v0.32.5

docs/SETTINGS.md

@@ -607,3 +607,30 @@ The sample charts are browser-local, bounded and reset on a changed config
 revision, logout or source unavailability. They are not computed while hidden.
 No additional polling, SQLite schema migration or new administrator endpoint
 is introduced. Existing Stream widgets remain independent.
+
+
+## Dynamic DNS / DDNS client ACL (0.32.5)
+
+In **ACL profiles**, add an **Allow** rule and select **DNS / DDNS** instead of
+IP/CIDR. Enter the hostname without a URL, port or wildcard, for example:
+
+```text
+allow myoffice.example.ddns.net
+```
+
+Apply the profile to the desired vhost. Use the **Allow exceptions** preset
+(default deny) to admit only resolved addresses (and any other explicitly
+allowed IP/country exceptions). Host policies and inline vhost/location ACLs
+accept the same rule format. A/AAAA records are refreshed every 60 seconds,
+with immediate refresh on published configuration changes. No request-path DNS
+lookup is performed. The initial state and failed, empty, oversized, or expired
+DNS results **do not authorize any client IP** for that DNS rule. Only
+**allow** rules may contain DNS names; `deny example.com` is rejected.
+
+Limits: 128 distinct names across active ACLs, 32 returned IPs/name, four-
+second lookup timeout and eight parallel DNS lookups. Successful answers expire
+after 180 seconds if the refresh task stalls. DNS changes may take up to the
+next poll interval to take effect. The chosen DDNS provider controls which IPs
+receive access; always trust the provider and protect its credentials. Existing
+IP/CIDR ACLs and country rules are unchanged. No new admin access path or
+backend origin DNS exceptions are created by this feature.

docs/TEST_REPORT.md

@@ -1,63 +0,0 @@
-# Verification report - RustProxy 0.32.4
-
-## Scope
-
-Review of the supplied RustProxy 0.32.3 source and patch to 0.32.4:
-HTTP Host / HTTP/2 authority parity, explicit TCP/DNS destination and TLS/SNI
-isolation, relaxed HTTPS-by-IP troubleshooting hint, and uniform Overview gutters.
-Follow-up patch to the first 0.32.4 archive:
-- Fix reported `E0382` in `src/proxy/types.rs`: `Request::builder().uri(uri)`
-  moved `uri` before `upstream_request_target(&uri, ...)` could borrow it.
-  `.uri(uri.clone())` preserves the original URI for authority selection.
-- Make normal Overview gutters uniformly 4px (dense 3px, comfortable 12px).
-  Resolve the higher-specificity `html[data-dashboard-density] .stats-grid`
-  rule which otherwise overrode the aligned grid and kept the larger gaps.
-Existing database/configuration schemas and retry/transport policies are
-unchanged. Only compiling Rust and live protocol tests prove runtime behavior.
-
-## Available checks
-
-- `./dev.sh test`: **all pre-Cargo checks passed**, including source/security,
-  SQLite migration/upgrade/backup simulations, memory-model scripts and **35
-  Node.js UI/behavior test scripts**. The command then exited **127** because
-  Rust/Cargo is not installed; this is **not** a passing Rust test run.
-- New `preserve_host_0324.py` and `preserve_host_0324_ui_test.mjs` passed:
-  authority/destination split source contracts, four protocol selectors,
-  verified/unencrypted origin warnings, explicit diagnostics preset.
-- Expanded Chromium CSS fixture `tools/checks/overview_gutters_0324_browser.py`:
-  **27 checks passed** (3 container widths x 3 UI density modes x 3 Dashboard
-  densities), checking horizontal/vertical gutters, equally high rows and
-  numeric-to-large-card transition. Normal/dense/comfortable gaps measured
-  **4/3/12px** and the outer grid bottom margin remained `0px`.
-  The older `overview_grid_spacing_0323_browser.py` also passed with all
-  62 blocks, responsive breakpoints and browser zoom 90%-130%.
-  These are simulated layout tests, not a live administrator session.
-- `preserve_host_0324.py` now guards against moving `uri` before its final
-  authority adjustment, in addition to the backend/transport source contracts.
-  The existing Rust unit test for retry authority remains in the source.
-- Version consistency: Cargo manifest, package root in existing lockfile,
-  OpenAPI, README, release notes and static assertion fixtures updated to 0.32.4.
-  External Cargo dependency resolutions have **not** been regenerated.
-
-## Rust validation not performed (blocking for production)
-
-The user's Rust compiler reported `error[E0382]: borrow of moved value: uri`
-from the first 0.32.4 archive. This has been corrected in source, but **the
-corrected code has not been compiled here**: no Cargo or Rust compiler is
-available in the source-editing environment.
-Do not treat static tests or the simulated TLS-peer tests added to Rust source
-as evidence that RustProxy builds or that an actual Angie backend accepts the
-corrected requests. Run, on a Rust 1.99+ host:
-
-```sh
-cargo fmt --all -- --check
-cargo check --locked --all-targets
-cargo test --locked
-```
-
-Then validate on staging with HTTPS-by-IP and `preserve_host: true` for
-HTTP/1.1, Auto (H2 and H1 ALPN), compatible HTTP/2 and strict H2; check
-`:authority` vs `Host`, SNI, certificate verification, WebSockets, H2C and
-HTTP health probe `host` overrides. Inspect Angie response/error logs for
-400 responses and verify backend connectivity through pool rotation/retry.
-No claim of universal backend compatibility or measured throughput is made.