v0.32.4

docs/API.md

@@ -397,6 +397,14 @@ and rust_proxy_http3_requests_total. See source `metrics.rs` for exact HELP/type
 contracts and INTEGRATIONS_040.md for configuration examples.
 
 
+## 0.32.4 backend Host and HTTP/2 authority
+
+Existing backend `preserve_host` is now valid for all `protocol` values:
+`http1`, `auto`, `http2` and `h2`. HTTP/2 :authority follows the request Host,
+while socket/DNS use the configured origin and TLS SNI uses
+`tls_server_name` if present. No new JSON fields, endpoints, database migration
+or extra retries. HTTP health checks maintain their own Host override.
+
 ## 0.32.3 Overview registry and compatible upstream modes
 
 The backend `protocol` wire values are `http1` (default), `auto`, `http2`

docs/MIGRATION.md

@@ -1,5 +1,20 @@
 # Deployment and configuration migration history
 
+## 0.32.3 -> 0.32.4 Preserve Host and Dashboard gutters
+
+No SQL schema, saved vhost JSON, account preferences or widget IDs change.
+`preserve_host: true` now works with `http1`, `auto`, `http2` and `h2` instead of
+being rejected for the latter three. If an HTTPS backend is addressed by IP but
+serves multiple vhosts, retaining the visitor Host also sets HTTP/2 `:authority`
+to the public host, while TCP/DNS use the configured URL and optional
+`tls_server_name` sets SNI/certificate identity. Keep a separate
+`health_check.host` for HTTP probes that require the vhost name. The debugging
+H1 preset remains optional, and original Overview widget preferences survive.
+Check TLS verification, hostname/certificate coverage and Angie handling on a
+real staging instance before deployment; the Rust compiler acceptance gate
+is still open.
+
+
 ## 0.32.2 -> 0.32.3 upstream protocol and Dashboard compatibility
 
 No database or backend JSON rewrite is required. In 0.32.2 an HTTPS origin

docs/TEST_REPORT.md

@@ -0,0 +1,63 @@
+# Verification report - RustProxy 0.32.4
+
+## Scope
+
+Review of the supplied RustProxy 0.32.3 source and patch to 0.32.4:
+HTTP Host / HTTP/2 authority parity, explicit TCP/DNS destination and TLS/SNI
+isolation, relaxed HTTPS-by-IP troubleshooting hint, and uniform Overview gutters.
+Follow-up patch to the first 0.32.4 archive:
+- Fix reported `E0382` in `src/proxy/types.rs`: `Request::builder().uri(uri)`
+  moved `uri` before `upstream_request_target(&uri, ...)` could borrow it.
+  `.uri(uri.clone())` preserves the original URI for authority selection.
+- Make normal Overview gutters uniformly 4px (dense 3px, comfortable 12px).
+  Resolve the higher-specificity `html[data-dashboard-density] .stats-grid`
+  rule which otherwise overrode the aligned grid and kept the larger gaps.
+Existing database/configuration schemas and retry/transport policies are
+unchanged. Only compiling Rust and live protocol tests prove runtime behavior.
+
+## Available checks
+
+- `./dev.sh test`: **all pre-Cargo checks passed**, including source/security,
+  SQLite migration/upgrade/backup simulations, memory-model scripts and **35
+  Node.js UI/behavior test scripts**. The command then exited **127** because
+  Rust/Cargo is not installed; this is **not** a passing Rust test run.
+- New `preserve_host_0324.py` and `preserve_host_0324_ui_test.mjs` passed:
+  authority/destination split source contracts, four protocol selectors,
+  verified/unencrypted origin warnings, explicit diagnostics preset.
+- Expanded Chromium CSS fixture `tools/checks/overview_gutters_0324_browser.py`:
+  **27 checks passed** (3 container widths x 3 UI density modes x 3 Dashboard
+  densities), checking horizontal/vertical gutters, equally high rows and
+  numeric-to-large-card transition. Normal/dense/comfortable gaps measured
+  **4/3/12px** and the outer grid bottom margin remained `0px`.
+  The older `overview_grid_spacing_0323_browser.py` also passed with all
+  62 blocks, responsive breakpoints and browser zoom 90%-130%.
+  These are simulated layout tests, not a live administrator session.
+- `preserve_host_0324.py` now guards against moving `uri` before its final
+  authority adjustment, in addition to the backend/transport source contracts.
+  The existing Rust unit test for retry authority remains in the source.
+- Version consistency: Cargo manifest, package root in existing lockfile,
+  OpenAPI, README, release notes and static assertion fixtures updated to 0.32.4.
+  External Cargo dependency resolutions have **not** been regenerated.
+
+## Rust validation not performed (blocking for production)
+
+The user's Rust compiler reported `error[E0382]: borrow of moved value: uri`
+from the first 0.32.4 archive. This has been corrected in source, but **the
+corrected code has not been compiled here**: no Cargo or Rust compiler is
+available in the source-editing environment.
+Do not treat static tests or the simulated TLS-peer tests added to Rust source
+as evidence that RustProxy builds or that an actual Angie backend accepts the
+corrected requests. Run, on a Rust 1.99+ host:
+
+```sh
+cargo fmt --all -- --check
+cargo check --locked --all-targets
+cargo test --locked
+```
+
+Then validate on staging with HTTPS-by-IP and `preserve_host: true` for
+HTTP/1.1, Auto (H2 and H1 ALPN), compatible HTTP/2 and strict H2; check
+`:authority` vs `Host`, SNI, certificate verification, WebSockets, H2C and
+HTTP health probe `host` overrides. Inspect Angie response/error logs for
+400 responses and verify backend connectivity through pool rotation/retry.
+No claim of universal backend compatibility or measured throughput is made.

docs/TRANSPORT.md

@@ -35,10 +35,13 @@ Extended CONNECT on vhosts that did not opt in. Ordinary CONNECT and other Exten
 protocols remain rejected because RustProxy is not an open forward proxy. RFC 8441 may bridge
 to an HTTP/1.1 WebSocket backend or use a backend explicitly configured for HTTP/2.
 
-HTTP/2 and `auto` upstream configuration require `preserve_host: false` in this
-release. The target URI, pool key and HTTP/2 authority use the configured backend.
-Use HTTP/1.1 for a backend that requires the original Host. The original hostname
-is also available through the proxy-generated `X-Forwarded-Host` field.
+Since 0.32.4, `preserve_host: true` is supported with `http1`, `auto`, `http2`
+and strict `h2`. H1 carries the public Host; on H2 the outgoing `:authority`
+follows that Host. The *network* destination and DNS/ACL policy stay pinned to
+the configured backend URL. TLS SNI and certificate validation independently use
+`tls_server_name` when supplied or the configured origin otherwise.
+The client hostname also remains available via `X-Forwarded-Host`. HTTP health
+probes are separate H1 requests and may need an explicit `health_check.host`.
 
 For ordinary proxy traffic, an explicit `protocol=http2` backend is forwarded with an
 HTTP/2 request version. Cleartext `http://` uses h2 prior knowledge. HTTPS keeps the

docs/VHOSTS.md

@@ -260,8 +260,22 @@ RustProxy does not replay an ambiguous failed POST/PATCH/DELETE through H1, and
 does not interpret backend 4xx/5xx responses as a reason to switch protocols.
 Existing pool reuse, keep-alive, client generation rotation and the independent
 HTTP/1.1 WebSocket Upgrade / H2 Extended CONNECT paths are retained.
-HTTP health probes continue to use HTTP/1.1; H2C-only peers can use TCP probes. `http2`/`h2`/`auto` require `preserve_host: false` to keep origin
-URI/authority/TLS identity consistent. HTTPS backend certificate verification is disabled when `tls_verify` is omitted. Enable `tls_verify: true` when origin identity must be validated; for IP-based origins use a DNS `tls_server_name` present in the certificate and provide `tls_ca_pem` when the issuer is private.
+HTTP health probes continue to use HTTP/1.1 independently of ordinary requests;
+H2C-only peers can use TCP probes. A health probe that needs a virtual-host
+name must configure `health_check.host` separately; `preserve_host` affects
+visitor requests, not independent health probes.
+
+**Since 0.32.4:** all four upstream modes allow `preserve_host: true`.
+With HTTP/2, `:authority` follows the selected HTTP Host instead of the backend
+IP; with HTTP/1.1 it remains the regular Host. TCP/DNS always target the
+configured backend URL and still enforce the address and local-listener
+policies; `tls_server_name` independently controls HTTPS SNI and certificate
+identity, not the visitor Host. HTTPS backend certificate verification defaults
+to OFF when `tls_verify` is omitted. Turn on verification and configure
+`tls_server_name` / `tls_ca_pem` for a private DNS certificate; a valid IP-SAN
+certificate can instead authenticate an IP backend without a DNS name.
+The form's HTTP/1.1 troubleshooting preset is optional; it is not required
+for Auto/H2, private origins or Host preservation.
 
 ## Scheduling