0.34.9

src/admin/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "RustProxy Administration API",
-    "version": "0.34.8",
+    "version": "0.34.9",
     "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust. The API also permits explicitly scoped GeneralApiBearer tokens on a narrow route allowlist, with RO/RW and source CIDR checks; API-token management and Prometheus-token management are browser-session-only."
   },
   "servers": [
@@ -622,6 +622,11 @@
                 "items": {
                   "type": "string"
                 }
+              },
+              "post_quantum": {
+                "type": "boolean",
+                "default": false,
+                "description": "Experimental hybrid X25519MLKEM768 TLS 1.3 key exchange. Can only be enabled for a Vhost when enabled in the global TLS policy. HTTP/3 Vhosts must match the global policy."
               }
             },
             "additionalProperties": false,
@@ -772,7 +777,35 @@
           },
           "tls": {
             "type": "object",
-            "properties": {},
+            "properties": {
+              "policy": {
+                "type": "object",
+                "description": "Global TLS policy inherited by frontends, including experimental post-quantum key exchange.",
+                "properties": {
+                  "tls12": {
+                    "type": "boolean",
+                    "default": true
+                  },
+                  "tls13": {
+                    "type": "boolean",
+                    "default": true
+                  },
+                  "cipher_suites": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "TLS cipher suites, independent of key exchange groups."
+                  },
+                  "post_quantum": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Experimental hybrid X25519MLKEM768 TLS 1.3 key exchange. Requires tls13=true, uses aws-lc-rs for frontend TLS; classic groups remain as fallback."
+                  }
+                },
+                "additionalProperties": false
+              }
+            },
             "additionalProperties": true
           },
           "cache": {