v0.24.13

src/config/model.rs

@@ -70,13 +70,81 @@ pub struct Config {
     pub vhosts: Vec<crate::vhost::Vhost>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_policies: Vec<HostPolicy>,
+    // Preserve old 0.34.13 and earlier config/backup data until compilation migrates it.
+    // Migration happens in compile_with_active, before validation and persistence.
+    #[serde(default, rename = "user_agent_blocking", skip_serializing_if = "Option::is_none")]
+    pub legacy_user_agent_blocking: Option<crate::user_agent::Policy>,
     #[serde(default)]
-    pub user_agent_blocking: crate::user_agent::Policy,
+    pub global_security: GlobalSecurity,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub acl_profiles: Vec<AclProfile>,
     #[serde(default, skip_serializing_if = "HeaderRules::is_empty")]
     pub headers: HeaderRules,
 }
+/// Global HTTP public-listener security. Disabled defaults preserve older configurations.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct GlobalSecurity {
+    // None distinguishes omitted legacy input from an explicitly configured empty policy.
+    // Successful compilation always normalizes this to Some(...).
+    pub user_agent_blocking: Option<crate::user_agent::Policy>,
+    pub country_access: crate::rate_limit::CountryAccess,
+    pub acl: Option<Acl>,
+    pub method_policy: crate::vhost::MethodPolicy,
+    pub content_type_policy: crate::vhost::ContentTypePolicy,
+    pub rate_limit: crate::rate_limit::Settings,
+    pub security_headers: crate::security::SecurityHeaders,
+}
+
+#[derive(Debug, Clone)]
+pub struct CompiledGlobalSecurity {
+    pub user_agent_blocking: crate::user_agent::CompiledPolicy,
+    pub country_access: crate::rate_limit::CountryAccess,
+    pub acl: Option<CompiledAcl>,
+    pub method_policy: crate::vhost::MethodPolicy,
+    pub content_type_policy: crate::vhost::ContentTypePolicy,
+    pub rate_limit: crate::rate_limit::Settings,
+    pub headers: crate::security::CompiledSecurity,
+}
+
+impl Config {
+    pub fn migrate_legacy_user_agent_blocking(&mut self) -> Result<()> {
+        if let Some(legacy) = self.legacy_user_agent_blocking.take() {
+            match &self.global_security.user_agent_blocking {
+                Some(current) => ensure!(
+                    *current == legacy,
+                    "conflicting legacy user_agent_blocking and global_security.user_agent_blocking policies"
+                ),
+                None => self.global_security.user_agent_blocking = Some(legacy),
+            }
+        }
+        Ok(())
+    }
+}
+
+impl GlobalSecurity {
+    pub fn compile(&mut self) -> Result<CompiledGlobalSecurity> {
+        let user_agent_blocking = self.user_agent_blocking
+            .get_or_insert_with(Default::default)
+            .compile()?;
+        self.country_access.validate()?;
+        self.method_policy.validate()?;
+        self.content_type_policy.validate()?;
+        self.rate_limit.validate()?;
+        let acl = self.acl.as_ref().map(Acl::compile).transpose()?;
+        let headers = self.security_headers.compile()?;
+        Ok(CompiledGlobalSecurity {
+            user_agent_blocking,
+            country_access: self.country_access.clone(),
+            acl,
+            method_policy: self.method_policy.clone(),
+            content_type_policy: self.content_type_policy.clone(),
+            rate_limit: self.rate_limit.clone(),
+            headers,
+        })
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct HostPolicy {
@@ -275,7 +343,7 @@ pub struct Snapshot {
     redirects: HashMap<String, Vec<Arc<crate::redirect::CompiledHost>>>,
     not_found_hosts: HashMap<String, Vec<Arc<crate::not_found::CompiledHost>>>,
     host_acls: HashMap<String, Arc<CompiledAcl>>,
-    pub user_agent_blocking: crate::user_agent::CompiledPolicy,
+    pub global_security: CompiledGlobalSecurity,
     pub headers: CompiledHeaders,
 }
 impl std::fmt::Debug for Snapshot {