v0.32.4

docs/VHOSTS.md

@@ -260,8 +260,22 @@ RustProxy does not replay an ambiguous failed POST/PATCH/DELETE through H1, and
 does not interpret backend 4xx/5xx responses as a reason to switch protocols.
 Existing pool reuse, keep-alive, client generation rotation and the independent
 HTTP/1.1 WebSocket Upgrade / H2 Extended CONNECT paths are retained.
-HTTP health probes continue to use HTTP/1.1; H2C-only peers can use TCP probes. `http2`/`h2`/`auto` require `preserve_host: false` to keep origin
-URI/authority/TLS identity consistent. HTTPS backend certificate verification is disabled when `tls_verify` is omitted. Enable `tls_verify: true` when origin identity must be validated; for IP-based origins use a DNS `tls_server_name` present in the certificate and provide `tls_ca_pem` when the issuer is private.
+HTTP health probes continue to use HTTP/1.1 independently of ordinary requests;
+H2C-only peers can use TCP probes. A health probe that needs a virtual-host
+name must configure `health_check.host` separately; `preserve_host` affects
+visitor requests, not independent health probes.
+
+**Since 0.32.4:** all four upstream modes allow `preserve_host: true`.
+With HTTP/2, `:authority` follows the selected HTTP Host instead of the backend
+IP; with HTTP/1.1 it remains the regular Host. TCP/DNS always target the
+configured backend URL and still enforce the address and local-listener
+policies; `tls_server_name` independently controls HTTPS SNI and certificate
+identity, not the visitor Host. HTTPS backend certificate verification defaults
+to OFF when `tls_verify` is omitted. Turn on verification and configure
+`tls_server_name` / `tls_ca_pem` for a private DNS certificate; a valid IP-SAN
+certificate can instead authenticate an IP backend without a DNS name.
+The form's HTTP/1.1 troubleshooting preset is optional; it is not required
+for Auto/H2, private origins or Host preservation.
 
 ## Scheduling