A Retirement Party and a Week Rebuilding rust-proxy's Access Control
Sunday was a friend's retirement party right after church — a good excuse to slow down for an afternoon. The rest of the stretch since the last post went almost entirely into rust-proxy: a real certificate bug, a genuinely usable admin screen, a full rewrite of how sites get locked down, free wildcard certificates, and logs that are finally split into something you can actually debug from.
Sunday was church, then straight over to a friend's retirement party in the afternoon — the good kind of day where nothing on the list was work. Everything else below happened across the days around it.
rust-proxy: a real certificate bug, and an admin screen that finally makes sense
Logs from the proxy server turned up two certificate failures: one site rejected outright by Let's Encrypt, the other never even asking for the right kind of verification. The second was a real settings gap. The first was more interesting: every certificate request the server builds was going out with a placeholder name baked into it instead of the site's real domain, which Let's Encrypt correctly rejected. A one-line fix, plus a test that makes sure that placeholder can never sneak back in.
The admin screen got a real redesign on top of that: tabs instead of one long scrolling page, labeled fields grouped sensibly, and sites can finally be edited after they're created instead of only made from scratch or deleted. Testing it in an actual browser, not just reading the code, caught a real trap: editing a password-protected site while leaving the password field blank — which is exactly what the screen told you to do if you didn't want to change it — got wrongly rejected. Also replaced a single box where you had to paste several settings together in the right order with separate, clearly labeled fields per provider.
Found and fixed a firewall bug too, one that would have broken every brand-new install forever: the generated firewall rules started by clearing out an existing ruleset, which fails outright if nothing exists yet. A new server would fail its very first firewall setup and never recover. Reproduced the exact failure on a real machine, then fixed it so creating the ruleset always happens first and safely, whether or not one already exists.
Reusable access lists, free wildcard certificates, and logs you can actually use
The biggest piece: what used to be an allowed-IP list and a password gate typed directly onto every single site is now a real, reusable system. Build a named list once — either an allowed-IP list or a login list — and any number of sites can use it, instead of retyping the same office network or the same password on every site that needs it. A site can use several lists at once and any one of them matching is enough to get in. Existing sites moved over to the new system automatically the first time it started up, so nothing was lost. I tested the whole thing by hand in a real browser: built both kinds of list, applied several to one site, confirmed editing that site shows the right ones selected, and confirmed that trying to delete a list still in use gets refused with a clear warning instead of quietly breaking the site depending on it.
Wildcard certificates got real support too. Before, getting a certificate that covers an entire domain (like anything under example.com) meant creating a throwaway site just to trigger it. Now you can request that certificate on its own, with no site attached, and every new site under that domain just works automatically afterward with no extra step. Verified it against a real test run of Let's Encrypt's own system before trusting it for real.
Last piece was the logs, which used to all run together in one stream with no way to isolate anything. They're split three ways now: one log for day-to-day traffic and certificates, a brand-new log that tracks exactly who did what in the admin screen and when, and a log for everything else. One more small thing: the contact email Let's Encrypt needs used to only be settable by hand-editing a file. It's editable from the admin screen now.