v.34.1

docs/CONFIGURATION.md

@@ -2,12 +2,26 @@
 
 Most settings are managed in the authenticated panel. Save changes after validation; use **Configuration history** to compare or restore an earlier revision. Some listeners are process-owned and require restart to change. Configuration updates are not a replacement for encrypted full backups.
 
+## JSON file as authoritative configuration (0.34.1 DEV)
+
+Start the process with an **existing**, absolute JSON config filename, for example:
+
+```bash
+rust-proxy --data-dir /var/lib/rustproxy --config /etc/rustproxy/config.json serve
+```
+
+`RUST_PROXY_CONFIG=/etc/rustproxy/config.json` is an equivalent global setting. The file must be a regular file (not a symlink) within the configuration size limit and readable/writable by the service account; its parent directory must permit creation/renaming for atomic updates. The file is the canonical desired configuration. Panel and API edits, including history restore, rewrite it; SQLite retains revisions and audit. RustProxy rejects panel saves after an unimported external file edit rather than clobbering it. Use `rust-proxy reload` or `rust-proxy config reload` to import such edits after validation. No `--config` flag keeps the original SQLite-owned configuration behavior.
+
+For a systemd deployment, put `RUST_PROXY_CONFIG=/etc/rustproxy/config.json` into the private EnvironmentFile referenced by the unit, or add `--config ...` to `ExecStart`. Use `systemctl reload rustproxy` after manual edits; the example `ExecReload` calls the CLI. Keep write access to the file and directory narrowly restricted. Hot reload cannot change a process-owned listener's bind/address or ALPN without restart.
+
+
 ## Configuration map
 
 | Panel area | Main settings | Operational note |
 |---|---|---|
 | **Settings → Listeners** | Named HTTP/HTTPS frontends, addresses, HTTP/2, H2C, HTTP/3, transport limits | The selected Vhost must bind the correct listener. Binding changes may require restart. |
 | **Settings → Administration** | Dedicated admin address, HTTPS/certificate, accepted hostnames/public origin | Local HTTP by default. Remote admin requires deliberate security configuration. |
+| **Settings → Security** | Admin sessions, passwords, RO/RW API token creation and revocation, host policies | Administration includes a shortcut to API tokens here; token secret is displayed only once. |
 | **Vhosts** | Domains, certificates, source, backends, health, load balancing, custom locations | The primary place to publish a service. |
 | **Web Server** | Document roots, static delivery, rewrites, PHP-FPM, cache headers | Attach a Web Service to a Vhost as its source. |
 | **Access / ACL profiles** | IP/CIDR, DNS/DDNS allow rules, country policy, HTTP methods, rate limits | Access decisions combine across applicable levels. |