Add a GUC for the allowed domain list

[Thom Chiovoloni (thomcc-work)]

WIP (haven't really reviewed it yet). A bit more involved than expected, but I had an agent hack on it while I was working on other things.

This adds a restart-only pg_durable.http_allowed_domains postmaster SUSET GUC, and supports both exact hosts and prefix subdomain globs (no other flexibility). If you configure this it's a full replacement of the defaults, and setting it to the empty string means that all domains are denied.

This doesn't remove the cargo feature gates (so #374 is still open), but does allow swapping out the list of domains, which was mentioned as being more important than expected in the last meeting.

Fixes #375

[Copilot]

🟡 Changes recommended

The security-critical fail-closed behavior for malformed startup configuration lacks an end-to-end restart test.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a restart-only GUC for replacing the outbound HTTP domain allowlist while preserving existing feature-gated security tiers.

Changes:

• Parses and validates exact domains and wildcard subdomains.
• Applies one immutable policy to HTTP and multipart activities.
• Adds configuration tests and updates security documentation.

File summaries

File	Description
src/lib.rs	Registers the new GUC.
src/ssrf.rs	Implements domain parsing and enforcement.
src/worker.rs	Loads the policy at worker startup.
src/registry.rs	Supplies the policy to HTTP activities.
src/activities/execute_http.rs	Enforces the configured policy.
src/activities/execute_multipart.rs	Enforces the same multipart policy.
tests/e2e/sql/69_http_allowed_domains.sql	Tests custom replacement lists.
tests/e2e/sql/70_http_allowed_domains_empty.sql	Tests deny-all configuration.
tests/e2e/sql/47_http_dsl_disabled.sql	Verifies disabled builds remain disabled.
tests/e2e/sql/48_http_allow_all.sql	Verifies allow-all bypass behavior.
scripts/test-e2e-local.sh	Adds restart-sensitive test phases.
scripts/test-e2e-docker.sh	Skips unsupported restart tests.
scripts/test-upgrade.sh	Clears persisted allowlist configuration.
USER_GUIDE.md	Documents administration and behavior.
docs/http-security.md	Updates the HTTP security model.
docs/api-reference.md	Documents the GUC API.
docs/upgrade-testing.md	Records compatibility implications.
README.md	Updates published-image policy guidance.
CHANGELOG.md	Announces the new setting.

Review details

• Files reviewed: 19/19 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.