v0.34.4

src/admin/web/docker.js

@@ -52,23 +52,25 @@
   function checkboxField(key, control) { const field = el("div", undefined, "docker-field docker-checkbox-field"), label = el("label", undefined, "check vh-check"); label.append(control, el("span", t("enabled"))); field.append(el("span", t(key)), label); return field; }
   function selectedProfileIds(value) { return [...new Set([value?.acl_profile_id, ...(value?.acl_profile_ids || [])].filter(Boolean))]; }
   function profileChoices(initial, className) {
-    const box = el("div", undefined, `docker-acl-choices ${className}`), chosen = new Set(initial);
-    for (const profile of envelope?.config?.acl_profiles || []) {
-      const label = el("label", undefined, "check docker-acl-choice"), control = input("", "checkbox");
-      control.value = profile.id; control.checked = chosen.has(profile.id);
-      label.append(control, el("span", profile.name || profile.id)); box.append(label);
-    }
-    if (!box.children.length) box.append(el("span", t("dockerDefaultAclNone"), "fine"));
-    return box;
+    return window.rustProxyAclPicker.create(initial, className);
   }
   function readProfileChoices(scope, selector) {
-    return [...scope.querySelectorAll(`${selector} input[type=checkbox]:checked`)].map(input => input.value);
+    return window.rustProxyAclPicker.read(scope.querySelector(selector));
   }
   function profileWarning(choices, inheritedCount = 0) {
     const warning = el("p", t("multiAclWarning"), "fine acl-stack-warning");
-    const sync = () => { warning.hidden = (readProfileChoices(choices, ":scope").length || inheritedCount) < 2; };
+    const sync = () => {
+      const selected = window.rustProxyAclPicker.count(choices);
+      warning.hidden = (selected || inheritedCount) < 2;
+    };
     choices.addEventListener("change", sync); sync(); return warning;
   }
+  function profileField(key, picker, help) {
+    const wrapper = el("div", undefined, "docker-field docker-profile-field");
+    wrapper.append(el("span", t(key)), picker);
+    if (help) wrapper.append(el("small", help, "fine"));
+    return wrapper;
+  }
   function aliasEditor(initial = [], onChange = () => { }) {
     const field = el("div", undefined, "docker-field docker-alias-field host-chip-field"), box = el("div", undefined, "host-chip-editor docker-alias-editor"), inputNode = input("", "text", "docker-alias-input");
     field.append(el("span", t("dockerAliases"))); inputNode.maxLength = 253; inputNode.placeholder = "alias1 / app.example.com"; inputNode.setAttribute("aria-label", t("dockerAliasAdd"));
@@ -165,7 +167,7 @@
     const certificate = el("select", undefined, "docker-agent-certificate"), defaultCertificate = el("option", t("vhCertificateDefault")); defaultCertificate.value = ""; certificate.append(defaultCertificate);
     for (const cert of envelope?.config?.tls?.certificates || []) { const item = el("option", cert.id); item.value = cert.id; certificate.append(item); } certificate.value = value.certificate_id || "";
     const defaultAcl = profileChoices(selectedProfileIds(value), "docker-agent-acl-profile");
-    const defaultAclField = labeled("dockerDefaultAcl", defaultAcl, t("dockerDefaultAclHelp"));
+    const defaultAclField = profileField("dockerDefaultAcl", defaultAcl, t("dockerDefaultAclHelp"));
     defaultAclField.append(profileWarning(defaultAcl));
     const grid = el("div", undefined, "field-grid docker-agent-grid");
     grid.append(labeled("dockerAgentId", id), labeled("dockerAgentName", name), labeled("dockerAgentEndpoint", endpoint, t("dockerAgentEndpointHelp")), labeled("dockerAgentToken", token), labeled("dockerTlsFingerprint", fingerprint, t("dockerTlsFingerprintHelp")), labeled("dockerBaseDomain", domain), labeled("dockerPollInterval", poll, t("dockerPollIntervalHelp")), labeled("dockerDefaultTarget", target), labeled("dockerCertificate", certificate, t("dockerCertificateHelp")), defaultAclField);
@@ -258,13 +260,13 @@
     const details = el("details", undefined, "docker-acl-editor"), summary = el("summary"); summary.append(el("span", t("dockerAccessControl")), el("small", t("dockerAclSummary"), "fine")); details.append(summary);
     const grid = el("div", undefined, "field-grid docker-acl-grid"), profile = profileChoices(selectedProfileIds(assignment), "docker-acl-profile");
     const inheritedProfiles = selectedProfileIds(agent);
-    const profileField = labeled("dockerAclProfile", profile, inheritedProfiles.length ? `${t("dockerAclProfileInherit")}: ${inheritedProfiles.map(id => (envelope?.config?.acl_profiles || []).find(item => item.id === id)?.name || id).join(", ")}` : t("dockerAclProfileNone"));
-    profileField.append(profileWarning(profile, inheritedProfiles.length));
+    const profileControl = profileField("dockerAclProfile", profile, inheritedProfiles.length ? `${t("dockerAclProfileInherit")}: ${inheritedProfiles.map(id => (envelope?.config?.acl_profiles || []).find(item => item.id === id)?.name || id).join(", ")}` : t("dockerAclProfileNone"));
+    profileControl.append(profileWarning(profile, inheritedProfiles.length));
     const inline = input("", "checkbox", "docker-acl-inline"); inline.checked = !!assignment?.acl; const inlineLabel = checkboxField("dockerAclInline", inline);
     const defaultAction = el("select", undefined, "docker-acl-default"); for (const value of ["deny", "allow"]) { const option = el("option", t(value)); option.value = value; defaultAction.append(option); } defaultAction.value = assignment?.acl?.default || "deny";
     const rules = document.createElement("textarea"); rules.className = "docker-acl-rules"; rules.rows = 4; rules.maxLength = 32768; rules.spellcheck = false; rules.value = rulesText(assignment?.acl); rules.placeholder = "allow 10.0.0.0/8\ndeny 0.0.0.0/0";
     const sync = () => { defaultAction.disabled = !inline.checked; rules.disabled = !inline.checked; }; inline.addEventListener("change", sync); sync();
-    grid.append(profileField, inlineLabel, labeled("dockerAclDefault", defaultAction), labeled("dockerAclRules", rules, t("dockerAclHelp"))); details.append(grid); return details;
+    grid.append(profileControl, inlineLabel, labeled("dockerAclDefault", defaultAction), labeled("dockerAclRules", rules, t("dockerAclHelp"))); details.append(grid); return details;
   }
   function timeoutEditor(assignment) {
     const value = { ...defaultProxyTimeouts(), ...(assignment?.proxy_timeouts || {}) }, details = el("details", undefined, "docker-timeout-editor"), summary = el("summary"); summary.append(el("span", t("dockerProxyTimeouts")), el("small", t("dockerProxyTimeoutsHelp"), "fine")); details.append(summary);
@@ -277,7 +279,7 @@
     const inline = row.querySelector(".docker-acl-inline")?.checked;
     return {
       service_key: row.dataset.key, hostname: row.querySelector(".docker-hostname").value.trim().toLowerCase(), aliases: row._readAliases?.() || [], target_ip: row.querySelector(".docker-target-ip").value || null,
-      enabled: true, scheme: row.querySelector(".docker-scheme").value, preserve_host: row.querySelector(".docker-preserve-host").checked, force_ssl: row.querySelector(".docker-force-ssl").checked, websockets: row.querySelector(".docker-websockets").checked, cache_enabled: row.querySelector(".docker-cache-enabled").checked, transform_enabled: row.querySelector(".docker-transform-enabled").checked, compression_enabled: row.querySelector(".docker-compression-enabled").checked,
+      enabled: true, scheme: row.querySelector(".docker-scheme").value, preserve_host: row.querySelector(".docker-preserve-host").checked, force_ssl: row.querySelector(".docker-force-ssl").checked, websockets: row.querySelector(".docker-websockets").checked, http2_enabled: row.querySelector(".docker-http2-enabled").checked, http3_enabled: row.querySelector(".docker-http3-enabled").checked, cache_enabled: row.querySelector(".docker-cache-enabled").checked, transform_enabled: row.querySelector(".docker-transform-enabled").checked, compression_enabled: row.querySelector(".docker-compression-enabled").checked,
       // Docker publications intentionally expose one compression switch only. Codec selection stays global.
       compression_zstd: null, compression_br: null, compression_gzip: null, compression_deflate: null,
       acl_profile_id: null, acl_profile_ids: readProfileChoices(row, ".docker-acl-profile"),
@@ -335,13 +337,40 @@
     const certMismatch = input("", "checkbox", "docker-cert-mismatch"); certMismatch.checked = assignment?.allow_certificate_mismatch === true;
     const mismatchField = checkboxField("dockerCertMismatchForce", certMismatch);
     const mismatchHelp = el("p", t("dockerCertMismatchWarning"), "fine acl-stack-warning");
-    const syncMismatch = () => { certMismatch.disabled = !agent.certificate_id; if (!agent.certificate_id) certMismatch.checked = false; mismatchHelp.hidden = !certMismatch.checked; };
-    certMismatch.addEventListener("change", syncMismatch); syncMismatch(); mismatchField.append(mismatchHelp);
-    route.append(labeled("dockerHostname", host, t("dockerHostnameHelp").replace("{domain}", agent.base_domain)), aliases.node, labeled("dockerBackendIp", target), labeled("dockerBackendScheme", scheme), switches, mismatchField);
-    editor.append(route, aclEditor(assignment, agent), timeoutEditor(assignment), healthEditor(assignment), passiveHealthEditor(assignment));
+    const mismatchUnavailable = el("p", t("dockerCertMismatchUnavailable"), "fine");
+    const riskPill = el("span", t("dockerCertMismatchRisk"), "acl-picker-policy is-deny docker-cert-risk-pill");
+    const syncMismatch = () => {
+      certMismatch.disabled = !agent.certificate_id;
+      if (!agent.certificate_id) certMismatch.checked = false;
+      mismatchHelp.hidden = !certMismatch.checked;
+      mismatchUnavailable.hidden = !!agent.certificate_id;
+      riskPill.hidden = !certMismatch.checked;
+    };
+    certMismatch.addEventListener("change", syncMismatch);
+    mismatchField.append(mismatchHelp, mismatchUnavailable);
+    const certificateBar = el("div", undefined, "docker-service-certificate-bar");
+    const tlsControl = el("div", undefined, "docker-service-certificate-control");
+    const tlsHeading = el("div", undefined, "docker-service-certificate-title");
+    tlsHeading.append(el("strong", t("dockerCertSection")), riskPill);
+    tlsControl.append(tlsHeading, mismatchField); certificateBar.append(tlsControl);
+    syncMismatch();
+
+    const h2Enabled = input("", "checkbox", "docker-http2-enabled"); h2Enabled.checked = assignment?.http2_enabled !== false;
+    const h3Enabled = input("", "checkbox", "docker-http3-enabled"); h3Enabled.checked = assignment?.http3_enabled !== false;
+    const protocolBox = el("section", undefined, "docker-protocol-panel");
+    const protocolHeading = el("div", undefined, "docker-protocol-heading");
+    protocolHeading.append(el("strong", t("dockerFrontendProtocols")), el("small", t("dockerFrontendProtocolsHelp"), "fine"));
+    const protocolOptions = el("div", undefined, "docker-protocol-options");
+    const h1 = el("span", undefined, "docker-protocol-fixed");
+    h1.append(el("strong", "HTTP/1.1"), el("small", t("dockerHttp1Always"), "fine"));
+    protocolOptions.append(h1, checkboxField("dockerHttp2Enabled", h2Enabled), checkboxField("dockerHttp3Enabled", h3Enabled));
+    protocolBox.append(protocolHeading, protocolOptions);
+    route.append(labeled("dockerHostname", host, t("dockerHostnameHelp").replace("{domain}", agent.base_domain)), aliases.node, labeled("dockerBackendIp", target), labeled("dockerBackendScheme", scheme), switches);
+    editor.append(certificateBar, route, protocolBox, aclEditor(assignment, agent), timeoutEditor(assignment), healthEditor(assignment), passiveHealthEditor(assignment));
     const actions = el("div", undefined, "docker-service-actions"), apply = el("button", t("dockerApplyService"), "outline docker-apply"); apply.type = "button"; apply.disabled = !publish.checked; apply.addEventListener("click", async () => { apply.disabled = true; try { await saveAssignment(agent.id, row, true); } catch (error) { toast(error.message, true); } finally { if (row.isConnected) apply.disabled = !publish.checked; } }); actions.append(apply); editor.append(actions); row.append(editor);
-    function updateHint() { const targetLabel = target.selectedOptions?.[0]?.textContent || t("dockerBackendIpAuto"), aliasCount = aliases.count(); editorHint.textContent = `${host.value.trim() || technical} → ${scheme.value.toUpperCase()} · ${targetLabel}${aliasCount ? ` · +${aliasCount} ${t("dockerAliasesShort")}` : ""}`; } updateHint();
+    function updateHint() { const targetLabel = target.selectedOptions?.[0]?.textContent || t("dockerBackendIpAuto"), aliasCount = aliases.count(); editorHint.textContent = `${host.value.trim() || technical} → ${scheme.value.toUpperCase()} · ${targetLabel} · H1${h2Enabled.checked ? "/H2" : ""}${h3Enabled.checked ? "/H3" : ""}${aliasCount ? ` · +${aliasCount} ${t("dockerAliasesShort")}` : ""}`; } updateHint();
     for (const control of [host, aliases.input, target, scheme]) { control.addEventListener("input", updateHint); control.addEventListener("change", updateHint); }
+    for (const control of [h2Enabled, h3Enabled]) control.addEventListener("change", updateHint);
     host.addEventListener("input", () => syncOpenApp(host.value));
     row.addEventListener("input", event => { if (!event.target.classList.contains("docker-publish")) row.classList.add("is-dirty"); }); row.addEventListener("change", event => { if (!event.target.classList.contains("docker-publish")) row.classList.add("is-dirty"); });
     publish.addEventListener("change", async () => {
@@ -360,8 +389,6 @@
       const state = obs(agent.id), box = el("article", undefined, "card docker-agent-card"); box.dataset.agentId = agent.id; box.dataset.searchText = `${agent.id} ${agent.name || ""} ${agent.base_domain || ""}`.toLowerCase(); const head = el("div", undefined, "card-heading"), left = el("div"); left.append(el("span", agent.id, "small-label"), el("h2", agent.name));
       const badges = el("div", undefined, "entity-actions"), connection = el("span", state?.ok ? t("dockerConnected") : state ? t("dockerError") : t("dockerWaiting"), `pill ${state?.ok ? "live" : ""}`), sec = securityInfo(agent, state); badges.append(el("span", t(sec.key), `pill ${sec.cls}`.trim()), connection); head.append(left, badges); box.append(head);
       if (!agent.enabled) { box.append(el("p", t("dockerAgentDisabled"), "fine")); target.append(box); continue; }
-      // No observation is the normal state while the first background poll is in flight.
-      // A configured TLS fingerprint alone is not proof that an agent was contacted.
       if (!state) box.append(el("p", t("dockerNoObservation"), "fine"));
       else if (!state.ok) { const error = el("div", undefined, "docker-agent-error"); error.append(el("b", t("dockerAgentConnectionFailed")), el("p", state.error || t("dockerUnknownPollError"), "fine")); box.append(error); }
       if (!state?.inventory) { const rows = el("div", undefined, "docker-service-list"); for (const item of agent.assignments || []) rows.append(assignmentRow(agent, null, null, item, true)); if (!rows.children.length) rows.append(el("p", t("dockerNoPublishedPorts"), "empty")); box.append(rows); target.append(box); continue; }
@@ -455,8 +482,6 @@
   });
   rustProxyRefresh.register("docker", {
     interval: () => 5,
-    // Even with local Live view off, observe the first startup result.
-    // Once every enabled agent has a first result, stop unless Live is enabled.
     active: () => currentPanel === "docker-vhosts" && canLiveRender() && (liveEnabled() || hasUnobservedAgent()),
     run: async context => refresh(false, context)
   });