Fix signed-webhook breakage: X-Forwarded-* headers + plain-HTTP proxy mode

crates/rustunnel-server/src/config.rs

@@ -140,6 +140,12 @@ pub struct ServerSection {
     /// Allowed CORS origin for the external dashboard (e.g. "https://dashboard.rustunnel.com")
     #[serde(default = "default_dashboard_origin")]
     pub dashboard_origin: String,
+    /// Plain-HTTP (port 80) behaviour: `"proxy"` forwards requests whose
+    /// subdomain resolves to a tunnel (ngrok parity — required for signed
+    /// webhooks configured with an `http://` URL) and redirects the rest;
+    /// `"redirect"` (default) 308-redirects everything to HTTPS.
+    #[serde(default)]
+    pub plain_http_mode: crate::edge::PlainHttpMode,
 }
 
 fn default_dashboard_port() -> u16 {
@@ -318,6 +324,7 @@ impl Default for ServerConfig {
                 control_port: 9000,
                 dashboard_port: 4040,
                 dashboard_origin: "http://localhost:3000".to_string(),
+                plain_http_mode: crate::edge::PlainHttpMode::default(),
             },
             tls: TlsSection {
                 cert_path: "cert.pem".to_string(),

crates/rustunnel-server/src/core/router.rs

@@ -982,6 +982,13 @@ impl TunnelCore {
         self.dispatch_member(&group)
     }
 
+    /// Side-effect-free existence check for an HTTP route. Unlike
+    /// `resolve_http` this does not dispatch a member (no request-count
+    /// increment, no random pick) — use it for gating decisions.
+    pub fn has_http_route(&self, subdomain: &str) -> bool {
+        self.http_routes.contains_key(subdomain)
+    }
+
     /// Look up the tunnel and its session's control channel by TCP port.
     pub fn resolve_tcp(&self, port: u16) -> Option<(TunnelInfo, mpsc::Sender<ControlMessage>)> {
         let group = self.tcp_routes.get(&port)?.clone();