v0.26.0 proxy headers for acl

doc/sources.md

@@ -215,7 +215,8 @@ Options, each as type and default:
 - `auth` (table): peer authentication (`mtls` or `scram`) and node binding;
   see [Security](security.md#the-auth-block).
 - `acl` (table): `allow` and `deny`, addresses or CIDRs admitted and refused
-  before TLS; see [Security](security.md#the-acl-block).
+  before TLS, and `proxy_protocol` with `proxy_from` for the client a PROXY
+  header names; see [Security](security.md#the-acl-block).
 
 For passwords instead of certificates, the `auth` block takes `type = "scram"`
 and a `credentials_file`, and `client_auth` becomes optional; see
@@ -240,8 +241,9 @@ and a `credentials_file`, and `client_auth` becomes optional; see
   leaves per-entry labels to `trust_node`, so a relay can forward other nodes'
   entries while proving its own identity.
 - Each accepted connection gets a session recording the remote address, node
-  label, — under TLS — `tls` and `tls_peer_cn`, and — under auth —
-  `auth_method` and `auth_identity`.
+  label, — under TLS — `tls` and `tls_peer_cn`, — under auth —
+  `auth_method` and `auth_identity`, and behind a PROXY header the proxy as
+  `peer_addr`.
 - A malformed entry line increments `parse_errors` and is skipped; the
   connection survives. A line over 1 MiB is a protocol violation and terminates
   the connection.
@@ -249,7 +251,8 @@ and a `credentials_file`, and `client_auth` becomes optional; see
 **Statistics**: `active_connections`, `rejected_conns`, `parse_errors`,
 `tls_handshake_errors`, `trust_node`, `auth`, `auth_allowed`, `auth_rejected`,
 `node_binding`; under `scram` also `auth_users`, `auth_throttled`, `auth_busy`
-and `auth_binding_mismatch`; with `acl` rules also `acl` and `acl_denied`.
+and `auth_binding_mismatch`; with `acl` rules or `proxy_from` also `acl`,
+`acl_denied` and `acl_proxy_headers`.
 
 ---
 
@@ -301,7 +304,8 @@ Options, each as type and default:
 - `auth` (table): peer authentication (`mtls` or `scram`) and node binding;
   see [Security](security.md#the-auth-block).
 - `acl` (table): `allow` and `deny`, addresses or CIDRs admitted and refused
-  before TLS; see [Security](security.md#the-acl-block).
+  before TLS, and `proxy_protocol` with `proxy_from` for the client a PROXY
+  header names; see [Security](security.md#the-acl-block).
 
 **Behaviour**
 
@@ -328,8 +332,8 @@ Options, each as type and default:
 **Statistics**: `total_requests`, `rejected_requests`, `parse_errors`,
 `cached_sessions`, `trust_node`, `auth`, `auth_allowed`, `auth_rejected`,
 `node_binding`; under `scram` also `auth_users`, `auth_throttled`, `auth_busy`,
-`auth_binding_mismatch` and `auth_token_lifetime_ms`; with `acl` rules also
-`acl` and `acl_denied`.
+`auth_binding_mismatch` and `auth_token_lifetime_ms`; with `acl` rules or
+`proxy_from` also `acl`, `acl_denied` and `acl_proxy_headers`.
 
 ---