v0.24.13

src/admin/web/app/core.js

@@ -112,7 +112,7 @@ function appConfirm(message, options = {}) {
 }
 function apiArea(path) {
     const section = path.match(/^\/api\/config\/([^/?]+)/)?.[1];
-    if (section) return ({ "listeners": "settings", "http2": "settings", "docker-agents": "dockerVhosts", "response": "settings", "pages": "settings", "cache": "cache", "transform": "settings", "logging": "settings", "geoip": "settings", "forwarding": "settings", "headers": "settings", "prometheus": "settings", "administration": "administration", "tls": "tls", "vhosts": "vhosts", "redirects": "redirects", "not_found_hosts": "notfound", "streams": "streams", "acl-profiles": "aclProfiles", "host-policies": "security", "user-agent-blocking": "security" })[section] || "configuration";
+    if (section) return ({ "listeners": "settings", "http2": "settings", "docker-agents": "dockerVhosts", "response": "settings", "pages": "settings", "cache": "cache", "transform": "settings", "logging": "settings", "geoip": "settings", "forwarding": "settings", "headers": "settings", "prometheus": "settings", "administration": "administration", "tls": "tls", "vhosts": "vhosts", "redirects": "redirects", "not-found-hosts": "notfound", "streams": "streams", "acl-profiles": "aclProfiles", "host-policies": "security", "global-security": "settings" })[section] || "configuration";
     if (path === "/api/config") return "configuration";
     if (path.startsWith("/api/traffic")) return "traffic";
     if (path.startsWith("/api/cache")) return "cache";
@@ -386,9 +386,6 @@ function renderConfig() {
     $("host-policy-list").replaceChildren(...(config.host_policies || []).map((policy, index) => { const box = el("div", undefined, "entity"); box.append(el("span", policy.hosts.join(", "), "entity-title"), el("p", `${t("aclDefault")}: ${t(policy.acl.default || "deny")}\n${rulesText(policy.acl)}`, "entity-details")); const buttons = el("div", undefined, "entity-actions"); buttons.append(action(t("edit"), () => { $("policy-hosts").value = policy.hosts.join(", "); $("policy-default").value = policy.acl.default || "deny"; $("policy-rules").value = rulesText(policy.acl); const editor = $("security-policy-editor"); if (editor) { editor.open = true; editor.scrollIntoView({ block: "nearest" }); } }), action(t("remove"), async () => { if (await appConfirm(t("confirmDelete"), { danger: true })) { const next = structuredClone(config); next.host_policies.splice(index, 1); await saveSection("host-policies", next.host_policies); } })); box.append(buttons); return box; }));
     if (!config.host_policies?.length) $("host-policy-list").append(el("p", t("noPolicies"), "empty"));
     if ($("security-policy-count")) $("security-policy-count").textContent = String((config.host_policies || []).length);
-    const uaPolicy = config.user_agent_blocking || {};
-    if ($("global-ua-block-enabled")) $("global-ua-block-enabled").checked = uaPolicy.enabled === true;
-    if ($("global-ua-block-patterns")) $("global-ua-block-patterns").value = (uaPolicy.patterns || []).join("\n");
 }
 async function saveRequest(path, payload) { if (busy) { toast(t("busy"), true); return false; } if (!authenticated || !envelope) return false; busy = true; const epoch = authEpoch; try { const value = await api(path, { method: "PUT", body: JSON.stringify(payload) }); if (!authenticated || epoch !== authEpoch) return false; envelope = value; if (path === "/api/config" || path === "/api/config/tls") await refreshCertificateInventory(); if (!authenticated || epoch !== authEpoch || !envelope) return false; renderConfig(); toast(t("saved")); await refresh(true); return true; } catch (e) { toast(e.message, true); if (e.status === 401) lock(); return false; } finally { busy = false; } }
 async function save(config) { return saveRequest("/api/config", { expected_revision: envelope?.revision, config }); }
@@ -514,7 +511,69 @@ document.addEventListener("click", event => { if (dashboardSidebar?.classList.co
 document.addEventListener("keydown", event => { if (event.key === "Escape" && dashboardSidebar?.classList.contains("mobile-nav-open")) { setMobileMenu(false); mobileMenuToggle?.focus(); } });
 window.addEventListener("popstate", () => { setPanel(panelFromLocation(), false); setMobileMenu(false); });
 $("host-policy-form").addEventListener("submit", async event => { event.preventDefault(); const form = event.currentTarget; if (!envelope || busy) return; try { await withFormSubmitState(form, event.submitter, async () => { const hosts = [...new Set($("policy-hosts").value.split(",").map(h => h.trim().toLowerCase()).filter(Boolean))]; const acl = { default: $("policy-default").value, rules: parseRules($("policy-rules").value, $("policy-rules")) }; const next = structuredClone(envelope.config); next.host_policies = (next.host_policies || []).map(p => ({ ...p, hosts: p.hosts.filter(h => !hosts.includes(h)) })).filter(p => p.hosts.length); next.host_policies.push({ hosts, acl }); if (await saveSection("host-policies", next.host_policies)) { form.reset(); if ($("security-policy-editor")) $("security-policy-editor").open = false; } }); } catch (e) { toast(e.message, true); } });
-$("global-ua-block-form")?.addEventListener("submit", async event => { event.preventDefault(); const form = event.currentTarget; if (!envelope || busy) return; try { await withFormSubmitState(form, event.submitter, async () => { const patterns = [...new Set($("global-ua-block-patterns").value.split(/\r?\n/).map(value => value.trim()).filter(Boolean))]; await saveSection("user-agent-blocking", { enabled: $("global-ua-block-enabled").checked, patterns }); }); } catch (e) { toast(e.message, true); } });
+// Global HTTP controls are a single atomic API section. A header-only save preserves
+// the current block rules; a block-only save preserves the current security headers.
+const globalLines = id => [...new Set($(id).value.split(/[\n,]+/).map(v => v.trim()).filter(Boolean))];
+const globalPatternLines = id => [...new Set($(id).value.split(/\r?\n/).map(v => v.trim()).filter(Boolean))];
+function globalSecurityPayload(security, ua) {
+    return { ...security, user_agent_blocking: ua };
+}
+$("global-security-form")?.addEventListener("submit", async event => {
+    event.preventDefault(); const form = event.currentTarget; if (!envelope || busy) return;
+    try {
+        await withFormSubmitState(form, event.submitter, async () => {
+            const previous = envelope.config.global_security || {}, rate = previous.rate_limit || {};
+            const countryMode = $("global-country-mode").value;
+            const countries = globalLines("global-country-list").map(v => v.toUpperCase());
+            if (countryMode !== "off" && !countries.length) throw fieldError("global-country-list", t("globalCountriesRequired"));
+            if (countries.some(v => !/^[A-Z]{2}$/.test(v))) throw fieldError("global-country-list", t("globalCountriesInvalid"));
+            const methodMode = $("global-method-mode").value;
+            const methods = [...new Set($("global-method-list").value.split(/[\s,]+/).map(v => v.trim().toUpperCase()).filter(Boolean))];
+            if (methodMode !== "off" && !methods.length) throw fieldError("global-method-list", t("globalMethodsRequired"));
+            const contentTypes = globalLines("global-content-type-list").map(v => v.toLowerCase());
+            if ($("global-content-type-enabled").checked && !contentTypes.length) throw fieldError("global-content-type-list", t("globalContentTypesRequired"));
+            const acl = $("global-ip-enabled").checked ? { default: $("global-ip-default").value, rules: parseRules($("global-ip-rules").value, $("global-ip-rules")) } : null;
+            const ua = { enabled: $("global-ua-block-enabled").checked, patterns: globalPatternLines("global-ua-block-patterns") };
+            const security = {
+                ...previous,
+                country_access: { mode: countryMode, countries },
+                acl,
+                method_policy: { mode: methodMode, methods },
+                content_type_policy: { enabled: $("global-content-type-enabled").checked, blocked: contentTypes },
+                rate_limit: { ...rate, enabled: $("global-rate-enabled").checked,
+                    requests: Number($("global-rate-requests").value),
+                    window_seconds: Number($("global-rate-window").value),
+                    burst: Number($("global-rate-burst").value) },
+            };
+            if (await saveSection("global-security", globalSecurityPayload(security, ua))) {
+                setSettingsDirty("global-security-form", false); renderSettings();
+            }
+        });
+    } catch (e) { toast(e.message, true); }
+});
+$("global-security-headers-form")?.addEventListener("submit", async event => {
+    event.preventDefault(); const form = event.currentTarget; if (!envelope || busy) return;
+    try {
+        await withFormSubmitState(form, event.submitter, async () => {
+            const previous = envelope.config.global_security || {};
+            const optional = id => $(id).value.trim() || null;
+            const security = { ...previous, security_headers: {
+                hsts: { enabled: $("global-hsts-enabled").checked,
+                    max_age_seconds: Number($("global-hsts-age").value),
+                    include_subdomains: $("global-hsts-enabled").checked && $("global-hsts-sub").checked,
+                    preload: $("global-hsts-enabled").checked && $("global-hsts-preload").checked },
+                nosniff: $("global-nosniff").checked, frame_options: $("global-frame").value,
+                referrer_policy: optional("global-referrer"),
+                content_security_policy: optional("global-csp"),
+                permissions_policy: optional("global-permissions")
+            }};
+            if (await saveSection("global-security", globalSecurityPayload(security, previous.user_agent_blocking || { enabled: false, patterns: [] }))) {
+                setSettingsDirty("global-security-headers-form", false); renderSettings();
+            }
+        });
+    } catch (e) { toast(e.message, true); }
+});
+
 $("password-form").addEventListener("submit", async event => { event.preventDefault(); const form = event.currentTarget; try { await withFormSubmitState(form, event.submitter, async () => { if ($("new-password").value !== $("new-password-confirm").value) throw fieldError("new-password-confirm", t("passwordMismatch")); await api("/api/auth/password", { method: "POST", body: JSON.stringify({ current_password: $("current-password").value, new_password: $("new-password").value }) }); lock(); toast(t("passwordChanged")); }); } catch (e) { toast(e.message, true); } });
 $("revoke-sessions").addEventListener("click", async () => { if (!(await appConfirm(t("confirmRevoke"), { danger: true }))) return; try { await api("/api/auth/logout-all", { method: "POST" }); lock(); toast(t("locked")); } catch (e) { toast(e.message, true); } });
 $("security-audit-open").addEventListener("click", () => { const dialog = $("audit-dialog"); if (!dialog.open) dialog.showModal(); void loadAudit(); });

src/admin/web/app/path-permissions.js

@@ -108,6 +108,7 @@
         output.textContent = target.hidden ? "" : commands({ ...options, user: account.value });
         output.hidden = !output.textContent;
         description.hidden = output.hidden;
+        copy.hidden = !output.textContent;
         copy.disabled = !output.textContent;
         empty.hidden = !!output.textContent;
         empty.textContent = t(options.kind === "web" ? "pathPermissionsWebPrompt" : "pathPermissionsCertificatePrompt");
@@ -133,7 +134,7 @@
             const empty = el("p", undefined, "fine");
             details.append(summary, label, help);
             actions.append(copy, details);
-            target.replaceChildren(description, output, empty, actions);
+            target.replaceChildren(output, description, empty, actions);
             view = { target, options, description, summary, help, accountLabel, account, output, empty, copy };
             views.set(target, view);
             account.addEventListener("input", () => update(view));

src/admin/web/app/settings.js

@@ -76,6 +76,61 @@ function renderSettings() {
     $("error-log-status").textContent = errorSink ? `${t("loggingQueue")}: ${fmt(errorSink.queue_dropped)} ${t("loggingDropped")} / ${fmt(errorSink.written)} ${t("loggingSent")} / ${fmt(errorSink.errors)} ${t("errors")} · ${t("loggingCapacity")}: ${fmt(errorSink.queue_capacity)}` : "";
     if (!settingsDirty.has("forwarding-form")) { $("trusted-proxies").value = (config.forwarding?.trusted_proxies || []).join("\n"); $("trusted-proto").checked = !!config.forwarding?.trust_forwarded_proto; }
     if (!settingsDirty.has("headers-form")) { for (const direction of ["request", "response"]) renderHeaderRules(direction, config.headers?.[direction] || []); }
+    const global = config.global_security || {};
+    if (!settingsDirty.has("global-security-form")) {
+        const country = global.country_access || {}, methods = global.method_policy || {}, content = global.content_type_policy || {}, rate = global.rate_limit || {};
+        const ua = global.user_agent_blocking || {}, acl = global.acl;
+        $("global-country-mode").value = country.mode || "off";
+        $("global-country-list").value = (country.countries || []).join("\n");
+        $("global-ua-block-enabled").checked = ua.enabled === true;
+        $("global-ua-block-patterns").value = (ua.patterns || []).join("\n");
+        $("global-ip-enabled").checked = !!acl;
+        $("global-ip-default").value = acl?.default || "allow";
+        $("global-ip-rules").value = rulesText(acl);
+        $("global-method-mode").value = methods.mode || "off";
+        $("global-method-list").value = (methods.methods || []).join("\n");
+        $("global-content-type-enabled").checked = content.enabled === true;
+        $("global-content-type-list").value = (content.blocked || []).join("\n");
+        $("global-rate-enabled").checked = rate.enabled === true;
+        $("global-rate-requests").value = rate.requests ?? 120;
+        $("global-rate-window").value = rate.window_seconds ?? 60;
+        $("global-rate-burst").value = rate.burst ?? 30;
+        syncGlobalSecurityControls();
+    }
+    if (!settingsDirty.has("global-security-headers-form")) {
+        const headers = global.security_headers || {}, hsts = headers.hsts || {};
+        $("global-hsts-enabled").checked = hsts.enabled === true;
+        $("global-hsts-age").value = hsts.max_age_seconds ?? 31536000;
+        $("global-hsts-sub").checked = hsts.include_subdomains === true;
+        $("global-hsts-preload").checked = hsts.preload === true;
+        $("global-nosniff").checked = headers.nosniff === true;
+        $("global-frame").value = headers.frame_options || "preserve";
+        $("global-referrer").value = headers.referrer_policy || "";
+        $("global-csp").value = headers.content_security_policy || "";
+        $("global-permissions").value = headers.permissions_policy || "";
+        syncGlobalSecurityControls();
+    }
+}
+function syncGlobalSecurityControls() {
+    for (const [toggle, children] of [
+        ["global-country-mode", ["global-country-list"]],
+        ["global-ua-block-enabled", ["global-ua-block-patterns"]],
+        ["global-ip-enabled", ["global-ip-default", "global-ip-rules"]],
+        ["global-method-mode", ["global-method-list"]],
+        ["global-content-type-enabled", ["global-content-type-list"]],
+        ["global-rate-enabled", ["global-rate-requests", "global-rate-window", "global-rate-burst"]],
+        ["global-hsts-enabled", ["global-hsts-age", "global-hsts-sub", "global-hsts-preload"]]
+    ]) {
+        const source = $(toggle);
+        const enabled = source.type === "checkbox" ? source.checked : source.value !== "off";
+        for (const id of children) $(id).disabled = !enabled;
+    }
+}
+for (const id of ["global-country-mode", "global-ua-block-enabled", "global-ip-enabled", "global-method-mode", "global-content-type-enabled", "global-rate-enabled", "global-hsts-enabled"]) {
+    $(id)?.addEventListener("change", syncGlobalSecurityControls);
+}
+for (const id of ["global-security-form", "global-security-headers-form"]) {
+    for (const type of ["input", "change"]) $(id)?.addEventListener(type, () => setSettingsDirty(id));
 }
 function effectiveCacheMemory() {
     const d = latestStatus?.system || {}, host = Number(d.memory_total_bytes), cgroup = Number(d.cgroup_memory_max_bytes);

src/admin/web/css/10-base.css

@@ -1504,4 +1504,9 @@ html[data-table-density=ultra] :is(table th, table td) {
   display: grid;
   gap: 6px;
   max-width: 260px;
-}
+}
+/* Permission guidance belongs to its generated command block, not the path inputs. */
+#certificate-external-acl-example.path-permissions { margin-top: 20px; border-top: 1px solid var(--line); padding-top: 15px; }
+.path-permissions-commands { margin-bottom: 0; }
+.path-permissions-commands + .path-permissions-description { margin: 7px 0 0; }
+.path-permissions-actions { margin-top: 10px; }

src/admin/web/css/50-settings.css

@@ -1204,4 +1204,28 @@ html[data-dashboard-density=normal] #panel-overview .stat>span,
 .refresh-settings-grid select {
   width: 100%;
   min-width: 0;
-}
+}
+/* 0.34.13: global security policy forms, grouped with clear control boundaries. */
+.global-policy-form .global-policy-section {
+  display: grid;
+  gap: 10px;
+  border-top: 1px solid var(--line);
+  margin-top: 18px;
+  padding-top: 17px;
+  min-width: 0;
+}
+.global-policy-form .global-policy-section h3 { margin: 0; font-size: 14px; }
+.global-policy-heading { display: grid; gap: 5px; }
+.global-policy-heading p { margin: 0; max-width: 85ch; }
+.global-policy-fields { display: grid; grid-template-columns: minmax(180px, 1fr) minmax(260px, 2fr); gap: 14px; align-items: start; }
+.global-rate-fields { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 14px; align-items: end; }
+.global-policy-fields label, .global-rate-fields label, .global-policy-section > label:not(.check) { display: grid; gap: 6px; min-width: 0; }
+.global-policy-section textarea { width: 100%; box-sizing: border-box; }
+.global-policy-form .form-actions { margin-top: 20px; }
+.cache-static-guidance { margin: 9px 0 0; max-width: 88ch; }
+.cache-header-settings-heading { border-top: 1px solid var(--line); padding-top: 18px; margin-top: 24px; margin-bottom: 13px; }
+.transform-operations-title { border-top: 1px solid var(--line); padding-top: 18px; margin-top: 22px; margin-bottom: 14px; }
+.transform-operations-grid { margin-top: 3px; row-gap: 12px; }
+@media (max-width: 760px) {
+  .global-policy-fields, .global-rate-fields { grid-template-columns: 1fr; }
+}

src/admin/web/host404.js

@@ -80,13 +80,13 @@
     list.replaceChildren(...entries.map(item => {
       const card = el("article", undefined, "vhost-card redirect-card"), head = el("div", undefined, "vhost-card-head"), identity = el("div", undefined, "vhost-card-identity"), title = el("div", undefined, "vhost-title-line");
       title.append(el("strong", item.name || item.id, "entity-title")); if (item.enabled === false) title.append(el("span", t("vhDisabled"), "pill")); identity.append(title, el("div", (item.frontend?.hosts || []).join(" · "), "vhost-hosts")); head.append(identity);
-      const actions = el("div", undefined, "entity-actions"); actions.append(action(t("edit"), () => { window.rustProxyDrafts.prepare(); load(structuredClone(item)); }), action(t("remove"), async () => { if (busy || !(await appConfirm(t("confirmDelete"), { danger: true }))) return; const next = (envelope.config.not_found_hosts || []).filter(value => value.id !== item.id); if (await saveSection("not_found_hosts", next)) { if (editing === item.id) dialog.close(); render(); } })); head.append(actions); card.append(head);
+      const actions = el("div", undefined, "entity-actions"); actions.append(action(t("edit"), () => { window.rustProxyDrafts.prepare(); load(structuredClone(item)); }), action(t("remove"), async () => { if (busy || !(await appConfirm(t("confirmDelete"), { danger: true }))) return; const next = (envelope.config.not_found_hosts || []).filter(value => value.id !== item.id); if (await saveSection("not-found-hosts", next)) { if (editing === item.id) dialog.close(); render(); } })); head.append(actions); card.append(head);
       const detail = el("div", undefined, "vhost-detail-strip"); for (const [key, text] of [["notfoundStatus", String(item.page?.status ?? 404)], ["notfoundMode", t(`notfoundMode${(item.page?.kind || "welcome").replace(/^./, c => c.toUpperCase())}`)], ["redirectListeners", (item.frontend?.listener_ids || []).join(", ")], ["vhCertificate", item.certificate_id || t("vhCertificateDefault")]]) { const node = el("div", undefined, "vhost-detail"); node.append(el("span", t(key), "small-label"), el("b", text)); detail.append(node); } card.append(detail); return card;
     }));
     if (!entries.length) list.append(el("p", t(query ? "notfoundSearchEmpty" : "notfoundEmpty"), "fine"));
   }
   form.addEventListener("input", changed); form.addEventListener("change", changed); $("notfound-mode").addEventListener("change", syncMode); $("notfound-status").addEventListener("change", syncMode);
-  form.addEventListener("submit", async event => { event.preventDefault(); if (!envelope || busy) return; const invalid = [...form.elements].find(input => input.willValidate && !input.checkValidity()); if (invalid) { invalid.reportValidity(); return; } if (revision !== envelope.revision) { toast(t("stale"), true); return; } try { const item = collect(), next = structuredClone(envelope.config.not_found_hosts || []); if (!editing && next.some(value => value.id === item.id)) throw new Error(t("notfoundDuplicate")); const index = next.findIndex(value => value.id === editing); if (index < 0) next.push(item); else next[index] = item; if (await saveSection("not_found_hosts", next)) { dirty = false; editing = item.id; dialog.close(); render(); } } catch (error) { toast(error.message, true); } });
+  form.addEventListener("submit", async event => { event.preventDefault(); if (!envelope || busy) return; const invalid = [...form.elements].find(input => input.willValidate && !input.checkValidity()); if (invalid) { invalid.reportValidity(); return; } if (revision !== envelope.revision) { toast(t("stale"), true); return; } try { const item = collect(), next = structuredClone(envelope.config.not_found_hosts || []); if (!editing && next.some(value => value.id === item.id)) throw new Error(t("notfoundDuplicate")); const index = next.findIndex(value => value.id === editing); if (index < 0) next.push(item); else next[index] = item; if (await saveSection("not-found-hosts", next)) { dirty = false; editing = item.id; dialog.close(); render(); } } catch (error) { toast(error.message, true); } });
   $("notfound-new").addEventListener("click", () => { window.rustProxyDrafts.prepare(); load(); }); $("notfound-search").addEventListener("input", render); $("notfound-sort")?.addEventListener("change", event => { listPrefs.sort = event.target.value; void saveListPrefs(); render(); }); $("notfound-sort-direction")?.addEventListener("click", () => { listPrefs.descending = !listPrefs.descending; syncSortDirection(); void saveListPrefs(); render(); }); $("notfound-close").addEventListener("click", closeEditor); $("notfound-reset").addEventListener("click", async () => { if (await allowDiscard()) load(editing ? structuredClone((envelope?.config.not_found_hosts || []).find(item => item.id === editing) || defaults()) : defaults()); }); dialog.addEventListener("cancel", event => { event.preventDefault(); closeEditor(); });
   window.rustProxyDrafts.register("notfound", { labelKey: "notfound", isOpen: () => dialog.open, isDirty: () => dirty, suspend: suspendDraft, restore: restoreDraft, close: () => { dirty = false; if (dialog.open) dialog.close(); } });
   window.rustProxyNotFound = { render, applyPreferences, reset() { dialog.close(); editing = null; revision = null; dirty = false; listPrefs = { sort: "id", descending: false }; list.replaceChildren(); $("notfound-search").value = ""; if ($("notfound-sort")) $("notfound-sort").value = listPrefs.sort; syncSortDirection(); } };

src/admin/web/index.html

@@ -2088,40 +2088,93 @@
                                 </div>
                                 <nav aria-label="Rules and headers" class="settings-tabs sub-tabs"
                                     id="policy-settings-tabs" role="tablist">
-                                    <button aria-selected="true" data-policy-settings-tab="user-agent"
-                                        data-i18n="globalUaBlockingTitle" type="button">Global User-Agent
-                                        blocklist</button>
+                                    <button aria-selected="true" data-policy-settings-tab="block-allow"
+                                        data-i18n="globalBlockAllow" type="button">Global block / allow</button>
+                                    <button aria-selected="false" data-policy-settings-tab="security-headers"
+                                        data-i18n="globalSecurityHeaders" type="button">Security headers</button>
                                     <button aria-selected="false" data-policy-settings-tab="headers"
                                         data-i18n="customHeaders" type="button">Global custom headers</button>
                                     <button aria-selected="false" data-policy-settings-tab="response"
                                         data-i18n="responseSettings" type="button">Client response</button>
                                 </nav>
                             </div>
-                            <div data-policy-settings-page="user-agent">
-                                <article class="card security-policy-card">
+                            <div data-policy-settings-page="block-allow">
+                                <form class="card edit-form global-policy-form" id="global-security-form">
                                     <div class="card-heading">
-                                        <div><span class="small-label" data-i18n="userAgentBlocking">USER-AGENT
-                                                BLOCKING</span>
-                                            <h2 data-i18n="globalUaBlockingTitle">Global User-Agent blocklist</h2>
-                                            <p class="fine" data-i18n="globalUaBlockingHelp">Blocks matching User-Agent
-                                                values on public proxy vhosts before an upstream is opened. Per-vhost
-                                                lists are configured in Vhosts → Security.</p>
-                                        </div>
+                                        <div><span class="small-label" data-i18n="globalPolicyScope">PUBLIC HTTP LISTENERS</span>
+                                            <h2 data-i18n="globalBlockAllow">Global block / allow</h2>
+                                        </div><span class="pill live" data-i18n="hotApply">LIVE APPLY</span>
                                     </div>
-                                    <form class="edit-form security-inline-form" id="global-ua-block-form">
-                                        <label class="check"><input id="global-ua-block-enabled" type="checkbox" /><span
-                                                data-i18n="enabled">Enabled</span></label>
-                                        <label><span data-i18n="uaBlockPatterns">Blocked patterns, one per
-                                                line</span><textarea id="global-ua-block-patterns" rows="6"
-                                                maxlength="32768" spellcheck="false"
-                                                placeholder="BadBot&#10;curl/*&#10;*scanner*"></textarea></label>
-                                        <p class="fine" data-i18n="uaBlockPatternHelp">Matching is case-insensitive.
-                                            Plain text matches a substring; * is a wildcard. Requests without User-Agent
-                                            are not blocked by this rule.</p>
-                                        <div class="form-actions"><button class="primary" data-i18n="apply"
-                                                type="submit">Validate, save and apply</button></div>
-                                    </form>
-                                </article>
+                                    <p class="fine" data-i18n="globalPolicyHelp">These rules apply before routing to the backend on all public HTTP vhosts, redirects and 404 hosts. Per-vhost restrictions remain active; a local allow cannot bypass a global block. Administration and TCP/UDP Streams are excluded.</p>
+                                    <section class="global-policy-section">
+                                        <div class="global-policy-heading"><h3 data-i18n="globalCountryTitle">Country access</h3><p class="fine" data-i18n="globalCountryHelp">Uses the verified client IP and GeoIP database. Unknown countries are denied in allow mode, but allowed in block mode.</p></div>
+                                        <div class="global-policy-fields">
+                                            <label><span data-i18n="globalCountryMode">Country policy</span><select id="global-country-mode">
+                                                <option value="off" data-i18n="vhOff">Off</option>
+                                                <option value="block" data-i18n="vhCountryBlock">Block listed</option>
+                                                <option value="allow" data-i18n="vhCountryAllow">Allow listed only</option>
+                                            </select></label>
+                                            <label><span data-i18n="globalCountryList">ISO country codes (one per line)</span><textarea id="global-country-list" rows="3" maxlength="1024" spellcheck="false" placeholder="RU&#10;CN"></textarea></label>
+                                        </div>
+                                    </section>
+                                    <section class="global-policy-section">
+                                        <div class="global-policy-heading"><h3 data-i18n="globalUaTitle">User-Agent blocklist</h3><p class="fine" data-i18n="uaBlockPatternHelp">Case-insensitive substring matching; * is a wildcard. A missing User-Agent is not blocked.</p></div>
+                                        <label class="check"><input id="global-ua-block-enabled" type="checkbox"/><span data-i18n="globalUaEnabled">Block matching User-Agents</span></label>
+                                        <label><span data-i18n="uaBlockPatterns">Blocked patterns, one per line</span><textarea id="global-ua-block-patterns" rows="4" maxlength="32768" spellcheck="false" placeholder="BadBot&#10;curl/*&#10;*scanner*"></textarea></label>
+                                    </section>
+                                    <section class="global-policy-section">
+                                        <div class="global-policy-heading"><h3 data-i18n="globalIpTitle">IP / CIDR access</h3><p class="fine" data-i18n="globalIpHelp">Each line: allow or deny followed by IPv4/IPv6 address, CIDR or allow-only DNS name. Default allow with no rules leaves access unrestricted.</p></div>
+                                        <label class="check"><input id="global-ip-enabled" type="checkbox"/><span data-i18n="globalIpEnabled">Enable global IP rules</span></label>
+                                        <div class="global-policy-fields">
+                                            <label><span data-i18n="aclDefault">Default action</span><select id="global-ip-default"><option value="allow" data-i18n="allow">Allow</option><option value="deny" data-i18n="deny">Deny</option></select></label>
+                                            <label><span data-i18n="globalIpRules">Rules (one per line)</span><textarea id="global-ip-rules" rows="3" maxlength="32768" placeholder="deny 192.0.2.0/24&#10;allow 10.0.0.0/8" spellcheck="false"></textarea></label>
+                                        </div>
+                                    </section>
+                                    <section class="global-policy-section">
+                                        <div class="global-policy-heading"><h3 data-i18n="globalMethodTitle">HTTP methods</h3><p class="fine" data-i18n="globalMethodHelp">Block selected methods or allow only those listed. Applies before redirects and cache invalidation; denied requests receive 405.</p></div>
+                                        <div class="global-policy-fields">
+                                            <label><span data-i18n="globalMethodMode">Method policy</span><select id="global-method-mode"><option value="off" data-i18n="vhOff">Off</option><option value="block" data-i18n="locationMethodBlock">Block listed</option><option value="allow" data-i18n="locationMethodAllow">Allow listed only</option></select></label>
+                                            <label><span data-i18n="globalMethodList">Methods (comma, space or newline separated)</span><textarea id="global-method-list" rows="2" maxlength="1024" spellcheck="false" placeholder="TRACE, TRACK"></textarea></label>
+                                        </div>
+                                    </section>
+                                    <section class="global-policy-section">
+                                        <div class="global-policy-heading"><h3 data-i18n="globalContentTypeTitle">Request Content-Type</h3><p class="fine" data-i18n="globalContentTypeHelp">Reject declared MIME types (exact or type/*) with 403. This is a header rule, not body inspection.</p></div>
+                                        <label class="check"><input id="global-content-type-enabled" type="checkbox"/><span data-i18n="globalContentTypeEnabled">Enable Content-Type denylist</span></label>
+                                        <label><span data-i18n="globalContentTypeList">Blocked MIME types, one per line</span><textarea id="global-content-type-list" rows="3" maxlength="16384" spellcheck="false" placeholder="application/x-msdownload&#10;application/x-sh"></textarea></label>
+                                    </section>
+                                    <section class="global-policy-section">
+                                        <div class="global-policy-heading"><h3 data-i18n="globalRateTitle">Shared rate limit</h3><p class="fine" data-i18n="globalRateHelp">Optional per-client-IP limit shared by all public vhosts. Runs in addition to per-vhost limits; use conservative values to avoid blocking legitimate shared clients.</p></div>
+                                        <label class="check"><input id="global-rate-enabled" type="checkbox"/><span data-i18n="globalRateEnabled">Enable global request rate limit</span></label>
+                                        <div class="global-rate-fields">
+                                            <label><span data-i18n="globalRateRequests">Requests per window</span><input id="global-rate-requests" type="number" min="1" max="1000000" required value="120"/></label>
+                                            <label><span data-i18n="globalRateWindow">Window (seconds)</span><input id="global-rate-window" type="number" min="1" max="3600" required value="60"/></label>
+                                            <label><span data-i18n="globalRateBurst">Burst allowance</span><input id="global-rate-burst" type="number" min="0" max="1000000" required value="30"/></label>
+                                        </div>
+                                    </section>
+                                    <div class="form-actions"><button class="primary" data-i18n="globalPolicySave" type="submit">Apply global block / allow rules</button></div>
+                                </form>
+                            </div>
+                            <div data-policy-settings-page="security-headers" hidden="">
+                                <form class="card edit-form global-policy-form" id="global-security-headers-form">
+                                    <div class="card-heading"><div><span class="small-label" data-i18n="globalPolicyScope">PUBLIC HTTP LISTENERS</span><h2 data-i18n="globalSecurityHeaders">Security headers</h2></div><span class="pill live" data-i18n="hotApply">LIVE APPLY</span></div>
+                                    <p class="fine" data-i18n="globalHeadersSecurityHelp">Global response-header baseline for public HTTP vhosts, redirects and 404 hosts. Explicit per-vhost values override matching global headers. HSTS is sent only over HTTPS; test CSP carefully before rollout.</p>
+                                    <section class="global-policy-section"><h3 data-i18n="vhSecurityHstsSection">HTTP Strict Transport Security (HSTS)</h3>
+                                        <label class="check"><input id="global-hsts-enabled" type="checkbox"/><span data-i18n="vhHsts">Enable HSTS</span></label>
+                                        <div class="global-rate-fields">
+                                            <label><span data-i18n="vhHstsAge">Max age (seconds)</span><input id="global-hsts-age" type="number" min="0" max="63072000" required value="31536000"/></label>
+                                            <label class="check"><input id="global-hsts-sub" type="checkbox"/><span data-i18n="vhHstsSub">Include subdomains</span></label>
+                                            <label class="check"><input id="global-hsts-preload" type="checkbox"/><span data-i18n="vhHstsPreload">Preload</span></label>
+                                        </div>
+                                    </section>
+                                    <section class="global-policy-section"><h3 data-i18n="vhSecurityHeadersSection">Response security headers</h3>
+                                        <label class="check"><input id="global-nosniff" type="checkbox"/><span data-i18n="vhNosniff">X-Content-Type-Options: nosniff</span></label>
+                                        <label><span data-i18n="vhFrame">X-Frame-Options</span><select id="global-frame"><option value="preserve" data-i18n="vhPreserve">Preserve origin value</option><option value="deny" data-i18n="vhDeny">DENY</option><option value="sameorigin" data-i18n="vhSameorigin">SAMEORIGIN</option></select></label>
+                                        <label><span data-i18n="vhReferrer">Referrer-Policy</span><input id="global-referrer" maxlength="8192" spellcheck="false" placeholder="strict-origin-when-cross-origin"/></label>
+                                        <label><span data-i18n="vhCsp">Content-Security-Policy</span><textarea id="global-csp" rows="3" maxlength="8192" spellcheck="false" placeholder="default-src 'self'"></textarea></label>
+                                        <label><span data-i18n="vhPermissions">Permissions-Policy</span><input id="global-permissions" maxlength="8192" spellcheck="false" placeholder="camera=(), microphone=()"/></label>
+                                    </section>
+                                    <div class="form-actions"><button class="primary" data-i18n="globalSecurityHeadersSave" type="submit">Apply security headers</button></div>
+                                </form>
                             </div>
                             <div data-policy-settings-page="headers" hidden="">
                                 <form class="card edit-form" id="headers-form">
@@ -2447,8 +2500,9 @@
                                     <label data-i18n="cacheStaticExtensions" for="cache-static-extensions">Global static
                                         extensions</label><textarea id="cache-static-extensions" rows="5"
                                         spellcheck="false"></textarea>
-                                    <p class="fine" data-i18n="cacheStaticHelp">Cookie bypass is limited to these file
+                                    <p class="fine cache-static-guidance" data-i18n="cacheStaticHelp">Cookie bypass is limited to these file
                                         extensions. Response privacy rules still apply.</p>
+                                    <h3 class="subheading cache-header-settings-heading" data-i18n="cacheHeadersSection">Cache response headers</h3>
                                     <div class="switch-grid"><label class="check"><input id="cache-status-header"
                                                 type="checkbox" /><span>X-Cache: HIT / MISS /
                                                 BYPASS</span></label><label class="check"><input id="cache-hits-header"
@@ -2541,7 +2595,7 @@
                                     <p class="fine" id="transform-preset-summary">-</p>
                                 </div>
                                 <p class="fine" id="transform-memory-warning" hidden></p>
-                                <div class="field-grid">
+                                <div class="field-grid transform-limits-grid">
                                     <div><label data-i18n="transformMemoryBudget"
                                             for="transform-memory-budget">Temporary
                                             transform memory budget (MiB)</label><input id="transform-memory-budget"
@@ -2554,7 +2608,8 @@
                                             concurrent transformations</label><input id="transform-max-inflight" min="1"
                                             max="1024" required="" type="number" /></div>
                                 </div>
-                                <div class="switch-grid">
+                                <h3 class="subheading transform-operations-title" data-i18n="transformOperationsTitle">Content transformations</h3>
+                                <div class="switch-grid transform-operations-grid">
                                     <label class="check"><input id="transform-javascript" type="checkbox" /><span
                                             data-i18n="transformJavascript">JavaScript minification</span></label>
                                     <label class="check"><input id="transform-css" type="checkbox" /><span

src/admin/web/settings.js

@@ -100,7 +100,7 @@
       event.preventDefault(); selectPolicyTab(policyTabs[next].dataset.policySettingsTab, true);
     });
   }
-  selectPolicyTab(["headers", "response"].includes(requestedTab) ? requestedTab : "user-agent");
+  selectPolicyTab(["headers", "response", "security-headers", "block-allow"].includes(requestedTab) ? requestedTab : "block-allow");
   const cacheTabs = [...document.querySelectorAll("[data-cache-settings-tab]")];
   function selectCacheTab(name, focus = false) {
     if (!cacheTabs.some(button => button.dataset.cacheSettingsTab === name)) return;
@@ -270,7 +270,7 @@
     const button = $("geoip-update-now"); button.disabled = true;
     $("geoip-status").textContent = t("geoipUpdateWorking");
     try {
-      const result = await api("/api/geoip/update", { method: "POST" });
+      const result = await api("/api/config/geoip/update", { method: "POST" });
       if (result.database) latestStatus = { ...(latestStatus || {}), geoip: result.database };
       render();
       toast(t(result.outcome === "updated" ? "geoipUpdateUpdated" : result.outcome === "busy" ? "geoipUpdateBusy" : "geoipUpdateCurrent"));
@@ -301,6 +301,6 @@
       const text = await response.text(); if (epoch !== authEpoch || !authenticated) return; $("prom-preview-output").textContent = text.slice(0, 262144); $("prom-preview-output").hidden = false;
     } catch (error) { if (epoch === authEpoch) toast(error.message, true); } finally { button.disabled = false; }
   });
-  window.rustProxySettings = { select, selectHttpTab, syncLocation, render, refreshSearch: applySettingsSearch, current: () => active, scrollToApiTokens, reset() { if (search) search.value = ""; applySettingsSearch(); select(validTab(rememberedTab) ? rememberedTab : "appearance", false, false); selectPolicyTab("user-agent"); selectCacheTab("general"); selectLoggingTab("outputs"); selectHttpTab("http2"); window.rustProxyCertificateApi?.reset(); window.rustProxyApiTokens?.reset?.(); window.rustProxyPrometheusToken?.reset?.(); $("prom-preview-output").textContent = ""; $("prom-preview-output").hidden = true; } };
+  window.rustProxySettings = { select, selectHttpTab, syncLocation, render, refreshSearch: applySettingsSearch, current: () => active, scrollToApiTokens, reset() { if (search) search.value = ""; applySettingsSearch(); select(validTab(rememberedTab) ? rememberedTab : "appearance", false, false); selectPolicyTab("block-allow"); selectCacheTab("general"); selectLoggingTab("outputs"); selectHttpTab("http2"); window.rustProxyCertificateApi?.reset(); window.rustProxyApiTokens?.reset?.(); window.rustProxyPrometheusToken?.reset?.(); $("prom-preview-output").textContent = ""; $("prom-preview-output").hidden = true; } };
   select(active); render();
 })();