v0.31.4

src/settings.rs

@@ -1,5 +1,5 @@
 //! Persisted listener intent and response controls. Listener changes require restart.
-use anyhow::{ensure, Result};
+use anyhow::{ensure, Context as _, Result};
 use http::{HeaderMap, HeaderValue};
 use serde::{Deserialize, Serialize};
 use std::{net::SocketAddr, time::Duration};
@@ -195,8 +195,13 @@ pub struct Administration {
     pub tls: bool,
     /// None uses the application-managed default certificate pair.
     pub certificate_id: Option<String>,
-    /// Optional strict DNS Host/Origin allowlist. Empty HTTPS lists accept valid DNS names.
+    /// Optional additional DNS Host allowlist. The hostname of public_origin is
+    /// included automatically at runtime, never duplicated in persisted config.
+    /// With no public_origin, an empty HTTPS list retains the legacy DNS policy.
     pub allowed_hosts: Vec<String>,
+    /// Optional fixed browser-facing HTTPS origin for the panel behind a trusted
+    /// reverse proxy. It is NEVER inferred from forwarded headers.
+    pub public_origin: Option<String>,
     /// Absolute browser-session lifetime. Existing sessions are bounded by the current value.
     pub session_days: u16,
     pub panel_compression: PanelCompression,
@@ -208,6 +213,7 @@ impl Default for Administration {
             tls: false,
             certificate_id: None,
             allowed_hosts: Vec::new(),
+            public_origin: None,
             session_days: 30,
             panel_compression: PanelCompression::default(),
         }
@@ -225,6 +231,7 @@ impl Administration {
             || self.tls != active.tls
             || self.certificate_id != active.certificate_id
             || self.allowed_hosts != active.allowed_hosts
+            || self.public_origin != active.public_origin
     }
     pub fn validate(&mut self, tls: &crate::tls::Settings) -> Result<()> {
         if let Some(addr) = self.listen {
@@ -263,6 +270,14 @@ impl Administration {
                 "duplicate administration hostname"
             );
         }
+        if let Some(public_origin) = self.public_origin.as_mut() {
+            *public_origin = normalize_public_admin_origin(public_origin)?;
+        }
+        // Accept old 0.31.4 saved configs, but never retain a second explicit
+        // copy of the pinned hostname in a validated or newly saved config.
+        if let Some(host) = self.public_origin_host().map(str::to_owned) {
+            self.allowed_hosts.retain(|allowed| !allowed.eq_ignore_ascii_case(&host));
+        }
         Ok(())
     }
 }
@@ -467,5 +482,6 @@ impl ServerHeader {
         }
     }
 }
+include!("settings/public_origin.rs");
 #[cfg(test)]
 include!("settings/tests.rs");