dash 3.0.1 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c267bf789f49a3eede649d1b17a328fefe83367ae48ddde1ae45feec2185460
-  data.tar.gz: 16248804c04178338ca3a4187f5299135c6c25cd1f8691b16394e9b70f61f5ff
+  metadata.gz: 76de5dcf1c023a36baae2b55567695e691d2a02ac65df587469742d95f043d55
+  data.tar.gz: d1b681c9d34d5313840bb588d24235c4f8d30058f7b01d1778390dd7056f56fd
 SHA512:
-  metadata.gz: 12bf8d9a911c032b75256ef587f796503c062c9988c8fc6ae88448b019ecb3bcab0a06a3055a38a806fa56ca0ecc4cbafa2cdb105428b86a3084ae32972e6bd1
-  data.tar.gz: 89013ac78a74c960f6598517216fe536cc3eba9f237bde7f62af00c57eaed164c85c7584ca3aadbb0d566261b5a9cec429125ff39fd5de6792c515be5a8fb02a
+  metadata.gz: 3418967bd8855f630c65a2a27090248ebda77b2f585f97039ca0b27b7d173936b905823854e9c2f156c1986003eedc18cb9373da56661d7267df425ab6dc83a7
+  data.tar.gz: '0439bbced6c8a6d496283970df7a21e5e679aa99052fc90d2e8ef6ba5072c0a954b2206e03c5c01200622b169d5d1bbec73d96c48c0fbaf9cc36ed879f25a752'

data/lib/kamal/cli/proxy.rb

@@ -504,6 +504,83 @@ class Kamal::Cli::Proxy < Kamal::Cli::Base
     end
   end
 
+  desc "export_certs LOCAL_PATH", "Export the TLS certificate store to a local archive (contains private keys)"
+  def export_certs(local_path)
+    load_balancing = KAMAL.config.proxy.load_balancing?
+
+    # Under the deploy lock: a concurrent deploy could boot or reboot the
+    # proxy mid-export, and the offline read below would archive a torn store.
+    modify(lock: true) do
+      on(cert_store_host) do |host|
+        execute *KAMAL.auditor.record("Exported the proxy certificate store"), verbosity: :debug
+
+        commands = load_balancing ? KAMAL.loadbalancer : KAMAL.proxy(host)
+        execute *commands.ensure_apps_config_directory
+
+        # Running: export through the container's RPC socket, under the proxy's
+        # certificate write lock. Stopped: read the data directory offline with a
+        # one-off container - which may first need the image.
+        if capture_with_info(*commands.container_id(only_running: true), raise_on_non_zero_exit: false).strip.present?
+          puts capture_with_info(*commands.export_certs)
+        else
+          execute *KAMAL.registry.login
+          puts capture_with_info(*commands.export_certs_offline)
+        end
+
+        # The archive holds private keys; it must not outlive a failed download.
+        begin
+          download! commands.certs_archive_host_path, local_path
+        ensure
+          execute *commands.remove_certs_archive, raise_on_non_zero_exit: false
+        end
+      end
+    end
+  end
+
+  desc "import_certs", "Import certificates into the TLS certificate store from a Traefik acme.json or an exported archive"
+  option :traefik_acme, type: :string, default: nil, desc: "Local path of a Traefik acme.json to import from"
+  option :archive, type: :string, default: nil, desc: "Local path of an archive written by kamal proxy export_certs"
+  option :resolver, type: :string, default: nil, desc: "Import only this Traefik resolver's certificates (default: all, last writer wins per domain)"
+  option :force, type: :boolean, default: false, desc: "Overwrite a non-empty certificate store when restoring an archive"
+  option :verify, type: :boolean, default: false, desc: "Only verify the archive: report domains and expiries without touching the store"
+  def import_certs
+    validate_import_certs_options!
+    source = options[:traefik_acme] || options[:archive]
+    traefik_acme, resolver = options[:traefik_acme].present?, options[:resolver]
+    force, verify = options[:force], options[:verify]
+    load_balancing = KAMAL.config.proxy.load_balancing?
+
+    modify(lock: true) do
+      on(cert_store_host) do |host|
+        commands = load_balancing ? KAMAL.loadbalancer : KAMAL.proxy(host)
+
+        # kamal-proxy import runs offline against the data directory - importing
+        # under a live proxy risks a torn store. --verify only reads the archive.
+        unless verify
+          if capture_with_info(*commands.container_id(only_running: true), raise_on_non_zero_exit: false).strip.present?
+            raise "Cannot import certificates while the #{load_balancing ? "loadbalancer" : "proxy"} " \
+              "is running on #{host} - stop it first " \
+              "(kamal proxy #{load_balancing ? "loadbalancer stop" : "stop"}), import, then start it again"
+          end
+        end
+
+        execute *KAMAL.auditor.record("Imported certificates into the proxy certificate store"), verbosity: :debug
+        execute *KAMAL.registry.login
+        execute *commands.ensure_proxy_directory
+
+        # upload! inside the ensure's reach: a failed or partial upload must
+        # not leave certificate material behind on the host either.
+        begin
+          upload! source, commands.certs_import_host_path, mode: "0600"
+          puts capture_with_info(*commands.import_certs(
+            traefik_acme: traefik_acme, resolver: resolver, force: force, verify: verify))
+        ensure
+          execute *commands.remove_certs_import, raise_on_non_zero_exit: false
+        end
+      end
+    end
+  end
+
   desc "remove_container", "Remove proxy container from servers", hide: true
   def remove_container
     modify(lock: true) do
@@ -556,6 +633,33 @@ class Kamal::Cli::Proxy < Kamal::Cli::Base
   end
 
   private
+    # The host that owns TLS, and so the certificate store: the loadbalancer
+    # host when load balancing (TLS terminates at the edge), else the primary
+    # host - the same host `loadbalancer: true` would resolve to.
+    def cert_store_host
+      KAMAL.config.proxy.load_balancing? ? KAMAL.config.proxy.effective_loadbalancer : KAMAL.primary_host
+    end
+
+    # Mirrors kamal-proxy's own flag groups (import.go), so a contradictory
+    # invocation fails before anything is uploaded.
+    def validate_import_certs_options!
+      if options[:traefik_acme].present? == options[:archive].present?
+        raise ArgumentError, "Specify exactly one of --traefik-acme or --archive"
+      end
+
+      if options[:resolver].present? && options[:archive].present?
+        raise ArgumentError, "--resolver only applies to a Traefik import"
+      end
+
+      if options[:traefik_acme].present? && (options[:force] || options[:verify])
+        raise ArgumentError, "--force and --verify only apply to an archive"
+      end
+
+      if options[:force] && options[:verify]
+        raise ArgumentError, "--verify does not touch the store, so it cannot be combined with --force"
+      end
+    end
+
     # A shared load balancer tier is the exact case this guard exists for, so it
     # has to cover the load balancer host too - `remove_container` and
     # `remove_image` both act on it.

data/lib/kamal/commands/loadbalancer.rb

@@ -1,4 +1,6 @@
 class Kamal::Commands::Loadbalancer < Kamal::Commands::Base
+  include Kamal::Commands::Proxy::CertTransfer
+
   delegate :argumentize, :optionize, to: Kamal::Utils
 
   attr_reader :loadbalancer_config
@@ -63,8 +65,8 @@ class Kamal::Commands::Loadbalancer < Kamal::Commands::Base
     docker :inspect, container_name, "--format", "'{{ index .Config.Labels \"#{Kamal::Commands::Proxy::CONFIG_DIGEST_LABEL}\" }}'"
   end
 
-  def container_id
-    container_id_for(container_name: container_name)
+  def container_id(only_running: false)
+    container_id_for(container_name: container_name, only_running: only_running)
   end
 
   def info
@@ -169,4 +171,14 @@ class Kamal::Commands::Loadbalancer < Kamal::Commands::Base
         [ "--volume", "kamal-loadbalancer-config:/home/kamal-proxy/.config/kamal-proxy" ]
       end
     end
+
+    # The certificate store lives in whichever config volume this loadbalancer
+    # actually mounts — the shared kamal-proxy one on a proxy host.
+    def cert_store_volume_args
+      config_volume
+    end
+
+    def one_off_image
+      [ loadbalancer_config.run.image ]
+    end
 end

data/lib/kamal/commands/proxy/cert_transfer.rb

@@ -0,0 +1,74 @@
+# Certificate store transfer, shared by the proxy and loadbalancer command
+# builders (kamal proxy export_certs / import_certs).
+#
+# Archives leave through the apps-config bind mount — the one container path
+# that is also a host path — and arrive through stdin into a one-off container:
+# a bind-mounted source would need host permissions the container user cannot
+# be guaranteed to have, and the store must be written as the image's own user
+# or the proxy cannot read it afterwards.
+#
+# The including class provides `container_name`, `cert_store_volume_args` (the
+# config volume mount) and `one_off_image` (the image tokens for a one-off
+# container).
+module Kamal::Commands::Proxy::CertTransfer
+  CERT_ARCHIVE_FILENAME = "certs-export.tar.gz"
+  CERT_IMPORT_STAGING_FILENAME = "certs-import"
+  CONTAINER_IMPORT_PATH = "/tmp/kamal-cert-import"
+
+  # Through the RPC socket of the running container, under the proxy's own
+  # certificate write lock, so a backup taken mid-renewal is never torn.
+  def export_certs
+    docker :exec, container_name, "kamal-proxy", :export, :certs, certs_archive_container_path
+  end
+
+  # Reads the data directory offline over the config volume — only safe when
+  # the container is stopped, which Kamal::Cli::Proxy guarantees.
+  def export_certs_offline
+    docker :run, "--rm",
+      *cert_store_volume_args,
+      *config.proxy_boot.apps_volume.docker_args,
+      *one_off_image,
+      "kamal-proxy", :export, :certs, certs_archive_container_path
+  end
+
+  # Offline by design (kamal-proxy import has no RPC path): the one-off
+  # container mounts the config volume — creating it when no proxy has booted
+  # yet, which is the Traefik-migration case — and the staged source streams
+  # through stdin.
+  def import_certs(traefik_acme: false, resolver: nil, force: false, verify: false)
+    source_flag = traefik_acme ? "traefik-acme" : "archive"
+    # Base#shell single-quotes the payload and escapes embedded apostrophes -
+    # without that, an apostrophe in a resolver name would end the quoting and
+    # run whatever follows on the target host.
+    import_command = shell [
+      "cat > #{CONTAINER_IMPORT_PATH} &&",
+      "kamal-proxy import certs",
+      *optionize({ source_flag => CONTAINER_IMPORT_PATH, resolver: resolver, force: force || nil, verify: verify || nil }.compact, with: "=")
+    ]
+
+    [
+      *docker(:run, "--rm", "--interactive", *cert_store_volume_args, *one_off_image, *import_command),
+      "<", certs_import_host_path
+    ]
+  end
+
+  def certs_archive_host_path
+    File.join config.proxy_boot.apps_directory, CERT_ARCHIVE_FILENAME
+  end
+
+  def certs_archive_container_path
+    File.join config.proxy_boot.apps_container_directory, CERT_ARCHIVE_FILENAME
+  end
+
+  def certs_import_host_path
+    File.join config.proxy_boot.host_directory, CERT_IMPORT_STAGING_FILENAME
+  end
+
+  def remove_certs_archive
+    remove_file certs_archive_host_path
+  end
+
+  def remove_certs_import
+    remove_file certs_import_host_path
+  end
+end

data/lib/kamal/commands/proxy.rb

@@ -1,4 +1,6 @@
 class Kamal::Commands::Proxy < Kamal::Commands::Base
+  include Kamal::Commands::Proxy::CertTransfer
+
   delegate :argumentize, :optionize, to: Kamal::Utils
   attr_reader :proxy_run_config
 
@@ -232,6 +234,20 @@ class Kamal::Commands::Proxy < Kamal::Commands::Base
       config.proxy_boot.container_name
     end
 
+    def cert_store_volume_args
+      [ "--volume", "kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy" ]
+    end
+
+    # Same fallback as #pull: without a run config the image comes from the
+    # legacy boot config files on the host.
+    def one_off_image
+      if proxy_run_config
+        [ proxy_run_config.image ]
+      else
+        [ "#{substitute(read_image)}:#{substitute(read_image_version)}" ]
+      end
+    end
+
     def config_digest_label_args(digest)
       [ "--label", "#{CONFIG_DIGEST_LABEL}=#{digest}" ] if digest
     end

data/lib/kamal/configuration/docs/proxy.yml

@@ -313,6 +313,33 @@ proxy:
     - from: /api/(.*)
       to: /v2/$1
 
+  # Dynamic redirect map
+  #
+  # Fetch a host-scoped redirect map from the application itself, so redirects
+  # ship with a content change instead of a deploy. `source` is a path resolved
+  # against this service, or an absolute http(s) URL. The app publishes
+  # `{"hosts": {...}}` entries — per-host `redirect_to`, path rules and
+  # trailing-slash policy — and the proxy answers matching requests before they
+  # reach the app.
+  #
+  # The map composes with the static `redirects` above: the map is consulted
+  # first, and the static rules run when it misses.
+  #
+  # `interval` is the poll interval in seconds (proxy default 300, minimum 10).
+  #
+  # Authentication tokens live in the PROXY's environment, not the app's: polls
+  # send `KAMAL_PROXY_REDIRECTS_TOKEN` as a bearer token when set, and
+  # `POST /.kamal-proxy/redirects/refresh` nudges an immediate re-poll when
+  # authenticated with `KAMAL_PROXY_REFRESH_TOKEN`. Set both via
+  # `proxy.run.options.env`, next to `KAMAL_PROXY_DOMAINS_TOKEN` — never as
+  # deploy flags, which leak into process listings and audit logs.
+  #
+  # When a loadbalancer is configured the map answers at the loadbalancer, same
+  # as `ssl_domains` and `canonical_host` — the per-host proxies never see it.
+  redirects_source:
+    source: /api/v1/proxy/redirects
+    interval: 300
+
   # Canonical host
   #
   # Redirect every request to this host, to force apex or www one way.
@@ -459,6 +486,25 @@ proxy:
   allow_ips:
     - 10.0.0.0/8
     - 192.168.0.0/16
+
+  # IP deny list
+  #
+  # Refuse this service to these addresses and ranges with a 403. Checked before
+  # `allow_ips`: an address on both lists is denied. Denied clients never spend
+  # rate-limit budget. Combine with `client_ip` above when behind a CDN, or the
+  # list is matched against the CDN's addresses rather than your visitors'.
+  deny_ips:
+    - 203.0.113.0/24
+    - 198.51.100.7
+
+  # User-agent deny list
+  #
+  # Refuse requests whose full User-Agent matches one of these RE2 patterns,
+  # checked after the IP rules. A missing User-Agent only matches an explicit
+  # '^$' pattern. Patterns are matched by kamal-proxy (Go RE2), so kamal checks
+  # only their shape, not their syntax.
+  deny_user_agents:
+    - 'BadBot/.*'
   #
   # ### Notes
   # - The health check path is served without an address check and without a rate
@@ -786,9 +832,9 @@ proxy:
                                    # `repository` to a host-less path (e.g.
                                    # myfork/kamal-proxy) - the default repository
                                    # below already embeds its ghcr.io host
-    repository: ghcr.io/mhenrixon/kamal-proxy # Container repository for the
+    repository: ghcr.io/zoolutions/kamal-proxy # Container repository for the
                                    # kamal-proxy image (this is the default)
-    version: v1.0.0.1              # Version tag of the kamal-proxy image to use.
+    version: v1.0.0.3              # Version tag of the kamal-proxy image to use.
                                    # Defaults to the minimum version this gem
                                    # requires - only pin it to roll forward early,
                                    # never below the default
@@ -810,6 +856,12 @@ proxy:
     # unsupported name is rejected here, at config time - kamal-proxy would only
     # log a warning and then never issue a certificate.
     #
+    # A plain string (`dns_provider: cloudflare`) uses one provider for every
+    # zone. The hash form pins zones to the DNS host that actually serves them,
+    # with `default` covering unmatched zones - for estates whose domains are
+    # spread across registrars. Each provider's API credentials must be present
+    # under `credentials` for its challenges to succeed.
+    #
     # kamal-proxy also accepts short aliases for the canonical names - `cf`
     # (cloudflare), `do` (digitalocean), `gcp`/`google`/`googledns` (gcloud),
     # `gd` (godaddy), `hz` (hetzner), `nc` (namecheap), `aws`/`r53` (route53)
@@ -837,7 +889,10 @@ proxy:
     # `kamal proxy reboot` yourself after a rotation.
     acme:
       email: admin@example.com
-      dns_provider: cloudflare
+      dns_provider:
+        platform.example: cloudflare
+        legacy.example: hetzner
+        default: route53
       prefer_wildcard: true
       http_fallback: false
       directory: https://acme-staging-v02.api.letsencrypt.org/directory

data/lib/kamal/configuration/proxy/acme.rb

@@ -60,10 +60,25 @@ class Kamal::Configuration::Proxy::Acme
   def run_command_options
     {
       "acme-email": acme_config["email"],
-      "acme-dns-provider": acme_config["dns_provider"],
+      "acme-dns-provider": dns_provider_entries,
       "acme-directory": acme_config["directory"],
       "acme-prefer-wildcard": acme_config["prefer_wildcard"],
       "acme-http-fallback": acme_config["http_fallback"]
     }.compact
   end
+
+  private
+    # The hash form pins zones to the DNS host that serves them; `default`
+    # covers unmatched zones. kamal-proxy takes repeatable --acme-dns-provider
+    # entries — zone=provider pairs plus at most one bare default — so the hash
+    # becomes an array and Utils.optionize repeats the flag. The string form
+    # passes through untouched and keeps meaning what it always has.
+    def dns_provider_entries
+      provider = acme_config["dns_provider"]
+      return provider unless provider.is_a?(Hash)
+
+      zones, default = provider.partition { |zone, _| zone != "default" }
+
+      [ *zones.map { |zone, zone_provider| "#{zone}=#{zone_provider}" }, *default.map(&:last) ]
+    end
 end

data/lib/kamal/configuration/proxy/boot.rb

@@ -30,7 +30,7 @@ class Kamal::Configuration::Proxy::Boot
   end
 
   def repository_name
-    "ghcr.io/mhenrixon"
+    "ghcr.io/zoolutions"
   end
 
   def image_name

data/lib/kamal/configuration/proxy/run.rb

@@ -1,5 +1,5 @@
 class Kamal::Configuration::Proxy::Run
-  MINIMUM_VERSION = "v1.0.0.1"
+  MINIMUM_VERSION = "v1.0.0.3"
   DEFAULT_HTTP_PORT = 80
   DEFAULT_HTTPS_PORT = 443
   DEFAULT_LOG_MAX_SIZE = "10m"
@@ -95,7 +95,7 @@ class Kamal::Configuration::Proxy::Run
   end
 
   def repository
-    run_config.fetch("repository", "ghcr.io/mhenrixon/kamal-proxy")
+    run_config.fetch("repository", "ghcr.io/zoolutions/kamal-proxy")
   end
 
   def image

data/lib/kamal/configuration/proxy.rb

@@ -51,6 +51,8 @@ class Kamal::Configuration::Proxy
     # request (its peer is the LB) and one limiter would count the whole
     # fleet as a single client.
     "allow-ip": :edge,
+    "deny-ip": :edge,
+    "deny-user-agent": :edge,
     "trusted-proxy": :edge,
     "client-ip-header": :edge,
     "rate-limit": :edge,
@@ -69,9 +71,12 @@ class Kamal::Configuration::Proxy
     "session-affinity-cookie": :edge,
 
     # --- Edge: redirectURLIfNeeded consults r.TLS only, so behind the LB a
-    # per-app redirect emits http:// Locations to HTTPS clients.
+    # per-app redirect emits http:// Locations to HTTPS clients. The dynamic
+    # redirect map answers where clients connect, for the same reason.
     "canonical-host": :edge,
     redirect: :edge,
+    "redirects-source": :edge,
+    "redirects-interval": :edge,
 
     # --- Edge: one response cache, at the edge — two layers of cache would
     # double the storage and let the inner cache serve entries the edge
@@ -499,6 +504,10 @@ class Kamal::Configuration::Proxy
         "remove-response-header": headers_config.dig("response", "remove").presence,
         redirect: path_rules("redirects"),
         rewrite: path_rules("rewrites"),
+        # The dynamic map is consulted before the static redirect rules above -
+        # they compose, the rules running when the map misses.
+        "redirects-source": proxy_config.dig("redirects_source", "source"),
+        "redirects-interval": seconds_duration(proxy_config.dig("redirects_source", "interval")),
         "canonical-host": proxy_config["canonical_host"],
         "intercept-errors": proxy_config["intercept_errors"].presence
       }.compact
@@ -532,6 +541,10 @@ class Kamal::Configuration::Proxy
 
       {
         "allow-ip": proxy_config["allow_ips"].presence,
+        # Checked before the allow list on the proxy side - an address on both
+        # lists is denied. UA patterns run after the IP rules.
+        "deny-ip": proxy_config["deny_ips"].presence,
+        "deny-user-agent": proxy_config["deny_user_agents"].presence,
         "trusted-proxy": client_ip["trusted_proxies"].presence,
         "client-ip-header": client_ip["header"],
         "rate-limit": rate_limit["requests"],

data/lib/kamal/configuration/validator/proxy.rb

@@ -32,6 +32,10 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
         validate_ssl_domains! config["ssl_domains"]
       end
 
+      if config["redirects_source"]
+        validate_redirects_source! config["redirects_source"]
+      end
+
       if config["basic_auth"].is_a?(Hash)
         validate_basic_auth! config["basic_auth"]
       end
@@ -109,6 +113,25 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
       end
     end
 
+    # Same source shape as ssl_domains. The interval minimum is kamal-proxy's
+    # own (MinRedirectsInterval, 10s) - it rejects a smaller one after the SSH
+    # round trip, so catch it here at config time.
+    def validate_redirects_source!(redirects_source)
+      with_context("redirects_source") do
+        source = redirects_source["source"]
+
+        if source.blank?
+          error "Missing source setting (required when redirects_source is set)"
+        elsif !valid_ssl_domains_source?(source)
+          error "source must be a path starting with '/' or an http(s) URL"
+        end
+
+        if (interval = redirects_source["interval"]) && (!interval.is_a?(Integer) || interval < 10)
+          error "interval must be an integer of at least 10 seconds"
+        end
+      end
+    end
+
     # kamal-proxy only logs a warning for a DNS provider it does not recognise
     # and then carries on with no provider at all, so the symptom is a
     # certificate that never issues rather than a failed boot. Catch it here,
@@ -122,7 +145,9 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
 
           provider = acme["dns_provider"]
 
-          if provider.present? && !Kamal::Configuration::Proxy::Acme::SUPPORTED_DNS_PROVIDERS.include?(provider.to_s.downcase)
+          if provider.is_a?(Hash)
+            validate_dns_provider_zones! provider
+          elsif provider.present? && !supported_dns_provider?(provider)
             error "unsupported dns_provider '#{provider}'. " \
               "Supported providers: #{Kamal::Configuration::Proxy::Acme::DNS_PROVIDERS.join(", ")}"
           end
@@ -130,6 +155,35 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
       end
     end
 
+    # The hash form maps zones to providers, with `default` covering unmatched
+    # zones. Wire format is repeatable zone=provider entries cut at the first
+    # '=', so a zone carrying one would silently build a different entry.
+    def validate_dns_provider_zones!(provider)
+      error "dns_provider cannot be an empty hash - map zones to providers, or use the string form" if provider.empty?
+
+      provider.each do |zone, zone_provider|
+        if zone.to_s.include?("=")
+          error "dns_provider zone '#{zone}' cannot contain '=' - " \
+            "the zone=provider wire format cuts at the first '=' and would silently build a different entry"
+        end
+
+        # A malformed zone key would emit an entry no zone ever matches, and the
+        # symptom is a certificate that never issues - a long way from here.
+        unless zone.is_a?(String) && zone.present? && !zone.match?(/\s/)
+          error "dns_provider zone '#{zone}' must be a non-empty string without whitespace"
+        end
+
+        unless zone_provider.is_a?(String) && supported_dns_provider?(zone_provider)
+          error "unsupported dns_provider '#{zone_provider}' for '#{zone}'. " \
+            "Supported providers: #{Kamal::Configuration::Proxy::Acme::DNS_PROVIDERS.join(", ")}"
+        end
+      end
+    end
+
+    def supported_dns_provider?(provider)
+      Kamal::Configuration::Proxy::Acme::SUPPORTED_DNS_PROVIDERS.include?(provider.to_s.downcase)
+    end
+
     # The whole TLS surface lives in the one `ssl` hash: certificate material,
     # on-demand issuance and the mTLS client CA. kamal-proxy rejects the
     # on-demand combinations outright rather than picking a winner
@@ -409,6 +463,15 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
         return true
       end
 
+      # A string or a zone→provider hash; the docs example can only show one
+      # shape, and zone names are the operator's to choose, so the example-driven
+      # unknown-key check would reject every real config. validate_acme! does the
+      # semantic checking (provider names, zone shapes).
+      if key.to_s == "dns_provider"
+        validate_type! value, String, Hash
+        return true
+      end
+
       return false unless key.to_s == "rate_limit"
 
       validate_type! value, Hash
@@ -429,14 +492,27 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
     # otherwise surface only once the deploy has reached a host.
     def validate_access_control!
       allow_ips = Array(config["allow_ips"])
+      deny_ips = Array(config["deny_ips"])
       client_ip = config["client_ip"] || {}
       rate_limit = config["rate_limit"] || {}
       trusted_proxies = Array(client_ip["trusted_proxies"])
       rate_limited = rate_limit["requests"].present?
 
       with_context("allow_ips") { allow_ips.each { |entry| validate_ip_entry! entry } }
+      with_context("deny_ips") { deny_ips.each { |entry| validate_ip_entry! entry } }
       with_context("rate_limit") { with_context("exempt") { Array(rate_limit["exempt"]).each { |entry| validate_ip_entry! entry } } }
 
+      # The patterns are deliberately not compiled - Go's RE2 and Ruby's Onigmo
+      # differ at the edges, same as redirects/rewrites - so only the shape is
+      # checked: a non-string or blank entry can never match anything.
+      with_context("deny_user_agents") do
+        Array(config["deny_user_agents"]).each do |pattern|
+          unless pattern.is_a?(String) && pattern.present?
+            error "'#{pattern}' is not a user agent pattern - each entry must be a non-empty RE2 pattern string"
+          end
+        end
+      end
+
       with_context("client_ip") do
         with_context("trusted_proxies") do
           trusted_proxies.each do |entry|
@@ -451,8 +527,8 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
           end
         end
 
-        if trusted_proxies.any? && allow_ips.empty? && !rate_limited
-          error "trusted_proxies has no effect without allow_ips or rate_limit"
+        if trusted_proxies.any? && allow_ips.empty? && deny_ips.empty? && !rate_limited
+          error "trusted_proxies has no effect without allow_ips, deny_ips or rate_limit"
         end
 
         # Unconditional: even without allow_ips/rate_limit, kamal-proxy rewrites
@@ -475,10 +551,10 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
 
       # kamal-proxy serves the health check path without an address check and
       # without a rate limit so deploys keep working, which makes '/' a hole
-      # straight through both features.
-      if (allow_ips.any? || rate_limited) && config.dig("healthcheck", "path") == "/"
+      # straight through all three features.
+      if (allow_ips.any? || deny_ips.any? || rate_limited) && config.dig("healthcheck", "path") == "/"
         with_context("healthcheck") do
-          error "path cannot be '/' when allow_ips or rate_limit is set, " \
+          error "path cannot be '/' when allow_ips, deny_ips or rate_limit is set, " \
             "as that path is served without an address check or a rate limit"
         end
       end

data/lib/kamal/configuration.rb

@@ -531,27 +531,38 @@ class Kamal::Configuration
       true
     end
 
-    # A rate limiter is only as correct as the address it keys on. `forward_headers:
-    # true` says something sits in front of the proxy, and without `trusted_proxies`
-    # kamal-proxy keys on that something's address rather than the client's — so the
-    # limiter throttles the whole world as one client, or nobody at all. Warn rather
-    # than raise: the config is legal, just almost certainly not what was meant.
+    # Rate limiting and IP deny rules are only as correct as the address they key
+    # on. `forward_headers: true` says something sits in front of the proxy, and
+    # without `trusted_proxies` kamal-proxy keys on that something's address
+    # rather than the client's — so the limiter throttles the whole world as one
+    # client (or nobody), and a deny list denies nobody it was written for. Warn
+    # rather than raise: the config is legal, just almost certainly not what was
+    # meant. (deny_user_agents is absent here on purpose — a User-Agent match
+    # never keys on the client address.)
     def ensure_rate_limit_can_identify_clients
-      offenders = roles.select do |role|
-        next false unless role.running_proxy?
+      offenders = roles.filter_map do |role|
+        next unless role.running_proxy?
 
         proxy_config = role.proxy.proxy_config
-        proxy_config.dig("rate_limit", "requests").present? &&
-          proxy_config["forward_headers"] &&
+        next unless proxy_config["forward_headers"] &&
           Array(proxy_config.dig("client_ip", "trusted_proxies")).empty?
+
+        features = []
+        features << "rate_limit" if proxy_config.dig("rate_limit", "requests").present?
+        features << "deny_ips" if proxy_config["deny_ips"].present?
+
+        [ role.name, features ] if features.any?
       end
 
       return true if offenders.empty?
 
-      warn "Role(s) #{offenders.map(&:name).join(", ")}: rate_limit is set with forward_headers, " \
-        "but no proxy/client_ip/trusted_proxies. kamal-proxy will key the limiter on the address of " \
-        "whatever sits in front of it, not on the client's — so it throttles every visitor as one " \
-        "client, or none of them. Declare the proxies in front with `client_ip: trusted_proxies:`."
+      offenders.each do |role_name, features|
+        warn "Role #{role_name}: #{features.join(" and ")} is set with forward_headers, " \
+          "but no proxy/client_ip/trusted_proxies. kamal-proxy will key on the address of " \
+          "whatever sits in front of it, not on the client's — so the rules apply to every " \
+          "visitor as one client, or to none of them. Declare the proxies in front with " \
+          "`client_ip: trusted_proxies:`."
+      end
 
       true
     end

data/lib/kamal/version.rb

@@ -1,3 +1,3 @@
 module Kamal
-  VERSION = "3.0.1"
+  VERSION = "3.1.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dash
 version: !ruby/object:Gem::Version
-  version: 3.0.1
+  version: 3.1.0
 platform: ruby
 authors:
 - Mikael Henriksson
@@ -304,6 +304,7 @@ files:
 - lib/kamal/commands/loadbalancer.rb
 - lib/kamal/commands/lock.rb
 - lib/kamal/commands/proxy.rb
+- lib/kamal/commands/proxy/cert_transfer.rb
 - lib/kamal/commands/prune.rb
 - lib/kamal/commands/registry.rb
 - lib/kamal/commands/server.rb