Add destination domain ACL rules

2026-10-28 14:13:53 +00:00
parent a33549e81a
commit 467624b747
5 changed files with 450 additions and 24 deletions
@@ -22,3 +22,14 @@ acl:
 #     - name: alice
 #       action: allow
 #       users: ["alice"]
+#
+# Add destination domains to any rule to allow only those destinations:
+#
+#     - name: localhost-approved-domains
+#       action: allow
+#       networks: ["127.0.0.1/32", "::1/128"]
+#       domains: ["example.com", "*.rust-lang.org"]
+#
+# `*.example.com` matches subdomains but not `example.com` itself. Domain
+# patterns never match IP literals, and domain blacklists do not block direct
+# connections to destination IP addresses.