Support route to multiple nodes

src/core/http/hb_http.erl

@@ -87,6 +87,10 @@ request(Method, #{ <<"opts">> := ReqOpts, <<"uri">> := URI }, _Path, Message, Op
             MergedOpts
         ),
     request(NewMethod, Node, NewPath, NewMsg, NewOpts);
+request(Method, #{ <<"prefix">> := Prefix }, Path, RawMessage, Opts) ->
+    % A configured remote node carrying a `prefix' URL (its per-node `opts' are
+    % read elsewhere). Use the prefix as the peer, preserving the request path.
+    request(Method, Prefix, Path, RawMessage, Opts);
 request(Method, Peer, Path, RawMessage, Opts) ->
     ?event({request, {method, Method}, {peer, Peer}, {path, Path}, {priv_message, RawMessage}}),
     Req =
@@ -329,9 +333,10 @@ http_response_to_httpsig(Status, HeaderMap, Body, Opts) ->
         0 -> #{};
         _ -> #{ <<"body">> => Body }
     end,
-    ConvertFrom = 
+    NormalizedHeaders = lowercase_header_keys(HeaderMap),
+    ConvertFrom =
         hb_maps:merge(
-            HeaderMap#{ <<"status">> => BinStatus },
+            NormalizedHeaders#{ <<"status">> => BinStatus },
             BodyMap,
 			Opts
         ),
@@ -342,6 +347,18 @@ http_response_to_httpsig(Status, HeaderMap, Body, Opts) ->
         Opts
     ))#{ <<"status">> => hb_util:int(Status) }.
 
+%% @doc Lowercase binary header keys from peer responses before the httpsig
+%% codec runs, so committed component names (signed lowercase per RFC 9421)
+%% match regardless of the peer's HTTP/1.1 header casing. Values are untouched.
+lowercase_header_keys(Headers) when is_map(Headers) ->
+    maps:fold(
+        fun(K, V, Acc) when is_binary(K) -> Acc#{ string:lowercase(K) => V };
+           (K, V, Acc) -> Acc#{ K => V }
+        end,
+        #{},
+        Headers
+    ).
+
 %% @doc Given a message, return the information needed to make the request.
 message_to_request(M, Opts) ->
     % Get the route for the message.
@@ -1145,10 +1162,9 @@ normalize_unsigned(PrimMsg, Req = #{ headers := RawHeaders }, Msg, Opts) ->
         not_found -> WithPrivIP;
         Device -> WithPrivIP#{<<"device">> => Device}
     end,
-    Host = cowboy_req:host(Req),
+    Host = cowboy_req:header(<<"host">>, Req, cowboy_req:host(Req)),
     WithDevice#{<<"host">> => Host}.
 
-
 %% @doc Determine the caller, honoring the `x-real-ip' header if present.
 real_ip(Req = #{ headers := RawHeaders }, Opts) ->
     case hb_maps:get(<<"x-real-ip">>, RawHeaders, undefined, Opts) of

src/core/http/hb_http_client.erl

@@ -5,6 +5,9 @@
 -include("include/hb.hrl").
 -include("include/hb_opts.hrl").
 -include("include/hb_http_client.hrl").
+-ifdef(TEST).
+-include_lib("eunit/include/eunit.hrl").
+-endif.
 %% Public API
 -export([request/2, response_status_to_atom/1, setup_conn/1]).
 %% GenServer
@@ -790,6 +793,12 @@ get_status_class({error, {down, noproc}}) ->
     <<"noproc">>;
 get_status_class({error, {stream_error, {closed, normal}}}) ->
     <<"stream-closed">>;
+get_status_class({error, {tls_alert, {internal_error, _}}}) ->
+    <<"tls-alert-internal-error">>;
+get_status_class({error, {tls_alert, {handshake_failure, _}}}) ->
+    <<"tls-alert-handshake-failure">>;
+get_status_class({error, {tls_alert, {certificate_expired, _}}}) ->
+    <<"tls-alert-certificate-expired">>;
 get_status_class({error, Error}) when is_atom(Error) ->
     hb_util:atom_to_dashed_binary(Error);
 get_status_class(208) ->
@@ -829,3 +838,21 @@ path_to_category(Path) ->
         undefined -> <<"unknown">>;
         _ -> <<"unknown">>
     end.
+
+-ifdef(TEST).
+
+tls_alert_status_class_test() ->
+    ?assertEqual(
+        <<"tls-alert-internal-error">>,
+        get_status_class({error, {tls_alert, {internal_error, test}}})
+    ),
+    ?assertEqual(
+        <<"tls-alert-handshake-failure">>,
+        get_status_class({error, {tls_alert, {handshake_failure, test}}})
+    ),
+    ?assertEqual(
+        <<"tls-alert-certificate-expired">>,
+        get_status_class({error, {tls_alert, {certificate_expired, test}}})
+    ).
+
+-endif.