v0.24.5

docs/REDIRECTS.md

@@ -0,0 +1,66 @@
+# Redirect hosts
+
+RustProxy 0.13.0 adds first-class redirect hosts on the **Redirects** dashboard page. A redirect host owns one or more source hostnames and named HTTP/HTTPS listeners and answers locally without opening a backend connection.
+
+Each host contains ordered redirect rules. The longest matching path wins. Rules can match `http`, `https` or either scheme and can use exact or path-prefix matching. Targets can be:
+
+- `url`: an absolute `http://` or `https://` URL,
+- `host`: a hostname/authority with the target scheme set to preserve, HTTP or HTTPS,
+- `path`: an absolute path on the same request authority.
+
+Supported status codes are 301, 302, 303, 307 and 308. Use 307/308 when the client must preserve the HTTP method. Path handling can append the complete source path, strip the matched prefix before appending, or replace the path entirely. Source query parameters can be preserved or dropped. `cache_seconds=0` emits `Cache-Control: no-store`; a positive value emits a bounded public `max-age`.
+
+Redirect hosts use the same named listener inventory and certificate library as vhosts. The dashboard uses the same listener-selection component for both editors. A new redirect preselects the standard enabled HTTP :80 and HTTPS :443 listeners together when available, while existing bindings are preserved. The same hostname cannot overlap a vhost or another redirect host on the same socket. Global host ACL policy still runs before a redirect response. Redirect rules never make DNS/TCP/TLS connections to the target; the client follows the resulting `Location` header.
+
+Configuration lives under `redirects` and normal dashboard saves use `PUT /api/config/redirects`.
+
+
+## Example
+
+```json
+{
+  "redirects": [
+    {
+      "id": "legacy-site",
+      "name": "Legacy site redirects",
+      "frontend": {
+        "hosts": ["old.example.com"],
+        "listener_ids": ["http", "https"]
+      },
+      "certificate_id": "old-example",
+      "rules": [
+        {
+          "id": "application",
+          "source_scheme": "any",
+          "match_type": "prefix",
+          "path_prefix": "/app",
+          "target_type": "host",
+          "target": "app.example.com",
+          "target_scheme": "https",
+          "path_mode": "strip_prefix",
+          "query_mode": "preserve",
+          "status_code": 308,
+          "cache_seconds": 300
+        },
+        {
+          "id": "fallback",
+          "match_type": "prefix",
+          "path_prefix": "/",
+          "target_type": "url",
+          "target": "https://www.example.com/",
+          "path_mode": "replace",
+          "query_mode": "drop",
+          "status_code": 302,
+          "cache_seconds": 0
+        }
+      ]
+    }
+  ]
+}
+```
+
+Rules are evaluated by longest path first; exact matching wins over prefix matching at the same path. A disabled redirect host reserves its hostname/listener ownership just like a disabled vhost, so another frontend cannot silently take over that traffic.
+
+## Hostname editor
+
+The Redirect source-domain field uses the same chip editor as Vhosts: add one hostname/wildcard at a time, remove individual chips, and keep listener selection in the shared frontend control.