cryptolabs-proxy 1.3.1__tar.gz → 1.5.0__tar.gz

{cryptolabs_proxy-1.3.1/src/cryptolabs_proxy.egg-info → cryptolabs_proxy-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cryptolabs-proxy
-Version: 1.3.1
+Version: 1.5.0
 Summary: Unified reverse proxy and fleet management landing page for CryptoLabs products
 Author-email: CryptoLabs <support@cryptolabs.co.za>
 License: MIT
@@ -190,6 +190,10 @@ always-running internal VPM session and reauthentication endpoints cannot fall
 through a preserved public <code>/auth/</code> route. Rollback restores the
 original stored baseline exactly.
 
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
 ### Vast Price Manager Fleet sign-in
 
 ### Vast Price Manager prerequisite

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.5.0}/README.md

@@ -162,6 +162,10 @@ always-running internal VPM session and reauthentication endpoints cannot fall
 through a preserved public <code>/auth/</code> route. Rollback restores the
 original stored baseline exactly.
 
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
 ### Vast Price Manager Fleet sign-in
 
 ### Vast Price Manager prerequisite

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cryptolabs-proxy"
-version = "1.3.1"
+version = "1.5.0"
 description = "Unified reverse proxy and fleet management landing page for CryptoLabs products"
 readme = "README.md"
 license = {text = "MIT"}

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/__init__.py

@@ -1,6 +1,6 @@
 """CryptoLabs Proxy - Unified reverse proxy for CryptoLabs products."""
 
-__version__ = "1.3.1"
+__version__ = "1.5.0"
 
 # Export programmatic setup API
 from .setup import (

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/config.py

@@ -5,6 +5,7 @@ from pathlib import Path
 from jinja2 import Environment, PackageLoader, select_autoescape
 
 CONFIG_DIR = Path("/etc/cryptolabs-proxy")
+_UNSET = object()
 
 
 def get_jinja_env():
@@ -17,13 +18,19 @@ def get_jinja_env():
     )
 
 
-def generate_nginx_config(config_dir: Path, domain: str, letsencrypt: bool = False, services: dict = None, *, host_forward_groups=None, acme_challenge=None):
+def generate_nginx_config(config_dir: Path, domain: str, letsencrypt: bool = False, services: dict = None, *, host_forward_groups=None, acme_challenge=None, hostname_policy=_UNSET, http_policy=_UNSET):
     """Generate nginx.conf from template."""
     from .services import ServiceRegistry
     if host_forward_groups is None:
         host_forward_groups = ServiceRegistry(config_dir).config.get('host_forward_groups', [])
     if acme_challenge is None:
         acme_challenge = ServiceRegistry(config_dir).config.get('acme_challenge')
+    if hostname_policy is _UNSET:
+        hostname_policy = ServiceRegistry(config_dir).config.get("hostname_policy")
+    hostname_policy = validate_hostname_policy(hostname_policy, domain)
+    if http_policy is _UNSET:
+        http_policy = ServiceRegistry(config_dir).config.get("http_policy")
+    http_policy = validate_http_policy(http_policy, domain, acme_challenge)
     acme_challenge = validate_acme_challenge(acme_challenge)
     host_forward_groups = validate_host_forward_groups(host_forward_groups, domain)
     env = get_jinja_env()
@@ -35,6 +42,8 @@ def generate_nginx_config(config_dir: Path, domain: str, letsencrypt: bool = Fal
         services=services or {},
         host_forward_groups=host_forward_groups,
         acme_challenge=acme_challenge,
+        hostname_policy=hostname_policy,
+        http_policy=http_policy,
     )
     
     (config_dir / "nginx.conf").write_text(content)
@@ -57,7 +66,12 @@ def generate_docker_compose(config_dir: Path, domain: str = None, use_letsencryp
     template = env.get_template("docker-compose.yml.j2")
     from .release_selection import load, targets, SelectionError
     from .services import ServiceRegistry
-    release_selection_dir = release_selection_dir or ServiceRegistry(config_dir).config.get('release_selection_dir')
+    registry = ServiceRegistry(config_dir)
+    if domain is None: domain = registry.config.get('domain')
+    release_selection_dir = release_selection_dir or registry.config.get('release_selection_dir')
+    http_policy = validate_http_policy(registry.config.get('http_policy'), domain, registry.config.get('acme_challenge'))
+    healthcheck = policy_healthcheck(registry.config.get('standard_adoption',{}).get('healthcheck'),domain,registry.config.get('hostname_policy'),http_policy,letsencrypt=use_letsencrypt)
+    health_command = healthcheck['Test'][1] if healthcheck else None
     proxy_image = 'ghcr.io/cryptolabsza/cryptolabs-proxy:latest'
     proxy_origin = None
     if release_selection_dir:
@@ -73,6 +87,9 @@ def generate_docker_compose(config_dir: Path, domain: str = None, use_letsencryp
         release_selection_dir=str(Path(release_selection_dir).resolve()) if release_selection_dir else None,
         proxy_image=proxy_image,
         proxy_origin=proxy_origin,
+        http_policy=http_policy,
+        policy_healthcheck=health_command,
+        policy_healthcheck_config=healthcheck,
     )
     
     (config_dir / "docker-compose.yml").write_text(content)
@@ -143,3 +160,77 @@ def validate_acme_challenge(value):
 
 def render_acme_challenge(value, *, legacy_profile=False):
     return get_jinja_env().get_template('acme-challenge.conf.j2').render(acme_challenge=value,legacy_forward_profile=legacy_profile).encode()
+
+
+def validate_hostname_policy(policy, domain):
+    """Only the observed literal-primary $host guard with fixed 444 is supported."""
+    import re
+    import ipaddress
+    if policy is None:
+        return None
+    if not isinstance(policy, str) or policy != 'primary-only':
+        raise ValueError('invalid_hostname_policy')
+    literal = re.compile(r'(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+')
+    if not isinstance(domain, str) or not literal.fullmatch(domain):
+        raise ValueError('hostname_policy_requires_literal_domain')
+    try:
+        ipaddress.ip_address(domain)
+    except ValueError:
+        return policy
+    raise ValueError('hostname_policy_requires_literal_domain')
+
+
+def validate_http_policy(policy, domain, acme_challenge=None):
+    """Closed primary HTTPS redirect and local HTTP ACME transport."""
+    if policy is None:
+        return None
+    if not isinstance(policy, str) or policy != 'redirect-primary-https':
+        raise ValueError('invalid_http_policy')
+    validate_hostname_policy('primary-only', domain)
+    if acme_challenge is not None:
+        raise ValueError('http_policy_local_acme_conflicts_with_upstream')
+    return policy
+
+
+def render_policy_healthcheck(domain, hostname_policy=None, http_policy=None, *, letsencrypt=False):
+    """Public HTTPS loopback uses the declared Host/SNI; internal API stays checked.
+
+    The stored certificate is the explicit local trust anchor. Hostname
+    verification remains enabled; browser and forwarding trust are unchanged.
+    """
+    validate_hostname_policy(hostname_policy, domain)
+    validate_http_policy(http_policy, domain)
+    if hostname_policy is None and http_policy is None:
+        return None
+    validate_hostname_policy('primary-only', domain)
+    certificate='/etc/letsencrypt/live/'+domain+'/fullchain.pem' if letsencrypt else '/etc/nginx/ssl/server.crt'
+    return ('curl -fsS --cacert '+certificate+' --resolve '+domain+':443:127.0.0.1 https://'+domain+
+            '/api/health && curl -f http://127.0.0.1:8080/api/health || exit 1')
+
+
+def policy_healthcheck(current, domain, hostname_policy=None, http_policy=None, *, letsencrypt=False):
+    """Keep the exact independently observed verified probe; map image defaults.
+
+    Recognition compares fixed raw shell syntax, with spaces/tabs only. It
+    never accepts arbitrary operations, flags, URLs, credentials or snippets.
+    """
+    from copy import deepcopy
+    import re
+    command=render_policy_healthcheck(domain,hostname_policy,http_policy,letsencrypt=letsencrypt)
+    if command is None: return None
+    default=['CMD-SHELL','curl -f http://localhost/api/health && curl -f http://localhost:8080/api/health || exit 1']
+    if current is None: return {'Test':['CMD-SHELL',command]}
+    fields={'Test','Interval','Timeout','StartPeriod','StartInterval','Retries'}
+    if not isinstance(current,dict) or set(current)-fields or not isinstance(current.get('Test'),list): raise ValueError('source_healthcheck_unmapped')
+    if any(type(v) is not int or not 0<=v<=2**63-1 for k,v in current.items() if k!='Test'): raise ValueError('source_healthcheck_unmapped')
+    test=current['Test']
+    trusted='curl -fsS --resolve '+domain+':443:127.0.0.1 https://'+domain+'/api/health >/dev/null && curl -fsS http://localhost:8080/api/health >/dev/null || exit 1'
+    if len(test)==2 and test[0]=='CMD-SHELL' and isinstance(test[1],str) and len(test[1])<=4096:
+        # Shell operators must remain operators, not quoted/escaped curl
+        # arguments. Only spaces/tabs may vary in this closed raw skeleton.
+        # The validated domain is escaped with every other literal position.
+        skeleton=re.escape(trusted).replace(r'\ ',r'[ 	]+')
+        if re.fullmatch(skeleton,test[1]): return deepcopy(current)
+    if test not in (default,['CMD-SHELL',command]): raise ValueError('source_healthcheck_unmapped')
+    result=deepcopy(current);result['Test']=['CMD-SHELL',command]
+    return result

cryptolabs_proxy-1.5.0/src/cryptolabs_proxy/controller_recovery.py

@@ -0,0 +1,284 @@
+"""Private controller exclusion on the updater's existing auth mount.
+
+This module uses only stdlib so its fixed helper can run without auth startup,
+network access, the Docker socket, or the source container's environment.
+"""
+import fcntl
+import json
+import os
+from pathlib import Path
+import re
+import socket
+import stat
+import sys
+import time
+import uuid
+from contextlib import contextmanager
+
+MARKER = 'controller-adoption.json'
+MAX_MARKER = 4096
+GUARD_IDLE_SECONDS = 300
+CAPABILITY = {'schema_version': 1, 'api': 'AdoptionEngine.controller_guard',
+              'durable_updater_exclusion': True}
+FIELDS = {'schema_version', 'kind', 'operation_id', 'source_id', 'source_image',
+          'auth_mount_sha256', 'owner'}
+
+
+class RecoveryError(RuntimeError):
+    """Fixed public failure, without private filesystem or Engine details."""
+
+
+def _hold():
+    raise RecoveryError('controller_recovery_required')
+
+
+def validate_record(value):
+    if not isinstance(value, dict) or set(value) != FIELDS:
+        _hold()
+    if type(value['schema_version']) is not int or value['schema_version'] != 1 or value['kind'] != 'dc-controller-adoption':
+        _hold()
+    patterns = {'operation_id': r'[A-Za-z0-9][A-Za-z0-9_.-]{0,95}',
+                'source_id': r'[0-9a-f]{64}',
+                'source_image': r'sha256:[0-9a-f]{64}',
+                'auth_mount_sha256': r'[0-9a-f]{64}', 'owner': r'[0-9a-f]{64}'}
+    for key, pattern in patterns.items():
+        if not isinstance(value[key], str) or not re.fullmatch(pattern, value[key]):
+            _hold()
+    return value
+
+
+def _private(info, *, directory=False):
+    return ((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
+            and info.st_uid == os.geteuid()
+            and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
+            and (directory or info.st_nlink == 1))
+
+
+@contextmanager
+def open_directory(directory):
+    """Traverse each parent without following links; create only missing dirs."""
+    path = Path(directory)
+    if not path.is_absolute() or '..' in path.parts:
+        _hold()
+    descriptor = os.open('/', os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        for index, part in enumerate(path.parts[1:]):
+            try:
+                child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=descriptor)
+            except FileNotFoundError:
+                os.mkdir(part, 0o700, dir_fd=descriptor)
+                os.fsync(descriptor)
+                child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=descriptor)
+            os.close(descriptor)
+            descriptor = child
+        if not _private(os.fstat(descriptor), directory=True):
+            _hold()
+        yield descriptor
+    except (OSError, ValueError):
+        _hold()
+    finally:
+        os.close(descriptor)
+
+
+def _unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError('duplicate field')
+        result[key] = value
+    return result
+
+
+def read_marker(directory_fd):
+    try:
+        descriptor = os.open(MARKER, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=directory_fd)
+    except FileNotFoundError:
+        return None
+    except OSError:
+        _hold()
+    try:
+        info = os.fstat(descriptor)
+        if not _private(info) or info.st_size > MAX_MARKER:
+            _hold()
+        data = os.read(descriptor, MAX_MARKER + 1)
+        if len(data) > MAX_MARKER:
+            _hold()
+        try:
+            value = json.loads(data, object_pairs_hook=_unique_object)
+        except (ValueError, UnicodeError, RecursionError):
+            _hold()
+        return validate_record(value)
+    finally:
+        os.close(descriptor)
+
+
+def require_clear(directory):
+    with open_directory(directory) as descriptor:
+        if read_marker(descriptor) is not None:
+            _hold()
+
+
+def _write_marker(directory_fd, value):
+    validate_record(value)
+    temporary = '.' + MARKER + '-' + uuid.uuid4().hex
+    descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+                         0o600, dir_fd=directory_fd)
+    try:
+        with os.fdopen(descriptor, 'wb') as stream:
+            stream.write(json.dumps(value, sort_keys=True, separators=(',', ':')).encode())
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.rename(temporary, MARKER, src_dir_fd=directory_fd, dst_dir_fd=directory_fd)
+        os.fsync(directory_fd)
+    finally:
+        try: os.unlink(temporary, dir_fd=directory_fd)
+        except FileNotFoundError: pass
+
+
+def open_lock(directory_fd, name):
+    descriptor = os.open(name, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK,
+                         0o600, dir_fd=directory_fd)
+    if not _private(os.fstat(descriptor)):
+        os.close(descriptor)
+        _hold()
+    return descriptor
+
+
+@contextmanager
+def updater_lock(directory, name):
+    with open_directory(directory) as directory_fd:
+        descriptor = None
+        try:
+            descriptor = open_lock(directory_fd, name)
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            yield
+        except OSError:
+            _hold()
+        finally:
+            if descriptor is not None:
+                os.close(descriptor)
+
+
+def request(path, owner, action, timeout):
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+        client.settimeout(timeout)
+        client.connect(path)
+        client.sendall(json.dumps({'owner': owner, 'action': action}).encode() + b'\n')
+        response = b''
+        while not response.endswith(b'\n'):
+            chunk = client.recv(1024)
+            if not chunk: _hold()
+            response += chunk
+            if len(response) > MAX_MARKER: _hold()
+    value = json.loads(response)
+    if value != {'owner': owner, 'state': 'completed' if action == 'complete' else 'held'}:
+        _hold()
+    return value
+
+
+# This fixed client is executed inside the exact guard helper, never the proxy.
+CLIENT_COMMAND = """import json,socket,sys
+with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as c:
+ c.settimeout(2); c.connect('/tmp/controller-guard.sock')
+ c.sendall(json.dumps({'owner':sys.argv[1],'action':sys.argv[2]}).encode()+b'\\n')
+ data=b''
+ while not data.endswith(b'\\n'):
+  part=c.recv(1024)
+  if not part: raise RuntimeError('guard_unavailable')
+  data+=part
+  if len(data)>4096: raise RuntimeError('guard_unavailable')
+ sys.stdout.buffer.write(data)
+"""
+
+
+def helper_main(directory, socket_path, expected, recover, timeout):
+    """Hold real locks until removal; durable marker outlives this process."""
+    validate_record(expected)
+    with open_directory(directory) as directory_fd:
+        descriptors = []
+        try:
+            deadline = time.monotonic() + timeout
+            for name in ('dispatch.lock', 'operation.lock'):
+                descriptor = open_lock(directory_fd, name)
+                descriptors.append((name, descriptor, os.fstat(descriptor)))
+                while True:
+                    try:
+                        fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                        break
+                    except BlockingIOError:
+                        if time.monotonic() >= deadline: _hold()
+                        time.sleep(.02)
+            previous = read_marker(directory_fd)
+            if previous is not None:
+                if not recover or {k: v for k, v in previous.items() if k != 'owner'} != {k: v for k, v in expected.items() if k != 'owner'}:
+                    _hold()
+            _write_marker(directory_fd, expected)
+            completed = False
+
+            def prove():
+                # Reopen by no-follow traversal to detect replaced parent/lock
+                # inodes. Fixed helper never unlocks its live descriptors.
+                with open_directory(directory) as current_fd:
+                    if (os.fstat(current_fd).st_dev, os.fstat(current_fd).st_ino) != (os.fstat(directory_fd).st_dev, os.fstat(directory_fd).st_ino):
+                        _hold()
+                    for name, descriptor, original in descriptors:
+                        current = os.stat(name, dir_fd=current_fd, follow_symlinks=False)
+                        if not _private(current) or (current.st_dev, current.st_ino) != (original.st_dev, original.st_ino):
+                            _hold()
+                        if (os.fstat(descriptor).st_dev, os.fstat(descriptor).st_ino) != (original.st_dev, original.st_ino):
+                            _hold()
+                    actual = read_marker(current_fd)
+                    if actual != (None if completed else expected): _hold()
+
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as server:
+                server.bind(socket_path)
+                os.chmod(socket_path, 0o600)
+                server.listen(1)
+                verified_at = time.monotonic()
+                while True:
+                    remaining = GUARD_IDLE_SECONDS - (time.monotonic() - verified_at)
+                    if remaining <= 0:
+                        return  # Release locks; persisted marker stays in place.
+                    server.settimeout(min(remaining, .25))
+                    try:
+                        connection, _ = server.accept()
+                    except socket.timeout:
+                        continue
+                    with connection:
+                        connection.settimeout(min(2, remaining))
+                        try:
+                            data = b''
+                            while not data.endswith(b'\n'):
+                                part = connection.recv(1024)
+                                if not part: _hold()
+                                data += part
+                                if len(data) > MAX_MARKER: _hold()
+                            command = json.loads(data)
+                            if command not in ({'owner': expected['owner'], 'action': 'check'},
+                                               {'owner': expected['owner'], 'action': 'complete'}): _hold()
+                            prove()
+                            if time.monotonic() - verified_at >= GUARD_IDLE_SECONDS:
+                                _hold()
+                            verified_at = time.monotonic()
+                            if command['action'] == 'complete':
+                                if not completed:
+                                    os.unlink(MARKER, dir_fd=directory_fd)
+                                    os.fsync(directory_fd)
+                                    completed = True
+                                state = 'completed'
+                            else:
+                                if completed: _hold()
+                                state = 'held'
+                            response = {'owner': expected['owner'], 'state': state}
+                        except (OSError, ValueError, RecoveryError):
+                            response = {'state': 'unavailable'}
+                        try: connection.sendall(json.dumps(response).encode() + b'\n')
+                        except OSError: pass
+        finally:
+            for _, descriptor, _ in descriptors: os.close(descriptor)
+            try: os.unlink(socket_path)
+            except FileNotFoundError: pass
+
+
+if __name__ == '__main__':
+    helper_main(sys.argv[1], sys.argv[2], json.loads(sys.argv[3]), sys.argv[4] == 'recover', float(sys.argv[5]))

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/setup.py

@@ -14,7 +14,7 @@ from dataclasses import dataclass
 from typing import Optional, Dict, List, Tuple
 from datetime import datetime
 
-from .config import generate_nginx_config, generate_docker_compose, CONFIG_DIR
+from .config import generate_nginx_config, generate_docker_compose, validate_hostname_policy, validate_http_policy, render_policy_healthcheck, CONFIG_DIR
 from .ssl import generate_self_signed_cert
 from .services import ServiceRegistry
 from .release_selection import SELECTION_CONTRACT, SelectionError, load as load_selection, targets as selection_targets
@@ -45,8 +45,12 @@ class ProxyConfig:
     # Internal API token - shared secret for service-to-service config API
     internal_api_token: str = ""
     release_selection_dir: Optional[Path] = None
+    hostname_policy: Optional[str] = None
+    http_policy: Optional[str] = None
     
     def __post_init__(self):
+        self.hostname_policy = validate_hostname_policy(self.hostname_policy, self.domain)
+        self.http_policy = validate_http_policy(self.http_policy, self.domain)
         if not self.auth_secret:
             self.auth_secret = secrets.token_hex(32)
         if not self.internal_api_token:
@@ -452,6 +456,13 @@ def setup_proxy(
 
     target_image = 'ghcr.io/cryptolabsza/cryptolabs-proxy:latest'
     recorded = ServiceRegistry(CONFIG_DIR).config
+    try:
+        policy = config.hostname_policy if config.hostname_policy is not None else recorded.get('hostname_policy')
+        config.hostname_policy = validate_hostname_policy(policy, config.domain)
+        http_policy = config.http_policy if config.http_policy is not None else recorded.get("http_policy")
+        config.http_policy = validate_http_policy(http_policy, config.domain, recorded.get("acme_challenge"))
+    except ValueError:
+        return False, 'Invalid hostname policy; setup not started'
     if recorded.get('standard_adoption'):
         from .standard_adoption import StandardAdoption
         return StandardAdoption(CONFIG_DIR).reconfigure(config)
@@ -459,6 +470,8 @@ def setup_proxy(
     if config.release_selection_dir is None and recorded_directory:
         config.release_selection_dir = Path(recorded_directory)
     baseline = config.release_selection_dir is not None
+    if (config.hostname_policy or config.http_policy) and not baseline:
+        return False, 'Hostname policy requires approved standard setup or configuration adoption'
     if baseline and recorded.get('custom_config'):
         from .updates import PROXY_ADOPTION_MESSAGE
         return False, 'Custom Nginx configuration requires host adoption. '+PROXY_ADOPTION_MESSAGE
@@ -568,16 +581,18 @@ def setup_proxy(
                 candidate_dir = Path(temporary)
                 generate_nginx_config(candidate_dir, config.domain, config.use_letsencrypt and ssl_success, registry.services,
                     host_forward_groups=registry.config.get('host_forward_groups', []),
-                    acme_challenge=registry.config.get('acme_challenge'))
+                    acme_challenge=registry.config.get('acme_challenge'),
+                    hostname_policy=config.hostname_policy, http_policy=config.http_policy)
                 validation = ['docker', 'run', '--rm', '--network', DOCKER_NETWORK_NAME,
                     '--entrypoint', '']
                 validation.extend(['-v', f'{CONFIG_DIR / "ssl"}:/etc/nginx/ssl:ro',
                     '-v', f'{candidate_dir / "nginx.conf"}:/etc/nginx/nginx.conf:ro'])
                 if config.use_letsencrypt and ssl_success:
+                    validation.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro'])
+                if config.use_letsencrypt and ssl_success or config.http_policy:
                     webroot = CONFIG_DIR / 'certbot' / 'www'
                     webroot.mkdir(parents=True, exist_ok=True)
-                    validation.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro',
-                        '-v', f'{webroot}:/var/www/certbot:ro'])
+                    validation.extend(['-v', f'{webroot}:/var/www/certbot:ro'])
                 validation.extend([target_image, 'nginx', '-t'])
                 try:
                     tested = subprocess.run(validation, capture_output=True, timeout=60)
@@ -614,8 +629,12 @@ def setup_proxy(
                 '-e', 'RELEASE_SELECTION_REQUIRED=true', '--label', 'io.cryptolabs.update.reference=' + target_image,
                 '--label', 'io.cryptolabs.update.origin=' + proxy_target['origin']])
             if config.use_letsencrypt and ssl_success:
-                cmd.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro',
-                    '-v', f'{CONFIG_DIR / "certbot" / "www"}:/var/www/certbot:ro'])
+                cmd.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro'])
+            if config.use_letsencrypt and ssl_success or config.http_policy:
+                cmd.extend(['-v', f'{CONFIG_DIR / "certbot" / "www"}:/var/www/certbot:ro'])
+            healthcheck = render_policy_healthcheck(config.domain, config.hostname_policy, config.http_policy, letsencrypt=config.use_letsencrypt and ssl_success)
+            if healthcheck:
+                cmd.extend(['--health-cmd', healthcheck])
         cmd.append(target_image)
 
         log("Freeing ports 80/443...")
@@ -681,6 +700,10 @@ def setup_proxy(
     # Step 6: Initialize service registry
     registry = ServiceRegistry(CONFIG_DIR)
     registry.config["domain"] = config.domain
+    if config.hostname_policy is not None:
+        registry.config["hostname_policy"] = config.hostname_policy
+    if config.http_policy is not None:
+        registry.config["http_policy"] = config.http_policy
     registry.config["letsencrypt"] = config.use_letsencrypt and ssl_success
     if baseline:
         registry.config['release_selection_dir'] = str(Path(config.release_selection_dir).resolve())
@@ -731,7 +754,7 @@ def update_proxy_credentials(
             fleet_admin_user=fleet_admin_user, fleet_admin_pass=fleet_admin_pass, auth_secret=auth_secret,
             watchdog_api_key=watchdog_api_key, watchdog_url=watchdog_url,
             internal_api_token=internal_api_token, site_name=existing.get('SITE_NAME', 'DC Overview'),
-            release_selection_dir=Path(release_directory)))
+            release_selection_dir=Path(release_directory), hostname_policy=registry.config.get('hostname_policy'), http_policy=registry.config.get('http_policy')))
     
     # Recreate with new credentials
     subprocess.run(["docker", "rm", "-f", "cryptolabs-proxy"], capture_output=True)