fix: DoH endpoint accepts loopback, TLS cert includes IP SANs #88

2026-04-12T22:56:55+08:00

razvandimescu commented

2026-04-12 22:56:55 +08:00

(Migrated from github.com)

Summary

DoH host check (is_doh_host) now accepts 127.0.0.1, ::1, and localhost (with optional port suffix)
TLS cert generation adds 127.0.0.1 and ::1 as IP SANs, plus the bare TLD (numa) as a DNS SAN
Enables https://127.0.0.1/dns-query as a DoH URL in browsers that reject single-label hostnames (e.g. Opera)

Closes #87

Test plan

is_doh_host unit tests cover loopback IPs, localhost, and port-suffixed variants
222 tests pass, clippy clean
After restart, curl -sk https://127.0.0.1/dns-query returns HTTP 200

## Summary - DoH host check (`is_doh_host`) now accepts `127.0.0.1`, `::1`, and `localhost` (with optional port suffix) - TLS cert generation adds `127.0.0.1` and `::1` as IP SANs, plus the bare TLD (`numa`) as a DNS SAN - Enables `https://127.0.0.1/dns-query` as a DoH URL in browsers that reject single-label hostnames (e.g. Opera) Closes #87 ## Test plan - [x] `is_doh_host` unit tests cover loopback IPs, localhost, and port-suffixed variants - [x] 222 tests pass, clippy clean - [x] After restart, `curl -sk https://127.0.0.1/dns-query` returns HTTP 200

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/numa#88