v0.28.1

docs/TRANSPORT.md

@@ -96,9 +96,12 @@ Changing listener addresses or enabling a new listener requires a restart.
 `data/certs/default.pem` and `default.key` are created once when needed. Generated
 certificates are self-signed development material; they do not provide public trust.
 Explicit bindings use exact hostname names and already-present certificate/key files.
-The API stores filenames and names, never private key bytes. CLI generate/import
-refuses to overwrite named files. Input size, regular-file status, private-key
-permissions, matching keys, chain parsing and name coverage are validated.
+Manual entries support two addressing modes: simple filenames are loaded from
+`<data-dir>/certs`, while two absolute paths are read in place (for example Certbot
+`/etc/letsencrypt/live/<name>/fullchain.pem` plus `privkey.pem`). Mixed relative/absolute
+pairs are rejected. The API stores filenames/paths and names, never private key bytes.
+CLI generate/import refuses to overwrite named files. Input size, regular-file status,
+private-key permissions, matching keys, chain parsing and name coverage are validated.
 
 ```bash
 rust-proxy tls generate --name app --hosts app.localhost,alias.localhost
@@ -127,7 +130,9 @@ handshakes use the refreshed snapshot, while established sessions/tunnels are no
 The administration TLS listener remains startup-fixed and reports that a service restart is
 required when its selected certificate changed.
 
-For an externally managed/manual certificate whose configured files were replaced in place, `POST /api/certificates/{certificate_id}/reload` provides the same revision-stable hot-publication contract while targeting that certificate ID. The TLS resolver is immutable, so RustProxy validates and republishes a complete snapshot atomically; this avoids partially updated SNI state. Managed ACME certificate IDs are not accepted by this manual reload path.
+For an externally managed/manual certificate whose configured files were replaced in place, `POST /api/certificates/{certificate_id}/reload` provides the same revision-stable hot-publication contract while targeting that certificate ID. For absolute external paths RustProxy canonicalizes the path again on every reload, intentionally following Certbot `live/` symlinks to the current `archive/` generation before opening the final regular file. The TLS resolver is immutable, so RustProxy validates and republishes a complete snapshot atomically; this avoids partially updated SNI state. Managed ACME certificate IDs are not accepted by this manual reload path.
+
+External absolute-path files are not copied into RustProxy full backups. Their path strings remain in configuration; restore or mount the certificate material separately on the destination host before starting TLS. The `rustproxy` service identity must be able to traverse every parent directory and read both files. External private keys may be owner-only (`0600`) or read-only for a restricted service group (`0640`); group-write, execute and any world permission are rejected.
 
 ## WebSocket behavior