v0.25.0

docs/API.md

@@ -9,12 +9,14 @@ protection headers.
 
 ## Browser documentation and anonymous surface
 
-Open `/docs` **on the administration listener** after signing in. The OpenAPI JSON,
-JavaScript, styles and Swagger vendor assets all require the same session. Writes
-are opt-in and CSRF-protected. See [API_ACCESS.md](API_ACCESS.md).
+Open `/docs` **on the administration listener** after signing in. The default **Reader**
+shows the bundled project Markdown documentation; the separate **API** tab renders the
+OpenAPI/Swagger interface. The documentation bundle, OpenAPI JSON, JavaScript, styles and
+Swagger vendor assets all require the same session. API writes are opt-in and CSRF-protected.
+See [API_ACCESS.md](API_ACCESS.md).
 
 Only GET/HEAD `/`, the panel routes `/overview`, `/vhosts`, `/streams`,
-`/acl-profiles`, `/configuration`, `/tls`, `/cache`, `/logging`, `/settings`,
+`/acl-profiles`, `/web-server`, `/configuration`, `/tls`, `/cache`, `/logging`, `/settings`,
 `/assets/login.js`, `/assets/login-langs.json`, `/assets/style.css`, `/favicon.svg`,
 `/healthz`, `/api/auth/status`, and POST `/api/auth/setup`, `/api/auth/login` are
 anonymous. Panel routes serve the same guarded shell as `/`, so a browser refresh
@@ -91,14 +93,14 @@ after the detached writer starts does not cancel an accepted write.
 The document limit is 256 KiB, with an additional 1024-byte request-envelope allowance.
 For ordinary Settings saves prefer `PUT /api/config/{section}`. Supported sections are
 `listeners`, `response`, `cache`, `logging`, `forwarding`, `headers`, `prometheus`,
-`administration`, `tls`, `vhosts`, `redirects`, `not_found_hosts`, `streams`, `acl-profiles` and `host-policies`.
+`administration`, `tls`, `vhosts`, `web-services`, `redirects`, `not_found_hosts`, `streams`, `acl-profiles` and `host-policies`.
 Each section write still uses revision CAS, full validation and atomic persistence.
 Only a change to the derived cache-compatibility identity purges hot/cold cache;
 unrelated section saves do not.
 
 ## Configuration fields
 
-The canonical document uses `vhosts`, `redirects`, `listeners`, `administration`, `tls`, `logging`,
+The canonical document uses `vhosts`, `web_services`, `redirects`, `listeners`, `administration`, `tls`, `logging`,
 `prometheus`, `cache`, `compression`, `server_header`, `headers`, `host_policies` and other defaulted
 settings. Unknown fields are rejected. `backends`/`routes` at the top level are
 input-only legacy migration fields, omitted from saved canonical documents.
@@ -204,6 +206,11 @@ The language bundle is generated by build.rs from langs/*.json and embedded into
 binary; uploading a new file requires recompilation/restart. It exposes public
 translations only, not filesystem paths, administrator data or credentials.
 
+
+### Web Services
+
+`web_services` contains reusable static-file service definitions. Use `PUT /api/config/web-services` to replace that section with revision CAS. A vhost or location selects `{ "type": "web_server", "web_service_id": "..." }`; an omitted `source` remains `{ "type": "reverse_proxy" }` for compatibility. Filesystem settings remain on the Web Service and are not duplicated inside vhosts. See [WEB_SERVER.md](WEB_SERVER.md).
+
 ## 0.2.0 vhosts and backend state
 
 `vhosts` defaults to an empty array. All models, enum values, defaults and bounds