v0.29.4

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.29.3"
+assert manifest["package"]["version"] == "0.29.4"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.29.3"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.29.4"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.29.3",
-    "CHANGELOG.md": "## 0.29.3",
-    "ROADMAP.md": "## 0.29.3",
-    "AGENTS.md": "Current source version: 0.29.3.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.29.3",
+    "README.md": "# RustProxy 0.29.4",
+    "CHANGELOG.md": "## 0.29.4",
+    "ROADMAP.md": "## 0.29.4",
+    "AGENTS.md": "Current source version: 0.29.4.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.29.4",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.29.3"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.29.4"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -1396,7 +1396,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.29.3"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.29.4"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1635,5 +1635,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.29.3 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.29.4 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.29.3 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.29.4 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -64,11 +64,11 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.29.3")
+assert readme.startswith("# RustProxy 0.29.4")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme
-assert roadmap.startswith("# RustProxy roadmap") and "## 0.29.3" and "## 0.29.1" in roadmap and "## 0.29.0" in roadmap and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
+assert roadmap.startswith("# RustProxy roadmap") and "## 0.29.4" and "## 0.29.1" in roadmap and "## 0.29.0" in roadmap and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
 assert "## 0.24." not in roadmap and "## Web Server follow-up" in roadmap and "docs/ROADMAP_HISTORY.md" in roadmap
 assert changelog.startswith("# Changelog\n")
 for release in ["0.29.1", "0.29.0", "0.28.2", "0.28.1", "0.28.0", "0.27.3", "0.27.2", "0.27.1", "0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]:

tools/checks/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.29.3 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.29.4 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.29.3 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.29.4 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.29.3"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.29.4"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.29.3"
+    assert manifest["to_version"] == "0.29.4"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -619,7 +619,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.29.3"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.29.4"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1109,7 +1109,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.29.3"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.29.4"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1314,7 +1314,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.29.3 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.29.4 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/web_server_contracts.py

@@ -21,7 +21,7 @@ web = rust_tree(ROOT, "src/web_server")
 proxy = rust_source(ROOT, "src/proxy/mod.rs")
 admin = rust_source(ROOT, "src/admin/mod.rs")
 ui = read_vhosts_js(ROOT)
-web_ui = (ROOT / "src/admin/web/web-server.js").read_text()
+web_ui = (ROOT / "src/admin/web/web-server.js").read_text() + "\n" + (ROOT / "src/admin/web/web-server-profiles.js").read_text()
 app_ui = read_app_js(ROOT)
 html = (ROOT / "src/admin/web/index.html").read_text()
 settings_ui = (ROOT / "src/admin/web/settings.js").read_text()
@@ -107,12 +107,14 @@ need(web,
      "secure filesystem confinement currently requires a Unix platform")
 need(proxy,
      "if let crate::config::CompiledSource::WebServer(service) = &route.source",
-     "let static_method = request.method().clone()",
+     "let request_method = request.method().clone()",
      "crate::web_server::serve(",
-     "static_headers",
+     "let request_headers = request.headers().clone()",
      "response.extensions_mut().insert(StaticSourceResponse)",
-     "let custom_error =",
+     "execute_error_fallback(",
      "crate::pages::replace_error",
+     "state.cache.wrap_with_fill(",
+     "crate::transform::apply(",
      "apply_response_rules(",
      "finish_headers(",
      "crate::compression::encode(")
@@ -123,8 +125,9 @@ web_source_pos = proxy.index("CompiledSource::WebServer(service)", basic_identit
 assert basic_identity_pos < web_source_pos
 assert identity_pos < web_source_pos
 assert web_source_pos < proxy.index("let (backend, backend_lease, affinity_cookie)")
-custom_error_pos = proxy.index("let custom_error =")
-assert proxy.find("apply_response_rules(", custom_error_pos) > custom_error_pos
+web_source = rust_source(ROOT, "src/proxy/forward/web_source.rs")
+assert web_source.index("apply_response_rules(") > web_source.index("let origin_headers =")
+assert web_source.index("crate::transform::apply(") > web_source.index("apply_response_rules(")
 need(acl, "ambiguous encoded path character", '"/%2e%2e/secret"', '"/a%2fb"', '"/a%5cb"', '"/bad%"')
 need(admin, '"/web-server"', '"/assets/web-server.js"', '"web-services"', '"vhost_metrics"')
 need(html, 'data-panel="web-server"', 'id="panel-web-server"', 'id="web-service-dialog"',
@@ -133,7 +136,9 @@ need(html, 'data-panel="web-server"', 'id="panel-web-server"', 'id="web-service-
      'data-web-service-page="php"', 'data-web-service-page="security"', 'data-web-service-page="htaccess"',
      'id="web-service-htaccess-enabled"', 'id="web-service-htaccess-help"', 'id="htaccess-help-dialog"', 'id="web-service-try-files"',
      'id="web-service-cache-rules"', 'id="web-service-precompressed"', 'id="web-service-compression"', 'id="web-service-compression-zstd"', 'id="web-service-compression-br"', 'id="web-service-compression-gzip"', 'id="web-service-compression-deflate"', 'id="web-service-php-enabled"',
-     'id="web-service-php-pass-authorization"', 'id="web-service-php-body-limit"',
+     'id="web-service-php-pass-authorization"', 'id="web-service-php-profile"',
+     'id="web-service-php-profiles"', 'id="php-fpm-profiles-dialog"',
+     'id="web-service-php-body-limit"',
      'id="web-service-php-header-limit"', 'id="web-service-php-stderr-limit"',
      'id="web-service-php-custom-params"', 'id="web-service-php-values"', 'id="php-help-dialog"',
      'id="web-service-symlink-policy"', 'id="web-service-preset"', 'id="web-service-preset-apply"',
@@ -147,6 +152,10 @@ need(web_ui, 'saveSection("web-services"', "directory_listing", "web_service_id"
      "syncHtaccess", "htaccess-help-dialog", "php-help-dialog", "parseFastCgiParams", "parsePhpValues", "validatePhpCustomData", "activateTab", "initTabs", "presetChanged",
      'button = el("button", t(key), "quiet")', 'button.dataset.tab = name', 'button.setAttribute("role", "tab")', "vhost-detail",
      'el("span", t(key), "small-label")', "if (envelope) render();")
+need(config, "pub php_fpm_profiles: Vec<crate::web_server::PhpFpmProfile>", "duplicate PHP-FPM profile id", "unknown PHP-FPM profile")
+need(web, "pub struct PhpFpmProfile", "pub php_profile_id: Option<String>", "fastcgi_always_sets_http_host_for_http2_http3_wordpress_requests")
+need(proxy, "empty_for_cache(&mut request)", 'request.headers_mut().insert(HOST, original_host.clone())')
+need(web_ui, "phpProfileLocal", 'saveSection("php-fpm-profiles"', "function profileEditor(")
 need(logging, '"route"', '"cache_effective_enabled"', '"transform_effective_enabled"', 'value["cache_enabled"]', 'value["transform_enabled"]')
 need(metrics, "pub struct VhostMetricsView", "ewma_duration_us", "pub fn view(&self) -> VhostMetricsView")
 assert 'item.append(text("span"' not in web_ui
@@ -154,7 +163,10 @@ need(app_ui, 'function showStartupFailure(error)', '$("login").hidden = true', '
 assert '$("login").hidden = false; document.documentElement.classList.remove("app-loading")' not in app_ui
 need(ui, 'type: "web_server"', "web_service_id", "sourceReverseProxy", "vhBackendRequired", "backend-diagnostics-card", "status.vhost_metrics", "vhostTrafficRate")
 assert "WebService" in openapi.get("components", {}).get("schemas", {})
+assert "PhpFpmProfile" in openapi["components"]["schemas"]
+assert "php_fpm_profiles" in openapi["components"]["schemas"]["Config"]["properties"]
 web_service_schema = openapi["components"]["schemas"]["WebService"]
+assert "php_profile_id" in web_service_schema["properties"]
 assert web_service_schema["properties"]["index"].get("minItems", 0) == 0
 assert web_service_schema["properties"]["index"]["maxItems"] == 16
 assert web_service_schema["properties"]["mime_types"]["maxProperties"] == 64

tools/checks/web_service_ui_test.mjs

@@ -33,6 +33,7 @@ class Element {
   showModal() { this.open = true; }
   close() { this.open = false; }
   reset() {}
+  checkValidity() { return true; }
 }
 
 const ids = [
@@ -48,7 +49,9 @@ const ids = [
   "web-service-compression","web-service-compression-options","web-service-compression-zstd","web-service-compression-br","web-service-compression-gzip","web-service-compression-deflate","web-service-precompressed","web-service-precompressed-br","web-service-precompressed-gzip",
   "web-service-preset","web-service-preset-apply","web-service-preset-summary","web-service-reset",
   "web-service-response-headers","web-service-rewrites","web-service-root","web-service-search",
-  "web-service-symlink-policy","web-service-tabs","web-service-try-files"
+  "web-service-symlink-policy","web-service-tabs","web-service-try-files",
+  "web-service-php-profile", "web-service-php-profiles", "web-service-php-profiles-open", "php-fpm-profiles-dialog",
+  "php-fpm-profiles-list", "php-fpm-profiles-close", "php-fpm-profile-add"
 ];
 const elements = new Map(ids.map(id => [id, new Element(id)]));
 const pages = ["general","routing","htaccess","mime","cache","delivery","php","security"].map(name => {
@@ -69,6 +72,7 @@ for (const name of ["zstd", "br", "gzip", "deflate"]) elements.get(`web-service-
 
 const document = {
   body: new Element("body"),
+  createElement: tag => { const node = new Element(); node.type = tag; return node; },
   querySelectorAll(selector) {
     if (selector === "#web-service-tabs button") return elements.get("web-service-tabs").children;
     if (selector === "[data-web-service-page]") return pages;
@@ -101,6 +105,7 @@ const context = {
 };
 vm.createContext(context);
 vm.runInContext(fs.readFileSync("src/admin/web/drafts.js", "utf8"), context, { filename: "drafts.js" });
+vm.runInContext(fs.readFileSync("src/admin/web/web-server-profiles.js", "utf8"), context, { filename: "web-server-profiles.js" });
 vm.runInContext(fs.readFileSync("src/admin/web/web-server.js", "utf8"), context, { filename: "web-server.js" });
 
 // Explicitly disabling scoped dynamic compression must hide and disable codec
@@ -172,3 +177,55 @@ if (saved.php.php_values.memory_limit !== "256M") throw new Error("Saved WordPre
 if (!saved.cache_rules.some(rule => rule.matcher === "ext:css" && rule.cache_control.includes("604800"))) throw new Error("Saved WordPress preset lost cache rules");
 
 console.log("PASS: Web Service preset selection materializes and persists CMS/download settings.");
+
+// The shared editor lists profiles, saves them under the new revisioned
+// section, and Web Services can attach without losing local PHP settings.
+context.envelope.config.php_fpm_profiles = [{
+  id: "wp-pool", name: "WordPress pool", php: {
+    enabled: true, path_info: true, pass_authorization: true,
+    extensions: ["php"], endpoint: "tcp:127.0.0.1:9000",
+    connect_timeout_ms: 1000, request_timeout_ms: 30000,
+    max_concurrent_requests: 64, max_request_body_bytes: 0,
+    max_response_header_bytes: 65536, stderr_log_bytes: 4096,
+    custom_params: {}, php_values: {}, php_admin_values: {}
+  }
+}];
+// Both entry points must share the existing modal; the toolbar shortcut
+// belongs next to New Web Service rather than inside the service editor.
+const html = fs.readFileSync("src/admin/web/index.html", "utf8");
+const webPanel = html.split('id="panel-web-server"')[1]?.split("</section>")[0] ?? "";
+const toolbar = webPanel.match(/<div class="vhost-list-tools">([\s\S]*?)<\/div>/)?.[1] ?? "";
+const shortcutAt = toolbar.indexOf('id="web-service-php-profiles-open"');
+const newAt = toolbar.indexOf('id="web-service-new"');
+if (shortcutAt < 0 || newAt < 0 || shortcutAt > newAt) {
+  throw new Error("PHP-FPM profiles shortcut must be adjacent to New Web Service in the toolbar");
+}
+elements.get("web-service-php-profiles-open").dispatch("click");
+if (!elements.get("php-fpm-profiles-dialog").open) throw new Error("Toolbar PHP-FPM profile shortcut did not open the modal");
+elements.get("php-fpm-profiles-close").dispatch("click");
+if (elements.get("php-fpm-profiles-dialog").open) throw new Error("PHP-FPM profile modal failed to close");
+elements.get("web-service-php-profiles").dispatch("click");
+if (!elements.get("php-fpm-profiles-dialog").open) throw new Error("PHP-FPM profile modal was not opened");
+const profileDetail = elements.get("php-fpm-profiles-list").children[0];
+if (!profileDetail || profileDetail.children[0].textContent !== "WordPress pool") throw new Error("Shared profile list missing");
+const profileForm = profileDetail.children[1];
+profileForm.children[1].children[1].value = "Updated WordPress pool";
+await profileForm.dispatch("submit");
+if (savedSection?.name !== "php-fpm-profiles" || savedSection.value[0].name !== "Updated WordPress pool") {
+  throw new Error("Shared profile edit did not save to the profile configuration section");
+}
+const profileSelector = elements.get("web-service-php-profile");
+const localEndpoint = elements.get("web-service-php-endpoint").value;
+profileSelector.value = "wp-pool";
+profileSelector.dispatch("change");
+if (!elements.get("web-service-php-endpoint").disabled) throw new Error("Shared profile left local PHP controls editable");
+elements.get("web-service-id").value = "wp-shared";
+elements.get("web-service-name").value = "WordPress shared";
+await elements.get("web-service-form").dispatch("submit");
+if (savedSection?.name !== "web-services" || savedSection.value[0].php_profile_id !== "wp-pool") {
+  throw new Error("Web Service did not persist selected shared PHP-FPM profile");
+}
+if (savedSection.value[0].php.endpoint !== localEndpoint) {
+  throw new Error("Attaching a shared FPM profile changed local settings");
+}
+console.log("PASS: Toolbar and editor PHP-FPM shortcuts open the shared modal; profile edits and Web Service attachment work.");