v0.25.0

docs/VHOSTS.md

@@ -1,15 +1,17 @@
 > 0.7 adds graphical locations, Basic Auth, cumulative IP ACL editing and a
 > WebSocket toggle. See [host access and locations](VHOST_ACCESS.md).
 
-# Virtual hosts, frontend bindings and backend pools - 0.2.0
+# Virtual hosts, frontend bindings and backend pools
 
 This is the source implementation contract. Rust compilation and runtime acceptance
 were not performed in the packaging environment; see TEST_REPORT.md.
 
 ## One vhost, one backend pool
 
-A `vhosts` entry owns an `id`, `enabled`, `frontend`, `backends`, `load_balancing`,
-`routes`, optional `acl`, `headers` and `security_headers`. The pre-production top-level
+A `vhosts` entry owns an `id`, `enabled`, `frontend`, `source`, `backends`, `load_balancing`,
+`routes`, optional `acl`, `headers` and `security_headers`. `source` defaults to Reverse Proxy
+for older documents; it can instead reference an independently configured Web Service. See
+[WEB_SERVER.md](WEB_SERVER.md). The pre-production top-level
 routing and inline-listener formats are no longer accepted. Unknown JSON fields are
 rejected. The examples are complete documents, not JSON merge patches:
 
@@ -126,8 +128,9 @@ still validated, but create no pool or additional active listener.
 
 ## Paths, policies and migration
 
-`routes` contains per-vhost paths: `id`, `path_prefix`, `enabled`, nullable `cache`,
-optional `acl`, `headers` and `backend_id`. An empty array becomes one enabled root route. Longest
+`routes` contains per-vhost paths: `id`, `path_prefix`, `enabled`, `source`, nullable `cache`,
+optional `acl`, `headers` and `backend_id`. `source` selects Reverse Proxy or a reusable Web Service;
+`backend_id` is valid only for Reverse Proxy. An empty array leaves the main vhost source as the fallback. Longest
 segment-boundary prefix wins. Origins receive the original path/query; prefixes
 are not stripped. IDs must use ASCII letters, digits, hyphens and underscores.
 Host-policy, reusable ACL-profile, vhost and route ACLs are ANDed before pool