+- The ACL profile editor now offers an IP/CIDR vs DNS/DDNS selector and
+  explains the allow-only semantics. Existing JSON documents keep the `network`
+  string format; no database migration, extra public route or backend resolver
+  behavior change. Name resolution follows the machine's DNS configuration.
+- DNS names are **allow-only**: dynamic deny rules are rejected because a DNS
+  outage could otherwise silently remove a security deny. Hostnames must be
+  ASCII FQDNs (punycode for IDNs, no wildcards, URL or ports).
+- **Security note:** allowing a DDNS hostname delegates address authorization
+  to whoever controls its DNS records. Use trusted domains and keep a
+  default-deny ACL profile; old IPs may remain allowed until the next DNS refresh.
+- Rust/Cargo compilation and real DNS/address-rotation testing are **pending**
+  before production deployment.
+
+## Previously in 0.32.4
 
 - **Follow-up build correction:** a retry request now passes a cloned URI to
   the HTTP request builder, retaining the original for backend-specific