v0.32.4

langs/en_US.json

@@ -352,7 +352,7 @@
     "vhBackup": "Backup only",
     "vhDrain": "Drain new sessions",
     "vhPrivate": "Allow private origin IP",
-    "vhPreserveHost": "Preserve client Host (HTTP/1.1 only)",
+    "vhPreserveHost": "Preserve original client Host / HTTP/2 authority",
     "vhProtocol": "Origin protocol",
     "vhProtocolHttp1": "HTTP/1.1 (TLS or cleartext)",
     "vhProtocolAuto": "Auto (HTTPS ALPN: H2 + H1; HTTP: H1)",
@@ -883,10 +883,10 @@
     "vhForwardClientIpHelp": "Keep enabled for normal reverse-proxy behavior. Disable to withhold Forwarded, X-Forwarded-For and X-Real-IP from the application while RustProxy, ACLs, rate limits and Tinyauth still use the real client IP.",
     "vhClientIpHidden": "Client IP hidden from backend",
     "listenerMigrateInline": "Existing vhost listener (will migrate)",
-    "vhDebugOriginPreset": "Apply recommended preset",
+    "vhDebugOriginPreset": "Apply HTTP/1.1 troubleshooting preset",
     "vhDebugOriginTlsWarning": "This preset keeps backend TLS certificate verification disabled. The connection is encrypted, but CA and hostname identity are not checked. Continue?",
-    "vhOriginPresetHelp": "Debug origin defaults for new backend rows: HTTPS by IP, default LB pool ON, private origin ON, HTTP/1.1, Preserve client Host ON and TLS verification OFF. Re-enable TLS verification whenever the origin certificate can be validated.",
-    "vhDebugOriginMismatch": "This HTTPS-by-IP origin does not match the debug forwarding preset (pool ON, private origin ON, HTTP/1.1, preserve Host ON, TLS verification OFF). If you enable verification, set TLS server name to the certificate DNS name and add its private CA when needed. Continue with the current values?",
+    "vhOriginPresetHelp": "Optional diagnostic preset, not a requirement: pool ON, private origin ON, HTTP/1.1, Preserve Host ON and TLS verification OFF. Auto/H2 also support Preserve Host. TLS verification OFF skips certificate identity checks; for verified TLS configure the certificate name and private CA when needed.",
+    "vhDebugOriginMismatch": "This HTTPS-by-IP origin has TLS verification enabled without a TLS server name. That works only if the certificate contains the IP address. For a DNS certificate, specify TLS server name and add its private CA when needed. Preserve Host and H1/Auto/H2 do not require this debug preset. Continue?",
     "vhCacheStaticCookie": "Ignore request cookies for selected static file extensions",
     "vhCacheStaticCustom": "Use a custom static extension list",
     "vhCacheStaticExtensions": "Static extensions (one per line, without dot)",