v0.34.10

docs/INSTALL.md

@@ -98,6 +98,18 @@ modify these files merely because a group or ACL permits it. No systemd
 drop-in or extra `ReadOnlyPaths=` entry is needed to **read** site content or
 an external certificate. This also applies when paths are stored in the panel.
 
+In **0.34.10**, the panel generates Linux permission commands from the actual
+paths you enter: below the two external certificate/key fields, and directly
+below a Web Server's document root. The commands target the standard
+`rustproxy` account and resolve symlink targets when run. Review them and run
+them as an administrator on the server; the panel never executes them.
+Install your distribution's `acl` package for `setfacl`. If you use a different
+service identity, set **Service user** under **Options and help** to that account before
+copying. This field changes only the commands, not the process identity.
+No command can replace
+the certificate trusted-owner checks or bypass systemd/SELinux/AppArmor
+restrictions.
+
 The service runs as the unprivileged `rustproxy` user. To use a dedicated web
 group, give that group directory traversal and file read permissions on the
 site, then add RustProxy to it:
@@ -144,6 +156,12 @@ are suitable for static websites but **not** for external keys under the
 current trusted-path validation. Use root-owned certificate storage instead.
 Keep all key access narrow and read-only.
 
+After granting certificate read access, return to the form and use
+**Read names from certificate**. The editor reads the public certificate's
+DNS SAN entries into the legacy SNI field; this does not read the private key
+or save the certificate. Manual name edits are preserved by background reads.
+See [Certificates](ACME_PROVIDERS.md#permission-commands-and-automatic-sni-names).
+
 To diagnose unresolved errors, run `systemctl cat rustproxy` and
 `systemctl show rustproxy -p ProtectHome -p ProtectSystem -p User -p Group`,
 check parent permissions with `namei -l /path/to/file`, and examine