v0.36.1
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
672c84bc13
commit
6f52ac3d00
38 files changed
+1183
-221
No files matched your search
+165
-49
@@ -61,7 +61,8 @@
|
||||
<div class="sidebar-bottom" id="app-health-slot" hidden>
|
||||
<button class="local-tag app-health-button is-checking" id="app-health-open" type="button"
|
||||
aria-haspopup="dialog" aria-controls="app-health-dialog">
|
||||
<i aria-hidden="true"></i><span id="app-health-label" data-i18n="appHealthSidebarChecking">CHECKING</span>
|
||||
<i aria-hidden="true"></i><span id="app-health-label"
|
||||
data-i18n="appHealthSidebarChecking">CHECKING</span>
|
||||
</button>
|
||||
</div>
|
||||
</aside>
|
||||
@@ -1792,6 +1793,12 @@
|
||||
</select><small class="fine" data-i18n="buttonStyleHelp">Normal uses the
|
||||
refreshed controls; Compact restores the smaller source-style buttons
|
||||
across all actions and dialog tabs.</small></label>
|
||||
<label class="check appearance-interface-icons-setting"><input
|
||||
id="ui-interface-icons" type="checkbox" /><span><b
|
||||
data-i18n="interfaceIcons">Show SVG interface icons</b><small
|
||||
data-i18n="interfaceIconsHelp">Adds semantic SVG icons to
|
||||
navigation,
|
||||
actions, tabs and dialogs.</small></span></label>
|
||||
<label><span data-i18n="cornerStyle">Corner rounding</span><select
|
||||
id="ui-corner-style">
|
||||
<option data-i18n="cornerStyleDefault" value="default">Original
|
||||
@@ -2102,79 +2109,184 @@
|
||||
<div data-policy-settings-page="block-allow">
|
||||
<form class="card edit-form global-policy-form" id="global-security-form">
|
||||
<div class="card-heading">
|
||||
<div><span class="small-label" data-i18n="globalPolicyScope">PUBLIC HTTP LISTENERS</span>
|
||||
<div><span class="small-label" data-i18n="globalPolicyScope">PUBLIC HTTP
|
||||
LISTENERS</span>
|
||||
<h2 data-i18n="globalBlockAllow">Global block / allow</h2>
|
||||
</div><span class="pill live" data-i18n="hotApply">LIVE APPLY</span>
|
||||
</div>
|
||||
<p class="fine" data-i18n="globalPolicyHelp">These rules apply before routing to the backend on all public HTTP vhosts, redirects and 404 hosts. Per-vhost restrictions remain active; a local allow cannot bypass a global block. Administration and TCP/UDP Streams are excluded.</p>
|
||||
<p class="fine" data-i18n="globalPolicyHelp">These rules apply before routing to the
|
||||
backend on all public HTTP vhosts, redirects and 404 hosts. Per-vhost
|
||||
restrictions remain active; a local allow cannot bypass a global block.
|
||||
Administration and TCP/UDP Streams are excluded.</p>
|
||||
<section class="global-policy-section">
|
||||
<div class="global-policy-heading"><h3 data-i18n="globalCountryTitle">Country access</h3><p class="fine" data-i18n="globalCountryHelp">Uses the verified client IP and GeoIP database. Unknown countries are denied in allow mode, but allowed in block mode.</p></div>
|
||||
<div class="global-policy-heading">
|
||||
<h3 data-i18n="globalCountryTitle">Country access</h3>
|
||||
<p class="fine" data-i18n="globalCountryHelp">Uses the verified client IP
|
||||
and GeoIP database. Unknown countries are denied in allow mode, but
|
||||
allowed in block mode.</p>
|
||||
</div>
|
||||
<div class="global-policy-fields">
|
||||
<label><span data-i18n="globalCountryMode">Country policy</span><select id="global-country-mode">
|
||||
<option value="off" data-i18n="vhOff">Off</option>
|
||||
<option value="block" data-i18n="vhCountryBlock">Block listed</option>
|
||||
<option value="allow" data-i18n="vhCountryAllow">Allow listed only</option>
|
||||
</select></label>
|
||||
<label><span data-i18n="globalCountryList">ISO country codes (one per line)</span><textarea id="global-country-list" rows="3" maxlength="1024" spellcheck="false" placeholder="RU CN"></textarea></label>
|
||||
<label><span data-i18n="globalCountryMode">Country policy</span><select
|
||||
id="global-country-mode">
|
||||
<option value="off" data-i18n="vhOff">Off</option>
|
||||
<option value="block" data-i18n="vhCountryBlock">Block listed
|
||||
</option>
|
||||
<option value="allow" data-i18n="vhCountryAllow">Allow listed only
|
||||
</option>
|
||||
</select></label>
|
||||
<label><span data-i18n="globalCountryList">ISO country codes (one per
|
||||
line)</span><textarea id="global-country-list" rows="3"
|
||||
maxlength="1024" spellcheck="false"
|
||||
placeholder="RU CN"></textarea></label>
|
||||
</div>
|
||||
</section>
|
||||
<section class="global-policy-section">
|
||||
<div class="global-policy-heading"><h3 data-i18n="globalUaTitle">User-Agent blocklist</h3><p class="fine" data-i18n="uaBlockPatternHelp">Case-insensitive substring matching; * is a wildcard. A missing User-Agent is not blocked.</p></div>
|
||||
<label class="check"><input id="global-ua-block-enabled" type="checkbox"/><span data-i18n="globalUaEnabled">Block matching User-Agents</span></label>
|
||||
<label><span data-i18n="uaBlockPatterns">Blocked patterns, one per line</span><textarea id="global-ua-block-patterns" rows="4" maxlength="32768" spellcheck="false" placeholder="BadBot curl/* *scanner*"></textarea></label>
|
||||
<div class="global-policy-heading">
|
||||
<h3 data-i18n="globalUaTitle">User-Agent blocklist</h3>
|
||||
<p class="fine" data-i18n="uaBlockPatternHelp">Case-insensitive substring
|
||||
matching; * is a wildcard. A missing User-Agent is not blocked.</p>
|
||||
</div>
|
||||
<label class="check"><input id="global-ua-block-enabled" type="checkbox" /><span
|
||||
data-i18n="globalUaEnabled">Block matching User-Agents</span></label>
|
||||
<label><span data-i18n="uaBlockPatterns">Blocked patterns, one per
|
||||
line</span><textarea id="global-ua-block-patterns" rows="4"
|
||||
maxlength="32768" spellcheck="false"
|
||||
placeholder="BadBot curl/* *scanner*"></textarea></label>
|
||||
</section>
|
||||
<section class="global-policy-section">
|
||||
<div class="global-policy-heading"><h3 data-i18n="globalIpTitle">IP / CIDR access</h3><p class="fine" data-i18n="globalIpHelp">Each line: allow or deny followed by IPv4/IPv6 address, CIDR or allow-only DNS name. Default allow with no rules leaves access unrestricted.</p></div>
|
||||
<label class="check"><input id="global-ip-enabled" type="checkbox"/><span data-i18n="globalIpEnabled">Enable global IP rules</span></label>
|
||||
<div class="global-policy-heading">
|
||||
<h3 data-i18n="globalIpTitle">IP / CIDR access</h3>
|
||||
<p class="fine" data-i18n="globalIpHelp">Each line: allow or deny followed
|
||||
by IPv4/IPv6 address, CIDR or allow-only DNS name. Default allow with no
|
||||
rules leaves access unrestricted.</p>
|
||||
</div>
|
||||
<label class="check"><input id="global-ip-enabled" type="checkbox" /><span
|
||||
data-i18n="globalIpEnabled">Enable global IP rules</span></label>
|
||||
<div class="global-policy-fields">
|
||||
<label><span data-i18n="aclDefault">Default action</span><select id="global-ip-default"><option value="allow" data-i18n="allow">Allow</option><option value="deny" data-i18n="deny">Deny</option></select></label>
|
||||
<label><span data-i18n="globalIpRules">Rules (one per line)</span><textarea id="global-ip-rules" rows="3" maxlength="32768" placeholder="deny 192.0.2.0/24 allow 10.0.0.0/8" spellcheck="false"></textarea></label>
|
||||
<label><span data-i18n="aclDefault">Default action</span><select
|
||||
id="global-ip-default">
|
||||
<option value="allow" data-i18n="allow">Allow</option>
|
||||
<option value="deny" data-i18n="deny">Deny</option>
|
||||
</select></label>
|
||||
<label><span data-i18n="globalIpRules">Rules (one per line)</span><textarea
|
||||
id="global-ip-rules" rows="3" maxlength="32768"
|
||||
placeholder="deny 192.0.2.0/24 allow 10.0.0.0/8"
|
||||
spellcheck="false"></textarea></label>
|
||||
</div>
|
||||
</section>
|
||||
<section class="global-policy-section">
|
||||
<div class="global-policy-heading"><h3 data-i18n="globalMethodTitle">HTTP methods</h3><p class="fine" data-i18n="globalMethodHelp">Block selected methods or allow only those listed. Applies before redirects and cache invalidation; denied requests receive 405.</p></div>
|
||||
<div class="global-policy-heading">
|
||||
<h3 data-i18n="globalMethodTitle">HTTP methods</h3>
|
||||
<p class="fine" data-i18n="globalMethodHelp">Block selected methods or allow
|
||||
only those listed. Applies before redirects and cache invalidation;
|
||||
denied requests receive 405.</p>
|
||||
</div>
|
||||
<div class="global-policy-fields">
|
||||
<label><span data-i18n="globalMethodMode">Method policy</span><select id="global-method-mode"><option value="off" data-i18n="vhOff">Off</option><option value="block" data-i18n="locationMethodBlock">Block listed</option><option value="allow" data-i18n="locationMethodAllow">Allow listed only</option></select></label>
|
||||
<label><span data-i18n="globalMethodList">Methods (comma, space or newline separated)</span><textarea id="global-method-list" rows="2" maxlength="1024" spellcheck="false" placeholder="TRACE, TRACK"></textarea></label>
|
||||
<label><span data-i18n="globalMethodMode">Method policy</span><select
|
||||
id="global-method-mode">
|
||||
<option value="off" data-i18n="vhOff">Off</option>
|
||||
<option value="block" data-i18n="locationMethodBlock">Block listed
|
||||
</option>
|
||||
<option value="allow" data-i18n="locationMethodAllow">Allow listed
|
||||
only</option>
|
||||
</select></label>
|
||||
<label><span data-i18n="globalMethodList">Methods (comma, space or newline
|
||||
separated)</span><textarea id="global-method-list" rows="2"
|
||||
maxlength="1024" spellcheck="false"
|
||||
placeholder="TRACE, TRACK"></textarea></label>
|
||||
</div>
|
||||
</section>
|
||||
<section class="global-policy-section">
|
||||
<div class="global-policy-heading"><h3 data-i18n="globalContentTypeTitle">Request Content-Type</h3><p class="fine" data-i18n="globalContentTypeHelp">Reject declared MIME types (exact or type/*) with 403. This is a header rule, not body inspection.</p></div>
|
||||
<label class="check"><input id="global-content-type-enabled" type="checkbox"/><span data-i18n="globalContentTypeEnabled">Enable Content-Type denylist</span></label>
|
||||
<label><span data-i18n="globalContentTypeList">Blocked MIME types, one per line</span><textarea id="global-content-type-list" rows="3" maxlength="16384" spellcheck="false" placeholder="application/x-msdownload application/x-sh"></textarea></label>
|
||||
<div class="global-policy-heading">
|
||||
<h3 data-i18n="globalContentTypeTitle">Request Content-Type</h3>
|
||||
<p class="fine" data-i18n="globalContentTypeHelp">Reject declared MIME types
|
||||
(exact or type/*) with 403. This is a header rule, not body inspection.
|
||||
</p>
|
||||
</div>
|
||||
<label class="check"><input id="global-content-type-enabled"
|
||||
type="checkbox" /><span data-i18n="globalContentTypeEnabled">Enable
|
||||
Content-Type denylist</span></label>
|
||||
<label><span data-i18n="globalContentTypeList">Blocked MIME types, one per
|
||||
line</span><textarea id="global-content-type-list" rows="3"
|
||||
maxlength="16384" spellcheck="false"
|
||||
placeholder="application/x-msdownload application/x-sh"></textarea></label>
|
||||
</section>
|
||||
<section class="global-policy-section">
|
||||
<div class="global-policy-heading"><h3 data-i18n="globalRateTitle">Shared rate limit</h3><p class="fine" data-i18n="globalRateHelp">Optional per-client-IP limit shared by all public vhosts. Runs in addition to per-vhost limits; use conservative values to avoid blocking legitimate shared clients.</p></div>
|
||||
<label class="check"><input id="global-rate-enabled" type="checkbox"/><span data-i18n="globalRateEnabled">Enable global request rate limit</span></label>
|
||||
<div class="global-policy-heading">
|
||||
<h3 data-i18n="globalRateTitle">Shared rate limit</h3>
|
||||
<p class="fine" data-i18n="globalRateHelp">Optional per-client-IP limit
|
||||
shared by all public vhosts. Runs in addition to per-vhost limits; use
|
||||
conservative values to avoid blocking legitimate shared clients.</p>
|
||||
</div>
|
||||
<label class="check"><input id="global-rate-enabled" type="checkbox" /><span
|
||||
data-i18n="globalRateEnabled">Enable global request rate
|
||||
limit</span></label>
|
||||
<div class="global-rate-fields">
|
||||
<label><span data-i18n="globalRateRequests">Requests per window</span><input id="global-rate-requests" type="number" min="1" max="1000000" required value="120"/></label>
|
||||
<label><span data-i18n="globalRateWindow">Window (seconds)</span><input id="global-rate-window" type="number" min="1" max="3600" required value="60"/></label>
|
||||
<label><span data-i18n="globalRateBurst">Burst allowance</span><input id="global-rate-burst" type="number" min="0" max="1000000" required value="30"/></label>
|
||||
<label><span data-i18n="globalRateRequests">Requests per window</span><input
|
||||
id="global-rate-requests" type="number" min="1" max="1000000"
|
||||
required value="120" /></label>
|
||||
<label><span data-i18n="globalRateWindow">Window (seconds)</span><input
|
||||
id="global-rate-window" type="number" min="1" max="3600" required
|
||||
value="60" /></label>
|
||||
<label><span data-i18n="globalRateBurst">Burst allowance</span><input
|
||||
id="global-rate-burst" type="number" min="0" max="1000000" required
|
||||
value="30" /></label>
|
||||
</div>
|
||||
</section>
|
||||
<div class="form-actions"><button class="primary" data-i18n="globalPolicySave" type="submit">Apply global block / allow rules</button></div>
|
||||
<div class="form-actions"><button class="primary" data-i18n="globalPolicySave"
|
||||
type="submit">Apply global block / allow rules</button></div>
|
||||
</form>
|
||||
</div>
|
||||
<div data-policy-settings-page="security-headers" hidden="">
|
||||
<form class="card edit-form global-policy-form" id="global-security-headers-form">
|
||||
<div class="card-heading"><div><span class="small-label" data-i18n="globalPolicyScope">PUBLIC HTTP LISTENERS</span><h2 data-i18n="globalSecurityHeaders">Security headers</h2></div><span class="pill live" data-i18n="hotApply">LIVE APPLY</span></div>
|
||||
<p class="fine" data-i18n="globalHeadersSecurityHelp">Global response-header baseline for public HTTP vhosts, redirects and 404 hosts. Explicit per-vhost values override matching global headers. HSTS is sent only over HTTPS; test CSP carefully before rollout.</p>
|
||||
<section class="global-policy-section"><h3 data-i18n="vhSecurityHstsSection">HTTP Strict Transport Security (HSTS)</h3>
|
||||
<label class="check"><input id="global-hsts-enabled" type="checkbox"/><span data-i18n="vhHsts">Enable HSTS</span></label>
|
||||
<div class="card-heading">
|
||||
<div><span class="small-label" data-i18n="globalPolicyScope">PUBLIC HTTP
|
||||
LISTENERS</span>
|
||||
<h2 data-i18n="globalSecurityHeaders">Security headers</h2>
|
||||
</div><span class="pill live" data-i18n="hotApply">LIVE APPLY</span>
|
||||
</div>
|
||||
<p class="fine" data-i18n="globalHeadersSecurityHelp">Global response-header
|
||||
baseline for public HTTP vhosts, redirects and 404 hosts. Explicit per-vhost
|
||||
values override matching global headers. HSTS is sent only over HTTPS; test CSP
|
||||
carefully before rollout.</p>
|
||||
<section class="global-policy-section">
|
||||
<h3 data-i18n="vhSecurityHstsSection">HTTP Strict Transport Security (HSTS)</h3>
|
||||
<label class="check"><input id="global-hsts-enabled" type="checkbox" /><span
|
||||
data-i18n="vhHsts">Enable HSTS</span></label>
|
||||
<div class="global-rate-fields">
|
||||
<label><span data-i18n="vhHstsAge">Max age (seconds)</span><input id="global-hsts-age" type="number" min="0" max="63072000" required value="31536000"/></label>
|
||||
<label class="check"><input id="global-hsts-sub" type="checkbox"/><span data-i18n="vhHstsSub">Include subdomains</span></label>
|
||||
<label class="check"><input id="global-hsts-preload" type="checkbox"/><span data-i18n="vhHstsPreload">Preload</span></label>
|
||||
<label><span data-i18n="vhHstsAge">Max age (seconds)</span><input
|
||||
id="global-hsts-age" type="number" min="0" max="63072000" required
|
||||
value="31536000" /></label>
|
||||
<label class="check"><input id="global-hsts-sub" type="checkbox" /><span
|
||||
data-i18n="vhHstsSub">Include subdomains</span></label>
|
||||
<label class="check"><input id="global-hsts-preload" type="checkbox" /><span
|
||||
data-i18n="vhHstsPreload">Preload</span></label>
|
||||
</div>
|
||||
</section>
|
||||
<section class="global-policy-section"><h3 data-i18n="vhSecurityHeadersSection">Response security headers</h3>
|
||||
<label class="check"><input id="global-nosniff" type="checkbox"/><span data-i18n="vhNosniff">X-Content-Type-Options: nosniff</span></label>
|
||||
<label><span data-i18n="vhFrame">X-Frame-Options</span><select id="global-frame"><option value="preserve" data-i18n="vhPreserve">Preserve origin value</option><option value="deny" data-i18n="vhDeny">DENY</option><option value="sameorigin" data-i18n="vhSameorigin">SAMEORIGIN</option></select></label>
|
||||
<label><span data-i18n="vhReferrer">Referrer-Policy</span><input id="global-referrer" maxlength="8192" spellcheck="false" placeholder="strict-origin-when-cross-origin"/></label>
|
||||
<label><span data-i18n="vhCsp">Content-Security-Policy</span><textarea id="global-csp" rows="3" maxlength="8192" spellcheck="false" placeholder="default-src 'self'"></textarea></label>
|
||||
<label><span data-i18n="vhPermissions">Permissions-Policy</span><input id="global-permissions" maxlength="8192" spellcheck="false" placeholder="camera=(), microphone=()"/></label>
|
||||
<section class="global-policy-section">
|
||||
<h3 data-i18n="vhSecurityHeadersSection">Response security headers</h3>
|
||||
<label class="check"><input id="global-nosniff" type="checkbox" /><span
|
||||
data-i18n="vhNosniff">X-Content-Type-Options: nosniff</span></label>
|
||||
<label><span data-i18n="vhFrame">X-Frame-Options</span><select
|
||||
id="global-frame">
|
||||
<option value="preserve" data-i18n="vhPreserve">Preserve origin value
|
||||
</option>
|
||||
<option value="deny" data-i18n="vhDeny">DENY</option>
|
||||
<option value="sameorigin" data-i18n="vhSameorigin">SAMEORIGIN</option>
|
||||
</select></label>
|
||||
<label><span data-i18n="vhReferrer">Referrer-Policy</span><input
|
||||
id="global-referrer" maxlength="8192" spellcheck="false"
|
||||
placeholder="strict-origin-when-cross-origin" /></label>
|
||||
<label><span data-i18n="vhCsp">Content-Security-Policy</span><textarea
|
||||
id="global-csp" rows="3" maxlength="8192" spellcheck="false"
|
||||
placeholder="default-src 'self'"></textarea></label>
|
||||
<label><span data-i18n="vhPermissions">Permissions-Policy</span><input
|
||||
id="global-permissions" maxlength="8192" spellcheck="false"
|
||||
placeholder="camera=(), microphone=()" /></label>
|
||||
</section>
|
||||
<div class="form-actions"><button class="primary" data-i18n="globalSecurityHeadersSave" type="submit">Apply security headers</button></div>
|
||||
<div class="form-actions"><button class="primary"
|
||||
data-i18n="globalSecurityHeadersSave" type="submit">Apply security
|
||||
headers</button></div>
|
||||
</form>
|
||||
</div>
|
||||
<div data-policy-settings-page="headers" hidden="">
|
||||
@@ -2501,9 +2613,11 @@
|
||||
<label data-i18n="cacheStaticExtensions" for="cache-static-extensions">Global static
|
||||
extensions</label><textarea id="cache-static-extensions" rows="5"
|
||||
spellcheck="false"></textarea>
|
||||
<p class="fine cache-static-guidance" data-i18n="cacheStaticHelp">Cookie bypass is limited to these file
|
||||
<p class="fine cache-static-guidance" data-i18n="cacheStaticHelp">Cookie bypass is
|
||||
limited to these file
|
||||
extensions. Response privacy rules still apply.</p>
|
||||
<h3 class="subheading cache-header-settings-heading" data-i18n="cacheHeadersSection">Cache response headers</h3>
|
||||
<h3 class="subheading cache-header-settings-heading"
|
||||
data-i18n="cacheHeadersSection">Cache response headers</h3>
|
||||
<div class="switch-grid"><label class="check"><input id="cache-status-header"
|
||||
type="checkbox" /><span>X-Cache: HIT / MISS /
|
||||
BYPASS</span></label><label class="check"><input id="cache-hits-header"
|
||||
@@ -2609,7 +2723,8 @@
|
||||
concurrent transformations</label><input id="transform-max-inflight" min="1"
|
||||
max="1024" required="" type="number" /></div>
|
||||
</div>
|
||||
<h3 class="subheading transform-operations-title" data-i18n="transformOperationsTitle">Content transformations</h3>
|
||||
<h3 class="subheading transform-operations-title" data-i18n="transformOperationsTitle">
|
||||
Content transformations</h3>
|
||||
<div class="switch-grid transform-operations-grid">
|
||||
<label class="check"><input id="transform-javascript" type="checkbox" /><span
|
||||
data-i18n="transformJavascript">JavaScript minification</span></label>
|
||||
@@ -3144,8 +3259,8 @@
|
||||
<p class="fine" data-i18n="tlsPqcHelp">TLS 1.3 only: prioritize hybrid
|
||||
X25519MLKEM768 with classic key exchanges as fallback. This is a key exchange
|
||||
group, not a cipher suite. Disabled by default.</p>
|
||||
<a href="/docs#doc=docs%2FTRANSPORT.md" target="_blank"
|
||||
rel="noopener noreferrer" data-i18n="tlsPqcDocs">Learn about PQC, compatibility
|
||||
<a href="/docs#doc=docs%2FTRANSPORT.md" target="_blank" rel="noopener noreferrer"
|
||||
data-i18n="tlsPqcDocs">Learn about PQC, compatibility
|
||||
and testing (documentation)</a>
|
||||
</div>
|
||||
<p class="fine" id="tls-policy-key-exchange"></p>
|
||||
@@ -4353,7 +4468,8 @@ log_errors = On</code></pre>
|
||||
</section>
|
||||
<div class="about-links">
|
||||
<a class="outline about-repository" href="https://rustproxy.linuxiarz.pl/" rel="noopener noreferrer"
|
||||
target="_blank"><span data-i18n="aboutPackagesRepository">Website and packages</span><span>rustproxy.linuxiarz.pl</span></a>
|
||||
target="_blank"><span data-i18n="aboutPackagesRepository">Website and
|
||||
packages</span><span>rustproxy.linuxiarz.pl</span></a>
|
||||
<a class="outline about-repository" href="https://git.linuxiarz.pl/gru/RustProxy"
|
||||
rel="noopener noreferrer" target="_blank"><span data-i18n="aboutRepository">Source
|
||||
code</span><span>git.linuxiarz.pl/gru/RustProxy</span></a>
|
||||
|
||||
Reference in new issue
Block a user