v0.31.7

docs/SETTINGS.md

@@ -34,6 +34,28 @@ The main `/api/events?interval=N` connection (allowlisted 1/2/5/10, default 2 se
 
 ACME diagnostics formerly shown in About and under Administration are now on this tab: mode/state, certificate environment path, and the active Python/pip/Certbot versions. Versions are probed by the ACME runtime setup with bounded subprocess output/timeouts and published from stored runtime status. They are not queried at every page refresh or status API request. Failed/unavailable probes leave the version empty. No new persistent settings or permissions are introduced.
 
+## Rules and headers (0.31.7)
+
+**Settings -> Rules & headers** (`/settings?tab=policies`) now groups the existing **Global User-Agent blocklist**, **Global custom headers** and **Client response** forms as persistent sub-tabs, following the Cache settings layout. There is no migration: each form continues to update its previous configuration section. **Settings -> Security** retains administrative hostname, Origin, session and password policies.
+
+**Vhosts -> Security -> Traffic policy** also supports optional `rate_limit.user_agent_limits` in each vhost, for example:
+
+```json
+{
+  "rate_limit": {
+    "enabled": true, "requests": 120, "window_seconds": 60, "burst": 30,
+    "user_agent_limits": [
+      {"pattern": "*scanner*", "requests": 10, "window_seconds": 60, "burst": 0},
+      {"pattern": "BadBot", "requests": 2, "window_seconds": 60, "burst": 0}
+    ]
+  }
+}
+```
+
+The first case-insensitive match wins. A plain pattern searches for a substring and `*` matches any sequence. A matching User-Agent uses its **own bucket for the vhost, rule and client IP** and overrides that request's standard/country throttle; nonmatching requests continue using existing rate rules. Rules also work with `enabled=false` for the base limiter. The User-Agent header is untrusted, so avoid treating these limits as authentication or identity enforcement.
+
+The **Revision history** detail shows only changed leaf fields, scrolling locally when there are many. **Full JSON comparison** is directly below Restore in the action group and opens a separate standard dialog. ACL profile *Attached to* details are collapsed by default. Listener HTTP/2 and HTTP/3 controls have additional spacing.
+
 ## Configuration and update semantics
 
 GET `/api/config` returns a revisioned envelope. PUT the entire document with
@@ -69,7 +91,7 @@ This is a settings fragment, not a replacement for the existing routing/vhost do
 A complete opt-in example is in `examples/cache-dashboard.json`.
 
 The dashboard exposes the complete raw JSON editor under **Settings -> Manual config**.
-The same card exposes **Revision history**, which reads the newest 512 retained configuration revisions from the configuration-history table introduced in SQLite schema 8 (current database schema 9) and groups them by month/day. Selecting a revision shows timestamp, actor and a bounded path-level before/after diff against the previous retained revision. An older retained revision can be restored from the same dialog; RustProxy validates it through the normal configuration update path and saves it as a new revision, preserving the prior history.
+The same card exposes **Revision history**, which reads the newest 512 retained configuration revisions from the configuration-history table introduced in SQLite schema 8 (current database schema 9) and groups them by month/day. Selecting a revision shows timestamp, actor and only the changed fields against the previous retained revision; the separate Full JSON comparison dialog contains complete JSON documents. An older retained revision can be restored from the same dialog; RustProxy validates it through the normal configuration update path and saves it as a new revision, preserving the prior history.
 The historical `/configuration` browser route is retained only as a compatibility alias and
 opens that Settings block; it is no longer a primary-navigation item. Prefer the structured
 section editors for routine changes so unrelated sections are not republished.