v0.34.10

docs/ACME_PROVIDERS.md

@@ -58,6 +58,18 @@ When another service owns the certificate, add a manual certificate with the act
 /etc/letsencrypt/live/example.com/privkey.pem
 ```
 
+### Permission commands and automatic SNI names
+
+Select **External files (absolute paths)** and enter both paths. A permission-command block is generated **below the certificate and private-key fields** and changes as the paths change. It uses the supplied paths, resolves symlink targets on the server when run, removes group/other write permission on the resolved PEM files and other-user read permission on the private key, then grants traversal of the relevant parent directories and read access to the files for `rustproxy`. Install the Linux `acl` tools if needed and review/run the commands as an administrator on that server. The panel generates commands; it does not execute them or change filesystem ownership.
+
+The paths must be absolute, without `.`/`..` components or control characters, and resolve to existing regular files when the commands run. For a custom deployment, change **Service user** under **Options and help** before copying the commands; the default is `rustproxy`. This field only changes the generated instructions, not RustProxy's process identity or saved configuration.
+
+The existing trusted-path rules still apply: real PEM files and ancestors must be owned by root or the RustProxy service user, ancestors must not be group/world-writable, and a private key must not be world-readable or group/world-writable. ACLs alone do not make an untrusted path acceptable. Container mounts and mandatory access-control rules need matching deployment settings; see [Installation](INSTALL.md#linux-debrpm-read-only-access-to-external-paths).
+
+After a public certificate becomes readable, the editor automatically fills **Legacy SNI names** from its DNS Subject Alternative Name (SAN) entries. Wildcard SANs are retained; filenames and a certificate's Common Name are not used to invent DNS names. Inspection applies to managed certificate filenames and external paths, reads only the public PEM, and does not activate or save the certificate. The certificate/key pair is still validated when applied.
+
+Automatic reads preserve manually edited names, intentional clearing and existing saved mappings. Results from an earlier path or form are ignored. Use **Read names from certificate** to retry after fixing filesystem permissions or to deliberately replace the current field with the certificate's names. Prefer explicit certificate assignment in the intended Vhost; auto-filled legacy SNI names do not create Vhosts or replace their assignments.
+
 Keep the original Certbot renewal system and use the RustProxy certificate reload/deploy API or local CLI after rotation. RustProxy resolves relevant symlinks again during reload. The service account must have directory traverse and narrow read permissions to the **current** key file; `ReadOnlyPaths` alone does not grant filesystem permission. Renewal hooks may need to reapply ACLs to replaced target files.
 
 ### Restricted certificate API
@@ -71,5 +83,6 @@ Create an appropriately scoped credential in **Settings → Certificate API**. I
 - **Certificate available but wrong site certificate displayed:** Vhost assignment, listener binding, hostname and restart/reload state.
 - **Renewal stops:** Certbot runtime, private profile files, DNS secrets, clock skew, permissions and CA limits.
 - **External file reload fails:** rotated symlink targets, certificate/key match, SAN coverage and read permissions.
+- **SNI field does not auto-fill:** check the read status below the paths, grant access to the public certificate, then use **Read names from certificate**. A manually edited/cleared field is intentionally preserved until this explicit action; a certificate without DNS SAN entries supplies no names.
 
 Keep a private encrypted application backup and a separate copy of any external certificate/key material. See [Backup and recovery](BACKUP.md) and [Security](SECURITY.md).

docs/API.md

@@ -26,6 +26,7 @@ The current bundled `src/admin/openapi.json` declares these operations (among ot
 | `GET /api/metrics/json` · `GET /api/metrics/summary` | Full JSON snapshot (includes all Prometheus samples and `summary`) or compact computed `summary` only, both pull-only. [Monitoring](MONITORING.md). |
 | `GET /api/docker` · `POST /api/docker/refresh` | Docker-agent observation and refresh. |
 | `GET /api/certificates` · `POST /api/certificates/upload` | Certificate inventory/import. |
+| `POST /api/certificates/inspect` | Read DNS SAN coverage from a managed/external public PEM path for the editor; admin browser session only. |
 | `GET /api/acme` · `POST /api/acme/issue` · `POST /api/acme/renew` | Managed certificate jobs. |
 | `GET/PUT /api/preferences` | Personal UI settings. |
 | `GET /api/dashboard-presets` and named preset operations | Saved Overview presets. |
@@ -33,6 +34,8 @@ The current bundled `src/admin/openapi.json` declares these operations (among ot
 
 Some paths have additional DELETE/PATCH operations, job-status resources, query parameters or restricted actions. Use OpenAPI for the **actual fields/methods**, not guesses based on a table. `GET /metrics` here is not a replacement for the separate Prometheus exporter.
 
+Certificate inspection accepts `{ "cert_file": "filename.pem" }` for a managed file or an absolute external path and returns `{ "cert_file": "...", "covered_hosts": ["example.com"] }`. It applies the existing certificate-file trust and size checks and reads no private key. It makes no configuration or permission changes. This POST requires the signed-in administrator's normal Origin, request-marker and CSRF checks; general RO/RW API tokens and certificate-only credentials cannot call it.
+
 ## Authentication and safe writes
 
 - Ordinary API calls require an administrator browser/session cookie on the admin listener, or a scoped general API Bearer token for explicitly allowlisted API methods/paths. Logging in also provides CSRF context. Writes require correct Host/Origin, `X-CSRF-Token` and `X-RustProxy-Request: 1` as enforced by the server.

docs/INSTALL.md

@@ -98,6 +98,18 @@ modify these files merely because a group or ACL permits it. No systemd
 drop-in or extra `ReadOnlyPaths=` entry is needed to **read** site content or
 an external certificate. This also applies when paths are stored in the panel.
 
+In **0.34.10**, the panel generates Linux permission commands from the actual
+paths you enter: below the two external certificate/key fields, and directly
+below a Web Server's document root. The commands target the standard
+`rustproxy` account and resolve symlink targets when run. Review them and run
+them as an administrator on the server; the panel never executes them.
+Install your distribution's `acl` package for `setfacl`. If you use a different
+service identity, set **Service user** under **Options and help** to that account before
+copying. This field changes only the commands, not the process identity.
+No command can replace
+the certificate trusted-owner checks or bypass systemd/SELinux/AppArmor
+restrictions.
+
 The service runs as the unprivileged `rustproxy` user. To use a dedicated web
 group, give that group directory traversal and file read permissions on the
 site, then add RustProxy to it:
@@ -144,6 +156,12 @@ are suitable for static websites but **not** for external keys under the
 current trusted-path validation. Use root-owned certificate storage instead.
 Keep all key access narrow and read-only.
 
+After granting certificate read access, return to the form and use
+**Read names from certificate**. The editor reads the public certificate's
+DNS SAN entries into the legacy SNI field; this does not read the private key
+or save the certificate. Manual name edits are preserved by background reads.
+See [Certificates](ACME_PROVIDERS.md#permission-commands-and-automatic-sni-names).
+
 To diagnose unresolved errors, run `systemctl cat rustproxy` and
 `systemctl show rustproxy -p ProtectHome -p ProtectSystem -p User -p Group`,
 check parent permissions with `namei -l /path/to/file`, and examine

docs/README.md

@@ -1,6 +1,6 @@
 # RustProxy documentation
 
-Practical guides for **RustProxy 0.34.9**. This index and the listed pages are also available in the authenticated panel at **`/docs → Reader`**. The adjacent **API** tab provides the embedded OpenAPI reference. Paths below are links to actual files in the source archive.
+Practical guides for **RustProxy 0.34.10**. This index and the listed pages are also available in the authenticated panel at **`/docs → Reader`**. The adjacent **API** tab provides the embedded OpenAPI reference. Paths below are links to actual files in the source archive.
 
 ## Getting started
 
@@ -14,7 +14,7 @@ Practical guides for **RustProxy 0.34.9**. This index and the listed pages are a
 - [Vhosts and backends](VHOSTS.md) — domains, listener bindings, request Content-Type filtering, balancing, health and redirects.
 - [Custom locations](CUSTOM_LOCATIONS.md) — path routing, rewrites, local responses and error fallbacks.
 - [Access and authentication](ACCESS.md) — ACL, country/DDNS, Basic Auth, Tinyauth and rate limits.
-- [Static Web Server](WEB_SERVER.md) — document roots, downloads, rules, built-in error pages and file delivery.
+- [Static Web Server](WEB_SERVER.md) — document roots, generated filesystem permission commands, downloads, rules, built-in error pages and file delivery.
 - [PHP-FPM](PHP_FPM.md) — PHP service profiles, security and application examples.
 - [Cache](CACHE.md) — HOT/COLD storage, privacy, TTL and invalidation.
 - [Response delivery](RESPONSE_DELIVERY.md) — compression, static transformations and response headers.
@@ -24,7 +24,7 @@ Practical guides for **RustProxy 0.34.9**. This index and the listed pages are a
 
 ## Integrations and operations
 
-- [Certificates and automatic renewal](ACME_PROVIDERS.md) — PEM, HTTP-01, DNS-01, Certbot and external certificates.
+- [Certificates and automatic renewal](ACME_PROVIDERS.md) — PEM, automatic SNI names, path permission commands, HTTP-01, DNS-01, Certbot and external certificates.
 - [Docker discovery](DOCKER_DISCOVERY.md) — optional Linux agent DEB/RPM or manual installation, TLS/token CLI, networking, generated Vhosts and their per-service live HTTP logs.
 - [Other integrations](INTEGRATIONS.md) — Tinyauth, NPM migration, OPNsense and monitoring tools.
 - [Dashboard](DASHBOARD.md) — metrics panels, HIT/MISS/BYPASS/OTHER request mix, presets, configuration history and applying stylesheet updates.

docs/TLS_POST_QUANTUM.md

@@ -1,6 +1,6 @@
 # Experimental post-quantum TLS key exchange (PQC)
 
-**Version:** RustProxy 0.34.9 (source candidate). **Default: off.** This is an experimental opt-in feature and not a production compatibility guarantee.
+**Version:** introduced in RustProxy 0.34.9; included in the 0.34.10 source candidate. **Default: off.** This is an experimental opt-in feature and not a production compatibility guarantee.
 
 ## What it does
 
@@ -50,4 +50,4 @@ If your TLS connection ends at a CDN, load balancer or TLS-terminating proxy, th
 - Enabling the switch changes the incoming TLS cryptographic provider to `aws-lc-rs`; some uncommon certificates, algorithms or hardware platforms may behave differently. `aws-lc-rs` requires a native C/C++ build toolchain; CMake may be needed for some build modes (non-FIPS commonly does not require it). The `ring` provider remains used where the switch is off and for existing outbound integrations.
 - A non-empty cipher-suite allowlist must contain suites supported by the selected provider; invalid combinations are rejected. PQC requires TLS 1.3.
 - For immediate rollback, **uncheck PQC in Settings → TLS policy and save**, and if necessary remove per-Vhost overrides that require PQC. Confirm new connections negotiate classic X25519. Existing sessions cannot renegotiate in place; close/reconnect them to retest. Keep the prior binary and backups available for a full rollback.
-- **Release verification:** this 0.34.9 source candidate has not undergone native Cargo build, TLS handshake, QUIC interoperability or production load testing. Verify the provisionally updated `Cargo.lock` with `cargo metadata --locked` (and refresh it with Cargo if needed), then run `cargo check --all-targets`, `cargo test --all-targets`, `cargo build --release`, and protocol tests before deployment. See the release changelog and source verification notes.
+- **Release verification:** the PQC implementation inherited from 0.34.9 still requires native Cargo build, TLS handshake, QUIC interoperability and production load acceptance. Verify the provisionally updated `Cargo.lock` with `cargo metadata --locked` (and refresh it with Cargo if needed), then run `cargo check --all-targets`, `cargo test --all-targets`, `cargo build --release`, and protocol tests before deployment. See the release changelog and source verification notes.

docs/WEB_SERVER.md

@@ -21,6 +21,16 @@ service outside its private state/log/config paths. Grant execute/traversal
 on each parent directory and read permission on served files; see
 [Installation: external paths](INSTALL.md#linux-debrpm-read-only-access-to-external-paths).
 
+### Generated filesystem permission commands
+
+As you enter an absolute **Document root**, the editor generates permission commands immediately below the path. They refresh when opening or clearing a service, applying a preset or changing the root, so the displayed commands refer to the current field. The path must not contain `.`/`..` components or control characters and must resolve to an existing directory when the commands run; `/` is not accepted. Install the Linux `acl` tools if needed, review the commands and run them as an administrator on the web server. Saving a Web Service does not execute shell commands or grant filesystem permissions.
+
+The helper grants the `rustproxy` service account traversal (`--x`) of parent directories, read/traversal (`r-x`) on the website's directories and read (`r--`) on regular files. Symlinked document roots are resolved when the commands run, so both the configured path and the target's ancestors can be traversed. Symlinks within the served tree are not followed by the permission walk. Read-only ACLs do not grant writes or relax the Web Service's own symlink policy. Keep private content outside the document root.
+
+Default read/traverse ACLs are added to the existing website directories for newly created content. Default ACL inheritance takes precedence over the creator's `umask`; missing defaults are seeded from the directory's existing permissions. Explicit restrictive creation modes can still mask RustProxy's read access. Files moved into the tree or installed with preserved permissions may need the commands reapplied. Repeat the commands after a deployment changes the document-root symlink target. For a custom service account, change **Service user** under **Options and help** before copying; this changes only the instructions, not the process identity or saved configuration.
+
+For PHP applications, the separate **PHP-FPM pool user** needs its own access to scripts and any writable application directories. The generated RustProxy ACLs do not configure that user. Files must also be visible within the service's container/systemd namespace and permitted by SELinux/AppArmor if used; filesystem ACLs cannot override those policies.
+
 ## File serving options
 
 | Feature | Behavior / caution |