v1.0.36 — Hostname aliases and upstream identity

Implements issue #31.

A protected site can now have a primary hostname and up to 31 additional exact DNS hostnames. For example, example.com and www.example.com share one site's WAF policy, authentication, access controls, backend pool and log attribution. Caddy manages automatic HTTPS for every configured name. Certificates may be managed separately; this feature does not require one combined SAN certificate. Aliases do not redirect to the primary hostname.

The site editor also provides independent upstream HTTP Host and TLS server-name controls:

• Default Host preserves existing behavior: incoming Host for HTTP, backend Host for HTTPS.
• Preserve incoming Host forwards the client's hostname and any port.
• Fixed Host sends the configured literal Host to the application.
• TLS server name sets a fixed DNS SNI and certificate-verification identity independently of the dial address. Existing system/custom CA verification remains in effect.

An HTTPS origin can therefore be reached at an internal IP while using its public TLS identity. Controls apply to application pool members; authentication and outpost proxy identities remain independent. A fixed Host becomes the default pool health-probe Host, unless an explicit health Host overrides it. Preserve mode needs an explicit health Host for virtual-host probes. The fixed TLS name also applies to probes.

Hostname ownership checks prevent new overlapping site claims, including disabled owners. Manual certificates must have leaf DNS SAN coverage for every configured name. Hostname-specific method exceptions and trusted-IP bypasses remain scoped to their hostname. Rejected reloads restore certificate files, including restricted private-key permissions.

Caddy remains 2.11.4, coraza-caddy 2.6.2, and Coraza 3.8.1.

Images

Production images target linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.36
• ghcr.io/socfortress/waf-admin-api:1.0.36
• ghcr.io/socfortress/waf-admin-ui:1.0.36

Upgrade

Back up the database and configuration, set WAF_IMAGE_TAG=1.0.36, pull the images and recreate the services. Preserve existing TCP/UDP port overrides. Once Caddy is ready, restart the admin API so it restores the saved configuration.

The API applies migration 0039_hostname_aliases, adding the alias list and three upstream identity fields with compatible defaults. Existing sites retain single-host behavior until edited. In Sites, edit a site and enter Additional hostnames, separated by commas or new lines. For Let's Encrypt, every name must resolve to the WAF and permit ACME validation. A successful save does not mean issuance has finished. When importing a certificate, upload one covering the primary and all additional names.

Catch-all sites cannot have aliases. Wildcard aliases, DNS-provider challenge configuration, request-dependent TLS SNI and automatic backend ACME challenge forwarding are outside this release. Origin virtual hosts, application cookies and application-generated redirects must support the configured names.

Validation

• Independent design and implementation review completed with all blocking findings resolved.
• 531 backend tests and 91 frontend tests passed; production frontend build passed.
• Real Caddy/Coraza integration verified manual alias TLS, local ACME HTTP-01 issuance for both names, redirects, alias removal, host-scoped bypass boundaries and catch-all isolation.
• Real HTTPS origin tests verified Host/SNI separation, CA and hostname verification failures, alternating aliases and native pool health checks.
• PostgreSQL migration up/down/up, persistence/clearing and concurrent hostname ownership checks passed. Database rollback used a simulated Caddy reload rejection.
• Browser edit/save/reopen checks passed with synthetic data.
• The production release workflow completed successfully for all three linux/amd64 images. Registry metadata confirms version 1.0.36 and merged source revision ecfd5caec8639c9c3bd94dcff5fc717cbc8f5ba7.

Public-CA issuance and elapsed certificate renewal were not tested. Caddy owns certificate renewal. The existing successful-Caddy-reload/failed-database-commit atomicity limitation remains.

Rollback

Before rolling back, remove additional hostnames and reset upstream Host to Default and TLS server name to blank, while v1.0.36 is still installed. Pause site edits and downgrade the database in the admin API container with alembic downgrade 0038_backend_pools. This drops aliases and identity overrides while retaining primary hostnames, upstream URLs and backend pools; keep a backup if those settings are needed later.

Restore all three images to WAF_IMAGE_TAG=1.0.35, recreate the services and restart the API after Caddy is ready.