v0.32.4

src/admin/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "RustProxy Administration API",
-    "version": "0.32.3",
+    "version": "0.32.4",
     "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust."
   },
   "servers": [
@@ -1981,7 +1981,8 @@
           },
           "preserve_host": {
             "type": "boolean",
-            "default": true
+            "default": true,
+            "description": "Keep the original client Host for HTTP/1.1 or HTTP/2 :authority, independently of origin URL, TCP destination and TLS SNI. Supported with http1, auto, http2 and h2."
           },
           "protocol": {
             "type": "string",

src/admin/web/vhosts/core.js

@@ -207,7 +207,8 @@ function memberRow(parent, value = { id: `origin-${parent.children.length + 1}`,
   const connection = el("div", undefined, "vh-wide vh-backend-switches vh-backend-connection"); main.append(connection);
   controls["member-private"] = field(connection, "member-private", "vhPrivate", value.allow_private, "checkbox");
   const preserve = field(connection, "member-host", "vhPreserveHost", value.preserve_host === true, "checkbox");
-  const syncProtocol = () => { preserve.disabled = protocol.value !== "http1"; if (preserve.disabled) preserve.checked = false; }; protocol.addEventListener("change", syncProtocol); syncProtocol();
+  // Preserve Host is a request-authority choice, not an HTTP/1.1-only option.
+  // The Rust forwarder keeps HTTP/2 :authority consistent with this value.
 
   const advanced = el("details", undefined, "vh-wide vh-backend-advanced"), extra = el("div", undefined, "vh-grid"); advanced.append(text("summary", "advanced"), extra);
   field(extra, "member-allowlist", "vhAddressAllowlist", (value.address_allowlist || []).join("\n"), "textarea", { rows: 2, maxLength: 8192 });
@@ -258,7 +259,7 @@ function memberRow(parent, value = { id: `origin-${parent.children.length + 1}`,
     if (!(await appConfirm(t("vhDebugOriginTlsWarning"), { danger: true }))) return;
     if (!url.value.trim()) url.value = "https://127.0.0.1:9000";
     controls["member-pool"].checked = true; controls["member-private"].checked = true;
-    protocol.value = "http1"; preserve.checked = true; tlsVerify.checked = false; syncProtocol(); syncRisk(); changed();
+    protocol.value = "http1"; preserve.checked = true; tlsVerify.checked = false; protocol.dispatchEvent(new Event("change")); syncRisk(); changed();
   }));
   actions.append(text("span", "vhOriginPresetHelp", "fine")); row.append(actions);
 
@@ -296,7 +297,10 @@ function debugOriginIssues(members) {
     let parsed; try { parsed = new URL(member.url); } catch { return false; }
     const host = parsed.hostname.replace(/^\[|\]$/g, ""), ipHost = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host) || host.includes(":");
     if (parsed.protocol !== "https:" || !ipHost) return false;
-    return !member.pool_eligible || !member.allow_private || member.protocol !== "http1" || !member.preserve_host || member.tls_verify;
+    // The troubleshooting preset is OPTIONAL, not a protocol compatibility rule.
+    // Warn only when IP-host TLS verification may need an explicit identity;
+    // HTTP/1.1, Auto and H2 plus preserve_host are all valid configurations.
+    return member.tls_verify === true && !String(member.tls_server_name || "").trim();
   });
 }
 function aclEditor(parent, initial, onChange = () => { }) {