Stop the proxy dialog wiping Custom Nginx Configuration, and let it be edited

Saving a host sent advanced_config as an empty string and reset http2, both HSTS flags, meta,
locations and enabled — so changing a port removed the auth_request block that puts Authelia in
front of the site. Twenty-five of the thirty-five hosts here carry one.

Plugin/unraid/pages/auth.php

@@ -229,6 +229,10 @@ require_once dirname(__DIR__) . '/include/ai_chat.php';
 .vv-au-adv-toggle:hover { color:#666; }
 .vv-au-adv-section { display:none; }
 .vv-au-adv-section.open { display:block; }
+/* nginx config is whitespace-significant and read in blocks — proportional text at 11px makes a
+   location block unreadable, and wrapping hides where a brace closes. */
+.vv-au-nginx    { font-family:monospace;font-size:11px;line-height:1.45;white-space:pre;
+                  overflow-wrap:normal;overflow-x:auto;tab-size:2;resize:vertical;min-height:180px; }
 .vv-au-err      { font-size:11px;color:#ef5350;margin-top:8px;display:none; }
 .vv-au-err.show { display:block; }
 
@@ -694,17 +698,53 @@ function _proxyModal(id) {
       <span class="vv-au-tog${(!p||p.allow_websocket_upgrade!==false)?' on':''}" id="pm-websocket"></span>
       <span class="vv-au-tog-lbl">WebSocket Support</span>
     </div>
+    <div class="vv-au-tog-row">
+      <span class="vv-au-tog${(!p||p.http2_support!==false)?' on':''}" id="pm-http2"></span>
+      <span class="vv-au-tog-lbl">HTTP/2 Support</span>
+    </div>
+    <div class="vv-au-tog-row">
+      <span class="vv-au-tog${p?.hsts_enabled?' on':''}" id="pm-hsts"></span>
+      <span class="vv-au-tog-lbl">HSTS Enabled</span>
+    </div>
+    <div class="vv-au-tog-row">
+      <span class="vv-au-tog${p?.hsts_subdomains?' on':''}" id="pm-hsts-sub"></span>
+      <span class="vv-au-tog-lbl">HSTS Subdomains</span>
+    </div>
+    <div class="vv-au-tog-row">
+      <span class="vv-au-tog${(!p||p.enabled!==false)?' on':''}" id="pm-enabled"></span>
+      <span class="vv-au-tog-lbl">Enabled</span>
+    </div>
+
+    <!-- The field this dialog used to send as an empty string on every save. Twenty-five of the
+         thirty-five hosts here carry one, and on the protected ones it is the auth_request block
+         that puts Authelia in front of the site — so an edit to a port silently removed the
+         authentication from it. -->
+    <div class="vv-au-adv-toggle" id="pm-adv-toggle">${(p?.advanced_config||'').trim() ? '▼' : '▶'} Custom Nginx Configuration${(p?.advanced_config||'').trim() ? ' (in use)' : ''}</div>
+    <div class="vv-au-adv-section${(p?.advanced_config||'').trim() ? ' open' : ''}" id="pm-adv">
+      <textarea class="vv-au-input vv-au-nginx" id="pm-advanced" rows="12" spellcheck="false"
+                placeholder="location / { ... }">${_esc(p?.advanced_config || '')}</textarea>
+      <div class="vv-au-hint">Pasted into the server block verbatim. NPM rejects the save if nginx
+        will not load it, and the error comes back here.</div>
+    </div>
+
     <div class="vv-au-err" id="pm-err"></div>
     <div class="vv-au-modal-acts">
       <button class="vv-au-btn" id="pm-cancel">Cancel</button>
       <button class="vv-au-btn prim" id="pm-save">${p ? 'Save' : 'Create'}</button>
-    </div>`);
+    </div>`, true);
 
   // Wire inline toggles
   document.querySelectorAll('#vv-au-modal .vv-au-tog').forEach(t => {
     t.addEventListener('click', () => t.classList.toggle('on'));
   });
 
+  document.getElementById('pm-adv-toggle').addEventListener('click', () => {
+    const sec = document.getElementById('pm-adv');
+    const open = sec.classList.toggle('open');
+    document.getElementById('pm-adv-toggle').textContent =
+      (open ? '▼' : '▶') + ' Custom Nginx Configuration';
+  });
+
   document.getElementById('pm-cancel').onclick = _closeModal;
   document.getElementById('pm-save').onclick = () => {
     const domains = document.getElementById('pm-domains').value.split(',').map(s=>s.trim()).filter(Boolean);
@@ -712,6 +752,14 @@ function _proxyModal(id) {
     const host = document.getElementById('pm-host').value.trim();
     if (!host) { _showModalErr('pm-err', 'Forward host required'); return; }
 
+    // NPM's update replaces the whole host, so anything not sent here is not "left alone" — it is
+    // reset. This object used to hardcode advanced_config to '', http2 and both HSTS flags to
+    // false, meta to {} and locations to [], and enabled to true. Editing a port therefore removed
+    // the site's auth_request block, turned off HTTP/2 and HSTS, dropped its custom locations, and
+    // switched a deliberately disabled host back on.
+    //
+    // Everything the dialog does not offer is carried from the host it is editing; only a genuinely
+    // new host gets defaults.
     const data = {
       domain_names:          domains,
       forward_scheme:        document.getElementById('pm-scheme').value,
@@ -721,13 +769,17 @@ function _proxyModal(id) {
       ssl_forced:            document.getElementById('pm-ssl-forced').classList.contains('on'),
       block_exploits:        document.getElementById('pm-block-exploits').classList.contains('on'),
       allow_websocket_upgrade: document.getElementById('pm-websocket').classList.contains('on'),
-      http2_support:         false,
+      http2_support:         document.getElementById('pm-http2').classList.contains('on'),
-      hsts_enabled:          false,
+      hsts_enabled:          document.getElementById('pm-hsts').classList.contains('on'),
-      hsts_subdomains:       false,
+      hsts_subdomains:       document.getElementById('pm-hsts-sub').classList.contains('on'),
-      meta:                  {},
+      enabled:               document.getElementById('pm-enabled').classList.contains('on'),
-      locations:             [],
+      advanced_config:       document.getElementById('pm-advanced').value,
-      advanced_config:       '',
+      // Not represented in this dialog at all. Preserved rather than blanked — an access list is a
-      enabled:               true,
+      // deliberate restriction and a location block is routing, and losing either quietly is worse
+      // than not being able to edit it here.
+      access_list_id:        p ? (p.access_list_id ?? 0) : 0,
+      meta:                  p ? (p.meta ?? {}) : {},
+      locations:             p ? (p.locations ?? []) : [],
     };
 
     const btn = document.getElementById('pm-save');