[os-OPNWAF] Allow multiple hostnames / ServerAlias entries per Virtual Server

[Zwiebelhacker]

[os-OPNWAF]: Allow multiple hostnames / ServerAlias entries per Virtual Server

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.

Currently, an OPNWAF Virtual Server is limited to a single hostname. For example, if the same web application should be accessible through both example.com and www.example.com, it is necessary to create two separate Virtual Servers, even though both hostnames share the exact same backend, TLS configuration, WAF configuration and routing rules.

This results in duplicated configuration and increases maintenance overhead. This is a common use case for web applications where both the www and non-www variants of a hostname are accepted and one of them is subsequently redirected to the canonical hostname.

Describe the solution you'd like

Allow a single OPNWAF Virtual Server to contain multiple hostnames. For example:

Virtual Server
    Server Name:                            example.com
    Additional Hostnames / Server Aliases:  www.example.com
    Backend:                                192.168.10.50:443

This could be implemented using Apache's ServerAlias directive:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
</VirtualHost>

The GUI could either provide a dedicated "Additional Hostnames" field or allow the hostname field to accept multiple entries.

Expected behavior

A single Virtual Server should be able to accept requests for multiple hostnames while sharing the same:

• backend / real server
• TLS certificate (the certificate must cover all configured hostnames, e.g. via a wildcard or SAN certificate)
• WAF policy
• locations
• authentication configuration
• security settings

If different behavior is required for a specific hostname, users can still create separate Virtual Servers as they do today.

Describe alternatives you've considered

Creating separate Virtual Servers for each hostname works, but results in duplicated configuration and increases the risk of configuration drift between Virtual Servers that are supposed to behave identically.

Manually modifying the generated Apache configuration is not desirable, as such changes are outside the GUI and may be overwritten when the configuration is regenerated.

[Monviech]

Sounds like a reasonable request but maybe its better to now use the server alias and just allow multiple normal hostnames which are looped over and printed as separate vhosts. Thats the beauty of templating.

Not sure what issues the alias would cause in the future eg with ACME and model validations, I like it simple.

I'll take it but it might take a while.

[Zwiebelhacker]

Sounds good, thanks for considering the feature!
The proposed approach makes total sense.