v0.26.6

docs/VHOST_ACCESS.md

@@ -73,13 +73,17 @@ custom request-header rules, which cannot reintroduce removed credentials.
 continues to use verified identity headers from that service.
 
 Global host policies, reusable ACL profiles, vhost ACLs and location ACLs remain
-cumulative: access requires all applicable policies **and** successful authentication.
+cumulative: access requires all applicable policy scopes **and** successful authentication.
 An ACL profile can be defined once under **ACL profiles**, combine default allow/deny
 IPv4/IPv6 CIDR rules with country block/allow-only policy, then be attached to several
 vhosts. Per-vhost rules remain available and are evaluated in addition to the profile.
-Within an IP ACL, deny takes precedence. This is not an Nginx `satisfy any` mode: a
-permitted IP cannot skip another applicable policy or a password. The graphical inline
-ACL editor still supports default allow/deny and IPv4/IPv6 CIDR rules.
+Within one policy scope, explicit IP deny rules and blocked countries take precedence.
+When country mode is **Allow only**, a listed country or an explicit IP allow rule may
+satisfy that scope; therefore `default=deny` can express e.g. private CIDRs **or** selected
+countries. An unresolved country still fails closed unless the client matches an explicit
+IP allow. This does not let a permitted IP skip another profile/vhost/location policy or
+a password. The graphical inline ACL editor still supports default allow/deny and
+IPv4/IPv6 CIDR rules.
 Trusted-proxy settings control which peer can contribute the effective client IP;
 untrusted forwarding headers do not grant network access.