v0.34.4

docs/TRANSPORT.md

@@ -69,3 +69,7 @@ Idle/read/connect/response-header timeouts and backend connection pools are conf
 - **Unexpected HTTP→HTTPS redirect:** inspect Vhost `force_ssl`, selected listeners and actual public scheme.
 
 For listener configuration see [Configuration](CONFIGURATION.md); for safer deployment see [Security](SECURITY.md).
+
+## Docker vhost frontend protocols
+
+A published Docker vhost stores `http2_enabled` and `http3_enabled` (both `true` by default, including older assignments without these fields). Both can be disabled individually in **Docker vhosts → Configure vhost → Frontend protocols**. HTTP/1.1 remains available. These switches control only the frontend transport on listeners selected for the agent; the separate Docker backend HTTP/HTTPS scheme is unchanged. Disabled H2 is not offered by SNI/ALPN; disabled H3 rejects HTTP/3 requests and withdraws `Alt-Svc` where HTTP/3 was previously advertised. A listener must already support a protocol to use it, and adding a new QUIC listener may require a restart.