# Firewall Plugin — Verified Architecture

## Wallarm Integration (2026-08-08)
- Wallarm active on 10.1.0.11:8081 — full chain working
- Nginx requires `proxy_set_header Host $http_host` to preserve Host for backend routing
- Plugin redirect preservation fixed — login Set-Cookie and 302 now pass through
- Health check: any HTTP response = reachable (connection error only = failure)
- UI: simplified to 3-state indicator (DISABLED / ENABLED / FAILED)

## Known
- Forgejo/Gitea login: requires redirect preservation + nginx Host header fix
- X-Forwarded-For chain preserved through Zoraxy → Plugin → Wallarm chain