milestone 17: real deadlines, validator holes, upstream editor, trusted proxies, contract samples, badvers

web/src/features/settings/RestartBanner.tsx

@@ -8,7 +8,7 @@ export default function RestartBanner() {
 			role="status"
 			className="flex items-center gap-3 border-b border-amber-300 bg-amber-50 px-4 py-2 text-sm text-amber-900 dark:border-amber-800 dark:bg-amber-950 dark:text-amber-100"
 		>
-			<span className="flex-1">Settings saved. Restart nxdns to apply.</span>
+			<span className="flex-1">Changes saved. Restart nxdns to apply.</span>
 			<button
 				type="button"
 				onClick={dismissRestartBanner}

web/src/features/settings/SettingsPage.test.tsx

@@ -10,7 +10,7 @@ import type { Settings, SettingsPatch } from "@/lib/types";
 
 function baseSettings(): Settings {
 	return {
-		upstream: { read_timeout_ms: 3000, total_timeout_ms: 5000 },
+		upstream: { attempt_timeout_ms: 2500, read_timeout_ms: 3000, total_timeout_ms: 5000 },
 		dns: { bind_ipv4: "0.0.0.0", bind_ipv6: "::", port: 53, rate_limit: 100, rate_window_seconds: 60 },
 		blocking: { response: "zero", ttl: 300 },
 		cache: { size: 10000, negative_ttl_max: 300 },
@@ -22,6 +22,7 @@ function baseSettings(): Settings {
 			api_rate_limit_per_min: 60,
 			api_localhost_exempt: true,
 			sse_max_connections_per_ip: 2,
+			trusted_proxies: "",
 			auth_enabled: true,
 		},
 		doh_server: { enabled: false, bind: "0.0.0.0", port: 443, cert_path: "", key_path: "" },

web/src/features/settings/SettingsPage.tsx

@@ -37,6 +37,7 @@ const SECTIONS: readonly SectionDef[] = [
 		section: "upstream",
 		title: "Upstream",
 		fields: [
+			{ key: "attempt_timeout_ms", kind: "number" },
 			{ key: "read_timeout_ms", kind: "number" },
 			{ key: "total_timeout_ms", kind: "number" },
 		],
@@ -79,6 +80,7 @@ const SECTIONS: readonly SectionDef[] = [
 			{ key: "api_rate_limit_per_min", kind: "number" },
 			{ key: "api_localhost_exempt", kind: "boolean" },
 			{ key: "sse_max_connections_per_ip", kind: "number" },
+			{ key: "trusted_proxies", kind: "text" },
 		],
 	},
 	{ section: "doh_server", title: "DoH Server", fields: TLS_FIELDS },