From 69b38917b3a77feb087026bfff569c0fc2721bd9 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 15:01:44 +0100
Subject: [PATCH 01/24] test(e2e): run the Docker suites as a user of the
 docker group

run.sh e2e built the broken image and ran the docker-py integration
tests through sudo unconditionally, so on a host where the user may use
Docker but sudo needs a password (a developer box) cp-docker-it failed
before any test ran. It now uses sudo only when `docker info` fails, as
e2e_kerberos.sh and crabbox_bootstrap.sh already do.

The integration tests created their lists under the service default
/etc/linuxmuster-squid/blocklists, which only root may write; they now
use a directory under pytest's tmp_path like the secrets.
---
 controlplane/tests/test_docker_integration.py | 4 ++--
 scripts/tests/run.sh                          | 8 +++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/controlplane/tests/test_docker_integration.py b/controlplane/tests/test_docker_integration.py
index 7d128e4..8f1b6eb 100644
--- a/controlplane/tests/test_docker_integration.py
+++ b/controlplane/tests/test_docker_integration.py
@@ -32,7 +32,7 @@ def test_real_container_lifecycle(tmp_path: Path) -> None:
     # exercised by the compose E2E, not here — this proves docker-py lifecycle.
     (secrets / "it.keytab").write_bytes(b"dummy-keytab-not-valid")
 
-    svc = DockerService(secrets_dir=str(secrets))
+    svc = DockerService(secrets_dir=str(secrets), blocklists_dir=str(tmp_path / "lists"))
     inst = Instance(
         school="it",
         role="teachers",
@@ -78,7 +78,7 @@ def test_real_update_auto_rollback(tmp_path: Path) -> None:
     (secrets / "it.keytab").write_bytes(b"dummy-keytab-not-valid")
 
     store = Store(str(tmp_path / "instances"))
-    docker = DockerService(secrets_dir=str(secrets))
+    docker = DockerService(secrets_dir=str(secrets), blocklists_dir=str(tmp_path / "lists"))
     reconciler = Reconciler(store, docker)
     updater = Updater(store, docker, reconciler, health_timeout=45.0, poll_interval=2.0)
 
diff --git a/scripts/tests/run.sh b/scripts/tests/run.sh
index 76650e9..739cea0 100755
--- a/scripts/tests/run.sh
+++ b/scripts/tests/run.sh
@@ -124,14 +124,16 @@ e2e(){
   else
     skip "kerberos-e2e" "scripts/tests/e2e_kerberos.sh missing (comes in P1)"
   fi
+  # Docker directly, or via sudo when the user is not (yet) in the docker group (crabbox).
+  local asroot=(); docker info >/dev/null 2>&1 || asroot=(sudo)
   # Build broken image (FROM :dev) for the auto-rollback test.
   if have docker; then
-    sudo docker build -q -t linuxmuster-squid:broken deploy/e2e/broken-image >/dev/null 2>&1 || true
+    "${asroot[@]}" docker build -q -t linuxmuster-squid:broken deploy/e2e/broken-image >/dev/null 2>&1 || true
   fi
   # Control-plane Docker integration: real DockerService creates a container
-  # + update/auto-rollback; via sudo, since the crabbox user may not be in the docker group.
+  # + update/auto-rollback.
   if [ -x .venv/bin/pytest ]; then
-    if sudo env LMNSQUID_DOCKER_IT=1 ./.venv/bin/pytest -q controlplane/tests/test_docker_integration.py; then
+    if "${asroot[@]}" env LMNSQUID_DOCKER_IT=1 ./.venv/bin/pytest -q controlplane/tests/test_docker_integration.py; then
       pass "cp-docker-it"
     else
       fail "cp-docker-it"

From e00cc009cdffb10d3c244395340e8cd788462376 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 15:01:59 +0100
Subject: [PATCH 02/24] feat(noauth): per-instance domains reachable without
 proxy authentication

Some services break behind proxy authentication; Microsoft lists it among
the configurations known to cause Microsoft 365 connection issues. A
client-side bypass was not wanted, so an instance can now let listed
domains through the proxy without a ticket (ADR-016):

  lmnsquid noauth <name> list | add <domain> | remove <domain> | reload
  GET/POST/DELETE /v1/instances/{name}/noauth, POST .../noauth/reload

The list is <blocklists_dir>/<name>/noauth.domains, in the directory that
is already mounted at /etc/squid/lists, so the container spec (and its
fingerprint) does not change and an upgrade replaces no container for it.
Entries are normalized like the blocklist (.example.org = domain and
subdomains).

squid.conf (data-plane image):
- after the existing denies (Safe_ports, CONNECT only to 443, no IP
  literals): `deny noauth_domains blocked_domains` (the blocklist wins,
  403), then `allow noauth_domains school_net`, then the unchanged chain;
- the list ACL is `dstdomain -n`: without it an IP-literal URL whose
  address maps back to a listed name matched (measured: 200 without a
  ticket);
- a CONNECT to a listed domain is terminated at SslBump2 when its SNI is
  not on the list (ssl::server_name --client-requested) or when there is
  no SNI. ssl::server_name falls back to the CONNECT host without SNI, so
  a four-line external ACL helper (sni-sent.sh, %ssl::>sni) tells; squid
  sends it "<sni> <%DATA>", i.e. "- -" without SNI. No decryption: peek,
  splice and terminate only (ADR-002).
- entrypoint: a list directory without noauth.domains (an older control
  plane) gets an empty stand-in under /run and a notice.

Control plane: both list files are created before a container starts.
`noauth reload` first checks in the container that the rendered squid.conf
reads /etc/squid/lists/noauth.domains and answers 409 otherwise: the
pinned DEFAULT_IMAGE does not know the list yet, and a reload would report
success while changing nothing.

Tests: unit (normalization, unsafe names, API 401/403/404/409/422, CLI,
--help warnings, both files before create, noauth_active); Docker
integration with the real DockerService (new image reads and reloads the
list; the pinned image runs healthy next to it and is reported inactive);
Kerberos E2E with three new instances (squid-noauth, the pinned image, a
list directory without the file) covering listed/unlisted/blocked, foreign
SNI, blocked SNI, no SNI, IP literal, outside school_net and the ticket
matrix. Counter-runs without `-n` and without the SNI rule fail.

Docs: ADR-016, threat model T16 (exam mode, Internetsperre, no user in
the log), architecture, operations (commands, warnings, recommended
Microsoft 365 list from endpoints.office.com version 2026103000),
install.md optional step 8, README, test strategy, references.
debian/changelog: new 7.3.8 stanza.
---
 README.md                                     |   6 +-
 controlplane/lmnsquid/api.py                  |  62 ++++-
 controlplane/lmnsquid/blocklist.py            |  36 +--
 controlplane/lmnsquid/cli.py                  |  47 +++-
 controlplane/lmnsquid/docker_service.py       |  65 ++++--
 controlplane/lmnsquid/models.py               |   2 +-
 controlplane/tests/conftest.py                |  14 +-
 controlplane/tests/test_docker_integration.py |  46 +++-
 controlplane/tests/test_docker_service.py     |  63 +++++-
 controlplane/tests/test_noauth.py             | 211 ++++++++++++++++++
 debian/changelog                              |  21 ++
 deploy/e2e/client/Dockerfile                  |   2 +-
 deploy/e2e/client/assert.sh                   |  64 ++++++
 deploy/e2e/docker-compose.yml                 |  66 +++++-
 deploy/e2e/lists-legacy/blocked.domains       |   7 +
 deploy/e2e/lists-noauth/blocked.domains       |   8 +
 deploy/e2e/lists-noauth/noauth.domains        |   7 +
 docs/architecture.md                          |  26 ++-
 docs/decisions.md                             |  32 +++
 docs/install.md                               |  34 ++-
 docs/operations.md                            |  91 +++++++-
 docs/references.md                            |  25 +++
 docs/test-strategy.md                         |  21 +-
 docs/threat-model.md                          |   3 +-
 image/Dockerfile                              |   6 +-
 image/entrypoint.sh                           |  14 +-
 image/sni-sent.sh                             |  18 ++
 image/templates/squid.conf.template           |  18 ++
 scripts/tests/e2e_kerberos.sh                 |  46 +++-
 29 files changed, 997 insertions(+), 64 deletions(-)
 create mode 100644 controlplane/tests/test_noauth.py
 create mode 100644 deploy/e2e/lists-legacy/blocked.domains
 create mode 100644 deploy/e2e/lists-noauth/blocked.domains
 create mode 100644 deploy/e2e/lists-noauth/noauth.domains
 create mode 100755 image/sni-sent.sh

diff --git a/README.md b/README.md
index 2fd3d3e..a6c816c 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ the same AD/Kerberos infrastructure the school already operates.
   `ext_kerberos_ldap_group_acl` against the instance's AD group. HTTPS is
   **not decrypted** (SNI peek/splice or CONNECT `dstdomain`). Per-instance domain
   blocklist: HTTP → 403, HTTPS → the TLS handshake is cut (no block page without decryption).
+  Optional per-instance list of domains reachable without proxy login from the school subnets
+  (e.g. Microsoft 365; the blocklist still wins).
 - **Control Plane:** hardened systemd service with **REST API** (FastAPI) and
   **CLI** (Typer, thin client) — creates instances, configures policies, and
   **updates digest-pinned with health-check auto-rollback**. Shipped as a
@@ -92,7 +94,9 @@ lmnsquid rollback all-teachers             # to the last known-good
 lmnsquid reconcile                         # re-apply stored state (restore / after a crash)
 lmnsquid blocklist all-students add example.org    # block a domain + subdomains (HTTP 403, HTTPS TLS abort)
 lmnsquid blocklist all-students reload             # apply without restart; list / remove likewise
-lmnsquid rm all-students                   # container + cache/log volumes + blocklist (--keep-logs keeps the logs)
+lmnsquid noauth all-students add sharepoint.com    # reachable WITHOUT proxy login from the school subnets
+lmnsquid noauth all-students reload                # (exam mode and Internetsperre do not apply: docs/operations.md)
+lmnsquid rm all-students                   # container + cache/log volumes + both lists (--keep-logs keeps the logs)
 lmnsquid version
 ```
 
diff --git a/controlplane/lmnsquid/api.py b/controlplane/lmnsquid/api.py
index b910e51..a417be5 100644
--- a/controlplane/lmnsquid/api.py
+++ b/controlplane/lmnsquid/api.py
@@ -13,7 +13,7 @@
 from fastapi import Depends, FastAPI, HTTPException, Request, status
 from fastapi.responses import JSONResponse
 
-from .blocklist import Blocklist
+from .blocklist import NOAUTH_FILE_NAME, Blocklist
 from .config import Settings
 from .docker_service import DockerService
 from .models import DEFAULT_IMAGE, BlocklistEntry, Instance, InstancePatch, UpdateRequest
@@ -38,6 +38,7 @@ def create_app(
     """Build the FastAPI app wiring routes to the store, reconciler and docker service."""
     verify = make_verify_token(settings)
     blocklist = Blocklist(settings.blocklists_dir)
+    noauth = Blocklist(settings.blocklists_dir, NOAUTH_FILE_NAME)
     app = FastAPI(title="linuxmuster-squid control plane")
 
     @app.exception_handler(DockerException)
@@ -218,6 +219,65 @@ def reload_blocklist(name: str) -> dict[str, Any]:
                 status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=str(exc)
             ) from exc
 
+    # ------------------------------------------- domains without proxy auth (ADR-016)
+    @app.get("/v1/instances/{name}/noauth", dependencies=auth)
+    async def get_noauth(name: str) -> dict[str, Any]:
+        _require(name)
+        return {"name": name, "domains": noauth.read(name)}
+
+    @app.post("/v1/instances/{name}/noauth", dependencies=auth)
+    async def add_noauth_domain(name: str, entry: BlocklistEntry) -> dict[str, Any]:
+        """Let ``entry.domain`` and its subdomains through without proxy auth (after ``reload``)."""
+        _require(name)
+        domains = noauth.add(name, entry.domain)
+        audit.info("noauth add name=%s domain=%s", name, entry.domain)
+        return {"name": name, "domains": domains}
+
+    @app.delete("/v1/instances/{name}/noauth/{domain}", dependencies=auth)
+    async def remove_noauth_domain(name: str, domain: str) -> dict[str, Any]:
+        _require(name)
+        try:
+            domains = noauth.remove(name, domain)
+        except ValueError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=str(exc)
+            ) from exc
+        except KeyError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"{domain!r} is not on the noauth list of {name!r}",
+            ) from exc
+        audit.info("noauth remove name=%s domain=%s", name, domain)
+        return {"name": name, "domains": domains}
+
+    @app.post("/v1/instances/{name}/noauth/reload", dependencies=auth)
+    def reload_noauth(name: str) -> dict[str, Any]:
+        """Re-read the lists (``squid -k reconfigure``), refused if squid ignores the noauth list.
+
+        An image from before ADR-016, or a container started without ``noauth.domains`` in
+        its list directory, never reads the list: answer 409 instead of a silent "reloaded".
+        """
+        _require(name)
+        audit.info("noauth reload name=%s", name)
+        try:
+            if not docker.noauth_active(name):
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT,
+                    detail=(
+                        f"the running container of {name!r} does not read the noauth list "
+                        "(its image predates the list, or it started without noauth.domains): "
+                        f"update it to an image that supports the list, or `lmnsquid restart "
+                        f"{name}` when it already runs one"
+                    ),
+                )
+            return docker.reload(name)
+        except LookupError as exc:
+            raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(exc)) from exc
+        except RuntimeError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=str(exc)
+            ) from exc
+
     # ----------------------------------------------------------- lifecycle ops
     @app.post("/v1/instances/{name}/start", dependencies=auth)
     async def start_instance(name: str) -> dict[str, Any]:
diff --git a/controlplane/lmnsquid/blocklist.py b/controlplane/lmnsquid/blocklist.py
index 6d4c081..9a80f6d 100644
--- a/controlplane/lmnsquid/blocklist.py
+++ b/controlplane/lmnsquid/blocklist.py
@@ -1,13 +1,15 @@
 # SPDX-FileCopyrightText: Kevin Stenzel
 # SPDX-License-Identifier: GPL-3.0-or-later
-"""Per-instance domain blocklist: a file on the host, mounted read-only into the container.
-
-Every instance owns ``<blocklists_dir>/<name>/blocked.domains``. The DIRECTORY is
-bind-mounted read-only at ``/etc/squid/lists`` -- the path the rendered ``squid.conf``
-already reads its ``dstdomain`` / ``ssl::server_name`` ACL from -- so the image needs no
-change and the read-only rootfs stays read-only. The directory rather than the file is
-mounted on purpose: a single-file bind mount pins the inode, so an atomic replace on the
-host (an editor, ``blocklist-refresh.sh``, this module) would never reach the container.
+"""Per-instance domain lists: files on the host, mounted read-only into the container.
+
+Every instance owns the directory ``<blocklists_dir>/<name>/`` with two lists:
+``blocked.domains`` (the blocklist) and ``noauth.domains`` (domains reachable without proxy
+auth, ADR-016). The DIRECTORY is bind-mounted read-only at ``/etc/squid/lists`` -- the path
+the rendered ``squid.conf`` reads its ``dstdomain`` / ``ssl::server_name`` ACLs from -- so the
+read-only rootfs stays read-only, and the second list needs no mount of its own (the container
+spec, and with it every running container, stays as it was). The directory rather than the
+file is mounted on purpose: a single-file bind mount pins the inode, so an atomic replace on
+the host (an editor, ``blocklist-refresh.sh``, this module) would never reach the container.
 """
 
 from __future__ import annotations
@@ -19,6 +21,7 @@
 from pathlib import Path
 
 FILE_NAME = "blocked.domains"
+NOAUTH_FILE_NAME = "noauth.domains"
 CONTAINER_DIR = "/etc/squid/lists"  # squid.conf: acl blocked_domains dstdomain "/etc/squid/lists/blocked.domains"
 # Instance name = <school>-<role> (models._NAME_RE per part): the directory name under root.
 _INSTANCE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9-]{1,62}$")
@@ -48,10 +51,15 @@ def normalize_domain(value: str) -> str:
 
 
 class Blocklist:
-    """Read and modify the ``blocked.domains`` files under ``root`` (one dir per instance)."""
+    """Read and modify one list file (``blocked.domains`` by default) under ``root``.
 
-    def __init__(self, root: str) -> None:
+    One directory per instance; ``Blocklist(root, NOAUTH_FILE_NAME)`` handles the noauth list
+    in the same directories.
+    """
+
+    def __init__(self, root: str, file_name: str = FILE_NAME) -> None:
         self.root = Path(root)
+        self.file_name = file_name
 
     def dir_for(self, name: str) -> Path:
         """Host directory mounted into the instance ``name`` (rejects anything but a name)."""
@@ -60,7 +68,7 @@ def dir_for(self, name: str) -> Path:
         return self.root / name
 
     def file_for(self, name: str) -> Path:
-        return self.dir_for(name) / FILE_NAME
+        return self.dir_for(name) / self.file_name
 
     def ensure(self, name: str) -> Path:
         """Create the directory and an empty list if absent; return the directory.
@@ -70,7 +78,7 @@ def ensure(self, name: str) -> Path:
         """
         directory = self.dir_for(name)
         directory.mkdir(mode=0o755, parents=True, exist_ok=True)
-        file = directory / FILE_NAME
+        file = directory / self.file_name
         if not file.exists():
             self._write(file, [])
         return directory
@@ -107,7 +115,7 @@ def remove(self, name: str, domain: str) -> list[str]:
         return remaining
 
     def delete(self, name: str) -> None:
-        """Remove the instance's directory (called when the instance is removed)."""
+        """Remove the instance's directory with every list in it (instance removed)."""
         directory = self.dir_for(name)
         if directory.is_dir():
             shutil.rmtree(directory)
@@ -117,7 +125,7 @@ def _write(file: Path, entries: list[str]) -> None:
         # Atomic replace inside the directory: squid (on reload) or an editor never sees a
         # half-written list, and a root-owned file left behind by blocklist-refresh.sh
         # does not block the control plane (only the directory must be writable).
-        fd, tmp = tempfile.mkstemp(dir=file.parent, prefix=f".{FILE_NAME}.", suffix=".tmp")
+        fd, tmp = tempfile.mkstemp(dir=file.parent, prefix=f".{file.name}.", suffix=".tmp")
         try:
             with os.fdopen(fd, "w", encoding="utf-8") as fh:
                 fh.write("".join(f"{entry}\n" for entry in entries))
diff --git a/controlplane/lmnsquid/cli.py b/controlplane/lmnsquid/cli.py
index cd16405..21cbcc0 100644
--- a/controlplane/lmnsquid/cli.py
+++ b/controlplane/lmnsquid/cli.py
@@ -122,7 +122,7 @@ def rm(
         "default removes it together with the cache volume",
     ),
 ) -> None:
-    """Remove an instance: container, cache + log volumes, blocklist and definition."""
+    """Remove an instance: container, cache + log volumes, both lists and definition."""
     with _get_client() as c:
         _emit(
             c.delete(f"/v1/instances/{name}", params={"keep_logs": "true"} if keep_logs else None)
@@ -171,6 +171,51 @@ def blocklist_reload(ctx: typer.Context) -> None:
         _emit(c.post(f"/v1/instances/{ctx.obj}/blocklist/reload"))
 
 
+noauth_app = typer.Typer(
+    help="Per-instance domains reachable WITHOUT proxy authentication, from --school-subnets "
+    "only (e.g. Microsoft 365). The blocklist still wins; HTTPS only when the TLS SNI is on "
+    "the list too. WARNING: anyone in the school subnets reaches these domains without a "
+    "ticket, so exam accounts reach them in exam mode (OneDrive, Teams, Outlook ...) and the "
+    "Internetsperre does not apply to them. Changes take effect after `reload`.",
+    no_args_is_help=True,
+)
+app.add_typer(noauth_app, name="noauth")
+
+
+@noauth_app.callback()
+def _noauth(ctx: typer.Context, name: str = typer.Argument(..., help="instance name")) -> None:
+    """Manage the noauth list of one instance: list | add <domain> | remove <domain> | reload."""
+    ctx.obj = name
+
+
+@noauth_app.command("list")
+def noauth_list(ctx: typer.Context) -> None:
+    """Show the domains reachable without proxy authentication."""
+    with _get_client() as c:
+        _emit(c.get(f"/v1/instances/{ctx.obj}/noauth"))
+
+
+@noauth_app.command("add")
+def noauth_add(ctx: typer.Context, domain: str) -> None:
+    """Let a domain and all its subdomains through without authentication (then `reload`)."""
+    with _get_client() as c:
+        _emit(c.post(f"/v1/instances/{ctx.obj}/noauth", json={"domain": domain}))
+
+
+@noauth_app.command("remove")
+def noauth_remove(ctx: typer.Context, domain: str) -> None:
+    """Require authentication for a domain again (then `reload`)."""
+    with _get_client() as c:
+        _emit(c.delete(f"/v1/instances/{ctx.obj}/noauth/{quote(domain, safe='')}"))
+
+
+@noauth_app.command("reload")
+def noauth_reload(ctx: typer.Context) -> None:
+    """Apply the list without a restart; fails if the instance's image ignores the list."""
+    with _get_client() as c:
+        _emit(c.post(f"/v1/instances/{ctx.obj}/noauth/reload"))
+
+
 @app.command()
 def start(name: str) -> None:
     """Start the instance container."""
diff --git a/controlplane/lmnsquid/docker_service.py b/controlplane/lmnsquid/docker_service.py
index f934d15..d43d63c 100644
--- a/controlplane/lmnsquid/docker_service.py
+++ b/controlplane/lmnsquid/docker_service.py
@@ -16,7 +16,7 @@
 from docker.models.containers import Container
 from docker.types import LogConfig
 
-from .blocklist import CONTAINER_DIR, Blocklist
+from .blocklist import CONTAINER_DIR, NOAUTH_FILE_NAME, Blocklist
 from .models import Instance
 
 logger = logging.getLogger("lmnsquid.docker")
@@ -55,6 +55,7 @@ def __init__(
         self.log_max_size: str = log_max_size
         self.log_max_file: int = log_max_file
         self.blocklist = Blocklist(blocklists_dir)
+        self.noauth = Blocklist(blocklists_dir, NOAUTH_FILE_NAME)
         self.health_timeout = health_timeout
         self.poll_interval = poll_interval
         self.client: docker.DockerClient = (
@@ -183,9 +184,12 @@ def ensure_running(self, inst: Instance) -> dict[str, Any]:
 
         spec = self.spec_for(inst)
         digest = self.fingerprint(spec)
-        # Blocklist: created empty if absent (create, reconcile, update all pass through
+        # Lists: created empty if absent (create, reconcile, update all pass through
         # here, so instances from before 7.3.1 get the mount on their next replacement).
+        # noauth.domains must exist before a container starts: the entrypoint only reads
+        # it from the mount when it is there at start (ADR-016).
         self.blocklist.ensure(inst.name)
+        self.noauth.ensure(inst.name)
 
         cname = inst.container_name
         existing = self._get(inst.name)
@@ -323,19 +327,8 @@ def remove(self, name: str, keep_logs: bool = False) -> None:
                 logger.warning("volume %s not removed: %s", volume, exc)
         self.blocklist.delete(name)
 
-    def reload(self, name: str) -> dict[str, Any]:
-        """Make the running squid re-read squid.conf and its ACL list files (the blocklist).
-
-        Runs ``squid -k reconfigure`` inside the container: squid parses the config and
-        signals its running copy (SIGHUP). No restart -- the cache and open client
-        connections survive, the auth/group helpers are restarted. Deliberately NOT
-        ``container.kill(signal="SIGHUP")``: Docker records every kill(), whatever the
-        signal, as a manual stop, and an ``unless-stopped`` container is then no longer
-        started after a reboot (seen in the lab). Like ``access_logs`` this needs
-        ``docker exec`` (not available behind the socket proxy with ``EXEC: 0``).
-        Raises ``LookupError`` when there is no running container, ``RuntimeError``
-        when the exec is refused or squid does.
-        """
+    def _running(self, name: str) -> Container:
+        """The running container of ``name``; ``LookupError`` when there is none."""
         container = self._get(name)
         if container is None:
             raise LookupError(f"instance {name!r} has no container")
@@ -343,19 +336,53 @@ def reload(self, name: str) -> dict[str, Any]:
         state: dict[str, Any] = container.attrs.get("State", {}) or {}
         if not state.get("Running", False):
             raise LookupError(f"instance {name!r} is not running")
+        return container
+
+    def _exec(self, container: Container, cmd: list[str]) -> tuple[int, str]:
         try:
-            exit_code, output = container.exec_run(
-                ["squid", "-k", "reconfigure", "-f", _SQUID_CONF]
-            )
+            exit_code, output = container.exec_run(cmd)
         except APIError as exc:
             # The daemon is alive; exec itself was refused (socket proxy with EXEC: 0).
             raise RuntimeError(
-                f"docker exec refused ({exc.explanation or exc}); blocklist reload needs "
+                f"docker exec refused ({exc.explanation or exc}); list reload needs "
                 "EXEC at the docker socket proxy (ADR-012/ADR-014)"
             ) from exc
         text = (
             output.decode("utf-8", errors="replace") if isinstance(output, bytes) else str(output)
         )
+        return exit_code, text
+
+    def noauth_active(self, name: str) -> bool:
+        """Whether the running squid reads ``noauth.domains`` from the list directory.
+
+        Not so for an image from before ADR-016 (its template has no such ACL) or for a
+        container started while the directory held no ``noauth.domains`` (the entrypoint
+        then stands in an empty file); a reload cannot change either, only a new container
+        of a supporting image can. Same preconditions and errors as :meth:`reload`.
+        """
+        container = self._running(name)
+        exit_code, text = self._exec(
+            container, ["grep", "-qF", f"{CONTAINER_DIR}/{NOAUTH_FILE_NAME}", _SQUID_CONF]
+        )
+        if exit_code not in (0, 1):
+            raise RuntimeError(f"cannot read {_SQUID_CONF} (exit {exit_code}): {text.strip()}")
+        return exit_code == 0
+
+    def reload(self, name: str) -> dict[str, Any]:
+        """Make the running squid re-read squid.conf and its ACL list files (both lists).
+
+        Runs ``squid -k reconfigure`` inside the container: squid parses the config and
+        signals its running copy (SIGHUP). No restart -- the cache and open client
+        connections survive, the auth/group helpers are restarted. Deliberately NOT
+        ``container.kill(signal="SIGHUP")``: Docker records every kill(), whatever the
+        signal, as a manual stop, and an ``unless-stopped`` container is then no longer
+        started after a reboot (seen in the lab). Like ``access_logs`` this needs
+        ``docker exec`` (not available behind the socket proxy with ``EXEC: 0``).
+        Raises ``LookupError`` when there is no running container, ``RuntimeError``
+        when the exec is refused or squid does.
+        """
+        container = self._running(name)
+        exit_code, text = self._exec(container, ["squid", "-k", "reconfigure", "-f", _SQUID_CONF])
         if exit_code != 0:
             raise RuntimeError(f"squid -k reconfigure exited {exit_code}: {text.strip()}")
         return {"name": name, "reloaded": True}
diff --git a/controlplane/lmnsquid/models.py b/controlplane/lmnsquid/models.py
index c0ea4c5..2c62539 100644
--- a/controlplane/lmnsquid/models.py
+++ b/controlplane/lmnsquid/models.py
@@ -203,7 +203,7 @@ def _v_image(cls, v: str) -> str:
 
 
 class BlocklistEntry(BaseModel):
-    """Body for ``POST /v1/instances/{name}/blocklist``: one domain to block."""
+    """Body for ``POST /v1/instances/{name}/blocklist`` and ``…/noauth``: one domain."""
 
     domain: str
 
diff --git a/controlplane/tests/conftest.py b/controlplane/tests/conftest.py
index 0566f87..2c34b82 100644
--- a/controlplane/tests/conftest.py
+++ b/controlplane/tests/conftest.py
@@ -15,7 +15,7 @@
 from starlette.testclient import TestClient
 
 from lmnsquid.api import create_app
-from lmnsquid.blocklist import Blocklist
+from lmnsquid.blocklist import NOAUTH_FILE_NAME, Blocklist
 from lmnsquid.config import Settings
 from lmnsquid.models import Instance
 from lmnsquid.reconciler import Reconciler
@@ -42,6 +42,7 @@ def __init__(
         self.docker_host = docker_host
         self.secrets_dir = secrets_dir
         self.blocklist = Blocklist(blocklists_dir)
+        self.noauth = Blocklist(blocklists_dir, NOAUTH_FILE_NAME)
         self.containers: dict[str, dict[str, Any]] = {}
         self.volumes: set[str] = set()
         # Test-observability hooks.
@@ -70,14 +71,17 @@ def ensure_running(self, inst: Instance) -> dict[str, Any]:
             # Mirror the real service: the replacement is created first, so a failure
             # leaves the previous container exactly as it was and raises.
             raise RuntimeError("simulated pull failure")
-        # Mirror the real service: the blocklist is created (empty) and mounted, and the
+        # Mirror the real service: both lists are created (empty) and mounted, and the
         # cache/log volumes come into existence with the container.
         self.blocklist.ensure(inst.name)
+        self.noauth.ensure(inst.name)
         self.volumes.update({f"lmnsquid-cache-{inst.name}", f"lmnsquid-logs-{inst.name}"})
         self.containers[inst.name] = {
             "running": True,
             "image": inst.image,
             "health": "unhealthy" if "bad" in inst.image else "healthy",
+            # An image tagged "old" stands for one from before ADR-016 (ignores noauth).
+            "noauth_active": "old" not in inst.image,
             "env": self.env_for(inst),
             "logs": f"started {inst.container_name}\n",
             "access_logs": (
@@ -113,6 +117,12 @@ def remove(self, name: str, keep_logs: bool = False) -> None:
             self.volumes.discard(f"lmnsquid-logs-{name}")
         self.blocklist.delete(name)
 
+    def noauth_active(self, name: str) -> bool:
+        container = self.containers.get(name)
+        if container is None or not container["running"]:
+            raise LookupError(f"instance {name!r} is not running")
+        return bool(container["noauth_active"])
+
     def reload(self, name: str) -> dict[str, Any]:
         container = self.containers.get(name)
         if container is None or not container["running"]:
diff --git a/controlplane/tests/test_docker_integration.py b/controlplane/tests/test_docker_integration.py
index 8f1b6eb..3474e31 100644
--- a/controlplane/tests/test_docker_integration.py
+++ b/controlplane/tests/test_docker_integration.py
@@ -32,7 +32,8 @@ def test_real_container_lifecycle(tmp_path: Path) -> None:
     # exercised by the compose E2E, not here — this proves docker-py lifecycle.
     (secrets / "it.keytab").write_bytes(b"dummy-keytab-not-valid")
 
-    svc = DockerService(secrets_dir=str(secrets), blocklists_dir=str(tmp_path / "lists"))
+    lists = tmp_path / "lists"
+    svc = DockerService(secrets_dir=str(secrets), blocklists_dir=str(lists))
     inst = Instance(
         school="it",
         role="teachers",
@@ -56,6 +57,13 @@ def test_real_container_lifecycle(tmp_path: Path) -> None:
         time.sleep(5)
         assert svc.status(inst.name)["running"] is True
 
+        # ADR-016: noauth.domains exists before the start, so this image reads it, and a
+        # reload picks up an entry added afterwards.
+        assert (lists / inst.name / "noauth.domains").read_text() == ""
+        assert svc.noauth_active(inst.name) is True
+        svc.noauth.add(inst.name, "office.com")
+        assert svc.reload(inst.name) == {"name": inst.name, "reloaded": True}
+
         assert svc.stop(inst.name)["running"] is False
         assert svc.start(inst.name)["running"] is True
     finally:
@@ -106,3 +114,39 @@ def test_real_update_auto_rollback(tmp_path: Path) -> None:
         assert store.get(inst.name).image == IMAGE  # type: ignore[union-attr]
     finally:
         docker.remove(inst.name)
+
+
+def test_real_pinned_image_ignores_the_noauth_list(tmp_path: Path) -> None:
+    """The image installed systems run (DEFAULT_IMAGE) next to a list directory with
+    noauth.domains: it starts healthy, and the noauth reload is refused instead of
+    reporting a reload that changes nothing (ADR-016)."""
+    from lmnsquid.docker_service import DockerService
+    from lmnsquid.models import DEFAULT_IMAGE, Instance
+
+    old_image = os.environ.get("LMNSQUID_IT_OLD_IMAGE", DEFAULT_IMAGE)
+    secrets = tmp_path / "secrets"
+    secrets.mkdir()
+    (secrets / "it.keytab").write_bytes(b"dummy-keytab-not-valid")
+    lists = tmp_path / "lists"
+    svc = DockerService(secrets_dir=str(secrets), blocklists_dir=str(lists))
+    inst = Instance(
+        school="ito",
+        role="teachers",
+        ad_group="teachers",
+        realm="EXAMPLE.INTERNAL",
+        visible_hostname="squid-ito.example.internal",
+        http_port=3197,
+        school_subnets="0.0.0.0/0",
+        keytab_secret="it.keytab",
+        cache_size_mb=100,
+        image=old_image,
+    )
+    svc.remove(inst.name)
+    svc.noauth.add(inst.name, "office.com")  # a list that is there before the container
+    try:
+        status = svc.ensure_running(inst)  # health-gated: raises if it does not come up
+        assert status["running"] is True and status["health"] == "healthy"
+        assert svc.noauth_active(inst.name) is False
+        assert svc.reload(inst.name)["reloaded"] is True  # the blocklist reload still works
+    finally:
+        svc.remove(inst.name)
diff --git a/controlplane/tests/test_docker_service.py b/controlplane/tests/test_docker_service.py
index c1a29c1..526d7e9 100644
--- a/controlplane/tests/test_docker_service.py
+++ b/controlplane/tests/test_docker_service.py
@@ -12,7 +12,7 @@
 import pytest
 from docker.errors import APIError, NotFound
 
-from lmnsquid.blocklist import Blocklist
+from lmnsquid.blocklist import NOAUTH_FILE_NAME, Blocklist
 from lmnsquid.docker_service import SPEC_LABEL, DockerService
 from lmnsquid.models import Instance
 
@@ -22,6 +22,7 @@ def _service(tmp_path: Path) -> DockerService:
     ds.client = MagicMock()
     ds.secrets_dir = str(tmp_path / "secrets")
     ds.blocklist = Blocklist(str(tmp_path / "blocklists"))
+    ds.noauth = Blocklist(str(tmp_path / "blocklists"), NOAUTH_FILE_NAME)
     ds.container_bind_ip = "0.0.0.0"
     ds.log_max_size = "20m"
     ds.log_max_file = 5
@@ -71,6 +72,66 @@ def test_fingerprint_is_stable_and_sensitive(tmp_path: Path) -> None:
     spec = ds.spec_for(_inst())
     blocklist_dir = str(tmp_path / "blocklists" / "s-teachers")
     assert spec["volumes"][blocklist_dir]["bind"] == "/etc/squid/lists"
+    # The noauth list lives in the same mounted directory: no mount of its own, so the
+    # spec (and with it every container an upgrade would otherwise replace) is unchanged.
+    assert len(spec["volumes"]) == 4
+    assert not any("noauth" in str(k) or "noauth" in str(v) for k, v in spec.items())
+
+
+def test_ensure_running_creates_both_lists_before_the_container(tmp_path: Path) -> None:
+    ds = _service(tmp_path)
+    _registry(ds, {})
+    seen: list[bool] = []
+    lists = tmp_path / "blocklists" / "s-teachers"
+
+    def create(*_a: Any, **_k: Any) -> MagicMock:
+        # The entrypoint reads noauth.domains only when it is there at container start.
+        seen.append((lists / "noauth.domains").is_file() and (lists / "blocked.domains").is_file())
+        return _container("lmnsquid-s-teachers.new")
+
+    ds.client.containers.create.side_effect = create
+    ds.ensure_running(_inst())
+    assert seen == [True]
+    assert (lists / "noauth.domains").read_text() == ""
+
+
+@pytest.mark.parametrize(("grep_exit", "expected"), [(0, True), (1, False)])
+def test_noauth_active_reads_the_rendered_config(
+    tmp_path: Path, grep_exit: int, expected: bool
+) -> None:
+    ds = _service(tmp_path)
+    c = _container("lmnsquid-s-teachers")
+    c.exec_run.return_value = (grep_exit, b"")
+    _registry(ds, {"lmnsquid-s-teachers": c})
+    assert ds.noauth_active("s-teachers") is expected
+    cmd = c.exec_run.call_args.args[0]
+    assert cmd == [
+        "grep",
+        "-qF",
+        "/etc/squid/lists/noauth.domains",
+        "/run/lmnsquid/squid.conf",
+    ]
+
+
+def test_noauth_active_errors(tmp_path: Path) -> None:
+    ds = _service(tmp_path)
+    stopped = _container("lmnsquid-s-teachers", running=False)
+    _registry(ds, {"lmnsquid-s-teachers": stopped})
+    with pytest.raises(LookupError):
+        ds.noauth_active("s-teachers")
+    _registry(ds, {})
+    with pytest.raises(LookupError):
+        ds.noauth_active("s-teachers")
+    broken = _container("lmnsquid-s-teachers")
+    broken.exec_run.return_value = (2, b"grep: /run/lmnsquid/squid.conf: No such file")
+    _registry(ds, {"lmnsquid-s-teachers": broken})
+    with pytest.raises(RuntimeError, match="cannot read"):
+        ds.noauth_active("s-teachers")
+    refused = _container("lmnsquid-s-teachers")
+    refused.exec_run.side_effect = APIError("exec disabled")
+    _registry(ds, {"lmnsquid-s-teachers": refused})
+    with pytest.raises(RuntimeError, match="EXEC"):
+        ds.noauth_active("s-teachers")
 
 
 def test_spec_rejects_a_keytab_outside_secrets_dir(tmp_path: Path) -> None:
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
new file mode 100644
index 0000000..e636b99
--- /dev/null
+++ b/controlplane/tests/test_noauth.py
@@ -0,0 +1,211 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Domains without proxy auth (ADR-016): list file, API endpoints, CLI, and `rm`."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import pytest
+from starlette.testclient import TestClient
+from typer.testing import CliRunner
+
+from lmnsquid import cli
+from lmnsquid.blocklist import NOAUTH_FILE_NAME, Blocklist
+from lmnsquid.config import Settings
+
+runner = CliRunner()
+NAME = "default-school-teachers"
+
+
+def _create(client: TestClient, auth: dict[str, str], data: dict[str, Any]) -> str:
+    assert client.post("/v1/instances", json=data, headers=auth).status_code == 201
+    return NAME
+
+
+# ------------------------------------------------------------------ helper
+
+
+@pytest.mark.parametrize(
+    ("raw", "expected"),
+    [
+        ("office.com", [".office.com"]),
+        ("  Outlook.Office.COM. ", [".outlook.office.com"]),
+        (".sharepoint.com", [".sharepoint.com"]),
+        ("bücher.de", [".xn--bcher-kva.de"]),
+    ],
+)
+def test_noauth_add_normalizes(tmp_path: Path, raw: str, expected: list[str]) -> None:
+    na = Blocklist(str(tmp_path), NOAUTH_FILE_NAME)
+    assert na.add("s-teachers", raw) == expected
+    assert (tmp_path / "s-teachers" / "noauth.domains").read_text() == f"{expected[0]}\n"
+
+
+@pytest.mark.parametrize(
+    "bad", ["", ".", "*.office.com", "office.com/x", "a b.com", "-x.com", "x_y.com", "a" * 64]
+)
+def test_noauth_add_rejects_invalid_names(tmp_path: Path, bad: str) -> None:
+    na = Blocklist(str(tmp_path), NOAUTH_FILE_NAME)
+    with pytest.raises(ValueError):
+        na.add("s-teachers", bad)
+    assert not (tmp_path / "s-teachers" / "noauth.domains").exists()
+
+
+@pytest.mark.parametrize("bad", ["../x", "a/b", "..", "", "a", "a.b", "/etc"])
+def test_noauth_rejects_unsafe_instance_name(tmp_path: Path, bad: str) -> None:
+    na = Blocklist(str(tmp_path / "lists"), NOAUTH_FILE_NAME)
+    with pytest.raises(ValueError):
+        na.add(bad, "office.com")
+    assert not (tmp_path / "x").exists() and not (tmp_path / "lists").exists()
+
+
+def test_both_lists_share_the_directory(tmp_path: Path) -> None:
+    root = str(tmp_path)
+    bl, na = Blocklist(root), Blocklist(root, NOAUTH_FILE_NAME)
+    bl.add("s-teachers", "blocked.example")
+    na.add("s-teachers", "office.com")
+    directory = tmp_path / "s-teachers"
+    assert sorted(p.name for p in directory.iterdir()) == ["blocked.domains", "noauth.domains"]
+    assert bl.read("s-teachers") == [".blocked.example"]
+    assert na.read("s-teachers") == [".office.com"]
+    assert (directory / "noauth.domains").stat().st_mode & 0o777 == 0o644
+    na.remove("s-teachers", "office.com")
+    assert bl.read("s-teachers") == [".blocked.example"]  # the other list is untouched
+    na.delete("s-teachers")  # rm: the directory goes with both lists
+    assert not directory.exists()
+
+
+# --------------------------------------------------------------------- API
+
+
+def test_noauth_requires_token(client: TestClient) -> None:
+    assert client.get(f"/v1/instances/{NAME}/noauth").status_code == 401
+    assert client.post(f"/v1/instances/{NAME}/noauth", json={"domain": "x.org"}).status_code == 401
+    assert client.delete(f"/v1/instances/{NAME}/noauth/x.org").status_code == 401
+    assert client.post(f"/v1/instances/{NAME}/noauth/reload").status_code == 401
+    bad = {"Authorization": "Bearer nope"}
+    assert client.get(f"/v1/instances/{NAME}/noauth", headers=bad).status_code == 403
+
+
+def test_noauth_unknown_or_unsafe_instance(
+    client: TestClient, auth_headers: dict[str, str]
+) -> None:
+    assert client.get("/v1/instances/x-y/noauth", headers=auth_headers).status_code == 404
+    resp = client.post("/v1/instances/x-y/noauth", json={"domain": "x.org"}, headers=auth_headers)
+    assert resp.status_code == 404
+    assert client.post("/v1/instances/x-y/noauth/reload", headers=auth_headers).status_code == 404
+    # a traversal attempt never reaches the file system
+    resp = client.get("/v1/instances/..%2F..%2Fetc/noauth", headers=auth_headers)
+    assert resp.status_code in (404, 422)
+
+
+def test_noauth_endpoints(
+    client: TestClient,
+    auth_headers: dict[str, str],
+    instance_data: dict[str, Any],
+    docker: Any,
+    settings: Settings,
+) -> None:
+    name = _create(client, auth_headers, instance_data)
+    file = Path(settings.blocklists_dir) / name / "noauth.domains"
+    assert file.is_file() and file.read_text() == ""  # created empty with the instance
+    resp = client.get(f"/v1/instances/{name}/noauth", headers=auth_headers)
+    assert resp.status_code == 200 and resp.json() == {"name": name, "domains": []}
+
+    resp = client.post(
+        f"/v1/instances/{name}/noauth", json={"domain": "Office.com"}, headers=auth_headers
+    )
+    assert resp.status_code == 200 and resp.json()["domains"] == [".office.com"]
+    assert file.read_text() == ".office.com\n"
+    # the blocklist is a separate file in the same directory
+    assert client.get(f"/v1/instances/{name}/blocklist", headers=auth_headers).json() == {
+        "name": name,
+        "domains": [],
+    }
+
+    resp = client.post(
+        f"/v1/instances/{name}/noauth", json={"domain": "not a host"}, headers=auth_headers
+    )
+    assert resp.status_code == 422
+
+    resp = client.post(f"/v1/instances/{name}/noauth/reload", headers=auth_headers)
+    assert resp.status_code == 200 and resp.json() == {"name": name, "reloaded": True}
+    assert docker.reloaded == [name]
+
+    resp = client.delete(f"/v1/instances/{name}/noauth/office.com", headers=auth_headers)
+    assert resp.status_code == 200 and resp.json()["domains"] == []
+    resp = client.delete(f"/v1/instances/{name}/noauth/office.com", headers=auth_headers)
+    assert resp.status_code == 404
+    resp = client.delete(f"/v1/instances/{name}/noauth/bad%20host", headers=auth_headers)
+    assert resp.status_code == 422
+
+    client.post(f"/v1/instances/{name}/stop", headers=auth_headers)
+    resp = client.post(f"/v1/instances/{name}/noauth/reload", headers=auth_headers)
+    assert resp.status_code == 409
+
+
+def test_noauth_reload_refuses_an_image_that_ignores_the_list(
+    client: TestClient, auth_headers: dict[str, str], instance_data: dict[str, Any], docker: Any
+) -> None:
+    data = {**instance_data, "image": "ghcr.io/faircomp/linuxmuster-squid:old"}
+    name = _create(client, auth_headers, data)
+    client.post(f"/v1/instances/{name}/noauth", json={"domain": "office.com"}, headers=auth_headers)
+    resp = client.post(f"/v1/instances/{name}/noauth/reload", headers=auth_headers)
+    assert resp.status_code == 409
+    assert "does not read the noauth list" in resp.json()["detail"]
+    assert docker.reloaded == []  # no "reloaded" that changes nothing
+    # the blocklist reload is unaffected
+    resp = client.post(f"/v1/instances/{name}/blocklist/reload", headers=auth_headers)
+    assert resp.status_code == 200
+
+
+def test_rm_removes_the_noauth_list(
+    client: TestClient,
+    auth_headers: dict[str, str],
+    instance_data: dict[str, Any],
+    settings: Settings,
+) -> None:
+    name = _create(client, auth_headers, instance_data)
+    client.post(f"/v1/instances/{name}/noauth", json={"domain": "office.com"}, headers=auth_headers)
+    assert client.delete(f"/v1/instances/{name}", headers=auth_headers).status_code == 204
+    assert not (Path(settings.blocklists_dir) / name).exists()
+
+
+# --------------------------------------------------------------------- CLI
+
+
+@pytest.fixture
+def patch_client(monkeypatch: pytest.MonkeyPatch, app: Any, token: str) -> None:
+    def factory() -> TestClient:
+        tc = TestClient(app)
+        tc.headers.update({"Authorization": f"Bearer {token}"})
+        return tc
+
+    monkeypatch.setattr(cli, "_get_client", factory)
+
+
+def test_cli_noauth(patch_client: None, instance_data: dict[str, Any], docker: Any) -> None:
+    args = ["create", "--school", instance_data["school"], "--role", instance_data["role"]]
+    for key in ("ad_group", "realm", "visible_hostname", "keytab_secret"):
+        args += [f"--{key.replace('_', '-')}", instance_data[key]]
+    assert runner.invoke(cli.app, args).exit_code == 0
+
+    r = runner.invoke(cli.app, ["noauth", NAME, "add", "office.com"])
+    assert r.exit_code == 0 and '".office.com"' in r.output, r.output
+    r = runner.invoke(cli.app, ["noauth", NAME, "list"])
+    assert r.exit_code == 0 and '".office.com"' in r.output
+    r = runner.invoke(cli.app, ["noauth", NAME, "reload"])
+    assert r.exit_code == 0 and '"reloaded": true' in r.output
+    r = runner.invoke(cli.app, ["noauth", NAME, "remove", "office.com"])
+    assert r.exit_code == 0 and '".office.com"' not in r.output
+    assert runner.invoke(cli.app, ["noauth", NAME, "remove", "office.com"]).exit_code == 1
+    assert runner.invoke(cli.app, ["noauth", NAME, "add", "bad host"]).exit_code == 1
+
+
+def test_cli_noauth_help_warns() -> None:
+    r = runner.invoke(cli.app, ["noauth", "--help"])
+    assert r.exit_code == 0
+    text = " ".join(r.output.split())
+    for needle in ("exam mode", "Internetsperre", "school-subnets", "blocklist still wins"):
+        assert needle in text, needle
diff --git a/debian/changelog b/debian/changelog
index 0a095d3..c3c19f3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+linuxmuster-squid (7.3.8) lmn73; urgency=medium
+
+  * New per-instance list of domains reachable without proxy login, for
+    services that break behind proxy authentication (Microsoft 365):
+    "lmnsquid noauth <name> list|add <domain>|remove <domain>|reload"
+    (GET/POST/DELETE /v1/instances/{name}/noauth, POST .../noauth/reload),
+    stored in /etc/linuxmuster-squid/blocklists/<name>/noauth.domains next to
+    the blocklist. A listed domain and its subdomains are reachable without a
+    ticket from --school-subnets only; the blocklist still wins; HTTPS passes
+    only when the TLS SNI is on the list too (another SNI or none cuts the
+    handshake); IP addresses never match. Empty by default, so nothing
+    changes until you add a domain. Warning: exam accounts reach listed
+    domains during an exam, the Internetsperre does not apply to them, and
+    the access log shows no user for them. A recommended Microsoft 365 list
+    with its source is in docs/operations.md. The list needs a data-plane
+    image that knows it: until the instances run one, "noauth reload" answers
+    409 and the list has no effect. Existing instances are not restarted for
+    it.
+
+ -- Kevin Stenzel <mail@kevin-stenzel.de>  Fri, 30 Oct 2026 14:58:39 +0100
+
 linuxmuster-squid (7.3.7) lmn73; urgency=medium
 
   * Upgrades respect a service the admin switched off. Up to 7.3.6 every
diff --git a/deploy/e2e/client/Dockerfile b/deploy/e2e/client/Dockerfile
index 08e983f..cac3640 100644
--- a/deploy/e2e/client/Dockerfile
+++ b/deploy/e2e/client/Dockerfile
@@ -6,7 +6,7 @@
 FROM ubuntu:24.04
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
- && apt-get install -y --no-install-recommends krb5-user curl ca-certificates \
+ && apt-get install -y --no-install-recommends krb5-user curl ca-certificates openssl \
  && rm -rf /var/lib/apt/lists/*
 COPY krb5.conf /etc/krb5.conf
 COPY assert.sh /assert.sh
diff --git a/deploy/e2e/client/assert.sh b/deploy/e2e/client/assert.sh
index f4d427b..c26f5a0 100755
--- a/deploy/e2e/client/assert.sh
+++ b/deploy/e2e/client/assert.sh
@@ -64,6 +64,32 @@ check_via() {
   if [ "$code" = "$exp" ]; then echo "  [PASS] $desc ($code)"; else echo "  [FAIL] $desc: expected $exp, got $code"; fail=1; fi
 }
 
+# HTTPS through a proxy: "<CONNECT code> <code behind the tunnel>" must equal <expected>
+# (e.g. "200 200" = tunnel up and TLS done; "200 000" = tunnel up, TLS cut; "403 000").
+check_tunnel() {
+  local desc="$1" user="$2" proxy="$3" url="$4" exp="$5" got
+  kdestroy -q 2>/dev/null || true
+  if [ -n "$user" ]; then
+    printf '%s' "$PW" | kinit "$user@$REALM" >/dev/null 2>&1 || { echo "  [FAIL] $desc: kinit $user"; fail=1; return; }
+  fi
+  got=$(curl -sk -o /dev/null -w '%{http_connect} %{http_code}' --max-time 15 \
+             --proxy "$proxy" --proxy-negotiate -U : "$url" 2>/dev/null)
+  if [ "$got" = "$exp" ]; then echo "  [PASS] $desc ($got)"; else echo "  [FAIL] $desc: expected '$exp', got '$got'"; fail=1; fi
+}
+
+# A TLS handshake through the proxy WITHOUT a ticket, with a chosen SNI (or none: "-"):
+# <expected> = ok (server certificate received) or cut (no certificate: terminated).
+check_tls_sni() {
+  local desc="$1" proxy="$2" target="$3" sni="$4" exp="$5" got=cut
+  local args=(-proxy "$proxy" -connect "$target")
+  if [ "$sni" = "-" ]; then args+=(-noservername); else args+=(-servername "$sni"); fi
+  kdestroy -q 2>/dev/null || true
+  if timeout 20 openssl s_client "${args[@]}" </dev/null 2>/dev/null | grep -q 'BEGIN CERTIFICATE'; then
+    got=ok
+  fi
+  if [ "$got" = "$exp" ]; then echo "  [PASS] $desc ($got)"; else echo "  [FAIL] $desc: expected $exp, got $got"; fail=1; fi
+}
+
 echo "== Kerberos E2E assertions =="
 check "Teacher allowed"           teacher1 "$ALLOWED" 200
 check "Student denied"       student1 "$ALLOWED" 403
@@ -81,6 +107,44 @@ check_via "Internet-gate: teacher in 'internet' -> ok"          inetok "$PROXY3"
 check_via "Internet-gate OR: teacher in 'schule2-internet' -> ok" inetor "$PROXY3" "$ALLOWED" 200
 check_via "Internet-gate: teacher in NO internet group -> deny" inetno "$PROXY3" "$ALLOWED" 403
 
+# Domains without proxy auth (ADR-016). squid-noauth lists secure.example.internal and
+# both.example.internal (the latter also blocked); school_net = this client (172.28.0.30).
+NA="http://squid4.example.internal:3128"
+NA_HOST="squid4.example.internal:3128"
+echo "-- noauth (client $(hostname -I 2>/dev/null | tr -d ' '), school_net 172.28.0.30/32) --"
+check_via    "noauth: listed HTTP, no ticket -> 200"              "" "$NA" "http://secure.example.internal/" 200
+check_via    "noauth: listed subdomain, no ticket -> 200"         "" "$NA" "http://www.secure.example.internal/" 200
+check_via    "noauth: not listed, no ticket -> 407"               "" "$NA" "$ALLOWED" 407
+# squid-noauth knows 172.28.0.21 -> secure.example.internal (extra_hosts = its reverse
+# cache): without dstdomain -n this IP-literal URL would match the list (200, measured).
+check_via    "noauth: IP literal of a listed host -> 407"         "" "$NA" "http://172.28.0.21/" 407
+check_via    "noauth: listed AND blocked HTTP, no ticket -> 403"  "" "$NA" "http://both.example.internal/" 403
+check_tunnel "noauth: listed HTTPS, no ticket -> tunnel + TLS"   "" "$NA" "https://secure.example.internal/" "200 200"
+check_tunnel "noauth: not listed HTTPS, no ticket -> 407"         "" "$NA" "https://secure2.example.internal/" "407 000"
+# A denied CONNECT on an ssl-bump port: squid answers the CONNECT and delivers its 403 page
+# inside TLS with its throwaway certificate (browsers reject it: TLS error); curl -k shows it.
+check_tunnel "noauth: listed AND blocked HTTPS -> denied (403)"   "" "$NA" "https://both.example.internal/" "200 403"
+check_tls_sni "noauth: CONNECT listed, SNI listed -> handshake"      "$NA_HOST" secure.example.internal:443 secure.example.internal ok
+check_tls_sni "noauth: CONNECT listed, foreign SNI -> cut"           "$NA_HOST" secure.example.internal:443 origin.example.internal cut
+check_tls_sni "noauth: CONNECT listed, blocked SNI -> cut"           "$NA_HOST" secure.example.internal:443 blocked.example.com cut
+check_tls_sni "noauth: CONNECT listed, no SNI -> cut"                "$NA_HOST" secure.example.internal:443 - cut
+# With a ticket the instance behaves as before (the 200/403/407 matrix of install.md §6).
+check_via    "noauth instance: teacher -> 200"                    teacher1 "$NA" "$ALLOWED" 200
+check_via    "noauth instance: student -> 403"                    student1 "$NA" "$ALLOWED" 403
+check_via    "noauth instance: blocked (teacher) -> 403"          teacher1 "$NA" "http://blocked.example.com/" 403
+check_via    "noauth instance: listed+blocked (teacher) -> 403"   teacher1 "$NA" "http://both.example.internal/" 403
+check_via    "noauth instance: listed (teacher) -> 200"           teacher1 "$NA" "http://secure.example.internal/" 200
+check_tunnel "noauth instance: HTTPS not listed (teacher) -> 200" teacher1 "$NA" "https://secure2.example.internal/" "200 200"
+# An empty list (squid: the image's empty file) and a directory without the file (squid2,
+# as an older control plane mounts it) change nothing:
+check_via    "empty list: listed elsewhere, no ticket -> 407"     "" "$PROXY"  "http://secure.example.internal/" 407
+check_via    "no list file: no ticket -> 407"                     "" "$PROXY2" "http://secure.example.internal/" 407
+# The pinned image of installed systems with a directory that holds noauth.domains:
+PROXY5="http://squid5.example.internal:3128"
+check_via    "pinned image + noauth.domains: no ticket -> 407"    "" "$PROXY5" "http://secure.example.internal/" 407
+check_via    "pinned image + noauth.domains: teacher -> 200"      teacher1 "$PROXY5" "http://secure.example.internal/" 200
+check_via    "pinned image + noauth.domains: student -> 403"      student1 "$PROXY5" "$ALLOWED" 403
+
 echo
 if [ "$fail" -eq 0 ]; then echo "E2E: ALL ASSERTIONS OK"; else echo "E2E: FAILED"; fi
 exit "$fail"
diff --git a/deploy/e2e/docker-compose.yml b/deploy/e2e/docker-compose.yml
index 609f05d..0e6abec 100644
--- a/deploy/e2e/docker-compose.yml
+++ b/deploy/e2e/docker-compose.yml
@@ -3,7 +3,8 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 # Kerberos E2E stack for linuxmuster-squid (heavy tier / crabbox).
-# Proves: teacher->200, student->403, blocked domain->403, no ticket->407.
+# Proves: teacher->200, student->403, blocked domain->403, no ticket->407, and the
+# domains without proxy auth (ADR-016) incl. their negative cases.
 # Orchestrated by scripts/tests/e2e_kerberos.sh (brings services up in order,
 # creates fixtures and runs the assertions). Realm/domain: EXAMPLE.INTERNAL.
 name: lmnsquid-e2e
@@ -83,7 +84,8 @@ services:
         ipv4_address: 172.28.0.11
     volumes:
       - shared:/shared:ro
-      - ./blocked.domains:/etc/squid/lists/blocked.domains:ro
+      # The list directory of a control plane without ADR-016 (no noauth.domains).
+      - ./lists-legacy:/etc/squid/lists:ro
     read_only: true
     tmpfs: ["/run", "/tmp", "/var/log/squid", "/var/spool/squid"]
     cap_drop: ["ALL"]
@@ -119,6 +121,66 @@ services:
     cap_add: ["SETUID", "SETGID", "DAC_OVERRIDE", "CHOWN"]
     security_opt: ["no-new-privileges:true"]
 
+  # Domains without proxy auth (ADR-016): the list directory mounted like the control plane
+  # does it; school_net is the test client alone, so a request from any other container is
+  # "outside the school subnets".
+  squid-noauth:
+    image: linuxmuster-squid:dev
+    hostname: squid4.example.internal
+    depends_on: [samba-dc, squid]
+    environment:
+      INSTANCE: "e2e-noauth"
+      VISIBLE_HOSTNAME: "squid4.example.internal"
+      REALM: "EXAMPLE.INTERNAL"
+      AD_GROUP: "teachers"
+      SCHOOL_SUBNETS: "172.28.0.30/32"
+      KEYTAB: "/shared/squid.keytab"
+      CACHE_SIZE_MB: "200"
+    dns: ["172.28.0.2"]
+    # squid loads /etc/hosts into its reverse cache too: the IP-literal test needs the
+    # address to map back to a listed name (proves dstdomain -n).
+    extra_hosts: ["secure.example.internal:172.28.0.21"]
+    networks:
+      e2e:
+        ipv4_address: 172.28.0.13
+    volumes:
+      - shared:/shared:ro
+      - ./lists-noauth:/etc/squid/lists:ro
+    read_only: true
+    tmpfs: ["/run", "/tmp", "/var/log/squid", "/var/spool/squid"]
+    cap_drop: ["ALL"]
+    cap_add: ["SETUID", "SETGID", "DAC_OVERRIDE", "CHOWN"]
+    security_opt: ["no-new-privileges:true"]
+
+  # The image installed systems run (DEFAULT_IMAGE of the control plane, set by
+  # e2e_kerberos.sh) with a list directory that holds noauth.domains: an image that does not
+  # know the list must ignore it and keep asking for a ticket.
+  squid-pinned:
+    # (default only for the other smokes that start the DC from this file)
+    image: ${LMNSQUID_PINNED_IMAGE:-linuxmuster-squid:dev}
+    hostname: squid5.example.internal
+    depends_on: [samba-dc, squid]
+    environment:
+      INSTANCE: "e2e-pinned"
+      VISIBLE_HOSTNAME: "squid5.example.internal"
+      REALM: "EXAMPLE.INTERNAL"
+      AD_GROUP: "teachers"
+      SCHOOL_SUBNETS: "0.0.0.0/0"
+      KEYTAB: "/shared/squid.keytab"
+      CACHE_SIZE_MB: "200"
+    dns: ["172.28.0.2"]
+    networks:
+      e2e:
+        ipv4_address: 172.28.0.14
+    volumes:
+      - shared:/shared:ro
+      - ./lists-noauth:/etc/squid/lists:ro
+    read_only: true
+    tmpfs: ["/run", "/tmp", "/var/log/squid", "/var/spool/squid"]
+    cap_drop: ["ALL"]
+    cap_add: ["SETUID", "SETGID", "DAC_OVERRIDE", "CHOWN"]
+    security_opt: ["no-new-privileges:true"]
+
   # Allowed target (returns 200).
   origin:
     image: nginx:alpine
diff --git a/deploy/e2e/lists-legacy/blocked.domains b/deploy/e2e/lists-legacy/blocked.domains
new file mode 100644
index 0000000..1966405
--- /dev/null
+++ b/deploy/e2e/lists-legacy/blocked.domains
@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# A list directory as a control plane without ADR-016 mounts it: blocked.domains only,
+# no noauth.domains. The image must start and behave as before (no domain without auth).
+blocked.example.com
diff --git a/deploy/e2e/lists-noauth/blocked.domains b/deploy/e2e/lists-noauth/blocked.domains
new file mode 100644
index 0000000..f64da8c
--- /dev/null
+++ b/deploy/e2e/lists-noauth/blocked.domains
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Blocklist of the squid-noauth E2E instance (the directory is mounted at /etc/squid/lists,
+# as the control plane does). both.example.internal is on both lists: the blocklist wins.
+.blocked.example.com
+.both.example.internal
diff --git a/deploy/e2e/lists-noauth/noauth.domains b/deploy/e2e/lists-noauth/noauth.domains
new file mode 100644
index 0000000..f112f15
--- /dev/null
+++ b/deploy/e2e/lists-noauth/noauth.domains
@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Domains reachable without proxy auth for the squid-noauth E2E instance (ADR-016).
+.secure.example.internal
+.both.example.internal
diff --git a/docs/architecture.md b/docs/architecture.md
index e5f4b86..f911e96 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -74,6 +74,16 @@ Status document. Keep it up to date with every substantive change (see
   (the API endpoints below); `reload` = `squid -k reconfigure` inside the container
   (docker exec), no restart. Entries are `.example.org` = domain + subdomains. UT Capitole/Toulouse
   category lists via `blocklist-refresh.sh` (host cron) into the same file.
+- **Domains without proxy authentication per instance (ADR-016, optional):**
+  `<blocklists_dir>/<name>/noauth.domains` in the same mounted directory (no extra mount, the
+  container spec is unchanged), managed via `lmnsquid noauth <name> add|remove|list|reload`.
+  A listed domain is reachable from `school_net` without a ticket; the blocklist wins; a
+  CONNECT on this path must carry a listed SNI (no SNI → terminated); the list ACL is
+  `dstdomain -n` (no reverse DNS). Empty by default (= the old behaviour). The entrypoint uses
+  an empty stand-in when the mounted directory has no `noauth.domains` (older control plane);
+  `noauth reload` refuses (409) when the running container does not read the list (an image
+  from before ADR-016). Price: no identity for these requests (exam mode, Internetsperre;
+  threat model T16).
 - **Hardening:** `cache_effective_user proxy`; Keytab as a secret (tmpfs, readable by
   `proxy`); `KRB5CCNAME=FILE:` (the kernel-keyring ccache fails when unprivileged);
   `read_only` rootfs + tmpfs; `cap_drop: ALL` (+ minimal SETUID/SETGID/DAC_OVERRIDE);
@@ -84,9 +94,10 @@ Status document. Keep it up to date with every substantive change (see
 
 - **REST-API (FastAPI/uvicorn):** CRUD over instance definitions +
   lifecycle actions (`start/stop/restart/update/rollback/status/logs`) + the
-  per-instance blocklist (`GET/POST/DELETE …/blocklist`, `POST …/blocklist/reload`).
-  `DELETE /v1/instances/{name}` removes container, cache + log volumes and the
-  blocklist (`?keep_logs=true` keeps the log volume).
+  per-instance blocklist (`GET/POST/DELETE …/blocklist`, `POST …/blocklist/reload`) and
+  noauth list (`GET/POST/DELETE …/noauth`, `POST …/noauth/reload`).
+  `DELETE /v1/instances/{name}` removes container, cache + log volumes and both
+  lists (`?keep_logs=true` keeps the log volume).
   `HTTPBearer(auto_error=False)` + `hmac.compare_digest`; app-wide dependency;
   bind **127.0.0.1 only** (in-app TLS is NOT implemented; off-host only via
   an operator-owned TLS reverse proxy — on a non-loopback bind `main.py` warns, because the
@@ -119,5 +130,10 @@ Status document. Keep it up to date with every substantive change (see
 2. Squid `407 Proxy-Authenticate: Negotiate` → client sends a Kerberos ticket (SSO).
 3. `negotiate_kerberos_auth` checks against the Keytab → username (`%LOGIN`).
 4. `ext_kerberos_ldap_group_acl` checks group membership (ticket/LDAP, SRV).
-5. `http_access` (first-match-wins): `deny !authenticated` → `deny blocked` →
-   `allow authenticated role_group school_net` → `deny all`. Result 200 / 403 / 407.
+5. `http_access` (first-match-wins): the port/CONNECT/IP-literal denies →
+   `deny noauth+blocked` → `allow noauth school_net` (no ticket asked; empty list = never) →
+   `deny !authenticated` → `deny blocked` → `allow authenticated role_group school_net` →
+   `deny all`. Result 200 / 403 / 407.
+6. HTTPS (CONNECT, no decryption): `ssl_bump` peeks at the ClientHello (step 1) and at step 2
+   terminates a blocked SNI, and for a CONNECT to a noauth domain an SNI that is not on the
+   noauth list or a missing SNI; everything else is spliced.
diff --git a/docs/decisions.md b/docs/decisions.md
index 15d1688..2005735 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -205,6 +205,38 @@ rejects `--python-platform`, so the lock is compiled on linux/x86_64 (CI, Renova
 with `--python-version=3.12`; environment markers then evaluate as on the target.
 **Price:** dependency updates need a merged PR; the lock is regenerated, never hand-edited.
 
+### ADR-016 — Domains without proxy authentication, per instance, beside the blocklist
+**Status:** Proposed (2026-10-30, Kevin's request: Microsoft 365 through the proxy, without a
+login, no client-side bypass). **Decision:** each instance may list domains in
+`<blocklists_dir>/<name>/noauth.domains`, managed like the blocklist (`lmnsquid noauth <name>
+list|add|remove|reload`, entries `.example.org` = domain + subdomains). A request to a listed
+domain from `school_net` is allowed **without** proxy authentication; the rules, in order:
+the existing denies (Safe_ports, CONNECT only to 443, no IP literals on CONNECT) stay first;
+`deny noauth_domains blocked_domains` (the blocklist wins, 403); `allow noauth_domains
+school_net`; then the unchanged chain (`deny !authenticated`, …). The list ACL is `dstdomain
+-n`: no reverse DNS for IP-literal URLs, otherwise whoever controls a PTR record could put an
+address on the list (measured: without `-n`, `http://<ip>/` with a PTR to a listed name got
+200 without a ticket). A CONNECT that came through this way may not hand its tunnel to another
+name: at `SslBump2` it is terminated when the SNI is not on the list (`ssl::server_name
+--client-requested`) or when the ClientHello carries no SNI (`external_acl_type … %ssl::>sni`
+with a four-line helper, because `ssl::server_name` falls back to the CONNECT host without
+SNI). Still no decryption (peek, splice, terminate only; ADR-002). The empty list is the
+default and there is no built-in content; a recommended Microsoft 365 list lives in
+`docs/operations.md` with its source. The file sits in the directory already mounted at
+`/etc/squid/lists` (ADR-014), so the container spec does not change: an upgrade replaces no
+container for it.
+**Why:** Microsoft lists proxy authentication among the techniques that break Microsoft 365
+connections and asks to exempt its required endpoints; a client-side bypass (proxy exceptions
++ firewall rules) was not wanted, the traffic should still pass the proxy's domain filter.
+**Price (threat model T16):** a listed domain is reachable by everyone in the school subnets
+without identity: exam accounts reach it in exam mode, the Internetsperre does not apply to it,
+and the access log shows `-` instead of a user for it. **Rollout:** the template is in the
+data-plane image; until `DEFAULT_IMAGE` points at an image with this template, the list is
+ignored and `lmnsquid noauth <name> reload` answers 409 instead of reporting a reload that
+changes nothing (it checks the rendered `squid.conf` in the container). An image with the
+template next to a directory without `noauth.domains` (an older control plane) uses an empty
+list.
+
 ---
 
 ## Site facts to be verified (P0, enter with source/date)
diff --git a/docs/install.md b/docs/install.md
index cb335c9..ed64f77 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -156,12 +156,38 @@ HTTP to a blocked domain → **403**. HTTPS to a blocked domain is **cut at the
 connection/TLS error, not a block page. Details, the file path and UT-Capitole category
 lists: [`operations.md`](operations.md#blocklist-per-instance).
 
-## 8. Clients
+## 8. Domains without proxy authentication (optional)
+
+Some services break behind proxy authentication; Microsoft names it among the techniques that
+cause Microsoft 365 connection problems. Instead of a bypass on the clients, an instance can let
+listed domains through **without a ticket**, still through the proxy (domain filter, no
+decryption):
+
+```bash
+lmnsquid noauth all-students add sharepoint.com      # -> [".sharepoint.com"]: domain + subdomains
+lmnsquid noauth all-students list
+lmnsquid noauth all-students reload                  # squid re-reads the lists (no restart)
+```
+
+> **Warning:** a listed domain is open to **everyone in `--school-subnets`** without identity:
+> exam accounts reach it during an **exam** (OneDrive, Teams, Outlook …), the **Internetsperre**
+> does not apply to it, and the access log shows `-` instead of a user. Keep `--school-subnets`
+> tight (the default `0.0.0.0/0` means everyone who reaches the port) and the list short.
+
+The blocklist still wins (403 / TLS cut). HTTPS passes only when the TLS SNI is on the list
+as well; a different SNI or none cuts the handshake. Check from a client in `<subnet>` without
+a ticket: `kdestroy; req $P:3129 https://<listed-domain>/` gives 200,
+`req $P:3129 http://example.com/` still 407. The recommended Microsoft 365 list with its source
+and the details: [`operations.md`](operations.md#domains-without-proxy-authentication-per-instance).
+`reload` answers 409 while the instance still runs an image that does not know the list (the
+data-plane image must be updated first).
+
+## 9. Clients
 
 Assign the proxy per role by GPO (silent Kerberos SSO) and force the proxy at the firewall:
 [`deployment-gpo.md`](deployment-gpo.md). Clients must use the **FQDN**, never the IP.
 
-## 9. Updates
+## 10. Updates
 
 ```bash
 apt-get install -y ./linuxmuster-squid_<new>_amd64.deb # restarts the service, then update-all (*)
@@ -182,10 +208,10 @@ Verify with `docker inspect -f '{{range .Mounts}}{{.Destination}} {{end}}' lmnsq
 `journalctl -t linuxmuster-squid` and print a `WARNING:` in the apt output naming any instance
 that could not be brought up; the apt transaction itself never fails over them.
 
-## 10. Removing
+## 11. Removing
 
 ```bash
-lmnsquid rm all-students               # container, cache + log volumes, blocklist, definition
+lmnsquid rm all-students               # container, cache + log volumes, both lists, definition
 lmnsquid rm all-students --keep-logs   # same, but keeps the access-log volume lmnsquid-logs-all-students
 ```
 
diff --git a/docs/operations.md b/docs/operations.md
index 49a2cfb..0095d0f 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -38,7 +38,7 @@ lmnsquid list
 lmnsquid status default-school-teachers
 lmnsquid stop|start|restart default-school-teachers
 lmnsquid logs default-school-teachers --tail 100
-lmnsquid rm default-school-teachers               # + cache/log volumes, blocklist, .prev; --keep-logs keeps the log volume
+lmnsquid rm default-school-teachers               # + cache/log volumes, both lists, .prev; --keep-logs keeps the log volume
 ```
 The keytab must already be present as secret `<keytab-secret>` in `secrets_dir`
 (`/etc/linuxmuster-squid/secrets`) — see `keytab-and-dns.md`.
@@ -53,7 +53,8 @@ The keytab must already be present as secret `<keytab-secret>` in `secrets_dir`
   msg-internet`) so it covers **visitors** too and works with global `role-teacher`/`role-student`
   proxies — a user passes if in **any** listed group. Omit to enforce the role group only.
 - **`lmnsquid rm <name>`** removes the container, the cache volume, the **log volume**
-  (`lmnsquid-logs-<name>` = access-log history, personal data), the blocklist directory and
+  (`lmnsquid-logs-<name>` = access-log history, personal data), the list directory (blocklist
+  and noauth list) and
   the definition (+ its `.prev` rollback note). `--keep-logs` (API: `?keep_logs=true`) keeps
   the log volume, e.g. for a retention obligation; delete it later with
   `docker volume rm lmnsquid-logs-<name>`. The keytab in `secrets/` stays (operator-managed).
@@ -93,6 +94,90 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
 - **Upgraded from 7.3.0?** Containers created before 7.3.1 run without the mount until
   recreated once; the postinst runs `lmnsquid reconcile` for that (see Updates).
 
+## Domains without proxy authentication (per instance)
+
+Each instance can let a list of domains through **without proxy authentication** (ADR-016),
+`/etc/linuxmuster-squid/blocklists/<name>/noauth.domains` (created empty with the instance),
+seen by the container at `/etc/squid/lists/noauth.domains` — the same mounted directory as the
+blocklist. Empty = every request needs a ticket, as before.
+
+```
+lmnsquid noauth all-students add sharepoint.com      # -> [".sharepoint.com"]: the domain and all subdomains
+lmnsquid noauth all-students list
+lmnsquid noauth all-students remove sharepoint.com
+lmnsquid noauth all-students reload                  # squid re-reads both lists: no restart
+```
+
+> **⚠️ Warning — read before adding anything:**
+> - **Exam mode:** exam accounts (and every other device in the school subnets) reach a listed
+>   domain without a ticket during an exam, e.g. OneDrive, Teams and Outlook with the
+>   Microsoft 365 list below, although the proxy refuses them everything else.
+> - **Internetsperre:** does not apply to listed domains (without identity there is no group
+>   check); a user removed from the `internet` group still reaches them.
+> - **No user in the log:** these requests appear as `-` in the access log.
+> - **Only from `--school-subnets`:** from anywhere else a ticket is still required. With the
+>   default `0.0.0.0/0` that is everyone who can reach the proxy port, so set the real client
+>   subnets (`lmnsquid edit <name> --school-subnets …`) before using the list.
+
+- **Rules:** the blocklist wins (a domain on both lists gets **403**; HTTPS is cut). The
+  existing rules stay in front (Safe_ports, CONNECT only to 443, no IP literals on CONNECT); an
+  IP-literal URL never matches the list (`dstdomain -n`, no reverse DNS). HTTPS through the
+  list passes only when the TLS **SNI** is on the list too; a different SNI or a ClientHello
+  without SNI is **terminated** (no domain fronting into other names; no decryption, ADR-002).
+  With a ticket nothing changes (200 / 403 / 407 as before).
+- `add`/`remove` write the file (same format and rules as the blocklist, one `.domain` per
+  line, `#` comments allowed when hand-edited) and take effect on the next **`reload`**. API:
+  `GET/POST /v1/instances/{name}/noauth`, `DELETE …/noauth/{domain}`, `POST …/noauth/reload`.
+- **`reload` answers 409** when the running container does not read the list: its image
+  predates the list (update the instance to a data-plane image that has it, `lmnsquid update
+  <name>`), or it was started while its list directory had no `noauth.domains` (only possible
+  with an older control plane; `lmnsquid restart <name>`). Without that check a reload would
+  report success and change nothing. `blocklist reload` is not affected.
+- **What `lmnsquid rm` removes:** the directory with both lists.
+
+### Recommended list: Microsoft 365
+
+Microsoft asks to exempt the **required** Microsoft 365 endpoints from proxy authentication and
+inspection and does not support allowing only some of them ("Routing connections through
+network infrastructure applying its own authentication such as proxy authentication" is listed
+among the configurations "known to cause connectivity issues"; Microsoft 365 network
+connectivity principles, learn.microsoft.com, updated 2026-08-31). Source of the entries:
+the Microsoft 365 endpoints web service, `https://endpoints.office.com/endpoints/worldwide`
+(service areas Common, Exchange, SharePoint, Skype/Teams; version `2026103000`, fetched
+2026-10-30): every **required** item of category **Optimize** or **Allow** with TCP ports
+80/443 (ids 1, 9, 12, 31, 46, 56, 64). `*.x` and `x` are both one entry `x` here (the list
+always covers the domain and its subdomains, which is slightly wider than `*.x`); names under
+an entry already listed are left out (`ccs.` and `device.login.microsoftonline.com`,
+`api.passwordreset.microsoftonline.com`), squid only warns about them.
+
+```
+for d in outlook.cloud.microsoft outlook.office.com outlook.office365.com protection.outlook.com \
+         lync.com teams.cloud.microsoft teams.microsoft.com sharepoint.com \
+         officeapps.live.com online.office.com office.live.com \
+         auth.microsoft.com msftidentity.com account.activedirectory.windowsazure.com \
+         accounts.accesscontrol.windows.net adminwebservice.microsoftonline.com \
+         autologon.microsoftazuread-sso.com clientconfig.microsoftonline-p.net \
+         companymanager.microsoftonline.com graph.microsoft.com \
+         graph.windows.net login-us.microsoftonline.com login.microsoft.com \
+         login.microsoftonline-p.com login.microsoftonline.com login.windows.net \
+         logincert.microsoftonline.com loginex.microsoftonline.com nexus.microsoftonline-p.com \
+         passwordreset.microsoftonline.com protection.office.com security.microsoft.com \
+         compliance.microsoft.com defender.microsoft.com purview.microsoft.com; do
+  lmnsquid noauth all-students add "$d" >/dev/null
+done
+lmnsquid noauth all-students list && lmnsquid noauth all-students reload
+```
+
+- **Not on the list, on purpose:** items for mail protocols and SMTP (ids 2 and 10: TCP 25,
+  143, 587, 993, 995 — not HTTP proxy traffic) and Teams media (id 11: UDP 3478–3481, no URLs;
+  a forward proxy cannot carry UDP — allow it at the firewall if Teams calls are needed).
+  Endpoints of category **Default** keep going through the proxy with authentication.
+- **The list changes** (Microsoft recommends updating it automatically). Compare from time to
+  time with `curl -s 'https://endpoints.office.com/version/worldwide?clientrequestid=<uuid>'`
+  and the endpoints call above; for a client that still fails, look for `TCP_DENIED/407` lines
+  of Microsoft names in `lmnsquid logs <name>` before adding anything: every entry widens what
+  is reachable without identity.
+
 ## Updates (digest-pinned, health auto-rollback)
 
 ```
@@ -235,7 +320,7 @@ Access logs show **who visited/was blocked from which site** = personal data
 ## Backup
 
 - `/etc/linuxmuster-squid/config.yml` (API token!), `/etc/linuxmuster-squid/secrets/` (keytabs),
-  `/etc/linuxmuster-squid/blocklists/` (per-instance blocklists),
+  `/etc/linuxmuster-squid/blocklists/` (per-instance blocklists and noauth lists),
 - `instances_dir` (`/var/lib/linuxmuster-squid/instances/*.yaml` — git-versioned = change log;
   the postinst creates and configures the repo as its owner `lmnsquid`, with git's background
   maintenance off; every create/edit/update/rm is one commit:
diff --git a/docs/references.md b/docs/references.md
index 564a16a..0345e39 100644
--- a/docs/references.md
+++ b/docs/references.md
@@ -106,3 +106,28 @@ research workflows on **2026-07-02** (confidence in parentheses).
   — https://github.com/containrrr/watchtower · https://docs.renovatebot.com/docker/
 - `.deb` reproducible via dh-virtualenv (no pip-in-postinst). (high)
   — https://dh-virtualenv.readthedocs.io/en/latest/
+
+## Domains without proxy authentication (ADR-016, checked 2026-10-30)
+
+- `dstdomain`: "a reverse lookup is tried if a IP based URL is used and no match is found";
+  `-n` disables lookups (mismatch instead). `ssl::server_name`: no DNS lookups; without SNI the
+  CONNECT target is used instead; `--client-requested` = the SNI. `at_step SslBump2` = after the
+  ClientHello. Quoted `"file"` = one entry per line. (high)
+  — https://www.squid-cache.org/Doc/config/acl/
+- `external_acl_type`: FORMAT takes logformat codes, unavailable values expand to `-`, `%DATA`
+  (the ACL arguments) is `-` without any; replies `OK`/`ERR`/`BH`. `%ssl::>sni` = "SSL client
+  SNI sent to Squid". (high) — https://www.squid-cache.org/Doc/config/external_acl_type/ ·
+  https://www.squid-cache.org/Doc/config/logformat/
+- `ssl_bump` takes fast and slow ACLs; first match wins; actions peek/splice/terminate. (high)
+  — https://www.squid-cache.org/Doc/config/ssl_bump/
+- Measured with squid-openssl 6.14 (the image): the helper line is `<sni> <data>`, i.e. `- -`
+  without SNI; a missing ACL file is an `ERROR` plus an empty ACL, not fatal; without `-n` an
+  IP-literal URL whose address maps back to a listed name (squid's reverse cache) matched
+  `dstdomain`; a denied CONNECT on an ssl-bump port gets `200` and squid's 403 page inside TLS
+  with the throwaway certificate. (measured, E2E)
+- Microsoft 365: proxy authentication is among the configurations "known to cause
+  connectivity issues"; exempt the full set of required endpoints, selective allow-listing is
+  not supported. (high) —
+  https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-network-connectivity-principles
+  (updated 2026-08-31) · endpoints web service https://endpoints.office.com/endpoints/worldwide
+  (version 2026103000).
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index cf9938c..a419c16 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -89,7 +89,8 @@ the `/test` skill). **Core proof** (P1), assertions on `%{http_code}`:
 | No ticket | `kdestroy`; request | **407** |
 
 The 403-vs-407 split is the actual proof (authenticated-but-unauthorized
-vs. not-authenticated). The compose stack bind-mounts `deploy/e2e/blocked.domains`; the
+vs. not-authenticated). The compose stack bind-mounts `deploy/e2e/blocked.domains` (and the
+directories `deploy/e2e/lists-noauth/`, `deploy/e2e/lists-legacy/` for the noauth cases); the
 **product path** (`lmnsquid blocklist <name> add … && … reload` on a managed instance →
 403) is proven against a real domain in the lab (7.3.1 campaign fix) and is part of the
 acceptance list in `deployment-gpo.md`.
@@ -118,6 +119,24 @@ acceptance list in `deployment-gpo.md`.
   back to `lmnsquid`, history kept; a service the admin disabled (`systemctl disable
   --now`) before the upgrade from the release stays disabled and stopped across two upgrades
   in a row, with the "instances not updated" line in the apt output (CI upgrade-smoke).
+- **Domains without proxy auth (ADR-016)** (E2E, instance `squid-noauth` with the list
+  directory mounted like the control plane, `school_net` = the test client only): listed
+  domain and subdomain without ticket → 200, HTTPS → tunnel + TLS; unlisted → 407 (HTTP and
+  CONNECT); listed **and** blocked → 403 (HTTP; HTTPS: squid's 403 inside TLS); CONNECT to a
+  listed name with a foreign SNI, a blocked SNI or **no** SNI → TLS cut (openssl s_client);
+  IP-literal URL whose address maps back to a listed name → 407 (`dstdomain -n`); request from
+  outside `school_net` → 407 (HTTP and CONNECT, squidclient from another container); with a
+  ticket the 200/403/407 matrix is unchanged on that instance. Empty list (`squid`) and a list
+  directory without `noauth.domains` (`squid2`, as an older control plane mounts it) → 407 as
+  before, the latter logs a notice. The pinned image of installed systems (`squid-pinned`,
+  `DEFAULT_IMAGE` from `models.py`) next to a directory with `noauth.domains`: unchanged
+  (407 without ticket, 200/403 with). Counter-runs: without `-n` the IP-literal case and
+  without the SNI rule the foreign-SNI case fail. `cp-docker-it` (real DockerService): both
+  list files exist before the container starts, the new image reads the noauth list and
+  reloads, the pinned image is healthy with it and `noauth_active` is false. Unit: name
+  normalization (IDNA, leading dot, invalid names), unsafe instance names, API 401/403 without
+  or with a wrong token, 404/422, reload 409 when the container ignores the list or is stopped,
+  CLI and `--help` warnings.
 - **P10:** keytab perms; manager ACL not reachable externally; API bind ≠ 0.0.0.0;
   bypass/traversal; DC outage does not stall (ttl/grace).
 
diff --git a/docs/threat-model.md b/docs/threat-model.md
index 7ae519f..7484b93 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -32,10 +32,11 @@ Risks + countermeasures. Grows per roadmap phase; the negative tests for it live
 | T9 | **Unattended bad update → dead school** | digest pin, human-merge (no automerge; bumps by hand while Renovate is disabled), health-gated update + auto-rollback, known-good persisted | E2E: bad image → rollback |
 | T10 | **DC/LDAP outage stalls every request** | external ACL `ttl/negative_ttl/grace` + tune helper concurrency | load test P10 |
 | T11 | **Container escape/privilege** | `read_only` rootfs + tmpfs, `cap_drop: ALL` (minimal caps), non-root `proxy`, manager ACL localhost | hardening review P10 |
-| T12 | **Exam mode** | `<user>-exam` in no teachers/students group → ACL denies; lmn7 disables the proxy in exam mode | docs + optional test |
+| T12 | **Exam mode** | `<user>-exam` in no teachers/students group → ACL denies; lmn7 disables the proxy in exam mode. **Not** for domains on the noauth list (T16) | docs + optional test |
 | T13 | **Access logs = personal data** (browsing behavior, GDPR) | retention = `log_retention_days` (documented deletion period, default 30), gzip-rotated; access logging disableable per instance (`access_log_enabled:false`); log access only via API token, queries into the audit log; no secrets in the log; `lmnsquid rm` deletes the log volume with the instance (`--keep-logs` only on request) | retention/rotation smoke; `access_log none` render test; rm test |
 | T14 | **SNI filter bypass: ECH / QUIC / DoH** | **ECH** (Encrypted Client Hello) encrypts the SNI → splice filter blind; **QUIC/HTTP3** runs over **UDP 443**, bypassing the TCP forward proxy; **DoH** circumvents the DNS view. Limit of name-based filtering — the proxy alone does not close this. **Mitigate at the network edge:** OPNsense **block UDP 443** (forces TCP/443 through the proxy), block known DoH resolvers + `use-application-dns.net` (canary disables Firefox DoH); observe ECH adoption. For real completeness you would need SSL interception (a deliberate non-goal, ADR-002). | firewall review at the site; documented limit |
 | T15 | **Poisoned build input** (supply chain of the `.deb`, installed as root) — a compromised or silently changed PyPI release, build image or GitHub Action lands in the package | Python deps (pip included) only from `controlplane/requirements.lock` with SHA-256 hashes (`--require-hashes --no-deps --only-binary :all:`, wheels only), nothing younger than 7 days picked (`--exclude-newer=P7D`), own wheel built without build isolation from a hashed setuptools; build container, data-plane base image and actions pinned by digest/commit SHA; changes only via human-merged PRs (raised by hand while Renovate is disabled); releases published draft-first (immutable releases) with the asset hash checked against the build (ADR-015) | `lock-deps.sh --gate` first in the fast tier AND in every build, before anything from a lock is installed or run (no venv `bin/` on PATH; `/usr/bin/python3 -I`; every entry point restarts itself under `env -i` through `/bin/bash -p` with an allowlist, `packaging/clean-env.sh`: fixed PATH and `LC_ALL`, the caller's `HOME`, `TMPDIR`, proxies, CA bundles (`SSL_CERT_FILE`, `SSL_CERT_DIR`, `REQUESTS_CA_BUNDLE`, `PIP_CERT`) and the repository's own switches, nothing else; not undone, because it ran before the restart: the caller's first bash for `bash <script>` (`BASH_ENV`, `SHELLOPTS=noexec`), the make running `make deb` (`MAKEFILES`, `MAKEFLAGS`, `GNUMAKEFLAGS`), `LD_PRELOAD` of that first process): only lines uv writes, uv from a uv-only lock proven with the standard library and run by absolute path, every hash one PyPI publishes for exactly that `name==version`, pins exactly the closure of pyproject/`.in` within 7 days, a cp312 wheel for every pin; so a tag on a commit whose lock never passed CI still cannot be built; `--verify-freeze` fails the build unless each venv is exactly its lock (plus lmnsquid / ensurepip's pip), all `name==version`; not caught: a pin moved to another real release of a needed package, older or newer, at least 7 days old and within the declared requirements (review); a wrong hash or an sdist-only pin stops the build; `scripts/tests/lock_gates.sh` (fast tier, `--build` in CI) keeps the manipulations of the cold verification rejected, also from a shell with a poisoned venv; `make deb` packs only tracked files and runs nothing configured in the checkout's git (`scripts/tests/make_deb.sh`) |
+| T16 | **Domains without proxy authentication** (`noauth.domains`, ADR-016) widen access: everyone in the school subnets reaches a listed domain without a ticket. **Exam mode:** exam accounts (and anyone else) reach the listed domains during an exam, e.g. OneDrive, Teams, Outlook for Microsoft 365, although the proxy rejects them otherwise (T12). **Internetsperre:** does not apply to listed domains (no identity, so no group check). **Accountability:** the access log shows `-` instead of a user for these requests. Tunnel abuse: a listed CDN/front-door domain could carry other content (domain fronting) | empty by default, no built-in content; only from `school_net` (keep `--school-subnets` tight, the default `0.0.0.0/0` means "whoever reaches the port"); the blocklist wins (`deny noauth_domains blocked_domains` first, 403); the existing CONNECT rules stay before it (port 443 only, no IP literals); `dstdomain -n` (no reverse DNS for IP-literal URLs, a PTR cannot put an address on the list); a CONNECT on this path is terminated unless its SNI is listed too, and terminated without SNI; no decryption (ADR-002), so fronting via the encrypted Host header inside a listed name's TLS stays possible (as for any splice). Warnings in `operations.md`, `install.md` and `lmnsquid noauth --help` | E2E: listed → 200 / tunnel without ticket; unlisted → 407; listed+blocked → 403; foreign SNI, blocked SNI and no SNI → TLS cut; IP literal with a PTR to a listed name → 407; outside `school_net` → 407; with a ticket the 200/403/407 matrix unchanged; counter-runs without `-n` resp. without the SNI rule fail |
 
 ## Non-goals (deliberate)
 
diff --git a/image/Dockerfile b/image/Dockerfile
index ff3231e..e832430 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -29,7 +29,8 @@ RUN apt-get update \
  && rm -rf /var/lib/apt/lists/* \
  && mkdir -p /etc/squid/lists /etc/squid/templates /var/log/squid /var/spool/squid \
  && chown -R proxy:proxy /var/log/squid /var/spool/squid \
- && : > /etc/squid/lists/blocked.domains
+ && : > /etc/squid/lists/blocked.domains \
+ && : > /etc/squid/lists/noauth.domains
 
 # Fail the build early if a helper we rely on is missing (all verified present in
 # the noble squid-openssl / squidclient packages). NOTE: ntlm_auth (if ever needed
@@ -47,7 +48,8 @@ RUN set -eu; for b in \
 COPY templates/squid.conf.template /etc/squid/templates/squid.conf.template
 COPY entrypoint.sh   /usr/local/bin/entrypoint.sh
 COPY healthcheck.sh  /usr/local/bin/healthcheck.sh
-RUN chmod 0755 /usr/local/bin/entrypoint.sh /usr/local/bin/healthcheck.sh
+COPY sni-sent.sh     /usr/local/bin/sni-sent.sh
+RUN chmod 0755 /usr/local/bin/entrypoint.sh /usr/local/bin/healthcheck.sh /usr/local/bin/sni-sent.sh
 
 EXPOSE 3128
 HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
diff --git a/image/entrypoint.sh b/image/entrypoint.sh
index 8ba1b7e..065aef7 100644
--- a/image/entrypoint.sh
+++ b/image/entrypoint.sh
@@ -77,9 +77,19 @@ export KRB5CCNAME="FILE:${RUN}/krb5cc_${INSTANCE}"
 export KRB5RCACHEDIR="${RUN}"
 export KRB5_CONFIG="${RUN}/krb5.conf"
 export LDAPCONF="${RUN}/ldap.conf"
+# Domains reachable without proxy auth (ADR-016): a control plane that knows the list puts
+# noauth.domains into the mounted list directory before the container starts. A directory
+# from an older control plane has none: then an empty file under /run stands in (feature
+# off, no squid ERROR about a missing file).
+NOAUTH_LIST=/etc/squid/lists/noauth.domains
+if [ ! -f "${NOAUTH_LIST}" ]; then
+    NOAUTH_LIST="${RUN}/noauth.domains"
+    : > "${NOAUTH_LIST}"
+    echo "linuxmuster-squid: no /etc/squid/lists/noauth.domains, domains without proxy auth: none" >&2
+fi
 # envsubst substitutes only EXPORTED variables (otherwise "http_port " => FATAL).
 export INSTANCE HTTP_PORT CACHE_SIZE_MB KEYTAB REALM AD_GROUP VISIBLE_HOSTNAME SCHOOL_SUBNETS
-export ACCESS_LOG_DIRECTIVE INTERNET_ACL_DEF INTERNET_ACL_REF
+export ACCESS_LOG_DIRECTIVE INTERNET_ACL_DEF INTERNET_ACL_REF NOAUTH_LIST
 
 # krb5.conf: rdns/canonicalize=false so that the ldap/ SPN is built from the literal DC name
 # (via SRV) and NOT via reverse DNS (-> SASL "Local error").
@@ -113,7 +123,7 @@ TEMPLATE=/etc/squid/templates/squid.conf.template
 CONF="${RUN}/squid.conf"
 
 # Only substitute OUR variables so Squid's own %-tokens survive untouched.
-envsubst '${INSTANCE} ${HTTP_PORT} ${CACHE_SIZE_MB} ${KEYTAB} ${REALM} ${AD_GROUP} ${VISIBLE_HOSTNAME} ${SCHOOL_SUBNETS} ${ACCESS_LOG_DIRECTIVE} ${INTERNET_ACL_DEF} ${INTERNET_ACL_REF}' \
+envsubst '${INSTANCE} ${HTTP_PORT} ${CACHE_SIZE_MB} ${KEYTAB} ${REALM} ${AD_GROUP} ${VISIBLE_HOSTNAME} ${SCHOOL_SUBNETS} ${ACCESS_LOG_DIRECTIVE} ${INTERNET_ACL_DEF} ${INTERNET_ACL_REF} ${NOAUTH_LIST}' \
     < "${TEMPLATE}" > "${CONF}"
 
 # The blocklist file is normally mounted read-only; create an empty one only if absent.
diff --git a/image/sni-sent.sh b/image/sni-sent.sh
new file mode 100755
index 0000000..8587070
--- /dev/null
+++ b/image/sni-sent.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Squid external ACL helper (external_acl_type sni_sent ... %ssl::>sni): answers OK when the
+# client sent a TLS SNI, ERR when it sent none. Used only for CONNECTs that came through
+# without proxy auth (ADR-016), so that a tunnel without SNI is cut instead of being trusted
+# on its CONNECT host alone. Squid sends one line per lookup: the SNI, '-' when there is none,
+# followed by the ACL arguments (%DATA, again '-' without any), e.g. "- -" or
+# "outlook.office.com -" (measured with squid 6.14); only the first field counts.
+while read -r sni _data; do
+    case "${sni}" in
+        '' | '-') echo ERR ;;
+        *) echo OK ;;
+    esac
+done
diff --git a/image/templates/squid.conf.template b/image/templates/squid.conf.template
index b4ab77b..6bb8076 100644
--- a/image/templates/squid.conf.template
+++ b/image/templates/squid.conf.template
@@ -52,14 +52,30 @@ acl school_net src ${SCHOOL_SUBNETS}
 # so no SSL bump / no client CA needed.
 acl blocked_domains dstdomain "/etc/squid/lists/blocked.domains"
 
+# --- Domains reachable WITHOUT proxy authentication (ADR-016; empty list = feature off) ---
+# For clients in school_net only, and never for a blocked domain (both enforced in the
+# access chain). -n: no reverse DNS for IP-literal URLs -- a PTR record is controlled by
+# whoever owns the address and must never put an IP on this list.
+acl noauth_domains dstdomain -n "${NOAUTH_LIST}"
+
 # --- HTTPS: SNI peek + splice (NO decryption) ---
 # step1 reads the TLS ClientHello (SNI); blocked SNIs are disconnected (terminate),
 # everything else is tunneled (splice, no MITM). Also catches cases where the
 # CONNECT host differs from the real SNI (domain fronting).
 acl step1 at_step SslBump1
 acl blocked_sni ssl::server_name "/etc/squid/lists/blocked.domains"
+# A CONNECT to a listed domain got through without a ticket (every such CONNECT that reaches
+# this point came through the noauth line of the access chain), so its tunnel must not be
+# handed to another name: the SNI must be listed too, and a ClientHello WITHOUT SNI is cut as
+# well (ssl::server_name falls back to the CONNECT host when there is no SNI, so the helper
+# looks at the SNI itself; %ssl::>sni is '-' without one).
+acl noauth_sni ssl::server_name --client-requested "${NOAUTH_LIST}"
+external_acl_type sni_sent ttl=3600 negative_ttl=3600 children-max=2 %ssl::>sni /usr/local/bin/sni-sent.sh
+acl tls_sni_sent external sni_sent
 ssl_bump peek step1
 ssl_bump terminate blocked_sni
+ssl_bump terminate noauth_domains !noauth_sni
+ssl_bump terminate noauth_domains !tls_sni_sent
 ssl_bump splice all
 
 # --- Safe ports & methods ---
@@ -79,6 +95,8 @@ http_access deny CONNECT connect_ip_literal
 http_access deny CONNECT connect_ip6_literal
 http_access allow localhost manager        # cache manager from localhost (manual debug; healthcheck uses a 407 probe)
 http_access deny manager
+http_access deny noauth_domains blocked_domains   # listed AND blocked: the blocklist wins -> 403
+http_access allow noauth_domains school_net       # listed + school subnet -> no proxy auth (ADR-016)
 http_access deny !authenticated            # no ticket -> 407 (Negotiate challenge)
 http_access deny blocked_domains           # blocked domain -> 403 (also for teachers)
 http_access allow authenticated role_group ${INTERNET_ACL_REF} school_net   # in role (+internet) group + subnet -> 200
diff --git a/scripts/tests/e2e_kerberos.sh b/scripts/tests/e2e_kerberos.sh
index 15f43fa..08081f9 100755
--- a/scripts/tests/e2e_kerberos.sh
+++ b/scripts/tests/e2e_kerberos.sh
@@ -23,6 +23,14 @@ dcx(){ $DC exec -T samba-dc "$@"; }        # exec in the DC, no TTY
 cleanup(){ $DC down -v --remove-orphans >/dev/null 2>&1 || true; }
 trap cleanup EXIT
 
+# The image installed systems run: DEFAULT_IMAGE of the control plane (squid-pinned service).
+LMNSQUID_PINNED_IMAGE="$(sed -n 's/^ *"\(ghcr\.io\/[^"]*\)"$/\1/p; s/^ *"\(@sha256:[0-9a-f]*\)"$/\1/p' \
+  "$ROOT/controlplane/lmnsquid/models.py" | tr -d '\n')"
+case "$LMNSQUID_PINNED_IMAGE" in
+  ghcr.io/*@sha256:*) export LMNSQUID_PINNED_IMAGE ;;
+  *) echo "cannot read DEFAULT_IMAGE from models.py (got '$LMNSQUID_PINNED_IMAGE')"; exit 1 ;;
+esac
+
 log "reset"
 $DC down -v --remove-orphans >/dev/null 2>&1 || true
 
@@ -75,8 +83,17 @@ dcx samba-tool group addmembers schule2-internet inetor          >/dev/null 2>&1
 dcx samba-tool spn   add "HTTP/squid3.$DLC" squidsvc             >/dev/null 2>&1 || true
 dcx samba-tool dns add 127.0.0.1 "$DLC" squid3 A 172.28.0.12    -U "Administrator%$PW" >/dev/null 2>&1 || true
 
-log "start origin + origin-https + squid + squid2 + squid-inet"
-$DC up -d origin origin-https squid squid2 squid-inet || exit 1
+# Domains without proxy auth (ADR-016): squid4 = squid-noauth, squid5 = the pinned image;
+# more names on the HTTPS origin (a listed subdomain, an unlisted name).
+dcx samba-tool spn   add "HTTP/squid4.$DLC" squidsvc             >/dev/null 2>&1 || true
+dcx samba-tool spn   add "HTTP/squid5.$DLC" squidsvc             >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" squid4 A 172.28.0.13    -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" squid5 A 172.28.0.14    -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" www.secure A 172.28.0.21 -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" secure2 A 172.28.0.21   -U "Administrator%$PW" >/dev/null 2>&1 || true
+
+log "start origin + origin-https + squid + squid2 + squid-inet + squid-noauth + squid-pinned"
+$DC up -d origin origin-https squid squid2 squid-inet squid-noauth squid-pinned || exit 1
 
 wait_healthy() {
   local svc="$1" ready=0 st=none cid
@@ -92,6 +109,8 @@ log "wait for squid + squid2 + squid-inet healthy"
 wait_healthy squid     || exit 1
 wait_healthy squid2    || exit 1
 wait_healthy squid-inet || exit 1
+wait_healthy squid-noauth || exit 1
+wait_healthy squid-pinned || exit 1
 
 log "run assertions (test-client)"
 $DC run --rm test-client
@@ -111,6 +130,29 @@ else
   echo "  [FAIL] internetsperre: expected 403, got '$tcode'"; rc=$((rc + 1))
 fi
 
+# Outside school_net (squid-noauth admits 172.28.0.30/32 only): from the squid container
+# (172.28.0.10) a listed domain without a ticket must still get 407, plain HTTP and CONNECT.
+log "noauth: request from outside school_net, no ticket -> 407"
+for req in "http://secure.example.internal/" "-m CONNECT secure.example.internal:443"; do
+  # shellcheck disable=SC2086  # $req carries squidclient's options on purpose
+  line=$($DC exec -T squid squidclient -T 10 -h 172.28.0.13 -p 3128 $req 2>/dev/null | head -1 | tr -d '\r')
+  case "$line" in
+    *" 407 "*) echo "  [PASS] outside school_net: $req -> $line" ;;
+    *) echo "  [FAIL] outside school_net: $req: expected 407, got '$line'"; rc=$((rc + 1)) ;;
+  esac
+done
+# squid2 got a list directory without noauth.domains (older control plane): the entrypoint
+# says so and stands in an empty list.
+# (grep without -q: an early exit would SIGPIPE `compose logs`, a failure under pipefail)
+if $DC logs squid2 2>/dev/null | grep 'no /etc/squid/lists/noauth.domains' >/dev/null; then
+  echo "  [PASS] list directory without noauth.domains: empty list, notice logged"
+else
+  echo "  [FAIL] squid2: notice about the missing noauth.domains not logged"; rc=$((rc + 1))
+fi
+
+log "squid-noauth access.log (excerpt)"
+$DC exec -T squid-noauth sh -c 'tail -25 /var/log/squid/access.log' 2>/dev/null || true
+
 log "squid access.log (excerpt)"
 $DC exec -T squid sh -c 'tail -20 /var/log/squid/access.log' 2>/dev/null \
   || $DC logs squid 2>/dev/null | tail -20 || true

From 1eac730d7cc7012e7e3df8bcb5b165743fac53bf Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 15:12:24 +0100
Subject: [PATCH 03/24] fix(provision-keytab): stop when host/ of another
 account aliases the proxy SPN

Seen in a real installation: the proxy host was in devices.csv with a role
that gets a computer account, so sophomorix created PROXY$ with
host/proxy.<domain>. host/ is an alias of HTTP/ (sPNMappings host=...,http),
`samba-tool spn add HTTP/proxy.<domain> svc-squid` only logged
check_spn_alias_collision and added the SPN anyway, and the script, which
only looked for exactly HTTP/<fqdn> on another account and only before
adding it, exported a keytab. The second run took the idempotent branch and
did not check at all.

Now, on every run and before anything is changed or exported, it looks for
HTTP/<fqdn>, host/<fqdn> and host/<short-name> on any account other than the
service account (sAMAccountName compared case-insensitively, without the
trailing $) and stops with FATAL, exit 1, naming the account and, for a
computer account, the devices.csv role iponly. The check is fail-closed:
without ldbsearch (ldb-tools, a dependency of linuxmuster-base7 and
sophomorix4) or read access to sam.ldb nothing is exported. The FQDN must be
a host name (it goes into the LDAP filter).

provision_keytab_smoke.sh (E2E DC, Samba 4.15): a computer account with the
SPNs sophomorix sets (HOST/<name>, HOST/<name>.<domain>, RestrictedKrbHost/...)
-> abort, no keytab, SPN not added; the same with HTTP/ already on the
service account (samba-tool spn add accepted the colliding SPN there too)
-> abort; account removed -> keytab exported; sPNMappings host= contains
http; filter characters and a short name are refused. A-C unchanged.

docs/keytab-and-dns.md: the alias pitfall and what the script checks.
---
 debian/changelog                        | 11 +++++
 docs/keytab-and-dns.md                  | 13 ++++++
 scripts/provision-keytab.sh             | 61 ++++++++++++++++++++-----
 scripts/tests/provision_keytab_smoke.sh | 55 +++++++++++++++++++++-
 4 files changed, 128 insertions(+), 12 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index c3c19f3..75911fb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -16,6 +16,17 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     image that knows it: until the instances run one, "noauth reload" answers
     409 and the list has no effect. Existing instances are not restarted for
     it.
+  * provision-keytab.sh refuses a proxy name that a computer account already
+    answers for. Samba treats host/ as an alias of HTTP/, so a computer
+    account PROXY$ (the proxy host in devices.csv with a role that gets an
+    account) holds HTTP/<proxy-fqdn> too; samba-tool only logged the
+    collision and the script exported a keytab that could not work. On every
+    run, also when the SPN is already on the service account, it now looks
+    for HTTP/<fqdn>, host/<fqdn> and host/<short-name> on other accounts and
+    stops with FATAL and a hint (devices.csv role iponly) before it changes or
+    exports anything. It also stops when it cannot check (no ldbsearch or no
+    read access to sam.ldb) and refuses an argument that is not a fully
+    qualified host name.
 
  -- Kevin Stenzel <mail@kevin-stenzel.de>  Fri, 30 Oct 2026 14:58:39 +0100
 
diff --git a/docs/keytab-and-dns.md b/docs/keytab-and-dns.md
index 4d72cdf..26f4cc5 100644
--- a/docs/keytab-and-dns.md
+++ b/docs/keytab-and-dns.md
@@ -70,6 +70,19 @@ file; the control plane does **not** provision it itself (least privilege).
   NTLM fallback). `provision-keytab.sh` checks this beforehand (`ldbsearch`) and is idempotent;
   to check manually: `setspn -X` (Windows) or
   `ldbsearch -H .../sam.ldb '(servicePrincipalName=HTTP/<fqdn>)' sAMAccountName` (Samba).
+- **No computer account with the proxy's name** — `host/` is an alias of `HTTP/` (the
+  `sPNMappings` attribute on `CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,…`
+  lists `http` under `host=`, in AD and in Samba). A computer account `PROXY$` holds
+  `host/proxy` and `host/proxy.<domain>` and with them, for the KDC, `HTTP/proxy.<domain>`.
+  `samba-tool spn add HTTP/proxy.<domain> svc-squid` then only logs
+  `check_spn_alias_collision: … when 'host/proxy.<domain>' is on 'CN=PROXY,…'` and adds the SPN
+  anyway (seen in a real installation, 2026-10-30). Typical cause: the proxy host in
+  `devices.csv` with a role that gets a computer account; use the role **`iponly`** (DNS
+  records, no account; [`install.md`](install.md) step 1). `provision-keytab.sh` looks for
+  `HTTP/<fqdn>`, `host/<fqdn>` and `host/<short-name>` on any other account on every run (also
+  when the SPN is already on the service account) and stops with `FATAL`, exit ≠ 0, before it
+  changes or exports anything. Without `ldbsearch` (package `ldb-tools`, a dependency of
+  linuxmuster-base7) or read access to `sam.ldb` it stops as well.
 
 ## DNS & time requirements (hard)
 
diff --git a/scripts/provision-keytab.sh b/scripts/provision-keytab.sh
index b76edc8..bf59f3f 100755
--- a/scripts/provision-keytab.sh
+++ b/scripts/provision-keytab.sh
@@ -17,24 +17,63 @@ FQDN="${1:?Usage: provision-keytab.sh <proxy-fqdn> <service-account> <out.keytab
 ACCOUNT="${2:?service account (kinit-capable, existing)}"
 OUT="${3:?output keytab path}"
 
+# The FQDN goes into an LDAP filter and an SPN: a host name and nothing else.
+if ! printf '%s' "${FQDN}" | grep -Eqx '[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+'; then
+    echo "FATAL: '${FQDN}' is not a fully qualified host name." >&2
+    exit 1
+fi
 SPN="HTTP/${FQDN}"
+SHORT="${FQDN%%.*}"
 SAM_LDB="${SAM_LDB:-/var/lib/samba/private/sam.ldb}"
 
+# Conflicts, checked on every run (also when the SPN is already on the account) and before
+# anything is changed or exported: the KDC must find HTTP/<fqdn> on exactly one account.
+# - HTTP/<fqdn> on another account: duplicate SPN (KRB_AP_ERR_MODIFIED).
+# - host/<fqdn> or host/<short> on another account: Samba (like AD) treats host/ as an alias
+#   of HTTP/ via sPNMappings, so that account answers for HTTP/<fqdn> too. `samba-tool spn
+#   add` only logs check_spn_alias_collision and adds the SPN anyway. Typical cause: the
+#   proxy host listed in devices.csv with a role that gets a computer account.
+# ldbsearch (ldb-tools) is a dependency of linuxmuster-base7 and sophomorix4: without it, or
+# without read access to sam.ldb, the check cannot run and nothing is exported.
+if ! command -v ldbsearch >/dev/null 2>&1 || [ ! -r "${SAM_LDB}" ]; then
+    echo "FATAL: cannot check for conflicting SPNs: ldbsearch missing or ${SAM_LDB} not readable" >&2
+    echo "       (run this on the DC as root; ldbsearch is in the ldb-tools package)." >&2
+    exit 1
+fi
+account_lc=$(printf '%s' "${ACCOUNT%\$}" | tr '[:upper:]' '[:lower:]')
+conflict=0
+echo "== check ${SPN}, host/${FQDN}, host/${SHORT} on other accounts =="
+for spn in "${SPN}" "host/${FQDN}" "host/${SHORT}"; do
+    owners=$(ldbsearch -H "${SAM_LDB}" "(servicePrincipalName=${spn})" sAMAccountName \
+        2>/dev/null | awk '/^sAMAccountName:/ {print $2}')
+    for owner in ${owners}; do
+        owner_lc=$(printf '%s' "${owner%\$}" | tr '[:upper:]' '[:lower:]')
+        [ "${owner_lc}" = "${account_lc}" ] && continue
+        conflict=1
+        if [ "${spn}" = "${SPN}" ]; then
+            echo "FATAL: ${SPN} already exists on account '${owner}' (duplicate SPN)." >&2
+            echo "       Remove it there first: samba-tool spn delete ${SPN} ${owner}" >&2
+        else
+            echo "FATAL: ${spn} is on account '${owner}'; host/ is an alias of HTTP/, so that" >&2
+            echo "       account would get the tickets for ${SPN}." >&2
+            case "${owner}" in
+                *\$) echo "       '${owner}' is a computer account: if it comes from devices.csv, set the" >&2
+                     echo "       role (9th column) of '${SHORT}' to iponly and run linuxmuster-import-devices" >&2
+                     echo "       (no computer account, A/PTR stay); otherwise remove the account." >&2 ;;
+                *)   echo "       Remove it there first: samba-tool spn delete ${spn} ${owner}" >&2 ;;
+            esac
+        fi
+    done
+done
+if [ "${conflict}" -ne 0 ]; then
+    echo "       Nothing was changed and no keytab was exported." >&2
+    exit 1
+fi
+
 echo "== check/append SPN ${SPN} to ${ACCOUNT} =="
 if samba-tool spn list "${ACCOUNT}" 2>/dev/null | grep -Fq "${SPN}"; then
     echo "   ${SPN} is already on ${ACCOUNT} — skipping (idempotent)."
 else
-    # Detect duplicate SPN early: if the SPN is already on a DIFFERENT account, Kerberos
-    # breaks later with KRB_AP_ERR_MODIFIED (the KDC cannot disambiguate).
-    if command -v ldbsearch >/dev/null 2>&1 && [ -r "${SAM_LDB}" ]; then
-        OWNER=$(ldbsearch -H "${SAM_LDB}" "(servicePrincipalName=${SPN})" sAMAccountName \
-            2>/dev/null | awk '/^sAMAccountName:/ {print $2}')
-        if [ -n "${OWNER:-}" ]; then
-            echo "FATAL: ${SPN} already exists on account '${OWNER}' (duplicate SPN)." >&2
-            echo "       Remove it there first: samba-tool spn delete ${SPN} ${OWNER}" >&2
-            exit 1
-        fi
-    fi
     samba-tool spn add "${SPN}" "${ACCOUNT}"
 fi
 
diff --git a/scripts/tests/provision_keytab_smoke.sh b/scripts/tests/provision_keytab_smoke.sh
index 5b5fe6c..5c9722f 100755
--- a/scripts/tests/provision_keytab_smoke.sh
+++ b/scripts/tests/provision_keytab_smoke.sh
@@ -3,7 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Smoke against the E2E Samba DC: provision-keytab.sh is idempotent and aborts cleanly on
-# a duplicate SPN (same SPN on a different account). Needs Docker.
+# a duplicate SPN (same SPN on a different account) and on a computer account named like the
+# proxy (its host/ SPNs are aliases of HTTP/), also when HTTP/ is already on the service
+# account. Needs Docker.
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -46,5 +48,56 @@ if dcx bash /tmp/pk.sh "$FQDN" ktsvc1 /tmp/kt1b.keytab; then pass "second run id
 echo "== C: same SPN on ktsvc2 -> duplicate SPN abort =="
 if dcx bash /tmp/pk.sh "$FQDN" ktsvc2 /tmp/kt2.keytab; then bad "duplicate SPN NOT aborted"; else pass "duplicate SPN aborts (exit != 0)"; fi
 
+echo "== D: computer account named like the proxy (host/ alias of HTTP/) -> abort =="
+# What sophomorix creates for a devices.csv entry whose role gets an account
+# (SophomorixSambaAD.pm AD_computer_create: HOST/<name>, HOST/<name>.<dnsdomain>, ...).
+dcx samba-tool computer create kproxy >/dev/null 2>&1 || true
+for spn in HOST/kproxy HOST/kproxy.example.internal RestrictedKrbHost/kproxy RestrictedKrbHost/kproxy.example.internal; do
+  dcx samba-tool spn add "$spn" 'kproxy$' >/dev/null 2>&1 || true
+done
+dcx samba-tool user create ktsvc3 "$PW" >/dev/null 2>&1 || true
+# The alias the check relies on: host= in sPNMappings lists http (LDIF lines unfolded).
+if dcx sh -c 'ldbsearch -H /var/lib/samba/private/sam.ldb -s base -b "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=example,DC=internal" sPNMappings' 2>/dev/null \
+     | awk '/^ /{printf "%s", substr($0,2); next} {printf "\n%s", $0}' | grep -i '^sPNMappings: host=' | tr ',=' '\n\n' | grep -x http >/dev/null; then
+  pass "sPNMappings: host= includes http"
+else
+  bad "sPNMappings: http not under host="
+fi
+echo "   SPNs of kproxy\$: $(dcx samba-tool spn list 'kproxy$' 2>/dev/null | grep -i '/kproxy' | tr -d ' \t' | tr '\n' ' ')"
+if dcx bash /tmp/pk.sh kproxy.example.internal ktsvc3 /tmp/kt3.keytab; then
+  bad "host/ conflict NOT aborted"
+else
+  pass "host/ conflict aborts (exit != 0)"
+fi
+if dcx test -e /tmp/kt3.keytab; then bad "keytab exported despite the conflict"; else pass "no keytab exported"; fi
+if dcx samba-tool spn list ktsvc3 2>/dev/null | grep -qi 'HTTP/kproxy'; then bad "SPN added despite the conflict"; else pass "SPN not added"; fi
+
+echo "== E: same conflict, HTTP/ already on the account (idempotent branch) -> abort =="
+dcx samba-tool spn add HTTP/kproxy.example.internal ktsvc3 >/dev/null 2>&1 || true
+if dcx samba-tool spn list ktsvc3 2>/dev/null | grep -qi 'HTTP/kproxy.example.internal'; then
+  pass "fixture: samba-tool spn add put HTTP/ on ktsvc3 despite the alias collision"
+else
+  echo "   (samba-tool refused the colliding SPN here; the branch is still run)"
+fi
+if dcx bash /tmp/pk.sh kproxy.example.internal ktsvc3 /tmp/kt3b.keytab; then
+  bad "idempotent branch: host/ conflict NOT aborted"
+else
+  pass "idempotent branch: host/ conflict aborts"
+fi
+if dcx test -e /tmp/kt3b.keytab; then bad "idempotent branch: keytab exported"; else pass "idempotent branch: no keytab exported"; fi
+
+echo "== F: the computer account is gone (devices.csv role iponly) -> runs =="
+dcx samba-tool computer delete kproxy >/dev/null 2>&1 || true
+dcx samba-tool spn add HTTP/kproxy.example.internal ktsvc3 >/dev/null 2>&1 || true
+if dcx bash /tmp/pk.sh kproxy.example.internal ktsvc3 /tmp/kt3c.keytab && dcx test -s /tmp/kt3c.keytab; then
+  pass "without the computer account: keytab exported"
+else
+  bad "without the computer account: failed"
+fi
+
+echo "== G: not a host name -> abort before any LDAP query =="
+if dcx bash /tmp/pk.sh 'x)(servicePrincipalName=*' ktsvc1 /tmp/kt4.keytab; then bad "filter injection accepted"; else pass "invalid FQDN refused"; fi
+if dcx bash /tmp/pk.sh proxy ktsvc1 /tmp/kt4.keytab; then bad "short name accepted"; else pass "short name refused (FQDN required)"; fi
+
 echo "== provision-keytab smoke: $fail errors =="
 exit "$fail"

From 887b501dde5be21e5146e6f8f8a393f98fec0c17 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 15:12:33 +0100
Subject: [PATCH 04/24] docs(install): add the proxy to devices.csv with the
 role iponly

install.md step 1 recommended a static devices.csv entry for the proxy's
A/PTR records without naming a role. With the default role
(classroom-studentcomputer), server or any other role whose
COMPUTER_ACCOUNT is TRUE, sophomorix creates a computer account PROXY$ with
host/proxy and host/proxy.<domain>; host/ is an alias of HTTP/, so that
account answers for HTTP/proxy.<domain> and Kerberos SSO breaks (seen in a
real installation on 2026-10-30, where role iponly and
linuxmuster-import-devices fixed it: `samba-tool computer show PROXY` then
reports "Unable to find computer").

Evidence that iponly keeps the DNS records (from the sophomorix4 source,
upstream/sophomorix4 at eb0bbcc8):
- sophomorix.ini [computerrole.iponly] COMPUTER_ACCOUNT = FALSE;
- sophomorix-device puts every device with a fixed IP into dnsNode/dnsZone
  (A + reverse zone/PTR) regardless of the role and creates a computer
  account only when the role's COMPUTER_ACCOUNT is TRUE;
- sophomorix-test-2 asserts for switch01 (role switch, also
  COMPUTER_ACCOUNT = FALSE, comment "test for sophomorixRole iponly that
  there is no account") that no computer account exists while the A record
  and the reverse dnsNode do.
Not yet confirmed on the real system (`host <proxy-fqdn>` after the import).

install.md step 1 now asks for the role iponly, explains the conflict and
how to check it; keytab-and-dns.md names iponly under the DNS requirements.
---
 docs/install.md        | 14 ++++++++++++--
 docs/keytab-and-dns.md |  4 +++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/docs/install.md b/docs/install.md
index ed64f77..71ba7e9 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -25,8 +25,18 @@ groups are prefixed, e.g. `<school>-internet`). All commands as root.
 - `apt-get install -y docker.io krb5-user curl` (`krb5-user` only for the checks below).
 - **DNS:** the proxy FQDN needs an A record (and PTR). The linuxmuster DHCP does *not*
   register dynamic leases in the Samba DNS: add the proxy host as a static device in
-  `devices.csv` (import creates A/PTR), or on the DC
-  `samba-tool dns add <dc-ip> <domain> proxy A <proxy-ip> -U <domain-admin>`.
+  `devices.csv` with the **role `iponly`** (9th column) and run `linuxmuster-import-devices`,
+  or on the DC `samba-tool dns add <dc-ip> <domain> proxy A <proxy-ip> -U <domain-admin>`.
+  **Not with another role:** the default (`classroom-studentcomputer`), `server` and the other
+  roles with a computer account give the proxy a computer account `PROXY$` with
+  `host/<proxy-fqdn>`, and Samba treats `host/` as an alias of `HTTP/` (`sPNMappings`): that
+  account then holds the proxy's `HTTP/` name too, Kerberos SSO breaks, and
+  `provision-keytab.sh` (step 3) stops with a `FATAL`. sophomorix creates the A/PTR records for
+  every device with a fixed IP, a computer account only for roles with `COMPUTER_ACCOUNT =
+  TRUE` (`iponly`: `FALSE`; `sophomorix.ini`, `sophomorix-device`). Check on the DC:
+  `samba-tool computer show proxy` → `Unable to find computer "proxy$"`, and
+  `host <proxy-fqdn>` → the proxy's address. A proxy that already got an account: set the role
+  to `iponly`, import again (sophomorix removes the account), then run step 3.
 - **Time:** NTP in sync with the DC (`timedatectl`; Kerberos tolerates < 5 min).
 - **`/etc/hosts` on the proxy host:** the proxy FQDN must resolve to the host's LAN IP *on the
   host itself*. cloud-init writes `127.0.1.1 <proxy-fqdn>`; with that, requests from the host
diff --git a/docs/keytab-and-dns.md b/docs/keytab-and-dns.md
index 26f4cc5..2da94cd 100644
--- a/docs/keytab-and-dns.md
+++ b/docs/keytab-and-dns.md
@@ -86,7 +86,9 @@ file; the control plane does **not** provision it itself (least privilege).
 
 ## DNS & time requirements (hard)
 
-- **A record** for every proxy FQDN (`visible_hostname`).
+- **A record** for every proxy FQDN (`visible_hostname`). From `devices.csv`: role
+  **`iponly`** (A/PTR without a computer account), never a role with a computer account (see
+  "No computer account with the proxy's name" above).
 - **Forward + reverse DNS** OR `rdns = false` — the image already generates
   `/etc/krb5.conf` with `rdns=false` + `/etc/ldap/ldap.conf` `SASL_NOCANON on`, so that
   the `ldap/` SPN is formed from the literal DC name (not via PTR).

From ddc3c73c8ff389361bc6a808f56b4a0e560f6b75 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 15:14:26 +0100
Subject: [PATCH 05/24] fix(discover-ad-facts): read the realm on the DC, fill
 in the proxy FQDN

The script put whatever REALM the admin passed into the printed create
commands; a short name (REALM=BS-WIZ for BS-WIZ.LLAN) went through
unchecked. It now reads the realm from the DC's own smb.conf with
`testparm -s --parameter-name=realm` ("the kerberos realm to use",
smb.conf(5)), the realm the DC's KDC serves and available without
arguments (samba-tool domain info needs the DC's IP). A given REALM is only
compared: a mismatch prints a WARNING and the DC's realm is used. Without a
readable realm the given REALM is used with a warning, or <REALM> is
printed.

The commands carry --visible-hostname proxy.<domain> (the realm in lower
case) instead of the placeholder proxy.<fqdn>; PROXY_FQDN overrides it, and
the header reminds that the name needs an A record and no computer
account. A third template (B) creates one proxy for everybody in
`internet`, as set up at a single-school site, and says who is in that
group per sophomorix.ini (teachers, students, parents, staff, extra
students/course members, school admins) and that other schools' users are
not.

discover_ad_facts_smoke.sh: realm and FQDN filled, no placeholder,
template B, no REALM -> DC realm without warning, a wrong REALM -> warning
and the DC realm, PROXY_FQDN honoured. install.md step 4 and the README
drop REALM= from the call.
---
 README.md                                |  5 ++-
 debian/changelog                         |  8 ++++
 docs/install.md                          | 16 ++++---
 scripts/discover-ad-facts.sh             | 55 +++++++++++++++++++++---
 scripts/tests/discover_ad_facts_smoke.sh | 21 ++++++++-
 5 files changed, 89 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index a6c816c..2499cf3 100644
--- a/README.md
+++ b/README.md
@@ -78,8 +78,9 @@ sudo lmnsquid create --school all --role students --ad-group role-student \
   --realm EXAMPLE.ORG --visible-hostname proxy.example.org \
   --keytab-secret proxy.keytab --http-port 3129 --school-subnets 10.0.0.0/8
 ```
-> `REALM=EXAMPLE.ORG bash /usr/share/linuxmuster-squid/scripts/discover-ad-facts.sh` (on the DC)
-> prints the global role groups, the internet groups per school and the two `create` commands.
+> `bash /usr/share/linuxmuster-squid/scripts/discover-ad-facts.sh` (on the DC) reads the realm
+> there and prints the global role groups, the internet groups per school and the `create`
+> commands.
 > `--image` defaults to the maintained, digest-pinned image.
 
 **3. Everyday commands:**
diff --git a/debian/changelog b/debian/changelog
index 75911fb..b8c1190 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -27,6 +27,14 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     exports anything. It also stops when it cannot check (no ldbsearch or no
     read access to sam.ldb) and refuses an argument that is not a fully
     qualified host name.
+  * discover-ad-facts.sh reads the realm on the DC (smb.conf realm, via
+    testparm) instead of trusting REALM: a REALM given in the environment is
+    only compared, and a mismatch prints a WARNING (a short REALM such as
+    BS-WIZ for BS-WIZ.LLAN used to end up in the printed commands). The
+    commands now carry proxy.<domain> instead of the placeholder
+    proxy.<fqdn> (PROXY_FQDN overrides it), and a third template creates one
+    proxy for everybody in the group internet, which per sophomorix.ini also
+    holds parents, staff and the school admins.
 
  -- Kevin Stenzel <mail@kevin-stenzel.de>  Fri, 30 Oct 2026 14:58:39 +0100
 
diff --git a/docs/install.md b/docs/install.md
index 71ba7e9..d11aad5 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -97,13 +97,19 @@ and `lmnsquid restart <name>` ([`keytab-and-dns.md`](keytab-and-dns.md)).
 ## 4. Which groups? (on the DC)
 
 ```bash
-REALM=<REALM> bash /usr/share/linuxmuster-squid/scripts/discover-ad-facts.sh
+bash /usr/share/linuxmuster-squid/scripts/discover-ad-facts.sh
 ```
 
-prints the **global role groups** `role-teacher` / `role-student` / `role-staff` (each spans
-every school of the domain) for `--ad-group`, the **internet groups** (`internet` for the
-default school, `<school>-internet` for the others) for `--internet-group`, and two ready-made
-`create` commands. Use the global role groups: a visitor from another school is then accepted at
+reads the realm on the DC (`realm` in its `smb.conf`, the Kerberos realm; a `REALM=…` given in
+the environment is only compared with it and a mismatch is reported as `WARNING`), and prints
+the **global role groups** `role-teacher` / `role-student` / `role-staff` (each spans every
+school of the domain) for `--ad-group`, the **internet groups** (`internet` for the default
+school, `<school>-internet` for the others) for `--internet-group`, and ready-made `create`
+commands with `--realm <REALM> --visible-hostname proxy.<domain>` filled in
+(`PROXY_FQDN=<name>` for another host name): template A, a teacher and a student proxy, and
+template B, one proxy for everybody in `internet` (no teacher/student separation; per
+`sophomorix.ini` the group holds teachers, students, parents, staff, extra students/course
+members and the school admins of the default school). Use the global role groups: a visitor from another school is then accepted at
 the local proxy while teacher/student separation still holds. Do **not** use the per-school
 `teachers`/`students` groups unless schools must filter differently, and never a class group
 (`5a-students` looks like a role group but is not).
diff --git a/scripts/discover-ad-facts.sh b/scripts/discover-ad-facts.sh
index fe4c7a6..a4c2282 100755
--- a/scripts/discover-ad-facts.sh
+++ b/scripts/discover-ad-facts.sh
@@ -8,14 +8,38 @@
 # and prints ready-to-use `lmnsquid create` commands for a teacher and a student proxy,
 # so that the most common mistake (wrong/mistyped group -> silent 403) is eliminated.
 #
-# Run ON THE SAMBA-DC (samba-tool group list, read-only, NO domain join).
-# Optionally specify the realm: REALM=LINUXMUSTER.MEINESCHULE.DE ./discover-ad-facts.sh
+# Run ON THE SAMBA-DC (samba-tool group list, testparm; read-only, NO domain join).
+# The realm is read from the DC's own smb.conf (`realm`, the Kerberos realm its KDC serves);
+# a REALM given in the environment is only compared with it:
+#   REALM=LINUXMUSTER.MEINESCHULE.DE ./discover-ad-facts.sh
+# PROXY_FQDN overrides the proxy host name in the commands (default proxy.<dns-domain>).
 set -uo pipefail
-REALM="${REALM:-<enter-REALM>}"
 
 command -v samba-tool >/dev/null 2>&1 \
     || { echo "samba-tool not found — run this script on the Samba-DC." >&2; exit 2; }
 
+GIVEN_REALM="${REALM:-}"
+DC_REALM="$(testparm -s --parameter-name=realm 2>/dev/null | tr '[:lower:]' '[:upper:]' | tr -d '[:space:]')"
+if [ -n "$DC_REALM" ]; then
+    REALM="$DC_REALM"
+    if [ -n "$GIVEN_REALM" ] && [ "$GIVEN_REALM" != "$DC_REALM" ]; then
+        echo "WARNING: REALM='$GIVEN_REALM' differs from the realm of this DC ('$DC_REALM');" >&2
+        echo "         the commands below use '$DC_REALM' (smb.conf realm, the Kerberos realm)." >&2
+    fi
+elif [ -n "$GIVEN_REALM" ]; then
+    REALM="$GIVEN_REALM"
+    echo "WARNING: could not read the realm of this DC (testparm); using REALM='$REALM' unchecked." >&2
+else
+    REALM="<REALM>"
+    echo "WARNING: could not read the realm of this DC (testparm) and no REALM given;" >&2
+    echo "         replace <REALM> below (the AD DNS domain in UPPERCASE)." >&2
+fi
+if [ "$REALM" = "<REALM>" ]; then
+    PROXY_FQDN="${PROXY_FQDN:-<proxy-fqdn>}"
+else
+    PROXY_FQDN="${PROXY_FQDN:-proxy.$(printf '%s' "$REALM" | tr '[:upper:]' '[:lower:]')}"
+fi
+
 GROUPS_ALL="$(samba-tool group list 2>/dev/null | sort -u)"
 has_group() { grep -qxF -- "$1" <<< "$GROUPS_ALL"; }
 
@@ -51,16 +75,33 @@ internet_groups | sed 's/^/  - /'
 INET_ARGS="$(internet_groups | sed 's/^/--internet-group /' | tr '\n' ' ')"
 
 echo
-echo "== Template: one teacher proxy (:3128) + one student proxy (:3129) for the whole domain =="
-echo "   (adjust FQDN/keytab/subnet; --image defaults to the maintained pinned digest)"
+echo "== Realm: ${REALM}   proxy FQDN: ${PROXY_FQDN} =="
+echo "   (the FQDN needs an A record and must not be a computer account: devices.csv role iponly;"
+echo "    PROXY_FQDN=<name> overrides it; --image defaults to the maintained pinned digest)"
+
+echo
+echo "== Template A: one teacher proxy (:3128) + one student proxy (:3129) for the whole domain =="
 if has_group role-teacher; then
     echo "lmnsquid create --school all --role teachers --ad-group role-teacher \\"
-    echo "  --realm ${REALM} --visible-hostname proxy.<fqdn> \\"
+    echo "  --realm ${REALM} --visible-hostname ${PROXY_FQDN} \\"
     echo "  --keytab-secret proxy.keytab --http-port 3128 --school-subnets <subnet>"
 fi
 if has_group role-student; then
     echo "lmnsquid create --school all --role students --ad-group role-student \\"
     [ -n "$INET_ARGS" ] && echo "  ${INET_ARGS}\\"
-    echo "  --realm ${REALM} --visible-hostname proxy.<fqdn> \\"
+    echo "  --realm ${REALM} --visible-hostname ${PROXY_FQDN} \\"
     echo "  --keytab-secret proxy.keytab --http-port 3129 --school-subnets <subnet>"
 fi
+
+# One instance for everybody with internet access (as set up at a single-school site).
+if has_group internet; then
+    echo
+    echo "== Template B (instead of A): one proxy (:3128) for everybody in 'internet' =="
+    echo "   'internet' holds every account of the default school with internet access: per"
+    echo "   sophomorix.ini teachers, students, parents, staff, extra students/course members and"
+    echo "   the school admins. No teacher/student separation; other schools' users are not in it."
+    echo "lmnsquid create --school all --role users --ad-group internet \\"
+    echo "  ${INET_ARGS}\\"
+    echo "  --realm ${REALM} --visible-hostname ${PROXY_FQDN} \\"
+    echo "  --keytab-secret proxy.keytab --http-port 3128 --school-subnets <subnet>"
+fi
diff --git a/scripts/tests/discover_ad_facts_smoke.sh b/scripts/tests/discover_ad_facts_smoke.sh
index 785d17a..bdcf616 100755
--- a/scripts/tests/discover_ad_facts_smoke.sh
+++ b/scripts/tests/discover_ad_facts_smoke.sh
@@ -3,8 +3,8 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Smoke against the E2E Samba DC: discover-ad-facts.sh lists the global role groups and
-# the internet groups (and nothing that merely ends in -students) and generates the two
-# create commands. Requires Docker.
+# the internet groups (and nothing that merely ends in -students), reads the realm on the DC
+# (a wrong REALM only warns) and generates the create commands. Requires Docker.
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -48,5 +48,22 @@ grep -q 'create --school all --role teachers --ad-group role-teacher' /tmp/disc_
 grep -q 'create --school all --role students --ad-group role-student' /tmp/disc_out.txt && pass "create template students" || bad "create students"
 grep -q -- '--internet-group internet --internet-group schule2-internet' /tmp/disc_out.txt && pass "internet groups in template" || bad "internet groups missing"
 
+grep -q -- '--realm EXAMPLE.INTERNAL --visible-hostname proxy.example.internal' /tmp/disc_out.txt && pass "realm + proxy FQDN filled" || bad "realm/FQDN not filled"
+grep -q 'proxy\.<fqdn>' /tmp/disc_out.txt && bad "proxy.<fqdn> placeholder still printed" || pass "no proxy.<fqdn> placeholder"
+grep -q 'create --school all --role users --ad-group internet' /tmp/disc_out.txt && pass "template B (one instance for all)" || bad "template B missing"
+grep -q 'parents, staff' /tmp/disc_out.txt && pass "template B names who is in 'internet'" || bad "template B: membership note missing"
+
+echo "== the realm comes from the DC: without REALM, and with a wrong REALM (warning) =="
+dcx bash /tmp/disc.sh > /tmp/disc_norealm.txt 2>/tmp/disc_norealm.err
+grep -q -- '--realm EXAMPLE.INTERNAL ' /tmp/disc_norealm.txt && pass "no REALM: realm read on the DC" || bad "no REALM: realm not read"
+grep -q WARNING /tmp/disc_norealm.err && bad "no REALM: unexpected warning" || pass "no REALM: no warning"
+dcx env REALM=EXAMPLE bash /tmp/disc.sh > /tmp/disc_wrong.txt 2>/tmp/disc_wrong.err
+grep -q "WARNING: REALM='EXAMPLE' differs" /tmp/disc_wrong.err && pass "wrong REALM: warning" || bad "wrong REALM: no warning"
+grep -q -- '--realm EXAMPLE ' /tmp/disc_wrong.txt && bad "wrong REALM used in the commands" || pass "wrong REALM not used"
+grep -q -- '--realm EXAMPLE.INTERNAL ' /tmp/disc_wrong.txt && pass "wrong REALM: DC realm used" || bad "wrong REALM: DC realm not used"
+dcx env PROXY_FQDN=squid.example.internal bash /tmp/disc.sh > /tmp/disc_fqdn.txt 2>/dev/null
+grep -q -- '--visible-hostname squid.example.internal' /tmp/disc_fqdn.txt \
+  && pass "PROXY_FQDN overrides the host name" || bad "PROXY_FQDN ignored"
+
 echo "== discover-ad-facts smoke: $fail errors =="
 exit "$fail"

From 5a516c881b78616f7d5964c519324e0fa44f7f3f Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 16:09:20 +0100
Subject: [PATCH 06/24] fix(lists): never let a covered entry stop squid, in
 either list

Cold verification: squid 6.14 refuses a dstdomain / ssl::server_name list in
which a name covered by a listed parent domain comes first
(".a.example.org" before ".example.org", or "example.org" next to it):
"ERROR: '.a.example.org' is a subdomain of '.example.org'" and "FATAL:
Bungled". `squid -k reconfigure` then fails (reload 500, the running squid
keeps the old config) and the next start of the container fails. The other
order only warns; exact and case duplicates are accepted (measured for both
ACL types, with and without -n). `Blocklist.add` wrote sorted() output, so
"add graph.microsoft.com; add microsoft.com" produced exactly that; so did
blocklist-refresh.sh (`sed 's/^/./' | sort -u`) for any category list
holding a name and its subdomain. The blocklist had the bug before ADR-016.

At the root, for both lists:
- control plane: `uncovered()` drops every entry another dotted entry
  covers (compared lower-cased, without trailing dots) on every write;
  `add` of a name below a listed domain changes nothing, `add` of a parent
  removes the names below it, `remove` writes the cleaned list.
- blocklist-refresh.sh: the same rule (awk) before the atomic replace.
- data-plane image: squid reads /run/lmnsquid/lists/{blocked,noauth}.domains,
  built by the new lists-sync.sh from the mounted /etc/squid/lists at every
  start (entrypoint) and before every reload, with the same rule, so a
  hand-edited file cannot stop the proxy; ignored entries are named in the
  container log. A missing file is an empty list (this replaces the
  entrypoint's noauth stand-in; a noauth.domains created later is read by
  the next reload).
- reload: `sh -c` with a fixed script: lists-sync.sh where the image has it,
  then `squid -k reconfigure`; the old image keeps reading the mounted files.
  `noauth_active` now looks for the noauth ACL itself in squid.conf.

Tests: unit (`uncovered` cases, add/remove keep squid-loadable lists, reload
command and its error), blocklist smoke (refresh drops a covered subdomain),
E2E (squid-noauth mounts hand-edited lists with covered entries in both
lists: starts, logs them, reloads, comes back after a restart, blocked
subdomain 403; squid-pinned, the image without lists-sync.sh, gets its own
clean directory), cp-docker-it (such lists written after the start: reload
ok, restart, healthy). Counter-check: the same integration test with an
image whose lists-sync.sh only copies fails with "FATAL: Bungled".

Docs: operations (add semantics, hand edits, the M365 note now says why the
three covered names are left out instead of "squid only warns"),
architecture, ADR-014 amendment, threat model T8, test strategy;
debian/changelog bullet in 7.3.8.
---
 controlplane/lmnsquid/blocklist.py            | 50 ++++++++++++--
 controlplane/lmnsquid/docker_service.py       | 29 +++++----
 controlplane/tests/test_blocklist.py          | 37 ++++++++++-
 controlplane/tests/test_docker_integration.py | 19 ++++++
 controlplane/tests/test_docker_service.py     | 25 +++++--
 debian/changelog                              | 10 +++
 deploy/e2e/client/assert.sh                   |  1 +
 deploy/e2e/docker-compose.yml                 |  2 +-
 deploy/e2e/lists-noauth/blocked.domains       |  3 +
 deploy/e2e/lists-noauth/noauth.domains        |  4 ++
 deploy/e2e/lists-pinned/blocked.domains       |  7 ++
 deploy/e2e/lists-pinned/noauth.domains        |  6 ++
 docs/architecture.md                          | 10 ++-
 docs/decisions.md                             | 10 ++-
 docs/operations.md                            | 26 ++++++--
 docs/test-strategy.md                         |  8 +++
 docs/threat-model.md                          |  2 +-
 image/Dockerfile                              |  4 +-
 image/entrypoint.sh                           | 20 ++----
 image/lists-sync.sh                           | 65 +++++++++++++++++++
 image/templates/squid.conf.template           | 12 ++--
 scripts/blocklist-refresh.sh                  | 22 ++++++-
 scripts/tests/blocklist_smoke.sh              |  8 ++-
 scripts/tests/e2e_kerberos.sh                 | 28 ++++++++
 24 files changed, 349 insertions(+), 59 deletions(-)
 create mode 100644 deploy/e2e/lists-pinned/blocked.domains
 create mode 100644 deploy/e2e/lists-pinned/noauth.domains
 create mode 100755 image/lists-sync.sh

diff --git a/controlplane/lmnsquid/blocklist.py b/controlplane/lmnsquid/blocklist.py
index 9a80f6d..4681ad6 100644
--- a/controlplane/lmnsquid/blocklist.py
+++ b/controlplane/lmnsquid/blocklist.py
@@ -18,6 +18,7 @@
 import re
 import shutil
 import tempfile
+from collections.abc import Callable, Iterable
 from pathlib import Path
 
 FILE_NAME = "blocked.domains"
@@ -50,6 +51,34 @@ def normalize_domain(value: str) -> str:
     return f".{name}"
 
 
+def uncovered(entries: Iterable[str]) -> list[str]:
+    """Return ``entries`` without the ones another entry already covers, sorted.
+
+    squid 6 refuses to load a ``dstdomain``/``ssl::server_name`` list (``FATAL: Bungled``)
+    when a name covered by a listed parent domain comes first (``.a.example.org`` before
+    ``.example.org``, or ``example.org`` next to ``.example.org``), so a list is never
+    written that way. ``.example.org`` covers itself, ``example.org`` and every
+    ``*.example.org``; entries are compared lower-cased without trailing dots. The image's
+    ``lists-sync.sh`` applies the same rule to whatever the mounted file holds.
+    """
+    unique: list[str] = []
+    for raw in entries:
+        entry = raw.strip().lower().rstrip(".")
+        if entry and entry != "." and entry not in unique:
+            unique.append(entry)
+    dotted = {e for e in unique if e.startswith(".")}
+    kept: list[str] = []
+    for entry in unique:
+        rest = entry[1:] if entry.startswith(".") else entry
+        covered = not entry.startswith(".") and f".{entry}" in dotted
+        while not covered and "." in rest:
+            rest = rest.split(".", 1)[1]
+            covered = f".{rest}" in dotted
+        if not covered:
+            kept.append(entry)
+    return sorted(kept)
+
+
 class Blocklist:
     """Read and modify one list file (``blocked.domains`` by default) under ``root``.
 
@@ -57,9 +86,15 @@ class Blocklist:
     in the same directories.
     """
 
-    def __init__(self, root: str, file_name: str = FILE_NAME) -> None:
+    def __init__(
+        self,
+        root: str,
+        file_name: str = FILE_NAME,
+        normalize: Callable[[str], str] = normalize_domain,
+    ) -> None:
         self.root = Path(root)
         self.file_name = file_name
+        self.normalize = normalize
 
     def dir_for(self, name: str) -> Path:
         """Host directory mounted into the instance ``name`` (rejects anything but a name)."""
@@ -96,21 +131,26 @@ def read(self, name: str) -> list[str]:
         return entries
 
     def add(self, name: str, domain: str) -> list[str]:
-        """Add ``domain`` (idempotent); return the new list."""
-        entry = normalize_domain(domain)
+        """Add ``domain`` (idempotent); return the new list.
+
+        A name below a listed domain changes nothing (the parent already covers it); a
+        parent replaces the names below it (:func:`uncovered`).
+        """
+        entry = self.normalize(domain)
         self.ensure(name)
-        entries = sorted(set(self.read(name)) | {entry})
+        entries = uncovered([*self.read(name), entry])
         self._write(self.file_for(name), entries)
         return entries
 
     def remove(self, name: str, domain: str) -> list[str]:
         """Remove ``domain`` (with or without the leading dot); ``KeyError`` if absent."""
         entry = normalize_domain(domain)
-        current = self.read(name)
+        current = [e.lower().rstrip(".") for e in self.read(name)]
         # A hand-edited file may carry the bare form; both mean the same target.
         remaining = [e for e in current if e not in (entry, entry[1:])]
         if len(remaining) == len(current):
             raise KeyError(entry)
+        remaining = uncovered(remaining)
         self._write(self.file_for(name), remaining)
         return remaining
 
diff --git a/controlplane/lmnsquid/docker_service.py b/controlplane/lmnsquid/docker_service.py
index d43d63c..ad54d4e 100644
--- a/controlplane/lmnsquid/docker_service.py
+++ b/controlplane/lmnsquid/docker_service.py
@@ -24,6 +24,13 @@
 # The config entrypoint.sh renders and starts squid with (`squid -k` must read the same
 # file to find pid_filename).
 _SQUID_CONF = "/run/lmnsquid/squid.conf"
+# Reload: images with lists-sync.sh read the lists from /run/lmnsquid/lists, which the script
+# rebuilds from the mounted ones (without the entries squid refuses to load); older images read
+# the mounted files directly. Fixed text, nothing from a request goes into it.
+_RELOAD = (
+    "set -e; if [ -x /usr/local/bin/lists-sync.sh ]; then /usr/local/bin/lists-sync.sh; fi; "
+    f"exec squid -k reconfigure -f {_SQUID_CONF}"
+)
 # Container label carrying the fingerprint of everything the container was created
 # from; a container whose label matches the desired spec is left alone by
 # ensure_running (reconcile is a no-op for it), one without or with another
@@ -353,17 +360,14 @@ def _exec(self, container: Container, cmd: list[str]) -> tuple[int, str]:
         return exit_code, text
 
     def noauth_active(self, name: str) -> bool:
-        """Whether the running squid reads ``noauth.domains`` from the list directory.
+        """Whether the running squid has the noauth ACL (ADR-016) in its configuration.
 
-        Not so for an image from before ADR-016 (its template has no such ACL) or for a
-        container started while the directory held no ``noauth.domains`` (the entrypoint
-        then stands in an empty file); a reload cannot change either, only a new container
-        of a supporting image can. Same preconditions and errors as :meth:`reload`.
+        Not so for an image from before ADR-016 (its template has no such ACL); a reload
+        cannot change that, only a container of a newer image can. Same preconditions and
+        errors as :meth:`reload`.
         """
         container = self._running(name)
-        exit_code, text = self._exec(
-            container, ["grep", "-qF", f"{CONTAINER_DIR}/{NOAUTH_FILE_NAME}", _SQUID_CONF]
-        )
+        exit_code, text = self._exec(container, ["grep", "-qF", "acl noauth_domains ", _SQUID_CONF])
         if exit_code not in (0, 1):
             raise RuntimeError(f"cannot read {_SQUID_CONF} (exit {exit_code}): {text.strip()}")
         return exit_code == 0
@@ -371,7 +375,10 @@ def noauth_active(self, name: str) -> bool:
     def reload(self, name: str) -> dict[str, Any]:
         """Make the running squid re-read squid.conf and its ACL list files (both lists).
 
-        Runs ``squid -k reconfigure`` inside the container: squid parses the config and
+        Runs ``lists-sync.sh`` (images that have it: rebuilds the lists squid reads, without
+        entries squid would refuse) and then ``squid -k reconfigure`` inside the container. If
+        squid still refuses the configuration, the running squid keeps the previous one and a
+        ``RuntimeError`` carries squid's message. squid -k reconfigure parses the config and
         signals its running copy (SIGHUP). No restart -- the cache and open client
         connections survive, the auth/group helpers are restarted. Deliberately NOT
         ``container.kill(signal="SIGHUP")``: Docker records every kill(), whatever the
@@ -382,9 +389,9 @@ def reload(self, name: str) -> dict[str, Any]:
         when the exec is refused or squid does.
         """
         container = self._running(name)
-        exit_code, text = self._exec(container, ["squid", "-k", "reconfigure", "-f", _SQUID_CONF])
+        exit_code, text = self._exec(container, ["sh", "-c", _RELOAD])
         if exit_code != 0:
-            raise RuntimeError(f"squid -k reconfigure exited {exit_code}: {text.strip()}")
+            raise RuntimeError(f"list reload exited {exit_code}: {text.strip()}")
         return {"name": name, "reloaded": True}
 
     # -- introspection -----------------------------------------------------
diff --git a/controlplane/tests/test_blocklist.py b/controlplane/tests/test_blocklist.py
index 5148330..affdbfa 100644
--- a/controlplane/tests/test_blocklist.py
+++ b/controlplane/tests/test_blocklist.py
@@ -12,7 +12,7 @@
 from typer.testing import CliRunner
 
 from lmnsquid import cli
-from lmnsquid.blocklist import Blocklist, normalize_domain
+from lmnsquid.blocklist import Blocklist, normalize_domain, uncovered
 from lmnsquid.config import Settings
 
 runner = CliRunner()
@@ -68,6 +68,41 @@ def test_blocklist_file_lifecycle(tmp_path: Path) -> None:
     assert bl.read("s-teachers") == []  # absent file reads as empty
 
 
+@pytest.mark.parametrize(
+    ("entries", "expected"),
+    [
+        # squid 6 refuses these orders ("FATAL: Bungled"): the covered name goes
+        ([".graph.microsoft.com", ".microsoft.com"], [".microsoft.com"]),
+        (["microsoft.com", ".microsoft.com"], [".microsoft.com"]),
+        ([".microsoft.com", "a.b.microsoft.com", "MICROSOFT.COM."], [".microsoft.com"]),
+        # duplicates (also by case and trailing dot) collapse
+        ([".a.org", ".A.org", ".a.org."], [".a.org"]),
+        # a bare name covers nothing, a sibling or a mere suffix is not covered
+        (["a.org", "x.a.org"], ["a.org", "x.a.org"]),
+        ([".a.org", ".ba.org", ".org.example"], [".a.org", ".ba.org", ".org.example"]),
+        (["", " ", ".", ".b.org"], [".b.org"]),
+    ],
+)
+def test_uncovered(entries: list[str], expected: list[str]) -> None:
+    assert uncovered(entries) == expected
+
+
+def test_add_never_writes_a_list_squid_cannot_load(tmp_path: Path) -> None:
+    bl = Blocklist(str(tmp_path))
+    file = tmp_path / "s-teachers" / "blocked.domains"
+    assert bl.add("s-teachers", "graph.microsoft.com") == [".graph.microsoft.com"]
+    # a parent replaces the names below it ...
+    assert bl.add("s-teachers", "microsoft.com") == [".microsoft.com"]
+    # ... and a name below a listed parent changes nothing
+    assert bl.add("s-teachers", "login.microsoft.com") == [".microsoft.com"]
+    assert file.read_text() == ".microsoft.com\n"
+    # a hand-edited file with a covered name first is cleaned on the next write
+    file.write_text(".a.example.org\n.example.org\nexample.org\n")
+    assert bl.add("s-teachers", "other.org") == [".example.org", ".other.org"]
+    file.write_text(".a.example.org\n.example.org\n.x.org\n")
+    assert bl.remove("s-teachers", "x.org") == [".example.org"]
+
+
 def test_blocklist_rejects_unsafe_name(tmp_path: Path) -> None:
     bl = Blocklist(str(tmp_path))
     for bad in ("../x", "a/b", "", ".", "a", "a.b"):
diff --git a/controlplane/tests/test_docker_integration.py b/controlplane/tests/test_docker_integration.py
index 3474e31..8af8f39 100644
--- a/controlplane/tests/test_docker_integration.py
+++ b/controlplane/tests/test_docker_integration.py
@@ -64,6 +64,25 @@ def test_real_container_lifecycle(tmp_path: Path) -> None:
         svc.noauth.add(inst.name, "office.com")
         assert svc.reload(inst.name) == {"name": inst.name, "reloaded": True}
 
+        # Hand-edited lists that squid 6 refuses as such (a covered name before its parent,
+        # the bare apex): lists-sync.sh drops those entries on reload and at the next start.
+        (lists / inst.name / "blocked.domains").write_text(
+            ".a.example.org\nexample.org\n.example.org\n"
+        )
+        (lists / inst.name / "noauth.domains").write_text(
+            ".graph.microsoft.com\n.microsoft.com\nmicrosoft.com\n"
+        )
+        assert svc.reload(inst.name)["reloaded"] is True
+        svc.restart(inst.name)
+        deadline = time.monotonic() + 60
+        health = None
+        while time.monotonic() < deadline:
+            health = svc.status(inst.name)["health"]
+            if health in ("healthy", "unhealthy"):
+                break
+            time.sleep(2)
+        assert svc.status(inst.name)["running"] is True and health == "healthy"
+
         assert svc.stop(inst.name)["running"] is False
         assert svc.start(inst.name)["running"] is True
     finally:
diff --git a/controlplane/tests/test_docker_service.py b/controlplane/tests/test_docker_service.py
index 526d7e9..886b01a 100644
--- a/controlplane/tests/test_docker_service.py
+++ b/controlplane/tests/test_docker_service.py
@@ -105,12 +105,25 @@ def test_noauth_active_reads_the_rendered_config(
     _registry(ds, {"lmnsquid-s-teachers": c})
     assert ds.noauth_active("s-teachers") is expected
     cmd = c.exec_run.call_args.args[0]
-    assert cmd == [
-        "grep",
-        "-qF",
-        "/etc/squid/lists/noauth.domains",
-        "/run/lmnsquid/squid.conf",
-    ]
+    assert cmd == ["grep", "-qF", "acl noauth_domains ", "/run/lmnsquid/squid.conf"]
+
+
+def test_reload_syncs_the_lists_then_reconfigures(tmp_path: Path) -> None:
+    ds = _service(tmp_path)
+    c = _container("lmnsquid-s-teachers")
+    c.exec_run.return_value = (0, b"")
+    _registry(ds, {"lmnsquid-s-teachers": c})
+    assert ds.reload("s-teachers") == {"name": "s-teachers", "reloaded": True}
+    cmd = c.exec_run.call_args.args[0]
+    assert cmd[:2] == ["sh", "-c"]
+    # lists-sync.sh first (only where the image has it), then squid -k reconfigure.
+    assert "[ -x /usr/local/bin/lists-sync.sh ]" in cmd[2]
+    assert cmd[2].index("lists-sync.sh;") < cmd[2].index("squid -k reconfigure")
+    assert cmd[2].endswith("exec squid -k reconfigure -f /run/lmnsquid/squid.conf")
+
+    c.exec_run.return_value = (1, b"FATAL: Bungled /run/lmnsquid/squid.conf line 59")
+    with pytest.raises(RuntimeError, match="Bungled"):
+        ds.reload("s-teachers")
 
 
 def test_noauth_active_errors(tmp_path: Path) -> None:
diff --git a/debian/changelog b/debian/changelog
index b8c1190..8019cf6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -35,6 +35,16 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     proxy.<fqdn> (PROXY_FQDN overrides it), and a third template creates one
     proxy for everybody in the group internet, which per sophomorix.ini also
     holds parents, staff and the school admins.
+  * A blocklist with a subdomain sorted before its parent domain
+    (".a.example.org" before ".example.org", or "example.org" next to it)
+    no longer takes the proxy down. squid 6 refuses such a list ("FATAL:
+    Bungled"): "blocklist reload" failed and the next start of the container
+    failed. Category lists from blocklist-refresh.sh and hand edits produced
+    it easily. "lmnsquid blocklist|noauth add" now keeps a listed parent and
+    drops what it covers (adding a name below a listed domain changes
+    nothing), blocklist-refresh.sh drops covered entries, and the new
+    data-plane image builds the lists squid reads without them at every
+    start and reload, naming them in "lmnsquid logs <name>".
 
  -- Kevin Stenzel <mail@kevin-stenzel.de>  Fri, 30 Oct 2026 14:58:39 +0100
 
diff --git a/deploy/e2e/client/assert.sh b/deploy/e2e/client/assert.sh
index c26f5a0..f5f3e83 100755
--- a/deploy/e2e/client/assert.sh
+++ b/deploy/e2e/client/assert.sh
@@ -132,6 +132,7 @@ check_tls_sni "noauth: CONNECT listed, no SNI -> cut"                "$NA_HOST"
 check_via    "noauth instance: teacher -> 200"                    teacher1 "$NA" "$ALLOWED" 200
 check_via    "noauth instance: student -> 403"                    student1 "$NA" "$ALLOWED" 403
 check_via    "noauth instance: blocked (teacher) -> 403"          teacher1 "$NA" "http://blocked.example.com/" 403
+check_via    "noauth instance: blocked subdomain (teacher) -> 403" teacher1 "$NA" "http://a.blocked.example.com/" 403
 check_via    "noauth instance: listed+blocked (teacher) -> 403"   teacher1 "$NA" "http://both.example.internal/" 403
 check_via    "noauth instance: listed (teacher) -> 200"           teacher1 "$NA" "http://secure.example.internal/" 200
 check_tunnel "noauth instance: HTTPS not listed (teacher) -> 200" teacher1 "$NA" "https://secure2.example.internal/" "200 200"
diff --git a/deploy/e2e/docker-compose.yml b/deploy/e2e/docker-compose.yml
index 0e6abec..dd84325 100644
--- a/deploy/e2e/docker-compose.yml
+++ b/deploy/e2e/docker-compose.yml
@@ -174,7 +174,7 @@ services:
         ipv4_address: 172.28.0.14
     volumes:
       - shared:/shared:ro
-      - ./lists-noauth:/etc/squid/lists:ro
+      - ./lists-pinned:/etc/squid/lists:ro
     read_only: true
     tmpfs: ["/run", "/tmp", "/var/log/squid", "/var/spool/squid"]
     cap_drop: ["ALL"]
diff --git a/deploy/e2e/lists-noauth/blocked.domains b/deploy/e2e/lists-noauth/blocked.domains
index f64da8c..29c758e 100644
--- a/deploy/e2e/lists-noauth/blocked.domains
+++ b/deploy/e2e/lists-noauth/blocked.domains
@@ -4,5 +4,8 @@
 
 # Blocklist of the squid-noauth E2E instance (the directory is mounted at /etc/squid/lists,
 # as the control plane does). both.example.internal is on both lists: the blocklist wins.
+# .a.blocked.example.com and the bare apex: entries squid 6 refuses next to their parent.
+.a.blocked.example.com
+blocked.example.com
 .blocked.example.com
 .both.example.internal
diff --git a/deploy/e2e/lists-noauth/noauth.domains b/deploy/e2e/lists-noauth/noauth.domains
index f112f15..4b84e41 100644
--- a/deploy/e2e/lists-noauth/noauth.domains
+++ b/deploy/e2e/lists-noauth/noauth.domains
@@ -3,5 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 # Domains reachable without proxy auth for the squid-noauth E2E instance (ADR-016).
+# Hand-edited on purpose: a subdomain sorted before its parent and the bare apex next to it
+# would stop squid 6 ("FATAL: Bungled"); lists-sync.sh in the image drops them.
+.a.secure.example.internal
+secure.example.internal
 .secure.example.internal
 .both.example.internal
diff --git a/deploy/e2e/lists-pinned/blocked.domains b/deploy/e2e/lists-pinned/blocked.domains
new file mode 100644
index 0000000..c7d99cc
--- /dev/null
+++ b/deploy/e2e/lists-pinned/blocked.domains
@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Lists of the squid-pinned E2E instance (an image from before ADR-016, which reads the
+# mounted files directly, so no entry here may overlap another).
+.blocked.example.com
diff --git a/deploy/e2e/lists-pinned/noauth.domains b/deploy/e2e/lists-pinned/noauth.domains
new file mode 100644
index 0000000..8be60c9
--- /dev/null
+++ b/deploy/e2e/lists-pinned/noauth.domains
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# The image of squid-pinned predates ADR-016 and must ignore this list.
+.secure.example.internal
diff --git a/docs/architecture.md b/docs/architecture.md
index f911e96..c2a6566 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -72,15 +72,19 @@ Status document. Keep it up to date with every substantive change (see
   `/etc/squid/lists` — the path the template reads for `dstdomain` and
   `ssl::server_name`. Managed via `lmnsquid blocklist <name> add|remove|list|reload`
   (the API endpoints below); `reload` = `squid -k reconfigure` inside the container
-  (docker exec), no restart. Entries are `.example.org` = domain + subdomains. UT Capitole/Toulouse
+  (docker exec), no restart. Entries are `.example.org` = domain + subdomains. Squid reads
+  copies under `/run/lmnsquid/lists/` that `lists-sync.sh` builds from the mounted files at
+  start and before every reload, without entries a listed parent domain covers (squid 6 stops
+  with `FATAL: Bungled` when such an entry precedes its parent); the control plane never writes
+  them in the first place. UT Capitole/Toulouse
   category lists via `blocklist-refresh.sh` (host cron) into the same file.
 - **Domains without proxy authentication per instance (ADR-016, optional):**
   `<blocklists_dir>/<name>/noauth.domains` in the same mounted directory (no extra mount, the
   container spec is unchanged), managed via `lmnsquid noauth <name> add|remove|list|reload`.
   A listed domain is reachable from `school_net` without a ticket; the blocklist wins; a
   CONNECT on this path must carry a listed SNI (no SNI → terminated); the list ACL is
-  `dstdomain -n` (no reverse DNS). Empty by default (= the old behaviour). The entrypoint uses
-  an empty stand-in when the mounted directory has no `noauth.domains` (older control plane);
+  `dstdomain -n` (no reverse DNS). Empty by default (= the old behaviour). A missing
+  `noauth.domains` (older control plane) is an empty list;
   `noauth reload` refuses (409) when the running container does not read the list (an image
   from before ADR-016). Price: no identity for these requests (exam mode, Internetsperre;
   threat model T16).
diff --git a/docs/decisions.md b/docs/decisions.md
index 2005735..031657f 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -146,6 +146,14 @@ signal, as a manual stop, and an `unless-stopped` container then stays down afte
 (seen in the lab). Price: like `access-logs`, `reload` needs `docker exec` (ADR-012).
 **Limit (documented):** a blocked HTTPS name is terminated at the TLS handshake, there is
 no 403 page without decryption (ADR-002).
+**Amendment (2026-10-30, with ADR-016):** squid 6 refuses to load a `dstdomain` /
+`ssl::server_name` list in which a name covered by a listed parent domain comes first
+(`.a.example.org` before `.example.org`, or `example.org` next to it: `FATAL: Bungled`; a
+`reload` fails, the next container start fails), which category lists and hand edits produce
+easily. Squid therefore reads copies under `/run/lmnsquid/lists/` built by the image's
+`lists-sync.sh` at start and before every `reload`, without covered entries (logged); the
+control plane (`add` keeps the parent and drops what it covers) and `blocklist-refresh.sh`
+never write them.
 
 ### ADR-015 — Build inputs pinned: hashed Python locks, digests, action SHAs, draft-first releases
 **Status:** Accepted (2026-09-23, stage A "supply chain" of the linuxmusterDEV archive plan).
@@ -235,7 +243,7 @@ data-plane image; until `DEFAULT_IMAGE` points at an image with this template, t
 ignored and `lmnsquid noauth <name> reload` answers 409 instead of reporting a reload that
 changes nothing (it checks the rendered `squid.conf` in the container). An image with the
 template next to a directory without `noauth.domains` (an older control plane) uses an empty
-list.
+list until the file appears and the next reload reads it.
 
 ---
 
diff --git a/docs/operations.md b/docs/operations.md
index 0095d0f..9c4dc67 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -74,7 +74,10 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
 
 - `add`/`remove` write the file (sorted, one `.domain` per line; comments are not
   preserved) and take effect on the next **`reload`** — batch your changes, then reload once.
-  `reload` runs `squid -k reconfigure` inside the container (docker exec, like
+  A name below a listed domain is already covered: adding it changes nothing, and adding a
+  parent removes the names below it (squid 6 refuses to load a list in which a covered name,
+  e.g. `.a.example.org` or `example.org`, comes before `.example.org`: `FATAL: Bungled`).
+  `reload` runs `lists-sync.sh` and `squid -k reconfigure` inside the container (docker exec, like
   `access-logs` — not available behind the socket proxy with `EXEC: 0`); the auth/group
   helpers restart, the cache stays. API:
   `GET/POST /v1/instances/{name}/blocklist`, `DELETE …/blocklist/{domain}`, `POST …/blocklist/reload`.
@@ -85,6 +88,13 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
   in the access log.
 - **Hand-editing / category lists:** the file may be edited directly (one domain per line,
   leading dot = with subdomains; `#` comments) followed by `lmnsquid blocklist <name> reload`.
+  Squid does not read the mounted file itself: at every start and reload the image's
+  `lists-sync.sh` builds the list it reads (`/run/lmnsquid/lists/`) and leaves out every entry
+  a listed parent domain already covers, naming them in `lmnsquid logs <name>`
+  (`… entries ignored, already covered by a listed parent domain: …`); so a hand-edited list
+  cannot stop the proxy. `blocklist-refresh.sh` drops those entries itself. (The image pinned
+  by 7.3.7 and older reads the mounted file directly: with it such a list makes `reload` fail
+  and the next start of the container fail.)
   UT-Capitole category lists: `INSTANCE=<name> BLOCK_CATEGORIES="adult malware phishing"
   bash /usr/share/linuxmuster-squid/scripts/blocklist-refresh.sh` from a host cron **as user
   `lmnsquid`** (fail-closed size floor), then `reload`. The refresh **replaces the whole
@@ -130,9 +140,9 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
   `GET/POST /v1/instances/{name}/noauth`, `DELETE …/noauth/{domain}`, `POST …/noauth/reload`.
 - **`reload` answers 409** when the running container does not read the list: its image
   predates the list (update the instance to a data-plane image that has it, `lmnsquid update
-  <name>`), or it was started while its list directory had no `noauth.domains` (only possible
-  with an older control plane; `lmnsquid restart <name>`). Without that check a reload would
-  report success and change nothing. `blocklist reload` is not affected.
+  <name>`). Without that check a reload would report success and change nothing.
+  `blocklist reload` is not affected. A `noauth.domains` created after the container started
+  (an older control plane) is picked up by the next reload.
 - **What `lmnsquid rm` removes:** the directory with both lists.
 
 ### Recommended list: Microsoft 365
@@ -146,9 +156,11 @@ the Microsoft 365 endpoints web service, `https://endpoints.office.com/endpoints
 (service areas Common, Exchange, SharePoint, Skype/Teams; version `2026103000`, fetched
 2026-10-30): every **required** item of category **Optimize** or **Allow** with TCP ports
 80/443 (ids 1, 9, 12, 31, 46, 56, 64). `*.x` and `x` are both one entry `x` here (the list
-always covers the domain and its subdomains, which is slightly wider than `*.x`); names under
-an entry already listed are left out (`ccs.` and `device.login.microsoftonline.com`,
-`api.passwordreset.microsoftonline.com`), squid only warns about them.
+always covers the domain and its subdomains, which is slightly wider than `*.x`). Names under
+an entry already listed are left out (`ccs.` and `device.login.microsoftonline.com` under
+`login.microsoftonline.com`, `api.passwordreset.microsoftonline.com` under
+`passwordreset.microsoftonline.com`): they are covered anyway, `add` would not store them, and
+squid 6 refuses a list in which such a name comes before its parent.
 
 ```
 for d in outlook.cloud.microsoft outlook.office.com outlook.office365.com protection.outlook.com \
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index a419c16..49d2eb7 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -137,6 +137,14 @@ acceptance list in `deployment-gpo.md`.
   normalization (IDNA, leading dot, invalid names), unsafe instance names, API 401/403 without
   or with a wrong token, 404/422, reload 409 when the container ignores the list or is stopped,
   CLI and `--help` warnings.
+- **Lists squid 6 refuses** (`FATAL: Bungled`: a name covered by a listed parent before it,
+  or the bare apex next to it), both lists: unit (`uncovered`, `add` keeps the parent and
+  drops what it covers, a hand-edited file is cleaned on the next write), blocklist smoke
+  (`blocklist-refresh.sh` drops `a.bad3.example` under `bad3.example`), E2E (`squid-noauth`
+  mounts such hand-edited lists: starts, logs the ignored entries, reloads, comes back after a
+  restart, blocked subdomain → 403), cp-docker-it (real DockerService: such lists written after
+  the start → reload ok → restart → healthy; counter-check with an image whose `lists-sync.sh`
+  only copies: the reload fails with `Bungled`).
 - **P10:** keytab perms; manager ACL not reachable externally; API bind ≠ 0.0.0.0;
   bypass/traversal; DC outage does not stall (ttl/grace).
 
diff --git a/docs/threat-model.md b/docs/threat-model.md
index 7484b93..e921cde 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -28,7 +28,7 @@ Risks + countermeasures. Grows per roadmap phase; the negative tests for it live
 | T5 | **Control-plane RCE = host root** (Docker socket) | API **only `127.0.0.1`** + token (`compare_digest`), hardened systemd service, audit log. The socket proxy reduces the endpoint surface, **but does NOT downgrade below host root** (`container create` with host bind is inherently root-equivalent) → the real answer is **rootless Docker**. In-app TLS not implemented; off-host only via an operator-provided TLS reverse proxy (`main.py` warns on non-loopback bind) | API 401/403 tests; bind check ≠ 0.0.0.0 |
 | T6 | **Auth all-or-nothing / SSO outage** | auth never globally disableable by default; fallback Kerberos→Basic/LDAP (no NTLM); monitor SSO health | E2E: no ticket→407 |
 | T7 | **DNS/SPN misconfig** (silent Kerberos fail) | fwd+rev DNS resp. `rdns=false`; FQDN==SPN==`VISIBLE_HOSTNAME`; NTP<5min; AES enctypes | E2E canonicalization; `klist -k` |
-| T8 | **Blocklist rot / tampering** (supply chain) | per-instance list on the host (`/etc/linuxmuster-squid/blocklists/<name>/blocked.domains`, mounted read-only into the container, writable only by root/`lmnsquid`), maintained via `lmnsquid blocklist` + `reload`; category lists via `blocklist-refresh.sh` from a host cron with a fail-closed size floor (a truncated download never replaces the list); make outage visible. **HTTPS limit:** a blocked HTTPS name is cut at the TLS handshake (peek + terminate, no decryption) — the user sees a connection error, no block page; HTTP gets 403 | blocklist smoke; lab proof 7.3.1 (HTTP 403, HTTPS TLS abort) |
+| T8 | **Blocklist rot / tampering** (supply chain) | per-instance list on the host (`/etc/linuxmuster-squid/blocklists/<name>/blocked.domains`, mounted read-only into the container, writable only by root/`lmnsquid`), maintained via `lmnsquid blocklist` + `reload`; category lists via `blocklist-refresh.sh` from a host cron with a fail-closed size floor (a truncated download never replaces the list); make outage visible. A list squid 6 cannot load (a covered name before its parent: `FATAL: Bungled`) would take the instance down at the next start: squid reads a copy without such entries (`lists-sync.sh`), and neither the API nor the refresh writes them. **HTTPS limit:** a blocked HTTPS name is cut at the TLS handshake (peek + terminate, no decryption) — the user sees a connection error, no block page; HTTP gets 403 | blocklist smoke; lab proof 7.3.1 (HTTP 403, HTTPS TLS abort) |
 | T9 | **Unattended bad update → dead school** | digest pin, human-merge (no automerge; bumps by hand while Renovate is disabled), health-gated update + auto-rollback, known-good persisted | E2E: bad image → rollback |
 | T10 | **DC/LDAP outage stalls every request** | external ACL `ttl/negative_ttl/grace` + tune helper concurrency | load test P10 |
 | T11 | **Container escape/privilege** | `read_only` rootfs + tmpfs, `cap_drop: ALL` (minimal caps), non-root `proxy`, manager ACL localhost | hardening review P10 |
diff --git a/image/Dockerfile b/image/Dockerfile
index e832430..20b5bc1 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -49,7 +49,9 @@ COPY templates/squid.conf.template /etc/squid/templates/squid.conf.template
 COPY entrypoint.sh   /usr/local/bin/entrypoint.sh
 COPY healthcheck.sh  /usr/local/bin/healthcheck.sh
 COPY sni-sent.sh     /usr/local/bin/sni-sent.sh
-RUN chmod 0755 /usr/local/bin/entrypoint.sh /usr/local/bin/healthcheck.sh /usr/local/bin/sni-sent.sh
+COPY lists-sync.sh   /usr/local/bin/lists-sync.sh
+RUN chmod 0755 /usr/local/bin/entrypoint.sh /usr/local/bin/healthcheck.sh /usr/local/bin/sni-sent.sh \
+      /usr/local/bin/lists-sync.sh
 
 EXPOSE 3128
 HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
diff --git a/image/entrypoint.sh b/image/entrypoint.sh
index 065aef7..d0e49aa 100644
--- a/image/entrypoint.sh
+++ b/image/entrypoint.sh
@@ -77,19 +77,9 @@ export KRB5CCNAME="FILE:${RUN}/krb5cc_${INSTANCE}"
 export KRB5RCACHEDIR="${RUN}"
 export KRB5_CONFIG="${RUN}/krb5.conf"
 export LDAPCONF="${RUN}/ldap.conf"
-# Domains reachable without proxy auth (ADR-016): a control plane that knows the list puts
-# noauth.domains into the mounted list directory before the container starts. A directory
-# from an older control plane has none: then an empty file under /run stands in (feature
-# off, no squid ERROR about a missing file).
-NOAUTH_LIST=/etc/squid/lists/noauth.domains
-if [ ! -f "${NOAUTH_LIST}" ]; then
-    NOAUTH_LIST="${RUN}/noauth.domains"
-    : > "${NOAUTH_LIST}"
-    echo "linuxmuster-squid: no /etc/squid/lists/noauth.domains, domains without proxy auth: none" >&2
-fi
 # envsubst substitutes only EXPORTED variables (otherwise "http_port " => FATAL).
 export INSTANCE HTTP_PORT CACHE_SIZE_MB KEYTAB REALM AD_GROUP VISIBLE_HOSTNAME SCHOOL_SUBNETS
-export ACCESS_LOG_DIRECTIVE INTERNET_ACL_DEF INTERNET_ACL_REF NOAUTH_LIST
+export ACCESS_LOG_DIRECTIVE INTERNET_ACL_DEF INTERNET_ACL_REF
 
 # krb5.conf: rdns/canonicalize=false so that the ldap/ SPN is built from the literal DC name
 # (via SRV) and NOT via reverse DNS (-> SASL "Local error").
@@ -123,11 +113,13 @@ TEMPLATE=/etc/squid/templates/squid.conf.template
 CONF="${RUN}/squid.conf"
 
 # Only substitute OUR variables so Squid's own %-tokens survive untouched.
-envsubst '${INSTANCE} ${HTTP_PORT} ${CACHE_SIZE_MB} ${KEYTAB} ${REALM} ${AD_GROUP} ${VISIBLE_HOSTNAME} ${SCHOOL_SUBNETS} ${ACCESS_LOG_DIRECTIVE} ${INTERNET_ACL_DEF} ${INTERNET_ACL_REF} ${NOAUTH_LIST}' \
+envsubst '${INSTANCE} ${HTTP_PORT} ${CACHE_SIZE_MB} ${KEYTAB} ${REALM} ${AD_GROUP} ${VISIBLE_HOSTNAME} ${SCHOOL_SUBNETS} ${ACCESS_LOG_DIRECTIVE} ${INTERNET_ACL_DEF} ${INTERNET_ACL_REF}' \
     < "${TEMPLATE}" > "${CONF}"
 
-# The blocklist file is normally mounted read-only; create an empty one only if absent.
-[ -e /etc/squid/lists/blocked.domains ] || : > /etc/squid/lists/blocked.domains 2>/dev/null || true
+# The lists squid reads (/run/lmnsquid/lists/) from the mounted ones: without the entries
+# squid 6 refuses to load, a missing file as an empty list (lists-sync.sh, also run by
+# `lmnsquid ... reload`).
+/usr/local/bin/lists-sync.sh
 
 # Validate config, then initialise cache dirs on first run.
 squid -k parse -f "${CONF}"
diff --git a/image/lists-sync.sh b/image/lists-sync.sh
new file mode 100755
index 0000000..3a7bc35
--- /dev/null
+++ b/image/lists-sync.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+# SPDX-FileCopyrightText: Kevin Stenzel
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Builds the domain lists squid reads (/run/lmnsquid/lists/) from the mounted ones
+# (/etc/squid/lists/, read-only, maintained by the control plane, an editor or
+# blocklist-refresh.sh). Run by the entrypoint before squid starts and by `lmnsquid ...
+# reload` before `squid -k reconfigure`, so a list squid cannot load never reaches it:
+# squid 6 stops with "FATAL: Bungled ... acl ... dstdomain" when a list holds a name that
+# another entry already covers and comes first (".a.example.org" before ".example.org",
+# or "example.org" next to ".example.org"); measured with squid 6.14. Such names are
+# dropped here (the dotted parent matches them anyway) and reported on stderr (docker logs).
+set -eu
+
+SRC=/etc/squid/lists
+DST=/run/lmnsquid/lists
+mkdir -p "${DST}"
+chmod 0755 "${DST}"
+
+# Comments, blank lines and everything after the first word dropped, lower-cased, trailing
+# dots removed; then every entry that a dotted entry covers. Same program as in
+# scripts/blocklist-refresh.sh.
+uncovered() {
+    awk '
+    { sub(/\r$/, ""); sub(/#.*/, ""); e = tolower($1); sub(/\.+$/, "", e)
+      if (e == "" || e == "." || (e in seen)) next
+      seen[e] = 1; order[++n] = e
+      if (substr(e, 1, 1) == ".") dotted[e] = 1 }
+    END {
+      for (i = 1; i <= n; i++) {
+        e = order[i]; s = e; covered = 0
+        if (substr(e, 1, 1) == ".") s = substr(e, 2)
+        else if (("." e) in dotted) covered = 1
+        while (!covered && (p = index(s, ".")) > 0) {
+          s = substr(s, p + 1)
+          if (("." s) in dotted) covered = 1
+        }
+        if (covered) print e > "/dev/stderr"; else print e
+      }
+    }'
+}
+
+# sync <name>: a missing file becomes an empty list.
+sync_list() {
+    name=$1 src="${SRC}/$1" tmp="${DST}/.$1.tmp"
+    if [ -f "${src}" ]; then
+        uncovered < "${src}" 2>"${DST}/.$1.covered" | sort > "${tmp}"
+    else
+        : > "${tmp}"
+        [ "${name}" = noauth.domains ] \
+            && echo "linuxmuster-squid: no ${src}, domains without proxy auth: none" >&2
+    fi
+    if [ -s "${DST}/.$1.covered" ]; then
+        echo "linuxmuster-squid: ${name}: $(wc -l < "${DST}/.$1.covered") entries ignored, already covered by a listed parent domain:" \
+            "$(head -5 "${DST}/.$1.covered" | tr '\n' ' ')" >&2
+    fi
+    rm -f "${DST}/.$1.covered"
+    chmod 0644 "${tmp}"
+    mv -f "${tmp}" "${DST}/${name}"
+}
+
+sync_list blocked.domains
+sync_list noauth.domains
diff --git a/image/templates/squid.conf.template b/image/templates/squid.conf.template
index 6bb8076..785fbbc 100644
--- a/image/templates/squid.conf.template
+++ b/image/templates/squid.conf.template
@@ -49,27 +49,29 @@ acl school_net src ${SCHOOL_SUBNETS}
 
 # --- Domain filter WITHOUT decryption ---
 # dstdomain matches the plain-HTTP host AND the CONNECT target host (HTTPS),
-# so no SSL bump / no client CA needed.
-acl blocked_domains dstdomain "/etc/squid/lists/blocked.domains"
+# so no SSL bump / no client CA needed. The lists under /run/lmnsquid/lists are built by
+# lists-sync.sh from the mounted /etc/squid/lists (at start and on every reload) without
+# the entries squid 6 refuses to load (a name already covered by a listed parent domain).
+acl blocked_domains dstdomain "/run/lmnsquid/lists/blocked.domains"
 
 # --- Domains reachable WITHOUT proxy authentication (ADR-016; empty list = feature off) ---
 # For clients in school_net only, and never for a blocked domain (both enforced in the
 # access chain). -n: no reverse DNS for IP-literal URLs -- a PTR record is controlled by
 # whoever owns the address and must never put an IP on this list.
-acl noauth_domains dstdomain -n "${NOAUTH_LIST}"
+acl noauth_domains dstdomain -n "/run/lmnsquid/lists/noauth.domains"
 
 # --- HTTPS: SNI peek + splice (NO decryption) ---
 # step1 reads the TLS ClientHello (SNI); blocked SNIs are disconnected (terminate),
 # everything else is tunneled (splice, no MITM). Also catches cases where the
 # CONNECT host differs from the real SNI (domain fronting).
 acl step1 at_step SslBump1
-acl blocked_sni ssl::server_name "/etc/squid/lists/blocked.domains"
+acl blocked_sni ssl::server_name "/run/lmnsquid/lists/blocked.domains"
 # A CONNECT to a listed domain got through without a ticket (every such CONNECT that reaches
 # this point came through the noauth line of the access chain), so its tunnel must not be
 # handed to another name: the SNI must be listed too, and a ClientHello WITHOUT SNI is cut as
 # well (ssl::server_name falls back to the CONNECT host when there is no SNI, so the helper
 # looks at the SNI itself; %ssl::>sni is '-' without one).
-acl noauth_sni ssl::server_name --client-requested "${NOAUTH_LIST}"
+acl noauth_sni ssl::server_name --client-requested "/run/lmnsquid/lists/noauth.domains"
 external_acl_type sni_sent ttl=3600 negative_ttl=3600 children-max=2 %ssl::>sni /usr/local/bin/sni-sent.sh
 acl tls_sni_sent external sni_sent
 ssl_bump peek step1
diff --git a/scripts/blocklist-refresh.sh b/scripts/blocklist-refresh.sh
index c1b3324..5cd5651 100755
--- a/scripts/blocklist-refresh.sh
+++ b/scripts/blocklist-refresh.sh
@@ -41,8 +41,26 @@ done
 
 # Domain normalization: force a leading dot so that dstdomain / ssl::server_name
 # also match subdomains (without a dot, dstdomain matches only the exact host). Strip
-# comments/blank lines, dedupe + sort, then replace atomically.
-grep -vE '^[[:space:]]*(#|$)' "$NEW" | sed -E 's/^\.*/./' | sort -u > "${OUT}.tmp"
+# comments/blank lines, drop every entry a listed parent domain already covers (squid 6
+# refuses to load a list with ".a.example.org" before ".example.org": "FATAL: Bungled";
+# same program as image/lists-sync.sh), dedupe + sort, then replace atomically.
+grep -vE '^[[:space:]]*(#|$)' "$NEW" | sed -E 's/^\.*/./' | awk '
+    { sub(/\r$/, ""); sub(/#.*/, ""); e = tolower($1); sub(/\.+$/, "", e)
+      if (e == "" || e == "." || (e in seen)) next
+      seen[e] = 1; order[++n] = e
+      if (substr(e, 1, 1) == ".") dotted[e] = 1 }
+    END {
+      for (i = 1; i <= n; i++) {
+        e = order[i]; s = e; covered = 0
+        if (substr(e, 1, 1) == ".") s = substr(e, 2)
+        else if (("." e) in dotted) covered = 1
+        while (!covered && (p = index(s, ".")) > 0) {
+          s = substr(s, p + 1)
+          if (("." s) in dotted) covered = 1
+        }
+        if (!covered) print e
+      }
+    }' | sort -u > "${OUT}.tmp"
 
 # Fail-closed: a real UT-Capitole category has thousands of entries. If the new list is
 # suspiciously small (empty/truncated/tampered download), do NOT replace — the old
diff --git a/scripts/tests/blocklist_smoke.sh b/scripts/tests/blocklist_smoke.sh
index 9579f8b..c51ca1a 100755
--- a/scripts/tests/blocklist_smoke.sh
+++ b/scripts/tests/blocklist_smoke.sh
@@ -13,7 +13,7 @@ trap 'rm -rf "$TMP"' EXIT
 fail=0
 
 mkdir -p "$TMP/blacklists/adult" "$TMP/blacklists/news"
-printf 'bad1.example\nbad2.example\n' > "$TMP/blacklists/adult/domains"
+printf 'bad1.example\nbad2.example\na.bad3.example\nbad3.example\n' > "$TMP/blacklists/adult/domains"
 printf 'news1.example\n'              > "$TMP/blacklists/news/domains"
 tar -czf "$TMP/bl.tar.gz" -C "$TMP" blacklists
 out="$TMP/blocked.domains"
@@ -26,6 +26,12 @@ if grep -qx '.bad1.example' "$out" && grep -qx '.bad2.example' "$out" && ! grep
 else
     echo "  [FAIL] categories/normalization"; fail=$((fail + 1))
 fi
+# a.bad3.example sorts before bad3.example: squid 6 would refuse the list ("Bungled")
+if grep -qx '.bad3.example' "$out" && ! grep -q 'a.bad3.example' "$out"; then
+    echo "  [PASS] subdomain of a listed domain dropped"
+else
+    echo "  [FAIL] covered subdomain kept: $(tr '\n' ' ' < "$out")"; fail=$((fail + 1))
+fi
 
 echo "== Test 2: fail-closed (new list < floor -> keep old) =="
 printf '.oldkeep.example\n.old2.example\n.old3.example\n' > "$out"   # existing (larger) list
diff --git a/scripts/tests/e2e_kerberos.sh b/scripts/tests/e2e_kerberos.sh
index 08081f9..4b0d473 100755
--- a/scripts/tests/e2e_kerberos.sh
+++ b/scripts/tests/e2e_kerberos.sh
@@ -150,6 +150,34 @@ else
   echo "  [FAIL] squid2: notice about the missing noauth.domains not logged"; rc=$((rc + 1))
 fi
 
+# squid-noauth's mounted lists hold entries squid 6 refuses to load next to their parent
+# (hand-edited): lists-sync.sh must have dropped them (logged), the instance must reload and
+# come back after a restart (before, such a list stopped squid: "FATAL: Bungled").
+log "lists with covered entries: logged, reload, restart"
+if $DC logs squid-noauth 2>/dev/null | grep 'entries ignored, already covered' >/dev/null; then
+  echo "  [PASS] covered entries dropped and logged"
+else
+  echo "  [FAIL] no notice about covered entries"; rc=$((rc + 1))
+fi
+if $DC exec -T squid-noauth sh -c '/usr/local/bin/lists-sync.sh 2>/dev/null && squid -k reconfigure -f /run/lmnsquid/squid.conf'; then
+  echo "  [PASS] reload (lists-sync.sh + squid -k reconfigure) with these lists"
+else
+  echo "  [FAIL] reload with these lists"; rc=$((rc + 1))
+fi
+$DC restart squid-noauth >/dev/null 2>&1
+if wait_healthy squid-noauth; then
+  echo "  [PASS] squid-noauth healthy again after a restart"
+else
+  echo "  [FAIL] squid-noauth did not come back after a restart"; rc=$((rc + 1))
+fi
+code=$($DC run --rm --entrypoint sh test-client -c \
+  'curl -s -o /dev/null -w "%{http_code}" --proxy http://squid4.example.internal:3128 http://secure.example.internal/' 2>/dev/null | tr -cd '0-9')
+if [ "$code" = 200 ]; then
+  echo "  [PASS] after the restart: listed, no ticket -> 200"
+else
+  echo "  [FAIL] after the restart: expected 200, got '$code'"; rc=$((rc + 1))
+fi
+
 log "squid-noauth access.log (excerpt)"
 $DC exec -T squid-noauth sh -c 'tail -25 /var/log/squid/access.log' 2>/dev/null || true
 

From 652471cb3ef755459ae6e48b90d7350f568048ae Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 16:13:49 +0100
Subject: [PATCH 07/24] fix(noauth): refuse IP literals and single labels as
 noauth entries

Cold verification: `noauth add 172.28.0.20` and `noauth add com` were
accepted; with ".172.28.0.20" on the list `http://172.28.0.20/` got 200
without a ticket (squid matches an IP-literal URL against the list text;
`dstdomain -n` only stops the PTR route). That contradicted the changelog
and operations.md ("IP addresses never match"), and `com` would open a
whole TLD.

- normalize_noauth_domain(): normalize_domain plus at least two labels and a
  non-numeric last label (TLDs are never all-numeric). This refuses dotted,
  short (127.1), hex (0x7f000001) and decimal (2887516181) IPv4 forms and
  single labels; IPv6 never passed the name check. noauth_list() uses it;
  POST .../noauth takes a NoauthEntry, so the refusal is a 422 at the
  boundary. remove still takes any name, so a hand-written bad entry can be
  taken out.
- lists-sync.sh ignores such lines in a hand-written noauth.domains and
  names them in the container log ("ignored, not a domain name").
- The blocklist keeps accepting TLDs and addresses on purpose: blocking a
  TLD (`zip`) is a legitimate choice and a wrong entry there only blocks
  more (documented in operations.md).

Tests: unit (each IP form, IPv6, bracketed, mapped, `com`, `.com`,
`intranet` refused; `1und1.de`, `x.co.uk` accepted; blocklist still takes
`zip`/`10.0.0.1`; remove of hand-written `com` and an address; API 422; CLI
exit 1); E2E (hand-written `172.28.0.20` and `internal` in squid-noauth's
list: ignored and logged, `http://172.28.0.20/` 407, origin.example.internal
407). Docs: operations, ADR-016, threat model T16, test strategy; the
changelog bullet now says entries are refused.
---
 controlplane/lmnsquid/api.py              | 15 +++--
 controlplane/lmnsquid/blocklist.py        | 27 ++++++++-
 controlplane/lmnsquid/docker_service.py   |  4 +-
 controlplane/lmnsquid/models.py           | 16 +++++-
 controlplane/tests/conftest.py            |  4 +-
 controlplane/tests/test_docker_service.py |  4 +-
 controlplane/tests/test_noauth.py         | 67 +++++++++++++++++++----
 debian/changelog                          |  5 +-
 deploy/e2e/client/assert.sh               |  1 +
 deploy/e2e/lists-noauth/noauth.domains    |  4 ++
 docs/decisions.md                         |  4 +-
 docs/operations.md                        | 11 +++-
 docs/test-strategy.md                     |  4 +-
 docs/threat-model.md                      |  2 +-
 image/lists-sync.sh                       | 27 ++++++---
 scripts/tests/e2e_kerberos.sh             |  5 ++
 16 files changed, 160 insertions(+), 40 deletions(-)

diff --git a/controlplane/lmnsquid/api.py b/controlplane/lmnsquid/api.py
index a417be5..4aa60dc 100644
--- a/controlplane/lmnsquid/api.py
+++ b/controlplane/lmnsquid/api.py
@@ -13,10 +13,17 @@
 from fastapi import Depends, FastAPI, HTTPException, Request, status
 from fastapi.responses import JSONResponse
 
-from .blocklist import NOAUTH_FILE_NAME, Blocklist
+from .blocklist import Blocklist, noauth_list
 from .config import Settings
 from .docker_service import DockerService
-from .models import DEFAULT_IMAGE, BlocklistEntry, Instance, InstancePatch, UpdateRequest
+from .models import (
+    DEFAULT_IMAGE,
+    BlocklistEntry,
+    Instance,
+    InstancePatch,
+    NoauthEntry,
+    UpdateRequest,
+)
 from .reconciler import Reconciler
 from .security import make_verify_token
 from .store import Store
@@ -38,7 +45,7 @@ def create_app(
     """Build the FastAPI app wiring routes to the store, reconciler and docker service."""
     verify = make_verify_token(settings)
     blocklist = Blocklist(settings.blocklists_dir)
-    noauth = Blocklist(settings.blocklists_dir, NOAUTH_FILE_NAME)
+    noauth = noauth_list(settings.blocklists_dir)
     app = FastAPI(title="linuxmuster-squid control plane")
 
     @app.exception_handler(DockerException)
@@ -226,7 +233,7 @@ async def get_noauth(name: str) -> dict[str, Any]:
         return {"name": name, "domains": noauth.read(name)}
 
     @app.post("/v1/instances/{name}/noauth", dependencies=auth)
-    async def add_noauth_domain(name: str, entry: BlocklistEntry) -> dict[str, Any]:
+    async def add_noauth_domain(name: str, entry: NoauthEntry) -> dict[str, Any]:
         """Let ``entry.domain`` and its subdomains through without proxy auth (after ``reload``)."""
         _require(name)
         domains = noauth.add(name, entry.domain)
diff --git a/controlplane/lmnsquid/blocklist.py b/controlplane/lmnsquid/blocklist.py
index 4681ad6..23f5729 100644
--- a/controlplane/lmnsquid/blocklist.py
+++ b/controlplane/lmnsquid/blocklist.py
@@ -51,6 +51,24 @@ def normalize_domain(value: str) -> str:
     return f".{name}"
 
 
+def normalize_noauth_domain(value: str) -> str:
+    """:func:`normalize_domain`, but only a domain below a TLD: at least two labels, the last
+    one not numeric.
+
+    An entry opens access without authentication, so it must name a domain: an IP literal
+    (``10.0.0.1``, ``127.1``, ``0x7f000001``, ``2887516181``) would put an address on the list
+    (squid matches IP-literal URLs against the list text) and a single label (``com``) a whole
+    top-level domain. The blocklist accepts both on purpose: a wrong entry there only blocks.
+    """
+    entry = normalize_domain(value)
+    labels = entry[1:].split(".")
+    if len(labels) < 2:
+        raise ValueError(f"{value!r} is not a domain below a top-level domain")
+    if labels[-1].isdigit():
+        raise ValueError(f"{value!r} looks like an IP address, not a domain")
+    return entry
+
+
 def uncovered(entries: Iterable[str]) -> list[str]:
     """Return ``entries`` without the ones another entry already covers, sorted.
 
@@ -82,8 +100,8 @@ def uncovered(entries: Iterable[str]) -> list[str]:
 class Blocklist:
     """Read and modify one list file (``blocked.domains`` by default) under ``root``.
 
-    One directory per instance; ``Blocklist(root, NOAUTH_FILE_NAME)`` handles the noauth list
-    in the same directories.
+    One directory per instance; ``noauth_list(root)`` handles the noauth list in the same
+    directories.
     """
 
     def __init__(
@@ -175,3 +193,8 @@ def _write(file: Path, entries: list[str]) -> None:
             if os.path.exists(tmp):
                 os.unlink(tmp)
             raise
+
+
+def noauth_list(root: str) -> Blocklist:
+    """The noauth list (ADR-016) of the instances under ``root``, with its stricter names."""
+    return Blocklist(root, NOAUTH_FILE_NAME, normalize_noauth_domain)
diff --git a/controlplane/lmnsquid/docker_service.py b/controlplane/lmnsquid/docker_service.py
index ad54d4e..05f7176 100644
--- a/controlplane/lmnsquid/docker_service.py
+++ b/controlplane/lmnsquid/docker_service.py
@@ -16,7 +16,7 @@
 from docker.models.containers import Container
 from docker.types import LogConfig
 
-from .blocklist import CONTAINER_DIR, NOAUTH_FILE_NAME, Blocklist
+from .blocklist import CONTAINER_DIR, Blocklist, noauth_list
 from .models import Instance
 
 logger = logging.getLogger("lmnsquid.docker")
@@ -62,7 +62,7 @@ def __init__(
         self.log_max_size: str = log_max_size
         self.log_max_file: int = log_max_file
         self.blocklist = Blocklist(blocklists_dir)
-        self.noauth = Blocklist(blocklists_dir, NOAUTH_FILE_NAME)
+        self.noauth = noauth_list(blocklists_dir)
         self.health_timeout = health_timeout
         self.poll_interval = poll_interval
         self.client: docker.DockerClient = (
diff --git a/controlplane/lmnsquid/models.py b/controlplane/lmnsquid/models.py
index 2c62539..9bccc6a 100644
--- a/controlplane/lmnsquid/models.py
+++ b/controlplane/lmnsquid/models.py
@@ -15,7 +15,7 @@
 
 from pydantic import BaseModel, computed_field, field_validator
 
-from .blocklist import normalize_domain
+from .blocklist import normalize_domain, normalize_noauth_domain
 
 # school/role -> name -> filename + container/volume name: no '/', '..' (case allowed).
 _NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9-]{0,30}$")
@@ -203,7 +203,7 @@ def _v_image(cls, v: str) -> str:
 
 
 class BlocklistEntry(BaseModel):
-    """Body for ``POST /v1/instances/{name}/blocklist`` and ``…/noauth``: one domain."""
+    """Body for ``POST /v1/instances/{name}/blocklist``: one domain to block."""
 
     domain: str
 
@@ -212,3 +212,15 @@ class BlocklistEntry(BaseModel):
     def _v_domain(cls, v: str) -> str:
         # Normalized here so an invalid name is a 422 at the boundary, not a 500.
         return normalize_domain(v)
+
+
+class NoauthEntry(BaseModel):
+    """Body for ``POST /v1/instances/{name}/noauth``: one domain below a top-level domain."""
+
+    domain: str
+
+    @field_validator("domain")
+    @classmethod
+    def _v_domain(cls, v: str) -> str:
+        # No IP literals, no single labels (ADR-016): a 422 at the boundary.
+        return normalize_noauth_domain(v)
diff --git a/controlplane/tests/conftest.py b/controlplane/tests/conftest.py
index 2c34b82..a733487 100644
--- a/controlplane/tests/conftest.py
+++ b/controlplane/tests/conftest.py
@@ -15,7 +15,7 @@
 from starlette.testclient import TestClient
 
 from lmnsquid.api import create_app
-from lmnsquid.blocklist import NOAUTH_FILE_NAME, Blocklist
+from lmnsquid.blocklist import Blocklist, noauth_list
 from lmnsquid.config import Settings
 from lmnsquid.models import Instance
 from lmnsquid.reconciler import Reconciler
@@ -42,7 +42,7 @@ def __init__(
         self.docker_host = docker_host
         self.secrets_dir = secrets_dir
         self.blocklist = Blocklist(blocklists_dir)
-        self.noauth = Blocklist(blocklists_dir, NOAUTH_FILE_NAME)
+        self.noauth = noauth_list(blocklists_dir)
         self.containers: dict[str, dict[str, Any]] = {}
         self.volumes: set[str] = set()
         # Test-observability hooks.
diff --git a/controlplane/tests/test_docker_service.py b/controlplane/tests/test_docker_service.py
index 886b01a..7f5d2b9 100644
--- a/controlplane/tests/test_docker_service.py
+++ b/controlplane/tests/test_docker_service.py
@@ -12,7 +12,7 @@
 import pytest
 from docker.errors import APIError, NotFound
 
-from lmnsquid.blocklist import NOAUTH_FILE_NAME, Blocklist
+from lmnsquid.blocklist import Blocklist, noauth_list
 from lmnsquid.docker_service import SPEC_LABEL, DockerService
 from lmnsquid.models import Instance
 
@@ -22,7 +22,7 @@ def _service(tmp_path: Path) -> DockerService:
     ds.client = MagicMock()
     ds.secrets_dir = str(tmp_path / "secrets")
     ds.blocklist = Blocklist(str(tmp_path / "blocklists"))
-    ds.noauth = Blocklist(str(tmp_path / "blocklists"), NOAUTH_FILE_NAME)
+    ds.noauth = noauth_list(str(tmp_path / "blocklists"))
     ds.container_bind_ip = "0.0.0.0"
     ds.log_max_size = "20m"
     ds.log_max_file = 5
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index e636b99..bf20666 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -12,7 +12,7 @@
 from typer.testing import CliRunner
 
 from lmnsquid import cli
-from lmnsquid.blocklist import NOAUTH_FILE_NAME, Blocklist
+from lmnsquid.blocklist import Blocklist, noauth_list, normalize_noauth_domain
 from lmnsquid.config import Settings
 
 runner = CliRunner()
@@ -37,16 +37,38 @@ def _create(client: TestClient, auth: dict[str, str], data: dict[str, Any]) -> s
     ],
 )
 def test_noauth_add_normalizes(tmp_path: Path, raw: str, expected: list[str]) -> None:
-    na = Blocklist(str(tmp_path), NOAUTH_FILE_NAME)
+    na = noauth_list(str(tmp_path))
     assert na.add("s-teachers", raw) == expected
     assert (tmp_path / "s-teachers" / "noauth.domains").read_text() == f"{expected[0]}\n"
 
 
 @pytest.mark.parametrize(
-    "bad", ["", ".", "*.office.com", "office.com/x", "a b.com", "-x.com", "x_y.com", "a" * 64]
+    "bad",
+    [
+        "",
+        ".",
+        "*.office.com",
+        "office.com/x",
+        "a b.com",
+        "-x.com",
+        "x_y.com",
+        "a" * 64,
+        # IP literals in every form squid would see as a host, and single labels (a TLD)
+        "172.28.0.20",
+        "10.0.0.1",
+        "127.1",
+        "0x7f000001",
+        "2887516181",
+        "::1",
+        "[::1]",
+        "::ffff:172.28.0.21",
+        "com",
+        ".com",
+        "intranet",
+    ],
 )
 def test_noauth_add_rejects_invalid_names(tmp_path: Path, bad: str) -> None:
-    na = Blocklist(str(tmp_path), NOAUTH_FILE_NAME)
+    na = noauth_list(str(tmp_path))
     with pytest.raises(ValueError):
         na.add("s-teachers", bad)
     assert not (tmp_path / "s-teachers" / "noauth.domains").exists()
@@ -54,7 +76,7 @@ def test_noauth_add_rejects_invalid_names(tmp_path: Path, bad: str) -> None:
 
 @pytest.mark.parametrize("bad", ["../x", "a/b", "..", "", "a", "a.b", "/etc"])
 def test_noauth_rejects_unsafe_instance_name(tmp_path: Path, bad: str) -> None:
-    na = Blocklist(str(tmp_path / "lists"), NOAUTH_FILE_NAME)
+    na = noauth_list(str(tmp_path / "lists"))
     with pytest.raises(ValueError):
         na.add(bad, "office.com")
     assert not (tmp_path / "x").exists() and not (tmp_path / "lists").exists()
@@ -62,7 +84,7 @@ def test_noauth_rejects_unsafe_instance_name(tmp_path: Path, bad: str) -> None:
 
 def test_both_lists_share_the_directory(tmp_path: Path) -> None:
     root = str(tmp_path)
-    bl, na = Blocklist(root), Blocklist(root, NOAUTH_FILE_NAME)
+    bl, na = Blocklist(root), noauth_list(root)
     bl.add("s-teachers", "blocked.example")
     na.add("s-teachers", "office.com")
     directory = tmp_path / "s-teachers"
@@ -76,6 +98,27 @@ def test_both_lists_share_the_directory(tmp_path: Path) -> None:
     assert not directory.exists()
 
 
+def test_noauth_names_vs_blocklist_names(tmp_path: Path) -> None:
+    # a domain below a TLD with letters in the last label passes, also IDNA and digits inside
+    assert normalize_noauth_domain("1und1.de") == ".1und1.de"
+    assert normalize_noauth_domain("x.co.uk") == ".x.co.uk"
+    # the blocklist keeps accepting a TLD and an address on purpose: a wrong entry there
+    # only blocks more
+    bl = Blocklist(str(tmp_path))
+    assert bl.add("s-teachers", "zip") == [".zip"]
+    assert bl.add("s-teachers", "10.0.0.1") == [".10.0.0.1", ".zip"]
+
+
+def test_noauth_remove_accepts_what_add_refuses(tmp_path: Path) -> None:
+    # a hand-written "com" or address can still be taken out with the CLI
+    file = tmp_path / "s-teachers" / "noauth.domains"
+    file.parent.mkdir()
+    file.write_text(".com\n10.0.0.1\n.office.com\n")
+    na = noauth_list(str(tmp_path))
+    assert na.remove("s-teachers", "com") == [".office.com", "10.0.0.1"]
+    assert na.remove("s-teachers", "10.0.0.1") == [".office.com"]
+
+
 # --------------------------------------------------------------------- API
 
 
@@ -124,10 +167,12 @@ def test_noauth_endpoints(
         "domains": [],
     }
 
-    resp = client.post(
-        f"/v1/instances/{name}/noauth", json={"domain": "not a host"}, headers=auth_headers
-    )
-    assert resp.status_code == 422
+    for bad in ("not a host", "172.28.0.20", "com", "127.1", "::1"):
+        resp = client.post(
+            f"/v1/instances/{name}/noauth", json={"domain": bad}, headers=auth_headers
+        )
+        assert resp.status_code == 422, bad
+    assert file.read_text() == ".office.com\n"
 
     resp = client.post(f"/v1/instances/{name}/noauth/reload", headers=auth_headers)
     assert resp.status_code == 200 and resp.json() == {"name": name, "reloaded": True}
@@ -201,6 +246,8 @@ def test_cli_noauth(patch_client: None, instance_data: dict[str, Any], docker: A
     assert r.exit_code == 0 and '".office.com"' not in r.output
     assert runner.invoke(cli.app, ["noauth", NAME, "remove", "office.com"]).exit_code == 1
     assert runner.invoke(cli.app, ["noauth", NAME, "add", "bad host"]).exit_code == 1
+    assert runner.invoke(cli.app, ["noauth", NAME, "add", "10.0.0.1"]).exit_code == 1
+    assert runner.invoke(cli.app, ["noauth", NAME, "add", "com"]).exit_code == 1
 
 
 def test_cli_noauth_help_warns() -> None:
diff --git a/debian/changelog b/debian/changelog
index 8019cf6..0cc0a98 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,8 +8,9 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     the blocklist. A listed domain and its subdomains are reachable without a
     ticket from --school-subnets only; the blocklist still wins; HTTPS passes
     only when the TLS SNI is on the list too (another SNI or none cuts the
-    handshake); IP addresses never match. Empty by default, so nothing
-    changes until you add a domain. Warning: exam accounts reach listed
+    handshake); IP addresses and single labels (a whole TLD) are refused as
+    entries, and an IP-literal URL never matches. Empty by default, so
+    nothing changes until you add a domain. Warning: exam accounts reach listed
     domains during an exam, the Internetsperre does not apply to them, and
     the access log shows no user for them. A recommended Microsoft 365 list
     with its source is in docs/operations.md. The list needs a data-plane
diff --git a/deploy/e2e/client/assert.sh b/deploy/e2e/client/assert.sh
index f5f3e83..9578d6f 100755
--- a/deploy/e2e/client/assert.sh
+++ b/deploy/e2e/client/assert.sh
@@ -118,6 +118,7 @@ check_via    "noauth: not listed, no ticket -> 407"               "" "$NA" "$ALL
 # squid-noauth knows 172.28.0.21 -> secure.example.internal (extra_hosts = its reverse
 # cache): without dstdomain -n this IP-literal URL would match the list (200, measured).
 check_via    "noauth: IP literal of a listed host -> 407"         "" "$NA" "http://172.28.0.21/" 407
+check_via    "noauth: IP written into the list -> 407"           "" "$NA" "http://172.28.0.20/" 407
 check_via    "noauth: listed AND blocked HTTP, no ticket -> 403"  "" "$NA" "http://both.example.internal/" 403
 check_tunnel "noauth: listed HTTPS, no ticket -> tunnel + TLS"   "" "$NA" "https://secure.example.internal/" "200 200"
 check_tunnel "noauth: not listed HTTPS, no ticket -> 407"         "" "$NA" "https://secure2.example.internal/" "407 000"
diff --git a/deploy/e2e/lists-noauth/noauth.domains b/deploy/e2e/lists-noauth/noauth.domains
index 4b84e41..b038d93 100644
--- a/deploy/e2e/lists-noauth/noauth.domains
+++ b/deploy/e2e/lists-noauth/noauth.domains
@@ -8,4 +8,8 @@
 .a.secure.example.internal
 secure.example.internal
 .secure.example.internal
+# Also hand-written, and ignored by lists-sync.sh for this list: an address (origin) and a
+# single label that would open every *.internal name.
+172.28.0.20
+internal
 .both.example.internal
diff --git a/docs/decisions.md b/docs/decisions.md
index 031657f..9f62efe 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -217,7 +217,9 @@ with `--python-version=3.12`; environment markers then evaluate as on the target
 **Status:** Proposed (2026-10-30, Kevin's request: Microsoft 365 through the proxy, without a
 login, no client-side bypass). **Decision:** each instance may list domains in
 `<blocklists_dir>/<name>/noauth.domains`, managed like the blocklist (`lmnsquid noauth <name>
-list|add|remove|reload`, entries `.example.org` = domain + subdomains). A request to a listed
+list|add|remove|reload`, entries `.example.org` = domain + subdomains; only names below a
+top-level domain: IP literals in any form and single labels are refused, and ignored in the
+container when hand-written). A request to a listed
 domain from `school_net` is allowed **without** proxy authentication; the rules, in order:
 the existing denies (Safe_ports, CONNECT only to 443, no IP literals on CONNECT) stay first;
 `deny noauth_domains blocked_domains` (the blocklist wins, 403); `allow noauth_domains
diff --git a/docs/operations.md b/docs/operations.md
index 9c4dc67..131581b 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -131,12 +131,19 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
 
 - **Rules:** the blocklist wins (a domain on both lists gets **403**; HTTPS is cut). The
   existing rules stay in front (Safe_ports, CONNECT only to 443, no IP literals on CONNECT); an
-  IP-literal URL never matches the list (`dstdomain -n`, no reverse DNS). HTTPS through the
+  IP-literal URL never matches the list (`dstdomain -n`, no reverse DNS; addresses cannot be
+  put on it, see below). HTTPS through the
   list passes only when the TLS **SNI** is on the list too; a different SNI or a ClientHello
   without SNI is **terminated** (no domain fronting into other names; no decryption, ADR-002).
   With a ticket nothing changes (200 / 403 / 407 as before).
 - `add`/`remove` write the file (same format and rules as the blocklist, one `.domain` per
-  line, `#` comments allowed when hand-edited) and take effect on the next **`reload`**. API:
+  line, `#` comments allowed when hand-edited) and take effect on the next **`reload`**.
+  Stricter names than the blocklist: only a domain below a top-level domain, so `add` refuses
+  IP addresses in any form (`10.0.0.1`, `127.1`, `0x7f000001`, IPv6) and single labels such as
+  `com` (they would open an address or a whole TLD); hand-written lines of that kind are
+  ignored by the container and named in `lmnsquid logs <name>`. The blocklist accepts both on
+  purpose: blocking a TLD (`zip`) is a legitimate choice and a wrong entry there only blocks
+  more. API:
   `GET/POST /v1/instances/{name}/noauth`, `DELETE …/noauth/{domain}`, `POST …/noauth/reload`.
 - **`reload` answers 409** when the running container does not read the list: its image
   predates the list (update the instance to a data-plane image that has it, `lmnsquid update
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index 49d2eb7..df33a98 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -134,7 +134,9 @@ acceptance list in `deployment-gpo.md`.
   without the SNI rule the foreign-SNI case fail. `cp-docker-it` (real DockerService): both
   list files exist before the container starts, the new image reads the noauth list and
   reloads, the pinned image is healthy with it and `noauth_active` is false. Unit: name
-  normalization (IDNA, leading dot, invalid names), unsafe instance names, API 401/403 without
+  normalization (IDNA, leading dot, invalid names; IP literals as dotted, short, hex, decimal
+  and IPv6 forms and single labels refused for noauth, accepted for the blocklist; E2E: such
+  hand-written lines ignored and logged, `http://<ip>/` → 407), unsafe instance names, API 401/403 without
   or with a wrong token, 404/422, reload 409 when the container ignores the list or is stopped,
   CLI and `--help` warnings.
 - **Lists squid 6 refuses** (`FATAL: Bungled`: a name covered by a listed parent before it,
diff --git a/docs/threat-model.md b/docs/threat-model.md
index e921cde..b397a75 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -36,7 +36,7 @@ Risks + countermeasures. Grows per roadmap phase; the negative tests for it live
 | T13 | **Access logs = personal data** (browsing behavior, GDPR) | retention = `log_retention_days` (documented deletion period, default 30), gzip-rotated; access logging disableable per instance (`access_log_enabled:false`); log access only via API token, queries into the audit log; no secrets in the log; `lmnsquid rm` deletes the log volume with the instance (`--keep-logs` only on request) | retention/rotation smoke; `access_log none` render test; rm test |
 | T14 | **SNI filter bypass: ECH / QUIC / DoH** | **ECH** (Encrypted Client Hello) encrypts the SNI → splice filter blind; **QUIC/HTTP3** runs over **UDP 443**, bypassing the TCP forward proxy; **DoH** circumvents the DNS view. Limit of name-based filtering — the proxy alone does not close this. **Mitigate at the network edge:** OPNsense **block UDP 443** (forces TCP/443 through the proxy), block known DoH resolvers + `use-application-dns.net` (canary disables Firefox DoH); observe ECH adoption. For real completeness you would need SSL interception (a deliberate non-goal, ADR-002). | firewall review at the site; documented limit |
 | T15 | **Poisoned build input** (supply chain of the `.deb`, installed as root) — a compromised or silently changed PyPI release, build image or GitHub Action lands in the package | Python deps (pip included) only from `controlplane/requirements.lock` with SHA-256 hashes (`--require-hashes --no-deps --only-binary :all:`, wheels only), nothing younger than 7 days picked (`--exclude-newer=P7D`), own wheel built without build isolation from a hashed setuptools; build container, data-plane base image and actions pinned by digest/commit SHA; changes only via human-merged PRs (raised by hand while Renovate is disabled); releases published draft-first (immutable releases) with the asset hash checked against the build (ADR-015) | `lock-deps.sh --gate` first in the fast tier AND in every build, before anything from a lock is installed or run (no venv `bin/` on PATH; `/usr/bin/python3 -I`; every entry point restarts itself under `env -i` through `/bin/bash -p` with an allowlist, `packaging/clean-env.sh`: fixed PATH and `LC_ALL`, the caller's `HOME`, `TMPDIR`, proxies, CA bundles (`SSL_CERT_FILE`, `SSL_CERT_DIR`, `REQUESTS_CA_BUNDLE`, `PIP_CERT`) and the repository's own switches, nothing else; not undone, because it ran before the restart: the caller's first bash for `bash <script>` (`BASH_ENV`, `SHELLOPTS=noexec`), the make running `make deb` (`MAKEFILES`, `MAKEFLAGS`, `GNUMAKEFLAGS`), `LD_PRELOAD` of that first process): only lines uv writes, uv from a uv-only lock proven with the standard library and run by absolute path, every hash one PyPI publishes for exactly that `name==version`, pins exactly the closure of pyproject/`.in` within 7 days, a cp312 wheel for every pin; so a tag on a commit whose lock never passed CI still cannot be built; `--verify-freeze` fails the build unless each venv is exactly its lock (plus lmnsquid / ensurepip's pip), all `name==version`; not caught: a pin moved to another real release of a needed package, older or newer, at least 7 days old and within the declared requirements (review); a wrong hash or an sdist-only pin stops the build; `scripts/tests/lock_gates.sh` (fast tier, `--build` in CI) keeps the manipulations of the cold verification rejected, also from a shell with a poisoned venv; `make deb` packs only tracked files and runs nothing configured in the checkout's git (`scripts/tests/make_deb.sh`) |
-| T16 | **Domains without proxy authentication** (`noauth.domains`, ADR-016) widen access: everyone in the school subnets reaches a listed domain without a ticket. **Exam mode:** exam accounts (and anyone else) reach the listed domains during an exam, e.g. OneDrive, Teams, Outlook for Microsoft 365, although the proxy rejects them otherwise (T12). **Internetsperre:** does not apply to listed domains (no identity, so no group check). **Accountability:** the access log shows `-` instead of a user for these requests. Tunnel abuse: a listed CDN/front-door domain could carry other content (domain fronting) | empty by default, no built-in content; only from `school_net` (keep `--school-subnets` tight, the default `0.0.0.0/0` means "whoever reaches the port"); the blocklist wins (`deny noauth_domains blocked_domains` first, 403); the existing CONNECT rules stay before it (port 443 only, no IP literals); `dstdomain -n` (no reverse DNS for IP-literal URLs, a PTR cannot put an address on the list); a CONNECT on this path is terminated unless its SNI is listed too, and terminated without SNI; no decryption (ADR-002), so fronting via the encrypted Host header inside a listed name's TLS stays possible (as for any splice). Warnings in `operations.md`, `install.md` and `lmnsquid noauth --help` | E2E: listed → 200 / tunnel without ticket; unlisted → 407; listed+blocked → 403; foreign SNI, blocked SNI and no SNI → TLS cut; IP literal with a PTR to a listed name → 407; outside `school_net` → 407; with a ticket the 200/403/407 matrix unchanged; counter-runs without `-n` resp. without the SNI rule fail |
+| T16 | **Domains without proxy authentication** (`noauth.domains`, ADR-016) widen access: everyone in the school subnets reaches a listed domain without a ticket. **Exam mode:** exam accounts (and anyone else) reach the listed domains during an exam, e.g. OneDrive, Teams, Outlook for Microsoft 365, although the proxy rejects them otherwise (T12). **Internetsperre:** does not apply to listed domains (no identity, so no group check). **Accountability:** the access log shows `-` instead of a user for these requests. Tunnel abuse: a listed CDN/front-door domain could carry other content (domain fronting) | empty by default, no built-in content; entries only domains below a TLD (IP literals and single labels such as `com` refused, and ignored when hand-written); only from `school_net` (keep `--school-subnets` tight, the default `0.0.0.0/0` means "whoever reaches the port"); the blocklist wins (`deny noauth_domains blocked_domains` first, 403); the existing CONNECT rules stay before it (port 443 only, no IP literals); `dstdomain -n` (no reverse DNS for IP-literal URLs, a PTR cannot put an address on the list); a CONNECT on this path is terminated unless its SNI is listed too, and terminated without SNI; no decryption (ADR-002), so fronting via the encrypted Host header inside a listed name's TLS stays possible (as for any splice). Warnings in `operations.md`, `install.md` and `lmnsquid noauth --help` | E2E: listed → 200 / tunnel without ticket; unlisted → 407; listed+blocked → 403; foreign SNI, blocked SNI and no SNI → TLS cut; IP literal with a PTR to a listed name → 407; outside `school_net` → 407; with a ticket the 200/403/407 matrix unchanged; counter-runs without `-n` resp. without the SNI rule fail |
 
 ## Non-goals (deliberate)
 
diff --git a/image/lists-sync.sh b/image/lists-sync.sh
index 3a7bc35..fd9c43f 100755
--- a/image/lists-sync.sh
+++ b/image/lists-sync.sh
@@ -11,7 +11,10 @@
 # squid 6 stops with "FATAL: Bungled ... acl ... dstdomain" when a list holds a name that
 # another entry already covers and comes first (".a.example.org" before ".example.org",
 # or "example.org" next to ".example.org"); measured with squid 6.14. Such names are
-# dropped here (the dotted parent matches them anyway) and reported on stderr (docker logs).
+# dropped here (the dotted parent matches them anyway). For the noauth list (ADR-016)
+# entries that are not host names with at least two labels and a non-numeric last label
+# (IP literals, numeric forms, single labels like "com") are dropped as well: they would
+# open far more than a domain. Dropped entries are reported on stderr (docker logs).
 set -eu
 
 SRC=/etc/squid/lists
@@ -42,15 +45,21 @@ uncovered() {
     }'
 }
 
-# sync <name>: a missing file becomes an empty list.
+# sync <name> <kind>: kind "noauth" also drops what is not a multi-label host name.
 sync_list() {
-    name=$1 src="${SRC}/$1" tmp="${DST}/.$1.tmp"
-    if [ -f "${src}" ]; then
-        uncovered < "${src}" 2>"${DST}/.$1.covered" | sort > "${tmp}"
-    else
+    name=$1 kind=$2 src="${SRC}/$1" tmp="${DST}/.$1.tmp"
+    if [ ! -f "${src}" ]; then
         : > "${tmp}"
-        [ "${name}" = noauth.domains ] \
+        [ "${kind}" = noauth ] \
             && echo "linuxmuster-squid: no ${src}, domains without proxy auth: none" >&2
+    elif [ "${kind}" = noauth ]; then
+        sed -e 's/#.*//' "${src}" | awk '{ e = tolower($1); sub(/\.+$/, "", e); if (e != "") print e }' \
+            | awk -v list="${name}" '
+                /^\.?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\.[a-z0-9-]*[a-z][a-z0-9-]*$/ { print; next }
+                { print "linuxmuster-squid: " list ": ignored, not a domain name: " $0 > "/dev/stderr" }' \
+            | uncovered 2>"${DST}/.$1.covered" | sort > "${tmp}"
+    else
+        uncovered < "${src}" 2>"${DST}/.$1.covered" | sort > "${tmp}"
     fi
     if [ -s "${DST}/.$1.covered" ]; then
         echo "linuxmuster-squid: ${name}: $(wc -l < "${DST}/.$1.covered") entries ignored, already covered by a listed parent domain:" \
@@ -61,5 +70,5 @@ sync_list() {
     mv -f "${tmp}" "${DST}/${name}"
 }
 
-sync_list blocked.domains
-sync_list noauth.domains
+sync_list blocked.domains blocklist
+sync_list noauth.domains noauth
diff --git a/scripts/tests/e2e_kerberos.sh b/scripts/tests/e2e_kerberos.sh
index 4b0d473..6163eb2 100755
--- a/scripts/tests/e2e_kerberos.sh
+++ b/scripts/tests/e2e_kerberos.sh
@@ -159,6 +159,11 @@ if $DC logs squid-noauth 2>/dev/null | grep 'entries ignored, already covered' >
 else
   echo "  [FAIL] no notice about covered entries"; rc=$((rc + 1))
 fi
+if $DC logs squid-noauth 2>/dev/null | grep 'noauth.domains: ignored, not a domain name: 172.28.0.20' >/dev/null; then
+  echo "  [PASS] IP literal in noauth.domains ignored and logged"
+else
+  echo "  [FAIL] no notice about the IP literal in noauth.domains"; rc=$((rc + 1))
+fi
 if $DC exec -T squid-noauth sh -c '/usr/local/bin/lists-sync.sh 2>/dev/null && squid -k reconfigure -f /run/lmnsquid/squid.conf'; then
   echo "  [PASS] reload (lists-sync.sh + squid -k reconfigure) with these lists"
 else

From 82f79f4532fa1fb9b7620b710a098efebcd5bca0 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 16:19:13 +0100
Subject: [PATCH 08/24] fix(noauth): accurate 409 text; old-image checks no
 longer follow DEFAULT_IMAGE

Cold verification: the 409 of `noauth reload` and operations.md told the
admin to `lmnsquid update <name>`, which pulls DEFAULT_IMAGE, still the
image without the list, so it cannot help until a release pins a newer
image.

- The 409 says what is true: the instance's data-plane image does not
  support the noauth list, so the list has no effect; a linuxmuster-squid
  release whose pinned image supports it is needed, and its package upgrade
  moves the instances onto that image. operations.md, install.md and
  ADR-016 say the same.
- RELEASE.md: a release whose image/ changed pins that image before it is
  tagged (merge -> build-image.yml on main -> PR raising DEFAULT_IMAGE to the
  reported digest -> CI -> version + tag), with 7.3.8 named as such a
  release. No digest is invented here.
- The E2E service squid-pinned and the integration test used DEFAULT_IMAGE
  as "the image without the list": after the re-pin they would have run an
  image that reads the list and failed (407 expected, 200 got). They are now
  squid-old / test_real_old_image_ignores_the_noauth_list with a constant,
  the digest 7.3.7 pins (d13625b5...), i.e. what instances run until the
  upgrade replaces their containers; deploy/e2e/lists-pinned is now
  lists-old. They need no change for the pin.
---
 RELEASE.md                                    | 15 ++++++++++++++
 controlplane/lmnsquid/api.py                  |  8 ++++----
 controlplane/tests/test_docker_integration.py | 19 ++++++++++++------
 controlplane/tests/test_noauth.py             |  4 +++-
 deploy/e2e/client/assert.sh                   |  8 ++++----
 deploy/e2e/docker-compose.yml                 | 14 ++++++-------
 .../blocked.domains                           |  2 +-
 .../noauth.domains                            |  2 +-
 docs/decisions.md                             |  3 ++-
 docs/install.md                               |  4 ++--
 docs/operations.md                            |  9 ++++++---
 docs/test-strategy.md                         |  7 ++++---
 scripts/tests/e2e_kerberos.sh                 | 20 +++++++++----------
 13 files changed, 71 insertions(+), 44 deletions(-)
 rename deploy/e2e/{lists-pinned => lists-old}/blocked.domains (66%)
 rename deploy/e2e/{lists-pinned => lists-old}/noauth.domains (60%)

diff --git a/RELEASE.md b/RELEASE.md
index 1e143cb..d444a72 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -64,6 +64,21 @@ does not yet exist — every `lmnsquid create --image ghcr.io/…@sha256:<digest
 
 ## Ongoing releases
 
+**A release whose `image/` changed pins that image before it is tagged.** The control plane
+installs and updates instances with `DEFAULT_IMAGE` (`controlplane/lmnsquid/models.py`); a
+changed template that is not pinned never reaches an installed system. Order: merge the change
+→ `build-image.yml` builds and pushes it on `main` (the digest is in the job log, "Report
+digest") → a PR sets `DEFAULT_IMAGE` to that `@sha256:` digest (by hand while Renovate is
+disabled) → CI green → set the changelog version and tag. The package upgrade then moves every
+instance onto the new image (`update-all` in the postinst, health-gated with rollback).
+**7.3.8** is such a release: the noauth list (ADR-016) and `lists-sync.sh` live in the image;
+until the digest is pinned, `lmnsquid noauth <name> reload` answers 409 and the lists still
+reach squid unfiltered. The E2E service `squid-old` and the integration test
+`test_real_old_image_ignores_the_noauth_list` deliberately keep testing the image 7.3.7 pins
+(`…@sha256:d13625b5…`, a constant in `scripts/tests/e2e_kerberos.sh` and
+`controlplane/tests/test_docker_integration.py`), i.e. what instances run until the upgrade
+replaces their containers; they do not follow `DEFAULT_IMAGE` and need no change for the pin.
+
 Code + docs + a `debian/changelog` bullet in the same commit (Conventional Commits) → push →
 CI green (`ci.yml`: fast tier, container build, install smoke, upgrade smoke) → Kevin sets the
 release version in the changelog head and tags `v<version>` → `release.yml` builds, smokes and
diff --git a/controlplane/lmnsquid/api.py b/controlplane/lmnsquid/api.py
index 4aa60dc..856513d 100644
--- a/controlplane/lmnsquid/api.py
+++ b/controlplane/lmnsquid/api.py
@@ -271,10 +271,10 @@ def reload_noauth(name: str) -> dict[str, Any]:
                 raise HTTPException(
                     status_code=status.HTTP_409_CONFLICT,
                     detail=(
-                        f"the running container of {name!r} does not read the noauth list "
-                        "(its image predates the list, or it started without noauth.domains): "
-                        f"update it to an image that supports the list, or `lmnsquid restart "
-                        f"{name}` when it already runs one"
+                        f"the data-plane image of {name!r} does not support the noauth list, "
+                        "so the list has no effect: it needs a linuxmuster-squid release whose "
+                        "pinned data-plane image supports it (the package upgrade moves the "
+                        "instances onto that image)"
                     ),
                 )
             return docker.reload(name)
diff --git a/controlplane/tests/test_docker_integration.py b/controlplane/tests/test_docker_integration.py
index 8af8f39..56a83f0 100644
--- a/controlplane/tests/test_docker_integration.py
+++ b/controlplane/tests/test_docker_integration.py
@@ -20,6 +20,13 @@
 )
 
 IMAGE = os.environ.get("LMNSQUID_IT_IMAGE", "linuxmuster-squid:dev")
+# The data-plane image 7.3.7 pins, the last one without ADR-016: a constant, not DEFAULT_IMAGE,
+# which moves to an image that reads the noauth list before 7.3.8 is tagged.
+OLD_IMAGE = os.environ.get(
+    "LMNSQUID_IT_OLD_IMAGE",
+    "ghcr.io/faircomp/linuxmuster-squid"
+    "@sha256:d13625b51a99d62f14c37d18453092bbde651cb34df080dd49f3937f7f5f46ef",
+)
 
 
 def test_real_container_lifecycle(tmp_path: Path) -> None:
@@ -135,14 +142,14 @@ def test_real_update_auto_rollback(tmp_path: Path) -> None:
         docker.remove(inst.name)
 
 
-def test_real_pinned_image_ignores_the_noauth_list(tmp_path: Path) -> None:
-    """The image installed systems run (DEFAULT_IMAGE) next to a list directory with
-    noauth.domains: it starts healthy, and the noauth reload is refused instead of
-    reporting a reload that changes nothing (ADR-016)."""
+def test_real_old_image_ignores_the_noauth_list(tmp_path: Path) -> None:
+    """An image from before ADR-016 (what installed instances run until the upgrade replaces
+    their containers) next to a list directory with noauth.domains: it starts healthy, and the
+    noauth reload is refused instead of reporting a reload that changes nothing."""
     from lmnsquid.docker_service import DockerService
-    from lmnsquid.models import DEFAULT_IMAGE, Instance
+    from lmnsquid.models import Instance
 
-    old_image = os.environ.get("LMNSQUID_IT_OLD_IMAGE", DEFAULT_IMAGE)
+    old_image = OLD_IMAGE
     secrets = tmp_path / "secrets"
     secrets.mkdir()
     (secrets / "it.keytab").write_bytes(b"dummy-keytab-not-valid")
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index bf20666..2ea7dc2 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -198,7 +198,9 @@ def test_noauth_reload_refuses_an_image_that_ignores_the_list(
     client.post(f"/v1/instances/{name}/noauth", json={"domain": "office.com"}, headers=auth_headers)
     resp = client.post(f"/v1/instances/{name}/noauth/reload", headers=auth_headers)
     assert resp.status_code == 409
-    assert "does not read the noauth list" in resp.json()["detail"]
+    detail = resp.json()["detail"]
+    assert "does not support the noauth list" in detail and "release" in detail
+    assert "lmnsquid update" not in detail  # does not help while DEFAULT_IMAGE is the old one
     assert docker.reloaded == []  # no "reloaded" that changes nothing
     # the blocklist reload is unaffected
     resp = client.post(f"/v1/instances/{name}/blocklist/reload", headers=auth_headers)
diff --git a/deploy/e2e/client/assert.sh b/deploy/e2e/client/assert.sh
index 9578d6f..ea40c2a 100755
--- a/deploy/e2e/client/assert.sh
+++ b/deploy/e2e/client/assert.sh
@@ -141,11 +141,11 @@ check_tunnel "noauth instance: HTTPS not listed (teacher) -> 200" teacher1 "$NA"
 # as an older control plane mounts it) change nothing:
 check_via    "empty list: listed elsewhere, no ticket -> 407"     "" "$PROXY"  "http://secure.example.internal/" 407
 check_via    "no list file: no ticket -> 407"                     "" "$PROXY2" "http://secure.example.internal/" 407
-# The pinned image of installed systems with a directory that holds noauth.domains:
+# The image from before ADR-016 (7.3.7's pin) with a directory that holds noauth.domains:
 PROXY5="http://squid5.example.internal:3128"
-check_via    "pinned image + noauth.domains: no ticket -> 407"    "" "$PROXY5" "http://secure.example.internal/" 407
-check_via    "pinned image + noauth.domains: teacher -> 200"      teacher1 "$PROXY5" "http://secure.example.internal/" 200
-check_via    "pinned image + noauth.domains: student -> 403"      student1 "$PROXY5" "$ALLOWED" 403
+check_via    "old image + noauth.domains: no ticket -> 407"       "" "$PROXY5" "http://secure.example.internal/" 407
+check_via    "old image + noauth.domains: teacher -> 200"         teacher1 "$PROXY5" "http://secure.example.internal/" 200
+check_via    "old image + noauth.domains: student -> 403"         student1 "$PROXY5" "$ALLOWED" 403
 
 echo
 if [ "$fail" -eq 0 ]; then echo "E2E: ALL ASSERTIONS OK"; else echo "E2E: FAILED"; fi
diff --git a/deploy/e2e/docker-compose.yml b/deploy/e2e/docker-compose.yml
index dd84325..e30a54b 100644
--- a/deploy/e2e/docker-compose.yml
+++ b/deploy/e2e/docker-compose.yml
@@ -152,16 +152,16 @@ services:
     cap_add: ["SETUID", "SETGID", "DAC_OVERRIDE", "CHOWN"]
     security_opt: ["no-new-privileges:true"]
 
-  # The image installed systems run (DEFAULT_IMAGE of the control plane, set by
-  # e2e_kerberos.sh) with a list directory that holds noauth.domains: an image that does not
-  # know the list must ignore it and keep asking for a ticket.
-  squid-pinned:
+  # An image from before ADR-016 (the one 7.3.7 pins; set by e2e_kerberos.sh) with a list
+  # directory that holds noauth.domains: what an instance runs until the upgrade replaces its
+  # container. It must ignore the list and keep asking for a ticket.
+  squid-old:
     # (default only for the other smokes that start the DC from this file)
-    image: ${LMNSQUID_PINNED_IMAGE:-linuxmuster-squid:dev}
+    image: ${LMNSQUID_OLD_IMAGE:-linuxmuster-squid:dev}
     hostname: squid5.example.internal
     depends_on: [samba-dc, squid]
     environment:
-      INSTANCE: "e2e-pinned"
+      INSTANCE: "e2e-old"
       VISIBLE_HOSTNAME: "squid5.example.internal"
       REALM: "EXAMPLE.INTERNAL"
       AD_GROUP: "teachers"
@@ -174,7 +174,7 @@ services:
         ipv4_address: 172.28.0.14
     volumes:
       - shared:/shared:ro
-      - ./lists-pinned:/etc/squid/lists:ro
+      - ./lists-old:/etc/squid/lists:ro
     read_only: true
     tmpfs: ["/run", "/tmp", "/var/log/squid", "/var/spool/squid"]
     cap_drop: ["ALL"]
diff --git a/deploy/e2e/lists-pinned/blocked.domains b/deploy/e2e/lists-old/blocked.domains
similarity index 66%
rename from deploy/e2e/lists-pinned/blocked.domains
rename to deploy/e2e/lists-old/blocked.domains
index c7d99cc..555ff1c 100644
--- a/deploy/e2e/lists-pinned/blocked.domains
+++ b/deploy/e2e/lists-old/blocked.domains
@@ -2,6 +2,6 @@
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# Lists of the squid-pinned E2E instance (an image from before ADR-016, which reads the
+# Lists of the squid-old E2E instance (an image from before ADR-016, which reads the
 # mounted files directly, so no entry here may overlap another).
 .blocked.example.com
diff --git a/deploy/e2e/lists-pinned/noauth.domains b/deploy/e2e/lists-old/noauth.domains
similarity index 60%
rename from deploy/e2e/lists-pinned/noauth.domains
rename to deploy/e2e/lists-old/noauth.domains
index 8be60c9..f8ddbcb 100644
--- a/deploy/e2e/lists-pinned/noauth.domains
+++ b/deploy/e2e/lists-old/noauth.domains
@@ -2,5 +2,5 @@
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# The image of squid-pinned predates ADR-016 and must ignore this list.
+# The image of squid-old predates ADR-016 and must ignore this list.
 .secure.example.internal
diff --git a/docs/decisions.md b/docs/decisions.md
index 9f62efe..cf55d4c 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -241,7 +241,8 @@ connections and asks to exempt its required endpoints; a client-side bypass (pro
 **Price (threat model T16):** a listed domain is reachable by everyone in the school subnets
 without identity: exam accounts reach it in exam mode, the Internetsperre does not apply to it,
 and the access log shows `-` instead of a user for it. **Rollout:** the template is in the
-data-plane image; until `DEFAULT_IMAGE` points at an image with this template, the list is
+data-plane image; `DEFAULT_IMAGE` must point at an image built with it before the release
+that ships the control plane is tagged (RELEASE.md). Until then the list is
 ignored and `lmnsquid noauth <name> reload` answers 409 instead of reporting a reload that
 changes nothing (it checks the rendered `squid.conf` in the container). An image with the
 template next to a directory without `noauth.domains` (an older control plane) uses an empty
diff --git a/docs/install.md b/docs/install.md
index d11aad5..6d38e41 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -195,8 +195,8 @@ as well; a different SNI or none cuts the handshake. Check from a client in `<su
 a ticket: `kdestroy; req $P:3129 https://<listed-domain>/` gives 200,
 `req $P:3129 http://example.com/` still 407. The recommended Microsoft 365 list with its source
 and the details: [`operations.md`](operations.md#domains-without-proxy-authentication-per-instance).
-`reload` answers 409 while the instance still runs an image that does not know the list (the
-data-plane image must be updated first).
+`reload` answers 409 while the instance still runs a data-plane image that does not support the
+list; a package release whose pinned image supports it moves the instances onto it.
 
 ## 9. Clients
 
diff --git a/docs/operations.md b/docs/operations.md
index 131581b..14011f4 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -145,9 +145,12 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
   purpose: blocking a TLD (`zip`) is a legitimate choice and a wrong entry there only blocks
   more. API:
   `GET/POST /v1/instances/{name}/noauth`, `DELETE …/noauth/{domain}`, `POST …/noauth/reload`.
-- **`reload` answers 409** when the running container does not read the list: its image
-  predates the list (update the instance to a data-plane image that has it, `lmnsquid update
-  <name>`). Without that check a reload would report success and change nothing.
+- **`reload` answers 409** when the instance's data-plane image does not support the list
+  (an image from before the list). That is a release matter, not an admin step: a
+  linuxmuster-squid release whose pinned image supports the list moves the instances onto it
+  when the package is upgraded (`update-all` in the postinst); `lmnsquid update <name>` only
+  helps once such a release is installed. Without that check a reload would report success and
+  change nothing.
   `blocklist reload` is not affected. A `noauth.domains` created after the container started
   (an older control plane) is picked up by the next reload.
 - **What `lmnsquid rm` removes:** the directory with both lists.
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index df33a98..610eb91 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -128,12 +128,13 @@ acceptance list in `deployment-gpo.md`.
   outside `school_net` → 407 (HTTP and CONNECT, squidclient from another container); with a
   ticket the 200/403/407 matrix is unchanged on that instance. Empty list (`squid`) and a list
   directory without `noauth.domains` (`squid2`, as an older control plane mounts it) → 407 as
-  before, the latter logs a notice. The pinned image of installed systems (`squid-pinned`,
-  `DEFAULT_IMAGE` from `models.py`) next to a directory with `noauth.domains`: unchanged
+  before, the latter logs a notice. The image from before ADR-016 (`squid-old`, the digest
+  7.3.7 pins, a constant that does not follow `DEFAULT_IMAGE`) next to a directory with
+  `noauth.domains`: unchanged
   (407 without ticket, 200/403 with). Counter-runs: without `-n` the IP-literal case and
   without the SNI rule the foreign-SNI case fail. `cp-docker-it` (real DockerService): both
   list files exist before the container starts, the new image reads the noauth list and
-  reloads, the pinned image is healthy with it and `noauth_active` is false. Unit: name
+  reloads, the image from before ADR-016 is healthy with it and `noauth_active` is false. Unit: name
   normalization (IDNA, leading dot, invalid names; IP literals as dotted, short, hex, decimal
   and IPv6 forms and single labels refused for noauth, accepted for the blocklist; E2E: such
   hand-written lines ignored and logged, `http://<ip>/` → 407), unsafe instance names, API 401/403 without
diff --git a/scripts/tests/e2e_kerberos.sh b/scripts/tests/e2e_kerberos.sh
index 6163eb2..da3a603 100755
--- a/scripts/tests/e2e_kerberos.sh
+++ b/scripts/tests/e2e_kerberos.sh
@@ -23,13 +23,11 @@ dcx(){ $DC exec -T samba-dc "$@"; }        # exec in the DC, no TTY
 cleanup(){ $DC down -v --remove-orphans >/dev/null 2>&1 || true; }
 trap cleanup EXIT
 
-# The image installed systems run: DEFAULT_IMAGE of the control plane (squid-pinned service).
-LMNSQUID_PINNED_IMAGE="$(sed -n 's/^ *"\(ghcr\.io\/[^"]*\)"$/\1/p; s/^ *"\(@sha256:[0-9a-f]*\)"$/\1/p' \
-  "$ROOT/controlplane/lmnsquid/models.py" | tr -d '\n')"
-case "$LMNSQUID_PINNED_IMAGE" in
-  ghcr.io/*@sha256:*) export LMNSQUID_PINNED_IMAGE ;;
-  *) echo "cannot read DEFAULT_IMAGE from models.py (got '$LMNSQUID_PINNED_IMAGE')"; exit 1 ;;
-esac
+# squid-old: the data-plane image 7.3.7 pins, the last one without ADR-016 (lists-sync.sh,
+# noauth). A constant on purpose, not DEFAULT_IMAGE: it stands for what installed instances run
+# until the upgrade replaces their containers, and DEFAULT_IMAGE moves to an image that reads
+# the noauth list before 7.3.8 is tagged (RELEASE.md).
+export LMNSQUID_OLD_IMAGE="ghcr.io/faircomp/linuxmuster-squid@sha256:d13625b51a99d62f14c37d18453092bbde651cb34df080dd49f3937f7f5f46ef"
 
 log "reset"
 $DC down -v --remove-orphans >/dev/null 2>&1 || true
@@ -83,7 +81,7 @@ dcx samba-tool group addmembers schule2-internet inetor          >/dev/null 2>&1
 dcx samba-tool spn   add "HTTP/squid3.$DLC" squidsvc             >/dev/null 2>&1 || true
 dcx samba-tool dns add 127.0.0.1 "$DLC" squid3 A 172.28.0.12    -U "Administrator%$PW" >/dev/null 2>&1 || true
 
-# Domains without proxy auth (ADR-016): squid4 = squid-noauth, squid5 = the pinned image;
+# Domains without proxy auth (ADR-016): squid4 = squid-noauth, squid5 = squid-old (image from before ADR-016);
 # more names on the HTTPS origin (a listed subdomain, an unlisted name).
 dcx samba-tool spn   add "HTTP/squid4.$DLC" squidsvc             >/dev/null 2>&1 || true
 dcx samba-tool spn   add "HTTP/squid5.$DLC" squidsvc             >/dev/null 2>&1 || true
@@ -92,8 +90,8 @@ dcx samba-tool dns add 127.0.0.1 "$DLC" squid5 A 172.28.0.14    -U "Administrato
 dcx samba-tool dns add 127.0.0.1 "$DLC" www.secure A 172.28.0.21 -U "Administrator%$PW" >/dev/null 2>&1 || true
 dcx samba-tool dns add 127.0.0.1 "$DLC" secure2 A 172.28.0.21   -U "Administrator%$PW" >/dev/null 2>&1 || true
 
-log "start origin + origin-https + squid + squid2 + squid-inet + squid-noauth + squid-pinned"
-$DC up -d origin origin-https squid squid2 squid-inet squid-noauth squid-pinned || exit 1
+log "start origin + origin-https + squid + squid2 + squid-inet + squid-noauth + squid-old"
+$DC up -d origin origin-https squid squid2 squid-inet squid-noauth squid-old || exit 1
 
 wait_healthy() {
   local svc="$1" ready=0 st=none cid
@@ -110,7 +108,7 @@ wait_healthy squid     || exit 1
 wait_healthy squid2    || exit 1
 wait_healthy squid-inet || exit 1
 wait_healthy squid-noauth || exit 1
-wait_healthy squid-pinned || exit 1
+wait_healthy squid-old || exit 1
 
 log "run assertions (test-client)"
 $DC run --rm test-client

From 4a1460323735f88e236a968af9c9e3fd3531c8f3 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 16:21:00 +0100
Subject: [PATCH 09/24] fix(discover-ad-facts): compare REALM
 case-insensitively, print it upper-case

Cold verification: REALM=example.internal (right realm, lower case) printed
a WARNING about a different realm. A given REALM is now upper-cased before
it is compared with the DC's realm and, without a readable DC realm, before
it goes into the commands: AD Kerberos realms are the DNS domain in upper
case. discover_ad_facts_smoke.sh: lower-case REALM -> no warning, realm
printed upper-case.
---
 scripts/discover-ad-facts.sh             | 3 ++-
 scripts/tests/discover_ad_facts_smoke.sh | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/discover-ad-facts.sh b/scripts/discover-ad-facts.sh
index a4c2282..842b376 100755
--- a/scripts/discover-ad-facts.sh
+++ b/scripts/discover-ad-facts.sh
@@ -18,7 +18,8 @@ set -uo pipefail
 command -v samba-tool >/dev/null 2>&1 \
     || { echo "samba-tool not found — run this script on the Samba-DC." >&2; exit 2; }
 
-GIVEN_REALM="${REALM:-}"
+# Kerberos realms of AD are the DNS domain in upper case: compare and print them that way.
+GIVEN_REALM="$(printf '%s' "${REALM:-}" | tr '[:lower:]' '[:upper:]')"
 DC_REALM="$(testparm -s --parameter-name=realm 2>/dev/null | tr '[:lower:]' '[:upper:]' | tr -d '[:space:]')"
 if [ -n "$DC_REALM" ]; then
     REALM="$DC_REALM"
diff --git a/scripts/tests/discover_ad_facts_smoke.sh b/scripts/tests/discover_ad_facts_smoke.sh
index bdcf616..1b0e71b 100755
--- a/scripts/tests/discover_ad_facts_smoke.sh
+++ b/scripts/tests/discover_ad_facts_smoke.sh
@@ -61,6 +61,9 @@ dcx env REALM=EXAMPLE bash /tmp/disc.sh > /tmp/disc_wrong.txt 2>/tmp/disc_wrong.
 grep -q "WARNING: REALM='EXAMPLE' differs" /tmp/disc_wrong.err && pass "wrong REALM: warning" || bad "wrong REALM: no warning"
 grep -q -- '--realm EXAMPLE ' /tmp/disc_wrong.txt && bad "wrong REALM used in the commands" || pass "wrong REALM not used"
 grep -q -- '--realm EXAMPLE.INTERNAL ' /tmp/disc_wrong.txt && pass "wrong REALM: DC realm used" || bad "wrong REALM: DC realm not used"
+dcx env REALM=example.internal bash /tmp/disc.sh > /tmp/disc_lower.txt 2>/tmp/disc_lower.err
+grep -q WARNING /tmp/disc_lower.err && bad "lower-case REALM: spurious warning" || pass "lower-case REALM: no warning"
+grep -q -- '--realm EXAMPLE.INTERNAL ' /tmp/disc_lower.txt && pass "lower-case REALM: printed upper-case" || bad "lower-case REALM: realm not upper-case"
 dcx env PROXY_FQDN=squid.example.internal bash /tmp/disc.sh > /tmp/disc_fqdn.txt 2>/dev/null
 grep -q -- '--visible-hostname squid.example.internal' /tmp/disc_fqdn.txt \
   && pass "PROXY_FQDN overrides the host name" || bad "PROXY_FQDN ignored"

From 285956afd5d9c3f7751385033542ce7ad675a967 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 16:21:00 +0100
Subject: [PATCH 10/24] fix(provision-keytab): say why when ldbsearch fails

Cold verification: with a sam.ldb ldbsearch cannot read, the script ended
with exit 1 through set -e/pipefail and printed nothing, so the admin saw no
reason. Each conflict query now captures ldbsearch's exit status and output;
on failure it prints "FATAL: ldbsearch on <sam.ldb> failed, cannot check for
conflicting SPNs:" with ldbsearch's message, says nothing was changed and
exits 1 before any change or export (still fail-closed).
provision_keytab_smoke.sh case H: a non-ldb file as SAM_LDB -> FATAL with
the reason, no keytab. keytab-and-dns.md and the changelog bullet say so.
---
 debian/changelog                        |  6 +++---
 docs/keytab-and-dns.md                  |  3 ++-
 scripts/provision-keytab.sh             |  9 +++++++--
 scripts/tests/provision_keytab_smoke.sh | 11 +++++++++++
 4 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 0cc0a98..b11979e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -25,9 +25,9 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     run, also when the SPN is already on the service account, it now looks
     for HTTP/<fqdn>, host/<fqdn> and host/<short-name> on other accounts and
     stops with FATAL and a hint (devices.csv role iponly) before it changes or
-    exports anything. It also stops when it cannot check (no ldbsearch or no
-    read access to sam.ldb) and refuses an argument that is not a fully
-    qualified host name.
+    exports anything. It also stops when it cannot check (no ldbsearch, no
+    read access to sam.ldb, or ldbsearch failing, with its message) and
+    refuses an argument that is not a fully qualified host name.
   * discover-ad-facts.sh reads the realm on the DC (smb.conf realm, via
     testparm) instead of trusting REALM: a REALM given in the environment is
     only compared, and a mismatch prints a WARNING (a short REALM such as
diff --git a/docs/keytab-and-dns.md b/docs/keytab-and-dns.md
index 2da94cd..09eb400 100644
--- a/docs/keytab-and-dns.md
+++ b/docs/keytab-and-dns.md
@@ -82,7 +82,8 @@ file; the control plane does **not** provision it itself (least privilege).
   `HTTP/<fqdn>`, `host/<fqdn>` and `host/<short-name>` on any other account on every run (also
   when the SPN is already on the service account) and stops with `FATAL`, exit ≠ 0, before it
   changes or exports anything. Without `ldbsearch` (package `ldb-tools`, a dependency of
-  linuxmuster-base7) or read access to `sam.ldb` it stops as well.
+  linuxmuster-base7), without read access to `sam.ldb` or when `ldbsearch` fails it stops as
+  well, with the reason.
 
 ## DNS & time requirements (hard)
 
diff --git a/scripts/provision-keytab.sh b/scripts/provision-keytab.sh
index bf59f3f..44f2978 100755
--- a/scripts/provision-keytab.sh
+++ b/scripts/provision-keytab.sh
@@ -44,8 +44,13 @@ account_lc=$(printf '%s' "${ACCOUNT%\$}" | tr '[:upper:]' '[:lower:]')
 conflict=0
 echo "== check ${SPN}, host/${FQDN}, host/${SHORT} on other accounts =="
 for spn in "${SPN}" "host/${FQDN}" "host/${SHORT}"; do
-    owners=$(ldbsearch -H "${SAM_LDB}" "(servicePrincipalName=${spn})" sAMAccountName \
-        2>/dev/null | awk '/^sAMAccountName:/ {print $2}')
+    if ! found=$(ldbsearch -H "${SAM_LDB}" "(servicePrincipalName=${spn})" sAMAccountName 2>&1); then
+        echo "FATAL: ldbsearch on ${SAM_LDB} failed, cannot check for conflicting SPNs:" >&2
+        printf '%s\n' "${found}" | sed 's/^/       /' >&2
+        echo "       Nothing was changed and no keytab was exported." >&2
+        exit 1
+    fi
+    owners=$(printf '%s\n' "${found}" | awk '/^sAMAccountName:/ {print $2}')
     for owner in ${owners}; do
         owner_lc=$(printf '%s' "${owner%\$}" | tr '[:upper:]' '[:lower:]')
         [ "${owner_lc}" = "${account_lc}" ] && continue
diff --git a/scripts/tests/provision_keytab_smoke.sh b/scripts/tests/provision_keytab_smoke.sh
index 5c9722f..f76ab82 100755
--- a/scripts/tests/provision_keytab_smoke.sh
+++ b/scripts/tests/provision_keytab_smoke.sh
@@ -99,5 +99,16 @@ echo "== G: not a host name -> abort before any LDAP query =="
 if dcx bash /tmp/pk.sh 'x)(servicePrincipalName=*' ktsvc1 /tmp/kt4.keytab; then bad "filter injection accepted"; else pass "invalid FQDN refused"; fi
 if dcx bash /tmp/pk.sh proxy ktsvc1 /tmp/kt4.keytab; then bad "short name accepted"; else pass "short name refused (FQDN required)"; fi
 
+echo "== H: sam.ldb that ldbsearch cannot read -> FATAL with a reason, no export =="
+dcx sh -c 'echo "not an ldb" > /tmp/broken.ldb'
+dcx env SAM_LDB=/tmp/broken.ldb bash /tmp/pk.sh kproxy.example.internal ktsvc3 /tmp/kt5.keytab > /tmp/pk_h.out 2>&1
+hrc=$?
+if [ "$hrc" -ne 0 ] && grep -q 'FATAL: ldbsearch on /tmp/broken.ldb failed' /tmp/pk_h.out; then
+  pass "broken sam.ldb: FATAL with the reason (exit $hrc)"
+else
+  bad "broken sam.ldb: exit $hrc, output: $(tr '\n' ' ' < /tmp/pk_h.out)"
+fi
+if dcx test -e /tmp/kt5.keytab; then bad "broken sam.ldb: keytab exported"; else pass "broken sam.ldb: no keytab"; fi
+
 echo "== provision-keytab smoke: $fail errors =="
 exit "$fail"

From 13a953923c5cc33ca4483e0cfc7249fdd03446fd Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Fri, 30 Oct 2026 16:21:24 +0100
Subject: [PATCH 11/24] test(run.sh): run the provision-keytab and
 discover-ad-facts smokes in e2e

Cold verification: provision_keytab_smoke.sh and discover_ad_facts_smoke.sh,
which carry the tests of the two admin-script fixes, ran in no run.sh mode
and in no CI job. `run.sh e2e` (and so `all`) now runs them after the
Kerberos suite, one after the other (each starts and removes its own Samba
DC from the same compose file), with the usual dependency gate on docker.
No GitHub CI job: the heavy tier stays out of ci.yml, and a new job would be
a new required check of the main ruleset. test-strategy.md says so.
---
 docs/test-strategy.md | 6 +++++-
 scripts/tests/run.sh  | 4 ++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index 610eb91..a51e016 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -78,7 +78,11 @@ from the caller's PATH.
 ## Heavy tier — Kerberos E2E (Docker)
 
 docker-compose stack: `samba-dc` + `squid` + `origin` + `test-client` (details in
-the `/test` skill). **Core proof** (P1), assertions on `%{http_code}`:
+the `/test` skill). `run.sh e2e` (and `all`) also runs the admin-script smokes against the
+same Samba DC image: `provision_keytab_smoke.sh` (SPN/alias conflicts, idempotence, fail-closed
+cases) and `discover_ad_facts_smoke.sh` (groups, realm from the DC, templates). Not in GitHub
+CI: the heavy tier stays out of it (`ci.yml` header), and a new job would be a new required
+check of the `main` ruleset. **Core proof** (P1), assertions on `%{http_code}`:
 
 | Case | Action | Expectation |
 |---|---|---|
diff --git a/scripts/tests/run.sh b/scripts/tests/run.sh
index 739cea0..f485505 100755
--- a/scripts/tests/run.sh
+++ b/scripts/tests/run.sh
@@ -124,6 +124,10 @@ e2e(){
   else
     skip "kerberos-e2e" "scripts/tests/e2e_kerberos.sh missing (comes in P1)"
   fi
+  # The admin scripts against the E2E Samba DC (each starts and removes its own DC from the
+  # same compose file, so they run one after the other, after the Kerberos suite).
+  run_step "provision-keytab-smoke" docker bash scripts/tests/provision_keytab_smoke.sh
+  run_step "discover-ad-facts-smoke" docker bash scripts/tests/discover_ad_facts_smoke.sh
   # Docker directly, or via sudo when the user is not (yet) in the docker group (crabbox).
   local asroot=(); docker info >/dev/null 2>&1 || asroot=(sudo)
   # Build broken image (FROM :dev) for the auto-rollback test.

From 468efe45fbb6be3442c2067d40b5a21d7556cb35 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:35:40 +0100
Subject: [PATCH 12/24] fix(noauth): refuse IPv4 in every inet_aton notation,
 identically in the image

Cold verification 2: dotted forms with hex labels (0x7f.0x1, 1.2.3.0x4,
0x0a.0x00.0x00.0x01) passed `noauth add` and lists-sync.sh, because both only
required a non-numeric last label and "0x4" contains a letter. squid
normalises numeric hosts, so they did not open anything (measured 407), but
operations.md, ADR-016 and the changelog promise "IP addresses in any form".

normalize_noauth_domain() and lists-sync.sh now also refuse a name whose
labels are all inet_aton numbers (decimal, octal, 0x-hex). Names with such
labels next to a real one (0xcafe.com, 10.0.0.example, 1und1.de) still pass.

controlplane/tests/test_lists_sync.py runs image/lists-sync.sh as it is
(sh + awk; LISTS_SYNC_SRC/LISTS_SYNC_DST point it at a temp dir) and
normalize_noauth_domain on the same 24 cases (every IPv4 notation, IPv6,
single labels, valid names) and requires the same verdict, plus the
covered-entry rule against uncovered(). It is part of pytest, so CI runs it
in the existing fast job. Counter-check: with the Python half reverted,
exactly the five dotted hex cases fail.

Docs: operations.md, ADR-016 and test-strategy name the rule; the changelog
bullet mentions the notations.
---
 controlplane/lmnsquid/blocklist.py    |   5 +-
 controlplane/tests/test_lists_sync.py | 100 ++++++++++++++++++++++++++
 controlplane/tests/test_noauth.py     |   4 ++
 debian/changelog                      |   5 +-
 docs/decisions.md                     |   4 +-
 docs/operations.md                    |   4 +-
 docs/test-strategy.md                 |   7 +-
 image/lists-sync.sh                   |  17 +++--
 8 files changed, 136 insertions(+), 10 deletions(-)
 create mode 100644 controlplane/tests/test_lists_sync.py

diff --git a/controlplane/lmnsquid/blocklist.py b/controlplane/lmnsquid/blocklist.py
index 23f5729..74e9da6 100644
--- a/controlplane/lmnsquid/blocklist.py
+++ b/controlplane/lmnsquid/blocklist.py
@@ -30,6 +30,7 @@
 # One DNS name (labels of letters/digits/hyphens), after IDNA encoding and lower-casing.
 _LABEL = r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?"
 _DOMAIN_RE = re.compile(rf"^{_LABEL}(?:\.{_LABEL})*$")
+_INET_ATON_PART = re.compile(r"^(?:0x[0-9a-f]*|[0-9]+)$")
 
 
 def normalize_domain(value: str) -> str:
@@ -64,7 +65,9 @@ def normalize_noauth_domain(value: str) -> str:
     labels = entry[1:].split(".")
     if len(labels) < 2:
         raise ValueError(f"{value!r} is not a domain below a top-level domain")
-    if labels[-1].isdigit():
+    # Every label an inet_aton number (decimal, octal, 0x-hex): an IPv4 address in some
+    # notation (1.2.3.0x4, 0x7f.0x1). Same rule as image/lists-sync.sh.
+    if labels[-1].isdigit() or all(_INET_ATON_PART.match(label) for label in labels):
         raise ValueError(f"{value!r} looks like an IP address, not a domain")
     return entry
 
diff --git a/controlplane/tests/test_lists_sync.py b/controlplane/tests/test_lists_sync.py
new file mode 100644
index 0000000..61bbacb
--- /dev/null
+++ b/controlplane/tests/test_lists_sync.py
@@ -0,0 +1,100 @@
+# SPDX-FileCopyrightText: Kevin Stenzel
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""image/lists-sync.sh as it is (sh + awk + sort), next to the Python rules it must match.
+
+The control plane refuses a noauth entry with :func:`normalize_noauth_domain`; the container
+ignores a hand-written one with lists-sync.sh. Both must agree, so every case here goes
+through both.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from lmnsquid.blocklist import normalize_noauth_domain, uncovered
+
+SCRIPT = Path(__file__).resolve().parents[2] / "image" / "lists-sync.sh"
+
+pytestmark = pytest.mark.skipif(
+    not all(shutil.which(tool) for tool in ("sh", "awk", "sort", "sed")),
+    reason="needs sh, awk, sort and sed",
+)
+
+
+def _sync(tmp_path: Path, blocked: bytes = b"", noauth: bytes | None = None) -> tuple[Path, str]:
+    src, dst = tmp_path / "src", tmp_path / "dst"
+    src.mkdir(exist_ok=True)
+    (src / "blocked.domains").write_bytes(blocked)
+    if noauth is not None:
+        (src / "noauth.domains").write_bytes(noauth)
+    env = {**os.environ, "LISTS_SYNC_SRC": str(src), "LISTS_SYNC_DST": str(dst)}
+    done = subprocess.run(
+        ["sh", str(SCRIPT)], env=env, capture_output=True, text=True, check=True, timeout=60
+    )
+    return dst, done.stderr
+
+
+def _python_accepts(name: str) -> bool:
+    try:
+        normalize_noauth_domain(name)
+    except ValueError:
+        return False
+    return True
+
+
+@pytest.mark.parametrize(
+    "name",
+    [
+        # IPv4 in inet_aton notations: dotted, short, decimal, octal, hex, mixed
+        "172.28.0.20",
+        "127.1",
+        "2887516181",
+        "0177.0.0.1",
+        "0x7f000001",
+        "0x7f.0x1",
+        "1.2.3.0x4",
+        "0x0a.0x00.0x00.0x01",
+        "0xac.0x1c.0x0.0x15",
+        "172.28.0.0x15",
+        # single labels, IPv6, not a name
+        "com",
+        ".com",
+        "localhost",
+        "::1",
+        "fe80::1",
+        "*.example.org",
+        "x_y.example.org",
+        # names that must pass: hex-looking or numeric labels next to a real label
+        "office.com",
+        ".sharepoint.com",
+        "0xcafe.com",
+        "1und1.de",
+        "10.0.0.example",
+        "x.co.uk",
+        "xn--bcher-kva.de",
+    ],
+)
+def test_python_and_lists_sync_agree(tmp_path: Path, name: str) -> None:
+    dst, stderr = _sync(tmp_path, noauth=f"{name}\n".encode())
+    kept = (dst / "noauth.domains").read_text().split()
+    assert bool(kept) is _python_accepts(name), (name, kept, stderr)
+    if not kept:
+        assert f"ignored, not a domain name: {name.lower()}" in stderr
+
+
+def test_covered_entries_like_python(tmp_path: Path) -> None:
+    raw = [".a.example.org", "example.org", ".example.org", "B.Example.Org.", ".other.org"]
+    dst, stderr = _sync(tmp_path, blocked="\n".join(raw).encode() + b"\n")
+    assert sorted((dst / "blocked.domains").read_text().split()) == uncovered(raw)
+    assert "already covered by a listed parent domain" in stderr
+
+
+def test_missing_noauth_file_is_an_empty_list(tmp_path: Path) -> None:
+    dst, stderr = _sync(tmp_path, blocked=b".example.org\n")
+    assert (dst / "noauth.domains").read_text() == ""
+    assert "domains without proxy auth: none" in stderr
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index 2ea7dc2..b416137 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -58,6 +58,10 @@ def test_noauth_add_normalizes(tmp_path: Path, raw: str, expected: list[str]) ->
         "10.0.0.1",
         "127.1",
         "0x7f000001",
+        "0x7f.0x1",
+        "1.2.3.0x4",
+        "0x0a.0x00.0x00.0x01",
+        "0177.0.0.1",
         "2887516181",
         "::1",
         "[::1]",
diff --git a/debian/changelog b/debian/changelog
index b11979e..cd5bf94 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,8 +8,9 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     the blocklist. A listed domain and its subdomains are reachable without a
     ticket from --school-subnets only; the blocklist still wins; HTTPS passes
     only when the TLS SNI is on the list too (another SNI or none cuts the
-    handshake); IP addresses and single labels (a whole TLD) are refused as
-    entries, and an IP-literal URL never matches. Empty by default, so
+    handshake); IP addresses in any notation (also 0x7f.0x1 or 1.2.3.0x4)
+    and single labels (a whole TLD) are refused as entries, and an
+    IP-literal URL never matches. Empty by default, so
     nothing changes until you add a domain. Warning: exam accounts reach listed
     domains during an exam, the Internetsperre does not apply to them, and
     the access log shows no user for them. A recommended Microsoft 365 list
diff --git a/docs/decisions.md b/docs/decisions.md
index cf55d4c..a9fc155 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -218,7 +218,9 @@ with `--python-version=3.12`; environment markers then evaluate as on the target
 login, no client-side bypass). **Decision:** each instance may list domains in
 `<blocklists_dir>/<name>/noauth.domains`, managed like the blocklist (`lmnsquid noauth <name>
 list|add|remove|reload`, entries `.example.org` = domain + subdomains; only names below a
-top-level domain: IP literals in any form and single labels are refused, and ignored in the
+top-level domain: IP literals in any form (IPv6; IPv4 in every `inet_aton` notation, i.e. a
+name whose labels are all decimal, octal or `0x` numbers) and single labels are refused, and
+ignored in the
 container when hand-written). A request to a listed
 domain from `school_net` is allowed **without** proxy authentication; the rules, in order:
 the existing denies (Safe_ports, CONNECT only to 443, no IP literals on CONNECT) stay first;
diff --git a/docs/operations.md b/docs/operations.md
index 14011f4..16f20ce 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -139,7 +139,9 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
 - `add`/`remove` write the file (same format and rules as the blocklist, one `.domain` per
   line, `#` comments allowed when hand-edited) and take effect on the next **`reload`**.
   Stricter names than the blocklist: only a domain below a top-level domain, so `add` refuses
-  IP addresses in any form (`10.0.0.1`, `127.1`, `0x7f000001`, IPv6) and single labels such as
+  IP addresses in any form (IPv6, and every IPv4 notation `inet_aton` reads: `10.0.0.1`,
+  `127.1`, `0x7f000001`, `0x7f.0x1`, `1.2.3.0x4`; refused is any name whose labels are all
+  decimal, octal or `0x` numbers) and single labels such as
   `com` (they would open an address or a whole TLD); hand-written lines of that kind are
   ignored by the container and named in `lmnsquid logs <name>`. The blocklist accepts both on
   purpose: blocking a TLD (`zip`) is a legitimate choice and a wrong entry there only blocks
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index a51e016..e57d6a7 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -139,11 +139,16 @@ acceptance list in `deployment-gpo.md`.
   without the SNI rule the foreign-SNI case fail. `cp-docker-it` (real DockerService): both
   list files exist before the container starts, the new image reads the noauth list and
   reloads, the image from before ADR-016 is healthy with it and `noauth_active` is false. Unit: name
-  normalization (IDNA, leading dot, invalid names; IP literals as dotted, short, hex, decimal
+  normalization (IDNA, leading dot, invalid names; IP literals as dotted, short, hex, dotted hex
+  (`0x7f.0x1`, `1.2.3.0x4`), octal, decimal
   and IPv6 forms and single labels refused for noauth, accepted for the blocklist; E2E: such
   hand-written lines ignored and logged, `http://<ip>/` → 407), unsafe instance names, API 401/403 without
   or with a wrong token, 404/422, reload 409 when the container ignores the list or is stopped,
   CLI and `--help` warnings.
+- **Python and the image agree:** `controlplane/tests/test_lists_sync.py` runs
+  `image/lists-sync.sh` itself (sh + awk) and `normalize_noauth_domain` on the same cases (every
+  IPv4 notation, IPv6, single labels, valid names with numeric or hex-looking labels) and
+  requires the same verdict; the covered-entry rule likewise against `uncovered()`.
 - **Lists squid 6 refuses** (`FATAL: Bungled`: a name covered by a listed parent before it,
   or the bare apex next to it), both lists: unit (`uncovered`, `add` keeps the parent and
   drops what it covers, a hand-edited file is cleaned on the next write), blocklist smoke
diff --git a/image/lists-sync.sh b/image/lists-sync.sh
index fd9c43f..ac32f75 100755
--- a/image/lists-sync.sh
+++ b/image/lists-sync.sh
@@ -17,8 +17,9 @@
 # open far more than a domain. Dropped entries are reported on stderr (docker logs).
 set -eu
 
-SRC=/etc/squid/lists
-DST=/run/lmnsquid/lists
+# (Overridable only so that controlplane/tests/test_lists_sync.py can run this file as is.)
+SRC="${LISTS_SYNC_SRC:-/etc/squid/lists}"
+DST="${LISTS_SYNC_DST:-/run/lmnsquid/lists}"
 mkdir -p "${DST}"
 chmod 0755 "${DST}"
 
@@ -45,7 +46,9 @@ uncovered() {
     }'
 }
 
-# sync <name> <kind>: kind "noauth" also drops what is not a multi-label host name.
+# sync <name> <kind>: kind "noauth" also drops what is not a multi-label host name, and a
+# name whose labels are all inet_aton numbers (decimal, octal, 0x-hex: 1.2.3.0x4, 0x7f.0x1),
+# i.e. an IPv4 address in any notation (same rule as normalize_noauth_domain in Python).
 sync_list() {
     name=$1 kind=$2 src="${SRC}/$1" tmp="${DST}/.$1.tmp"
     if [ ! -f "${src}" ]; then
@@ -55,7 +58,13 @@ sync_list() {
     elif [ "${kind}" = noauth ]; then
         sed -e 's/#.*//' "${src}" | awk '{ e = tolower($1); sub(/\.+$/, "", e); if (e != "") print e }' \
             | awk -v list="${name}" '
-                /^\.?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\.[a-z0-9-]*[a-z][a-z0-9-]*$/ { print; next }
+                function numeric(name,    n, i, l) {
+                    n = split(name, l, ".")
+                    for (i = 1; i <= n; i++)
+                        if (l[i] != "" && l[i] !~ /^(0x[0-9a-f]*|[0-9]+)$/) return 0
+                    return 1
+                }
+                /^\.?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\.[a-z0-9-]*[a-z][a-z0-9-]*$/ && !numeric($0) { print; next }
                 { print "linuxmuster-squid: " list ": ignored, not a domain name: " $0 > "/dev/stderr" }' \
             | uncovered 2>"${DST}/.$1.covered" | sort > "${tmp}"
     else

From 10a4d0b79f45fcaed02c1a2e5712bd23cbcc13fd Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:36:18 +0100
Subject: [PATCH 13/24] fix(lists): accept CRLF line endings in a hand-edited
 noauth.domains

Cold verification 2: a noauth.domains saved with Windows line endings was
ignored completely: the noauth branch of lists-sync.sh kept the \r in each
entry, so every line failed the name check ("ignored, not a domain name:
.office.com" with an invisible \r) and the effective list was empty. The
blocklist branch already stripped it. Both branches now drop \r before the
first field is taken.

Tests: test_lists_sync.py runs the script on CRLF files for both lists
(comments, trailing comment, covered entry) and fails against the previous
script; test_noauth.py checks that the control plane reads such a file and
writes it back with \n. operations.md: Windows line endings are fine.
---
 controlplane/tests/test_lists_sync.py | 12 ++++++++++++
 controlplane/tests/test_noauth.py     | 14 ++++++++++++++
 docs/operations.md                    |  3 ++-
 image/lists-sync.sh                   |  3 ++-
 4 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/controlplane/tests/test_lists_sync.py b/controlplane/tests/test_lists_sync.py
index 61bbacb..1278f97 100644
--- a/controlplane/tests/test_lists_sync.py
+++ b/controlplane/tests/test_lists_sync.py
@@ -98,3 +98,15 @@ def test_missing_noauth_file_is_an_empty_list(tmp_path: Path) -> None:
     dst, stderr = _sync(tmp_path, blocked=b".example.org\n")
     assert (dst / "noauth.domains").read_text() == ""
     assert "domains without proxy auth: none" in stderr
+
+
+def test_crlf_line_endings_in_both_lists(tmp_path: Path) -> None:
+    # A list saved by a Windows editor: every entry must survive, without the \r.
+    dst, stderr = _sync(
+        tmp_path,
+        blocked=b".blocked.example.org\r\n.a.blocked.example.org\r\n",
+        noauth=b"# Microsoft 365\r\n.office.com\r\n.sharepoint.com  # comment\r\n",
+    )
+    assert (dst / "blocked.domains").read_text() == ".blocked.example.org\n"
+    assert (dst / "noauth.domains").read_text().split() == [".office.com", ".sharepoint.com"]
+    assert "not a domain name" not in stderr
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index b416137..51a3bb8 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -102,6 +102,20 @@ def test_both_lists_share_the_directory(tmp_path: Path) -> None:
     assert not directory.exists()
 
 
+def test_noauth_read_and_add_with_crlf(tmp_path: Path) -> None:
+    file = tmp_path / "s-teachers" / "noauth.domains"
+    file.parent.mkdir()
+    file.write_bytes(b".office.com\r\n.sharepoint.com\r\n")
+    na = noauth_list(str(tmp_path))
+    assert na.read("s-teachers") == [".office.com", ".sharepoint.com"]
+    assert na.add("s-teachers", "teams.microsoft.com") == [
+        ".office.com",
+        ".sharepoint.com",
+        ".teams.microsoft.com",
+    ]
+    assert b"\r" not in file.read_bytes()
+
+
 def test_noauth_names_vs_blocklist_names(tmp_path: Path) -> None:
     # a domain below a TLD with letters in the last label passes, also IDNA and digits inside
     assert normalize_noauth_domain("1und1.de") == ".1und1.de"
diff --git a/docs/operations.md b/docs/operations.md
index 16f20ce..a945f47 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -87,7 +87,8 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
   A blocked name shows up as `TCP_DENIED/403 … GET http://…` resp. `TCP_DENIED/200 0 CONNECT …:443`
   in the access log.
 - **Hand-editing / category lists:** the file may be edited directly (one domain per line,
-  leading dot = with subdomains; `#` comments) followed by `lmnsquid blocklist <name> reload`.
+  leading dot = with subdomains; `#` comments; Windows line endings are fine) followed by
+  `lmnsquid blocklist <name> reload`.
   Squid does not read the mounted file itself: at every start and reload the image's
   `lists-sync.sh` builds the list it reads (`/run/lmnsquid/lists/`) and leaves out every entry
   a listed parent domain already covers, naming them in `lmnsquid logs <name>`
diff --git a/image/lists-sync.sh b/image/lists-sync.sh
index ac32f75..b61d704 100755
--- a/image/lists-sync.sh
+++ b/image/lists-sync.sh
@@ -56,7 +56,8 @@ sync_list() {
         [ "${kind}" = noauth ] \
             && echo "linuxmuster-squid: no ${src}, domains without proxy auth: none" >&2
     elif [ "${kind}" = noauth ]; then
-        sed -e 's/#.*//' "${src}" | awk '{ e = tolower($1); sub(/\.+$/, "", e); if (e != "") print e }' \
+        sed -e 's/#.*//' "${src}" \
+            | awk '{ gsub(/\r/, ""); e = tolower($1); sub(/\.+$/, "", e); if (e != "") print e }' \
             | awk -v list="${name}" '
                 function numeric(name,    n, i, l) {
                     n = split(name, l, ".")

From 50b6851266c1ecd968877b0b9ab0ea0a5d1cfde0 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:39:24 +0100
Subject: [PATCH 14/24] fix(lists): report what lists-sync.sh ignored on
 reload, in the answer and the log

Lab test: operations.md says entries ignored by lists-sync.sh show up in
`lmnsquid logs <name>` "at every start and reload", but on reload the
script ran through docker exec and its stderr was thrown away: the reload
answered {"reloaded": true} and the log stayed silent (only a restart
showed the lines).

Making the documented behaviour true instead of narrowing the docs: an
admin who reloads after a hand edit is exactly the one who needs to see
that an entry was ignored, and the answer is where the CLI shows it.
- The reload script (fixed text) keeps lists-sync.sh's messages, prints
  them and appends them to /run/lmnsquid/lists-sync.log; on failure it
  prints them and stops before squid -k reconfigure.
- The entrypoint mirrors that file into the container log (tail -F, like
  the access log), so `lmnsquid logs` shows them after a reload too.
- The reload answer carries them: {"name", "reloaded": true, "notices":
  [...]} for both `blocklist reload` and `noauth reload`; the old image has
  no lists-sync.sh and answers "notices": [].

Tests: unit (notices extracted from the exec output, other lines left out,
the script appends to the log), cp-docker-it (hand-edited lists: the
reload answer names the ignored entries and they appear in `svc.logs()`).
Docs: operations.md, architecture, changelog bullet.
---
 controlplane/lmnsquid/docker_service.py       | 21 +++++++++++++++----
 controlplane/tests/conftest.py                |  2 +-
 controlplane/tests/test_blocklist.py          |  6 +++++-
 controlplane/tests/test_docker_integration.py |  9 ++++++--
 controlplane/tests/test_docker_service.py     | 14 +++++++++++--
 controlplane/tests/test_noauth.py             |  6 +++++-
 debian/changelog                              |  3 ++-
 docs/architecture.md                          |  3 ++-
 docs/operations.md                            |  6 ++++--
 image/entrypoint.sh                           |  3 +++
 10 files changed, 58 insertions(+), 15 deletions(-)

diff --git a/controlplane/lmnsquid/docker_service.py b/controlplane/lmnsquid/docker_service.py
index 05f7176..2d8b8e6 100644
--- a/controlplane/lmnsquid/docker_service.py
+++ b/controlplane/lmnsquid/docker_service.py
@@ -26,11 +26,18 @@
 _SQUID_CONF = "/run/lmnsquid/squid.conf"
 # Reload: images with lists-sync.sh read the lists from /run/lmnsquid/lists, which the script
 # rebuilds from the mounted ones (without the entries squid refuses to load); older images read
-# the mounted files directly. Fixed text, nothing from a request goes into it.
+# the mounted files directly. Its messages (ignored entries) are printed for the API response
+# and appended to /run/lmnsquid/lists-sync.log, which the entrypoint mirrors into the container
+# log (`lmnsquid logs`). Fixed text, nothing from a request goes into it.
 _RELOAD = (
-    "set -e; if [ -x /usr/local/bin/lists-sync.sh ]; then /usr/local/bin/lists-sync.sh; fi; "
+    "set -e; if [ -x /usr/local/bin/lists-sync.sh ]; then "
+    "/usr/local/bin/lists-sync.sh 2>/run/lmnsquid/lists-sync.last "
+    "|| { cat /run/lmnsquid/lists-sync.last; exit 1; }; "
+    "cat /run/lmnsquid/lists-sync.last; "
+    "cat /run/lmnsquid/lists-sync.last >> /run/lmnsquid/lists-sync.log; fi; "
     f"exec squid -k reconfigure -f {_SQUID_CONF}"
 )
+_NOTICE_PREFIX = "linuxmuster-squid: "
 # Container label carrying the fingerprint of everything the container was created
 # from; a container whose label matches the desired spec is left alone by
 # ensure_running (reconcile is a no-op for it), one without or with another
@@ -386,13 +393,19 @@ def reload(self, name: str) -> dict[str, Any]:
         started after a reboot (seen in the lab). Like ``access_logs`` this needs
         ``docker exec`` (not available behind the socket proxy with ``EXEC: 0``).
         Raises ``LookupError`` when there is no running container, ``RuntimeError``
-        when the exec is refused or squid does.
+        when the exec is refused or squid does. ``notices`` are the messages of
+        ``lists-sync.sh`` (entries it ignored), also written to the container log.
         """
         container = self._running(name)
         exit_code, text = self._exec(container, ["sh", "-c", _RELOAD])
         if exit_code != 0:
             raise RuntimeError(f"list reload exited {exit_code}: {text.strip()}")
-        return {"name": name, "reloaded": True}
+        notices = [
+            line[len(_NOTICE_PREFIX) :]
+            for line in text.splitlines()
+            if line.startswith(_NOTICE_PREFIX)
+        ]
+        return {"name": name, "reloaded": True, "notices": notices}
 
     # -- introspection -----------------------------------------------------
 
diff --git a/controlplane/tests/conftest.py b/controlplane/tests/conftest.py
index a733487..9c37da8 100644
--- a/controlplane/tests/conftest.py
+++ b/controlplane/tests/conftest.py
@@ -128,7 +128,7 @@ def reload(self, name: str) -> dict[str, Any]:
         if container is None or not container["running"]:
             raise LookupError(f"instance {name!r} is not running")
         self.reloaded.append(name)
-        return {"name": name, "reloaded": True}
+        return {"name": name, "reloaded": True, "notices": []}
 
     def status(self, name: str) -> dict[str, Any]:
         container = self.containers.get(name)
diff --git a/controlplane/tests/test_blocklist.py b/controlplane/tests/test_blocklist.py
index affdbfa..1cedcc2 100644
--- a/controlplane/tests/test_blocklist.py
+++ b/controlplane/tests/test_blocklist.py
@@ -149,7 +149,11 @@ def test_blocklist_endpoints(
 
     # reload -> squid -k reconfigure run in the running container
     resp = client.post(f"/v1/instances/{name}/blocklist/reload", headers=auth_headers)
-    assert resp.status_code == 200 and resp.json() == {"name": name, "reloaded": True}
+    assert resp.status_code == 200 and resp.json() == {
+        "name": name,
+        "reloaded": True,
+        "notices": [],
+    }
     assert docker.reloaded == [name]
 
     # stopped container -> 409, not a silent "ok"
diff --git a/controlplane/tests/test_docker_integration.py b/controlplane/tests/test_docker_integration.py
index 56a83f0..083bb74 100644
--- a/controlplane/tests/test_docker_integration.py
+++ b/controlplane/tests/test_docker_integration.py
@@ -69,7 +69,7 @@ def test_real_container_lifecycle(tmp_path: Path) -> None:
         assert (lists / inst.name / "noauth.domains").read_text() == ""
         assert svc.noauth_active(inst.name) is True
         svc.noauth.add(inst.name, "office.com")
-        assert svc.reload(inst.name) == {"name": inst.name, "reloaded": True}
+        assert svc.reload(inst.name) == {"name": inst.name, "reloaded": True, "notices": []}
 
         # Hand-edited lists that squid 6 refuses as such (a covered name before its parent,
         # the bare apex): lists-sync.sh drops those entries on reload and at the next start.
@@ -79,7 +79,12 @@ def test_real_container_lifecycle(tmp_path: Path) -> None:
         (lists / inst.name / "noauth.domains").write_text(
             ".graph.microsoft.com\n.microsoft.com\nmicrosoft.com\n"
         )
-        assert svc.reload(inst.name)["reloaded"] is True
+        reloaded = svc.reload(inst.name)
+        assert reloaded["reloaded"] is True
+        # what was ignored is in the response and in the container log (`lmnsquid logs`)
+        assert any("already covered" in n for n in reloaded["notices"]), reloaded
+        time.sleep(2)
+        assert "blocked.domains: 2 entries ignored, already covered" in svc.logs(inst.name, tail=50)
         svc.restart(inst.name)
         deadline = time.monotonic() + 60
         health = None
diff --git a/controlplane/tests/test_docker_service.py b/controlplane/tests/test_docker_service.py
index 7f5d2b9..e6b311f 100644
--- a/controlplane/tests/test_docker_service.py
+++ b/controlplane/tests/test_docker_service.py
@@ -113,12 +113,22 @@ def test_reload_syncs_the_lists_then_reconfigures(tmp_path: Path) -> None:
     c = _container("lmnsquid-s-teachers")
     c.exec_run.return_value = (0, b"")
     _registry(ds, {"lmnsquid-s-teachers": c})
-    assert ds.reload("s-teachers") == {"name": "s-teachers", "reloaded": True}
+    c.exec_run.return_value = (
+        0,
+        b"linuxmuster-squid: noauth.domains: ignored, not a domain name: com\n"
+        b"squid: some other line\n",
+    )
+    assert ds.reload("s-teachers") == {
+        "name": "s-teachers",
+        "reloaded": True,
+        "notices": ["noauth.domains: ignored, not a domain name: com"],
+    }
     cmd = c.exec_run.call_args.args[0]
     assert cmd[:2] == ["sh", "-c"]
     # lists-sync.sh first (only where the image has it), then squid -k reconfigure.
     assert "[ -x /usr/local/bin/lists-sync.sh ]" in cmd[2]
-    assert cmd[2].index("lists-sync.sh;") < cmd[2].index("squid -k reconfigure")
+    assert cmd[2].index("lists-sync.sh 2>") < cmd[2].index("squid -k reconfigure")
+    assert ">> /run/lmnsquid/lists-sync.log" in cmd[2]
     assert cmd[2].endswith("exec squid -k reconfigure -f /run/lmnsquid/squid.conf")
 
     c.exec_run.return_value = (1, b"FATAL: Bungled /run/lmnsquid/squid.conf line 59")
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index 51a3bb8..c5cb9ea 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -193,7 +193,11 @@ def test_noauth_endpoints(
     assert file.read_text() == ".office.com\n"
 
     resp = client.post(f"/v1/instances/{name}/noauth/reload", headers=auth_headers)
-    assert resp.status_code == 200 and resp.json() == {"name": name, "reloaded": True}
+    assert resp.status_code == 200 and resp.json() == {
+        "name": name,
+        "reloaded": True,
+        "notices": [],
+    }
     assert docker.reloaded == [name]
 
     resp = client.delete(f"/v1/instances/{name}/noauth/office.com", headers=auth_headers)
diff --git a/debian/changelog b/debian/changelog
index cd5bf94..4f529ee 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -46,7 +46,8 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     drops what it covers (adding a name below a listed domain changes
     nothing), blocklist-refresh.sh drops covered entries, and the new
     data-plane image builds the lists squid reads without them at every
-    start and reload, naming them in "lmnsquid logs <name>".
+    start and reload, naming them in "lmnsquid logs <name>" and in the
+    reload output ("notices").
 
  -- Kevin Stenzel <mail@kevin-stenzel.de>  Fri, 30 Oct 2026 14:58:39 +0100
 
diff --git a/docs/architecture.md b/docs/architecture.md
index c2a6566..495df0d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -74,7 +74,8 @@ Status document. Keep it up to date with every substantive change (see
   (the API endpoints below); `reload` = `squid -k reconfigure` inside the container
   (docker exec), no restart. Entries are `.example.org` = domain + subdomains. Squid reads
   copies under `/run/lmnsquid/lists/` that `lists-sync.sh` builds from the mounted files at
-  start and before every reload, without entries a listed parent domain covers (squid 6 stops
+  start and before every reload (its messages go to the container log and into the reload
+  answer as `notices`), without entries a listed parent domain covers (squid 6 stops
   with `FATAL: Bungled` when such an entry precedes its parent); the control plane never writes
   them in the first place. UT Capitole/Toulouse
   category lists via `blocklist-refresh.sh` (host cron) into the same file.
diff --git a/docs/operations.md b/docs/operations.md
index a945f47..785e916 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -92,7 +92,8 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
   Squid does not read the mounted file itself: at every start and reload the image's
   `lists-sync.sh` builds the list it reads (`/run/lmnsquid/lists/`) and leaves out every entry
   a listed parent domain already covers, naming them in `lmnsquid logs <name>`
-  (`… entries ignored, already covered by a listed parent domain: …`); so a hand-edited list
+  (`… entries ignored, already covered by a listed parent domain: …`) and, for a reload, also
+  in its answer (`"notices": [...]`); so a hand-edited list
   cannot stop the proxy. `blocklist-refresh.sh` drops those entries itself. (The image pinned
   by 7.3.7 and older reads the mounted file directly: with it such a list makes `reload` fail
   and the next start of the container fail.)
@@ -144,7 +145,8 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
   `127.1`, `0x7f000001`, `0x7f.0x1`, `1.2.3.0x4`; refused is any name whose labels are all
   decimal, octal or `0x` numbers) and single labels such as
   `com` (they would open an address or a whole TLD); hand-written lines of that kind are
-  ignored by the container and named in `lmnsquid logs <name>`. The blocklist accepts both on
+  ignored by the container and named in `lmnsquid logs <name>` and in the answer of
+  `lmnsquid noauth <name> reload` (`"notices"`). The blocklist accepts both on
   purpose: blocking a TLD (`zip`) is a legitimate choice and a wrong entry there only blocks
   more. API:
   `GET/POST /v1/instances/{name}/noauth`, `DELETE …/noauth/{domain}`, `POST …/noauth/reload`.
diff --git a/image/entrypoint.sh b/image/entrypoint.sh
index d0e49aa..7ee756a 100644
--- a/image/entrypoint.sh
+++ b/image/entrypoint.sh
@@ -120,6 +120,9 @@ envsubst '${INSTANCE} ${HTTP_PORT} ${CACHE_SIZE_MB} ${KEYTAB} ${REALM} ${AD_GROU
 # squid 6 refuses to load, a missing file as an empty list (lists-sync.sh, also run by
 # `lmnsquid ... reload`).
 /usr/local/bin/lists-sync.sh
+# What later syncs report (`lmnsquid ... reload` appends it here) goes to the container log too.
+: > "${RUN}/lists-sync.log"
+stdbuf -oL tail -n 0 -F "${RUN}/lists-sync.log" >&2 2>/dev/null &
 
 # Validate config, then initialise cache dirs on first run.
 squid -k parse -f "${CONF}"

From 7ae793f07b449c9fa594c482220c7655a48b4e2b Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:39:50 +0100
Subject: [PATCH 15/24] fix(noauth): the 409 also names lmnsquid update for
 after the release

Cold verification 2: the 409 of `noauth reload` only said a release with a
newer pinned image is needed. An instance that stays on its old image after
that release is installed (health-gated rollback in update-all, `lmnsquid
rollback`, its own --image) needs `lmnsquid update <name>`, which the text
did not say. It now names both: installing the release moves the instances
(update-all), and `lmnsquid update <name>` moves this one if it stayed on its
old image. Before the release that command pulls the same old image, so it
is not offered as the first step. operations.md says the same.
---
 controlplane/lmnsquid/api.py      | 5 +++--
 controlplane/tests/test_noauth.py | 3 ++-
 docs/operations.md                | 3 ++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/controlplane/lmnsquid/api.py b/controlplane/lmnsquid/api.py
index 856513d..6dbe196 100644
--- a/controlplane/lmnsquid/api.py
+++ b/controlplane/lmnsquid/api.py
@@ -273,8 +273,9 @@ def reload_noauth(name: str) -> dict[str, Any]:
                     detail=(
                         f"the data-plane image of {name!r} does not support the noauth list, "
                         "so the list has no effect: it needs a linuxmuster-squid release whose "
-                        "pinned data-plane image supports it (the package upgrade moves the "
-                        "instances onto that image)"
+                        "pinned data-plane image supports it; installing that release moves the "
+                        "instances onto that image (update-all), and `lmnsquid update "
+                        f"{name}` moves this one if it stayed on its old image"
                     ),
                 )
             return docker.reload(name)
diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index c5cb9ea..d1259f3 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -222,7 +222,8 @@ def test_noauth_reload_refuses_an_image_that_ignores_the_list(
     assert resp.status_code == 409
     detail = resp.json()["detail"]
     assert "does not support the noauth list" in detail and "release" in detail
-    assert "lmnsquid update" not in detail  # does not help while DEFAULT_IMAGE is the old one
+    # `lmnsquid update` only after the release (before it, it pulls the same old image)
+    assert "installing that release" in detail and f"lmnsquid update {name}" in detail
     assert docker.reloaded == []  # no "reloaded" that changes nothing
     # the blocklist reload is unaffected
     resp = client.post(f"/v1/instances/{name}/blocklist/reload", headers=auth_headers)
diff --git a/docs/operations.md b/docs/operations.md
index 785e916..0b01d72 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -154,7 +154,8 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
   (an image from before the list). That is a release matter, not an admin step: a
   linuxmuster-squid release whose pinned image supports the list moves the instances onto it
   when the package is upgraded (`update-all` in the postinst); `lmnsquid update <name>` only
-  helps once such a release is installed. Without that check a reload would report success and
+  helps once such a release is installed (then it moves an instance that stayed on its old
+  image, e.g. after a rollback). The 409 text says the same. Without that check a reload would report success and
   change nothing.
   `blocklist reload` is not affected. A `noauth.domains` created after the container started
   (an older control plane) is picked up by the next reload.

From 70647b590db037bac0d9b5319bf304d01476e62a Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:40:25 +0100
Subject: [PATCH 16/24] docs(controlplane): correct two comments that predate
 lists-sync.sh

Cold verification 2: the docstring of api.reload_noauth said a container
started without noauth.domains never reads the list, and the comment in
DockerService.ensure_running said the entrypoint reads the file only when it
is there at start. Since lists-sync.sh, a missing file is an empty list and
the next reload reads one that appeared later; only an image without the
noauth ACL is refused (which is what noauth_active checks). Comments only.
---
 controlplane/lmnsquid/api.py            | 8 +++++---
 controlplane/lmnsquid/docker_service.py | 4 ++--
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/controlplane/lmnsquid/api.py b/controlplane/lmnsquid/api.py
index 6dbe196..19b23a2 100644
--- a/controlplane/lmnsquid/api.py
+++ b/controlplane/lmnsquid/api.py
@@ -259,10 +259,12 @@ async def remove_noauth_domain(name: str, domain: str) -> dict[str, Any]:
 
     @app.post("/v1/instances/{name}/noauth/reload", dependencies=auth)
     def reload_noauth(name: str) -> dict[str, Any]:
-        """Re-read the lists (``squid -k reconfigure``), refused if squid ignores the noauth list.
+        """Re-read the lists (lists-sync.sh, ``squid -k reconfigure``), refused if the image
+        has no noauth list.
 
-        An image from before ADR-016, or a container started without ``noauth.domains`` in
-        its list directory, never reads the list: answer 409 instead of a silent "reloaded".
+        An image from before ADR-016 has no noauth ACL in its squid.conf and never reads the
+        list: answer 409 instead of a silent "reloaded". (A ``noauth.domains`` that appeared
+        after the container started is read by this reload.)
         """
         _require(name)
         audit.info("noauth reload name=%s", name)
diff --git a/controlplane/lmnsquid/docker_service.py b/controlplane/lmnsquid/docker_service.py
index 2d8b8e6..86cc0cc 100644
--- a/controlplane/lmnsquid/docker_service.py
+++ b/controlplane/lmnsquid/docker_service.py
@@ -200,8 +200,8 @@ def ensure_running(self, inst: Instance) -> dict[str, Any]:
         digest = self.fingerprint(spec)
         # Lists: created empty if absent (create, reconcile, update all pass through
         # here, so instances from before 7.3.1 get the mount on their next replacement).
-        # noauth.domains must exist before a container starts: the entrypoint only reads
-        # it from the mount when it is there at start (ADR-016).
+        # noauth.domains too, so the file an admin edits is there from the start (a missing
+        # one is an empty list to lists-sync.sh, which reads it again on every reload).
         self.blocklist.ensure(inst.name)
         self.noauth.ensure(inst.name)
 

From 417defeffb877b0f906c2daa7bf471c3adcc6c84 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:42:22 +0100
Subject: [PATCH 17/24] docs: HTTPS to a blocked name is answered by squid
 inside TLS, not cut
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lab test (B3, also with 7.3.7): `curl --proxy … https://<blocked>/` gets
"HTTP/1.1 200 Connection established", then a self-signed certificate
(curl exit 60); with -k a 403 page, access log `NONE_NONE/403 … GET
https://<blocked>/`, and the blocked server is never contacted. The docs
said the handshake is cut and the proxy never decrypts. Kevin decided to
keep the behaviour and fix the docs.

What happens (squid 6.14, measured; squid.conf does not describe it, the
squid 6 source does: client_side_request.cc, "we will attempt to bump the
client to serve the error", and no bump while authenticating):
- allowed CONNECT: spliced, never decrypted;
- CONNECT denied by http_access with 403 (blocked host, not in the group,
  IP literal or port rules, outside the subnets): squid confirms it, does
  TLS with the client itself using the instance's throwaway bump.pem
  (generate-host-certificates=off) and serves its 403 inside; browsers
  show a certificate warning; a client that clicks through sends the
  request's path and headers to the proxy;
- blocked SNI behind an allowed CONNECT host, and a foreign or missing SNI
  on the noauth path: ssl_bump terminate, cut during the handshake;
- 407: never bumped.

Corrected: ADR-002 (clarification), ADR-014 limit, threat model T4 and T8,
architecture, operations, install.md steps 7 and 8, deployment-gpo
checklist, README, test strategy, the blocklist --help and the template
comments (comment-only change in the image). debian/changelog: one bullet
in 7.3.8 saying the description was wrong and the behaviour is unchanged.
---
 README.md                           |  6 ++++--
 controlplane/lmnsquid/cli.py        |  3 ++-
 debian/changelog                    |  8 ++++++++
 docs/architecture.md                | 12 ++++++++----
 docs/decisions.md                   | 22 ++++++++++++++++++++--
 docs/deployment-gpo.md              |  4 +++-
 docs/install.md                     | 12 +++++++-----
 docs/operations.md                  | 15 ++++++++++-----
 docs/test-strategy.md               |  5 +++--
 docs/threat-model.md                |  4 ++--
 image/templates/squid.conf.template | 10 ++++++----
 11 files changed, 73 insertions(+), 28 deletions(-)

diff --git a/README.md b/README.md
index 2499cf3..89c64f9 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,9 @@ the same AD/Kerberos infrastructure the school already operates.
   authentication via `negotiate_kerberos_auth`, authorization via
   `ext_kerberos_ldap_group_acl` against the instance's AD group. HTTPS is
   **not decrypted** (SNI peek/splice or CONNECT `dstdomain`). Per-instance domain
-  blocklist: HTTP → 403, HTTPS → the TLS handshake is cut (no block page without decryption).
+  blocklist: HTTP → 403, HTTPS → certificate warning in the browser (squid's 403 inside TLS
+  with an untrusted throwaway certificate; the blocked server is never contacted, allowed traffic
+  is never decrypted).
   Optional per-instance list of domains reachable without proxy login from the school subnets
   (e.g. Microsoft 365; the blocklist still wins).
 - **Control Plane:** hardened systemd service with **REST API** (FastAPI) and
@@ -93,7 +95,7 @@ lmnsquid update all-teachers               # -> maintained default image (health
 lmnsquid update-all                        # every instance -> default image
 lmnsquid rollback all-teachers             # to the last known-good
 lmnsquid reconcile                         # re-apply stored state (restore / after a crash)
-lmnsquid blocklist all-students add example.org    # block a domain + subdomains (HTTP 403, HTTPS TLS abort)
+lmnsquid blocklist all-students add example.org    # block a domain + subdomains (HTTP 403, HTTPS cert warning)
 lmnsquid blocklist all-students reload             # apply without restart; list / remove likewise
 lmnsquid noauth all-students add sharepoint.com    # reachable WITHOUT proxy login from the school subnets
 lmnsquid noauth all-students reload                # (exam mode and Internetsperre do not apply: docs/operations.md)
diff --git a/controlplane/lmnsquid/cli.py b/controlplane/lmnsquid/cli.py
index 21cbcc0..efd6c6c 100644
--- a/controlplane/lmnsquid/cli.py
+++ b/controlplane/lmnsquid/cli.py
@@ -130,7 +130,8 @@ def rm(
 
 
 blocklist_app = typer.Typer(
-    help="Per-instance domain blocklist (HTTP -> 403; HTTPS is cut at the TLS handshake). "
+    help="Per-instance domain blocklist (HTTP -> 403; HTTPS -> certificate warning in the "
+    "browser, the blocked server is never contacted). "
     "Changes take effect after `reload`.",
     no_args_is_help=True,
 )
diff --git a/debian/changelog b/debian/changelog
index 4f529ee..b3c356b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -48,6 +48,14 @@ linuxmuster-squid (7.3.8) lmn73; urgency=medium
     data-plane image builds the lists squid reads without them at every
     start and reload, naming them in "lmnsquid logs <name>" and in the
     reload output ("notices").
+  * Documentation corrected: HTTPS to a blocked domain was described as cut
+    at the TLS handshake. squid answers a CONNECT it denies itself: "200",
+    then TLS with the instance's self-signed throwaway certificate and its
+    403 page inside; the blocked server is never contacted and browsers
+    show a certificate warning. Only a name blocked in the SNI behind an
+    allowed CONNECT host is cut during the handshake. Traffic to allowed
+    sites is spliced and never decrypted, as before; the behaviour itself
+    is unchanged (README, install.md, operations.md, ADR-002).
 
  -- Kevin Stenzel <mail@kevin-stenzel.de>  Fri, 30 Oct 2026 14:58:39 +0100
 
diff --git a/docs/architecture.md b/docs/architecture.md
index 495df0d..59baf59 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -63,10 +63,14 @@ Status document. Keep it up to date with every substantive change (see
 - **School scope:** `acl school_net src ${SCHOOL_SUBNETS}` (a school is identified
   by its subnet — no marker "on the wire").
 - **HTTPS filtering without decryption:** preferably SNI **peek + splice**
-  (squid-openssl; throwaway CA only for the peek step, **never** distributed to
-  clients), fallback CONNECT `dstdomain` (no SSL needed). A blocked HTTPS name is
-  **terminated at the TLS handshake** (`ssl_bump terminate`): the client sees a
-  connection error, not a 403 page — there is no error page without decryption.
+  (squid-openssl; throwaway certificate only to enable the bump machinery, **never**
+  distributed to clients), fallback CONNECT `dstdomain` (no SSL needed). Allowed traffic is
+  spliced, never decrypted. A CONNECT that `http_access` denies (e.g. a blocked host) is
+  answered by squid itself: `200`, then TLS with the untrusted throwaway certificate and its 403
+  page inside (squid's error delivery on an ssl-bump port; the target is never contacted; the
+  browser shows a certificate warning). A blocked SNI behind an allowed CONNECT host is
+  **terminated during the handshake** (`ssl_bump terminate`), without any page (ADR-002,
+  clarification).
 - **Blocklist per instance:** `<blocklists_dir>/<name>/blocked.domains` on the host
   (`/etc/linuxmuster-squid/blocklists/…`), the directory bind-mounted read-only at
   `/etc/squid/lists` — the path the template reads for `dstdomain` and
diff --git a/docs/decisions.md b/docs/decisions.md
index a9fc155..5d9e72b 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -30,6 +30,22 @@ requires explicit mode. **Source:** Squid wiki Features/Authentication.
 CONNECT `dstdomain`; **no** SSL-bump MITM. The peek CA is never distributed to clients.
 **Why:** privacy-friendly, no client CA rollout, no breaking of
 cert pinning; SSL-bumped traffic could no longer carry Kerberos identity.
+**Clarification (2026-11-02, measured in the E2E and the lab; Kevin: keep the behaviour):**
+traffic to a real target is never decrypted: an allowed CONNECT is spliced. Two things still
+happen at the TLS layer. (1) `ssl_bump terminate` closes the connection during the handshake,
+without a certificate or a page, for a blocked SNI behind an allowed CONNECT host and, on the
+noauth path (ADR-016), for a foreign or missing SNI. (2) A CONNECT that `http_access` denies with
+403 (blocked CONNECT host, not in the role or internet group, CONNECT to an IP literal or a port
+other than 443, outside the school subnets) is answered by squid itself: on an ssl-bump port it
+confirms the CONNECT (`200`), completes TLS with the client using the instance's self-signed
+throwaway certificate (`bump.pem`, `generate-host-certificates=off`) and sends its 403 page
+inside that session. squid.conf does not describe this; the squid 6 source does
+(`client_side_request.cc`: "we will attempt to bump the client to serve the error"). The target is
+never contacted. Browsers reject the certificate and show a certificate warning, no block page; a
+client that accepts it anyway (`curl -k`, a user clicking through the warning) sends its request
+line and headers for that denied name to the proxy, which logs the URL. A 407 is never answered
+this way (squid does not bump during authentication). The certificate is presented, never
+distributed or trusted.
 
 ### ADR-003 — One instance per (school × role)
 **Status:** Accepted (user decision). **Decision:** separate Squid containers
@@ -144,8 +160,10 @@ inode); reconfigure keeps the cache and client connections. **Not** `docker kill
 although squid is PID 1 and would reconfigure: Docker records every kill(), whatever the
 signal, as a manual stop, and an `unless-stopped` container then stays down after a reboot
 (seen in the lab). Price: like `access-logs`, `reload` needs `docker exec` (ADR-012).
-**Limit (documented):** a blocked HTTPS name is terminated at the TLS handshake, there is
-no 403 page without decryption (ADR-002).
+**Limit (documented):** HTTPS to a blocked name never shows a usable block page: a blocked
+CONNECT host gets squid's 403 inside TLS with an untrusted certificate (browser: certificate
+warning), a blocked SNI behind an allowed CONNECT host is cut during the handshake (ADR-002,
+clarification).
 **Amendment (2026-10-30, with ADR-016):** squid 6 refuses to load a `dstdomain` /
 `ssl::server_name` list in which a name covered by a listed parent domain comes first
 (`.a.example.org` before `.example.org`, or `example.org` next to it: `FATAL: Bungled`; a
diff --git a/docs/deployment-gpo.md b/docs/deployment-gpo.md
index 698faf6..4098a77 100644
--- a/docs/deployment-gpo.md
+++ b/docs/deployment-gpo.md
@@ -78,7 +78,9 @@ Log per client (browser, codes):
 - [ ] **Visitor** (teacher/student from **another school**) → the **local** proxy works (global role group).
 - [ ] **Internetsperre:** remove a user from their `internet` group → within ~10 s → **403**.
 - [ ] Blocked domain (`lmnsquid blocklist <name> add <domain>` + `reload`): HTTP → **403** page;
-      HTTPS → browser connection/TLS error (no block page — the proxy does not decrypt).
+      HTTPS → browser certificate warning (the proxy serves its 403 inside TLS with an
+      untrusted throwaway certificate; the blocked server is never contacted), or a connection
+      error when only the SNI is blocked. No usable block page (ADR-002, clarification).
 - [ ] `Squid access.log` shows the Kerberos username + ACL verdict.
 
 Document the result (client/browser/codes) here or in the ticket. Only then is
diff --git a/docs/install.md b/docs/install.md
index 6d38e41..a345278 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -167,9 +167,11 @@ lmnsquid blocklist all-students reload              # squid re-reads the list (n
 lmnsquid blocklist all-students remove example.org && lmnsquid blocklist all-students reload
 ```
 
-HTTP to a blocked domain → **403**. HTTPS to a blocked domain is **cut at the TLS handshake**
-(the proxy peeks at the SNI and terminates, it never decrypts): the browser shows a
-connection/TLS error, not a block page. Details, the file path and UT-Capitole category
+HTTP to a blocked domain → **403**. HTTPS to a blocked domain → the browser shows a
+**certificate warning**, no block page: the proxy answers the CONNECT itself with its 403 page
+inside TLS with an untrusted throwaway certificate; the blocked server is never contacted, and
+traffic to allowed sites is never decrypted (it is spliced). Details, the file path and
+UT-Capitole category
 lists: [`operations.md`](operations.md#blocklist-per-instance).
 
 ## 8. Domains without proxy authentication (optional)
@@ -190,8 +192,8 @@ lmnsquid noauth all-students reload                  # squid re-reads the lists
 > does not apply to it, and the access log shows `-` instead of a user. Keep `--school-subnets`
 > tight (the default `0.0.0.0/0` means everyone who reaches the port) and the list short.
 
-The blocklist still wins (403 / TLS cut). HTTPS passes only when the TLS SNI is on the list
-as well; a different SNI or none cuts the handshake. Check from a client in `<subnet>` without
+The blocklist still wins (HTTP 403; HTTPS certificate warning as in step 7). HTTPS passes only
+when the TLS SNI is on the list as well; a different SNI or none cuts the handshake. Check from a client in `<subnet>` without
 a ticket: `kdestroy; req $P:3129 https://<listed-domain>/` gives 200,
 `req $P:3129 http://example.com/` still 407. The recommended Microsoft 365 list with its source
 and the details: [`operations.md`](operations.md#domains-without-proxy-authentication-per-instance).
diff --git a/docs/operations.md b/docs/operations.md
index 0b01d72..4f07846 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -81,11 +81,16 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
   `access-logs` — not available behind the socket proxy with `EXEC: 0`); the auth/group
   helpers restart, the cache stays. API:
   `GET/POST /v1/instances/{name}/blocklist`, `DELETE …/blocklist/{domain}`, `POST …/blocklist/reload`.
-- **What the user sees:** HTTP → **403** (Squid error page, also for teachers). HTTPS → the
-  proxy peeks at the SNI and **terminates the TLS handshake**: the browser shows a
-  connection/TLS error, *not* a block page (there is none without decryption, ADR-002).
-  A blocked name shows up as `TCP_DENIED/403 … GET http://…` resp. `TCP_DENIED/200 0 CONNECT …:443`
-  in the access log.
+- **What the user sees:** HTTP → **403** (Squid error page, also for teachers). HTTPS → a
+  **certificate warning**, no block page: squid refuses the CONNECT to the blocked host by
+  answering it itself, with `200` and then TLS with the instance's untrusted throwaway
+  certificate and its 403 page inside; the target is never contacted. Someone who clicks
+  through the warning sees the 403 page, and the proxy sees the path and headers of that
+  request (it never sees traffic of an allowed site, that is spliced). A blocked name only in
+  the SNI (behind an allowed CONNECT host) is cut during the TLS handshake: connection error.
+  ADR-002 (clarification) has the details. In the access log a blocked name shows up as
+  `TCP_DENIED/403 … GET http://…`, resp. `NONE_NONE/200 0 CONNECT <host>:443` followed by
+  `NONE_NONE/403 … GET https://<host>/…` when the client accepted the certificate.
 - **Hand-editing / category lists:** the file may be edited directly (one domain per line,
   leading dot = with subdomains; `#` comments; Windows line endings are fine) followed by
   `lmnsquid blocklist <name> reload`.
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index e57d6a7..425e8c8 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -89,7 +89,7 @@ check of the `main` ruleset. **Core proof** (P1), assertions on `%{http_code}`:
 | Teacher allowed | `kinit teacher1`; via teacher instance | **200** |
 | Student denied (authN ok, authZ fail) | `kinit student1`; via teacher instance | **403** (not 407) |
 | Blocked domain (HTTP) | Teacher → entry from `blocked.domains` | **403** |
-| Blocked domain (HTTPS) | Teacher → CONNECT to a blocked name | **not 200**: TLS handshake terminated (curl exit ≠ 0), no 403 page |
+| Blocked domain (HTTPS) | Teacher → CONNECT to a blocked name | **not 200** behind the tunnel: squid answers the CONNECT itself and serves its 403 inside TLS with the throwaway certificate (`curl -k`: `200 403`; without `-k` curl fails the certificate) |
 | No ticket | `kdestroy`; request | **407** |
 
 The 403-vs-407 split is the actual proof (authenticated-but-unauthorized
@@ -102,7 +102,8 @@ acceptance list in `deployment-gpo.md`.
 ## Negative/security catalog (grows per phase; part of the DoD)
 
 - **P1:** no ticket→407; student→403; SPN mismatch/FQDN-as-IP → no 200.
-- **P2:** blocked HTTPS domain (SNI/CONNECT)→TLS handshake terminated, never 200,
+- **P2:** blocked HTTPS domain: CONNECT host blocked → squid's 403 inside TLS (untrusted
+  throwaway certificate), blocked SNI → TLS handshake terminated; never 200,
   **without** client CA; allowed→200; behavior on missing SNI defined.
 - **P3:** teacher of school A via school-B instance→403; prefixed group names take effect;
   subnet scope takes effect.
diff --git a/docs/threat-model.md b/docs/threat-model.md
index b397a75..b0106e8 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -24,11 +24,11 @@ Risks + countermeasures. Grows per roadmap phase; the negative tests for it live
 | T1 | **Keytab theft** | Secret (tmpfs, `:ro`), `0600` host, readable only by `proxy`, isolated per instance, never in env/log; Compose file secrets not encrypted at rest → harden the host | perms test; no keytab in `docker inspect`/logs |
 | T2 | **Proxy bypass** (non-inline) | OPNsense blocks direct 80/443 egress (force-proxy); client subnets = `SCHOOL_SUBNETS` | E2E + firewall review |
 | T3 | **Authorization bypass** (student on the teacher proxy, wrong group assignment) | group ACL enforced server-side; GPO groups == ACL groups; prefix rule correct | E2E: student→403; multischool matrix |
-| T4 | **HTTPS privacy** | no SSL-bump MITM; only SNI-splice/CONNECT; peek CA never distributed | `squid.conf` review; no `bump` verdict |
+| T4 | **HTTPS privacy** | no SSL-bump MITM of traffic to a real target: allowed CONNECTs are spliced (SNI peek, CONNECT `dstdomain`); the peek certificate is never distributed or trusted. A CONNECT denied by `http_access` gets squid's own 403 inside TLS with that untrusted throwaway certificate (squid's error delivery on an ssl-bump port; the target is never contacted); a client that clicks through the certificate warning reveals the path and headers of that denied request to the proxy (ADR-002, clarification) | `squid.conf` review (`ssl_bump` only peek/splice/terminate); E2E: denied HTTPS → `200 403` with the throwaway certificate, allowed → spliced |
 | T5 | **Control-plane RCE = host root** (Docker socket) | API **only `127.0.0.1`** + token (`compare_digest`), hardened systemd service, audit log. The socket proxy reduces the endpoint surface, **but does NOT downgrade below host root** (`container create` with host bind is inherently root-equivalent) → the real answer is **rootless Docker**. In-app TLS not implemented; off-host only via an operator-provided TLS reverse proxy (`main.py` warns on non-loopback bind) | API 401/403 tests; bind check ≠ 0.0.0.0 |
 | T6 | **Auth all-or-nothing / SSO outage** | auth never globally disableable by default; fallback Kerberos→Basic/LDAP (no NTLM); monitor SSO health | E2E: no ticket→407 |
 | T7 | **DNS/SPN misconfig** (silent Kerberos fail) | fwd+rev DNS resp. `rdns=false`; FQDN==SPN==`VISIBLE_HOSTNAME`; NTP<5min; AES enctypes | E2E canonicalization; `klist -k` |
-| T8 | **Blocklist rot / tampering** (supply chain) | per-instance list on the host (`/etc/linuxmuster-squid/blocklists/<name>/blocked.domains`, mounted read-only into the container, writable only by root/`lmnsquid`), maintained via `lmnsquid blocklist` + `reload`; category lists via `blocklist-refresh.sh` from a host cron with a fail-closed size floor (a truncated download never replaces the list); make outage visible. A list squid 6 cannot load (a covered name before its parent: `FATAL: Bungled`) would take the instance down at the next start: squid reads a copy without such entries (`lists-sync.sh`), and neither the API nor the refresh writes them. **HTTPS limit:** a blocked HTTPS name is cut at the TLS handshake (peek + terminate, no decryption) — the user sees a connection error, no block page; HTTP gets 403 | blocklist smoke; lab proof 7.3.1 (HTTP 403, HTTPS TLS abort) |
+| T8 | **Blocklist rot / tampering** (supply chain) | per-instance list on the host (`/etc/linuxmuster-squid/blocklists/<name>/blocked.domains`, mounted read-only into the container, writable only by root/`lmnsquid`), maintained via `lmnsquid blocklist` + `reload`; category lists via `blocklist-refresh.sh` from a host cron with a fail-closed size floor (a truncated download never replaces the list); make outage visible. A list squid 6 cannot load (a covered name before its parent: `FATAL: Bungled`) would take the instance down at the next start: squid reads a copy without such entries (`lists-sync.sh`), and neither the API nor the refresh writes them. **HTTPS limit:** no usable block page for HTTPS: a blocked CONNECT host gets squid's 403 inside TLS with an untrusted throwaway certificate (browser: certificate warning; the target is never contacted), a blocked SNI behind an allowed CONNECT host is cut during the handshake (`ssl_bump terminate`); HTTP gets 403 | blocklist smoke; lab proof 7.3.1 (HTTP 403, HTTPS no block page), re-measured in the lab and the E2E 2026-10-30: blocked CONNECT host → `200`, then 403 inside TLS with the throwaway certificate |
 | T9 | **Unattended bad update → dead school** | digest pin, human-merge (no automerge; bumps by hand while Renovate is disabled), health-gated update + auto-rollback, known-good persisted | E2E: bad image → rollback |
 | T10 | **DC/LDAP outage stalls every request** | external ACL `ttl/negative_ttl/grace` + tune helper concurrency | load test P10 |
 | T11 | **Container escape/privilege** | `read_only` rootfs + tmpfs, `cap_drop: ALL` (minimal caps), non-root `proxy`, manager ACL localhost | hardening review P10 |
diff --git a/image/templates/squid.conf.template b/image/templates/squid.conf.template
index 785fbbc..c22f119 100644
--- a/image/templates/squid.conf.template
+++ b/image/templates/squid.conf.template
@@ -11,9 +11,11 @@
 # ============================================================
 
 # --- Explicit forward proxy (NEVER intercept: Kerberos 407 requires explicit) ---
-# ssl-bump only for SNI peek/splice (NO decryption). generate-host-certificates=off,
-# because we never MITM-bump; the tls-cert CA is only needed to activate the bump machinery
-# and is NEVER delivered to clients (splice = end-to-end tunnel).
+# ssl-bump only for SNI peek/splice/terminate: traffic to a real target is NEVER decrypted.
+# generate-host-certificates=off, because we never MITM-bump. The self-signed tls-cert enables
+# the bump machinery; squid also uses it to serve its own 403 page for a CONNECT that
+# http_access denies (error delivery on an ssl-bump port; browsers reject the certificate).
+# It is never distributed or trusted (ADR-002, clarification).
 http_port ${HTTP_PORT} ssl-bump generate-host-certificates=off tls-cert=/run/lmnsquid/ssl/bump.pem
 sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB
 visible_hostname ${VISIBLE_HOSTNAME}
@@ -60,7 +62,7 @@ acl blocked_domains dstdomain "/run/lmnsquid/lists/blocked.domains"
 # whoever owns the address and must never put an IP on this list.
 acl noauth_domains dstdomain -n "/run/lmnsquid/lists/noauth.domains"
 
-# --- HTTPS: SNI peek + splice (NO decryption) ---
+# --- HTTPS: SNI peek + splice (NO decryption of allowed traffic) ---
 # step1 reads the TLS ClientHello (SNI); blocked SNIs are disconnected (terminate),
 # everything else is tunneled (splice, no MITM). Also catches cases where the
 # CONNECT host differs from the real SNI (domain fronting).

From 549946c1e181ea04fd690aee6b410b0cb26bf60e Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:42:41 +0100
Subject: [PATCH 18/24] docs(install): keep the proxy's /etc/hosts line on
 cloud-init hosts

Lab test (B4): after a reboot /etc/hosts again read `127.0.1.1 <fqdn>`
(cloud-init, manage_etc_hosts: true), so requests from the proxy host itself
were back outside --school-subnets (403). Per the cloud-init docs (module
"Update Etc Hosts", runs every boot) `true` re-renders /etc/hosts from the
template, `localhost` appends the 127.0.1.1 entry every boot, `false` leaves
it alone. install.md step 1 now says how to check which applies and the
durable fix: edit /etc/cloud/templates/hosts.debian.tmpl (name and its
`127.0.1.1 {{fqdn}} {{hostname}}` line checked with cloud-init 26.2 on Ubuntu
24.04) or set manage_etc_hosts to false where it is defined. references.md
records the sources, also for the squid error-delivery behaviour of the
previous commit.
---
 docs/install.md    |  9 +++++++++
 docs/references.md | 14 ++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/docs/install.md b/docs/install.md
index a345278..f60ab6e 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -42,6 +42,15 @@ groups are prefixed, e.g. `<school>-internet`). All commands as root.
   host itself*. cloud-init writes `127.0.1.1 <proxy-fqdn>`; with that, requests from the host
   reach the container via Docker's userland proxy as `172.17.0.1`, outside
   `--school-subnets`, and get 403. Put `<proxy-ip> <proxy-fqdn>` there.
+  **cloud-init hosts:** check `grep -rs manage_etc_hosts /etc/cloud/ /var/lib/cloud/instance/`.
+  With `manage_etc_hosts: true` cloud-init rewrites `/etc/hosts` from a template on **every
+  boot**, so a hand edit is gone after the next reboot (seen in the lab). Change the template
+  instead: on Ubuntu 24.04 `/etc/cloud/templates/hosts.debian.tmpl`, line
+  `127.0.1.1 {{fqdn}} {{hostname}}` → `<proxy-ip> {{fqdn}} {{hostname}}`. With
+  `manage_etc_hosts: localhost` it appends `127.0.1.1 <fqdn>` on every boot; set it to `false`
+  where it is defined (the instance's user-data, or a file under `/etc/cloud/cloud.cfg.d/`) and
+  keep your line in `/etc/hosts`. (cloud-init docs, module "Update Etc Hosts"; the template name
+  checked with cloud-init 26.2 on Ubuntu 24.04.)
 - The proxy host does **not** join the domain (ADR-009); it only needs the keytab from step 3.
 
 ## 2. Install the package
diff --git a/docs/references.md b/docs/references.md
index 0345e39..23ad187 100644
--- a/docs/references.md
+++ b/docs/references.md
@@ -131,3 +131,17 @@ research workflows on **2026-07-02** (confidence in parentheses).
   https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-network-connectivity-principles
   (updated 2026-08-31) · endpoints web service https://endpoints.office.com/endpoints/worldwide
   (version 2026103000).
+
+## Data-plane HTTPS errors and cloud-init (checked 2026-11-02)
+
+- A CONNECT denied by `http_access` on an ssl-bump port is answered by bumping the client
+  connection to serve the error page (not described in squid.conf / the SslBump wiki pages; squid
+  6 source `src/client_side_request.cc`: "If it applies, we will attempt to bump the client to
+  serve the error", "Do not bump during authentication"). Measured: `200`, then the 403 page inside
+  TLS with the static `tls-cert`; the target is not contacted. (high, source + measurement)
+  — https://github.com/squid-cache/squid/blob/v6/src/client_side_request.cc
+- cloud-init `update_etc_hosts`: runs every boot; `manage_etc_hosts: true` re-renders `/etc/hosts`
+  from the template ("To make modifications persistent across a reboot, you must modify" the
+  template), `localhost` appends a `127.0.1.1` entry every boot, `false` (default) leaves the file
+  alone. Ubuntu 24.04 (cloud-init 26.2) uses `/etc/cloud/templates/hosts.debian.tmpl` with
+  `127.0.1.1 {{fqdn}} {{hostname}}`. (high) — https://docs.cloud-init.io/en/latest/reference/modules.html

From 601d791216c4a022d6f82a3e97e51ca65ad78182 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 15:43:22 +0100
Subject: [PATCH 19/24] docs(noauth): name the known limits: public suffixes,
 raw list view, large lists
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cold verification 2, kept as documented limits:
- K2: two-label public suffixes (co.uk, com.de, github.io) pass the noauth
  name check and would open a whole registration space. No public-suffix
  list (YAGNI); operations.md, threat model T16 and `lmnsquid noauth --help`
  say to add the organisation's own domains only.
- K5: `noauth list` shows the file as it is, including hand-written lines
  the container ignores; what squid uses is what reload and the logs do
  not report as ignored.
- K6: lists-sync.sh and squid's parse take long for category lists of
  millions of entries (measured in the cold verification: 2 million ≈ 25 s
  + ≈ 55 s parse), which can exceed the 90 s health gate.
- K7: the M365 note no longer implies that id 2 is required.
---
 controlplane/lmnsquid/cli.py |  3 ++-
 docs/operations.md           | 18 ++++++++++++++++--
 docs/threat-model.md         |  2 +-
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/controlplane/lmnsquid/cli.py b/controlplane/lmnsquid/cli.py
index efd6c6c..d8308d7 100644
--- a/controlplane/lmnsquid/cli.py
+++ b/controlplane/lmnsquid/cli.py
@@ -177,7 +177,8 @@ def blocklist_reload(ctx: typer.Context) -> None:
     "only (e.g. Microsoft 365). The blocklist still wins; HTTPS only when the TLS SNI is on "
     "the list too. WARNING: anyone in the school subnets reaches these domains without a "
     "ticket, so exam accounts reach them in exam mode (OneDrive, Teams, Outlook ...) and the "
-    "Internetsperre does not apply to them. Changes take effect after `reload`.",
+    "Internetsperre does not apply to them. Add the organisation's own domains only, never a "
+    "public suffix such as co.uk or github.io. Changes take effect after `reload`.",
     no_args_is_help=True,
 )
 app.add_typer(noauth_app, name="noauth")
diff --git a/docs/operations.md b/docs/operations.md
index 4f07846..37c0e20 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -108,6 +108,11 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
   file** — entries added with `lmnsquid blocklist add` are lost, so keep manually curated
   instances out of the refresh or re-add them afterwards. The directory must stay owned by
   `lmnsquid` so the API can keep writing (it replaces the file atomically).
+- **Large category lists (known limit):** `lists-sync.sh` reads the whole list at every start
+  and reload (measured in the cold verification of 2026-10-30: 2 million entries ≈ 25 s and ≈ 290 MiB), and squid then parses it
+  (≈ 55 s for the same list, twice at a start). With lists that size a start can exceed the
+  90 s health gate of `update`/`reconcile` and roll back. Keep category selections moderate
+  and check `lmnsquid status <name>` after enabling a large one.
 - **Upgraded from 7.3.0?** Containers created before 7.3.1 run without the mount until
   recreated once; the postinst runs `lmnsquid reconcile` for that (see Updates).
 
@@ -165,6 +170,14 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
   `blocklist reload` is not affected. A `noauth.domains` created after the container started
   (an older control plane) is picked up by the next reload.
 - **What `lmnsquid rm` removes:** the directory with both lists.
+- **Known limits:**
+  - Names with two labels pass the name check, including public suffixes such as `co.uk`,
+    `com.de` or `github.io` (anyone can publish under them): adding one opens a whole
+    registration space without authentication. There is no public-suffix list built in; add
+    only the organisation's own domains (`sharepoint.com`, not `com.de`).
+  - `noauth list` shows the file as it is: after a hand edit it can contain lines the
+    container ignores (an address, a single label, a line with a trailing comment). What squid
+    really uses is what `reload` and `lmnsquid logs` do not report as ignored.
 
 ### Recommended list: Microsoft 365
 
@@ -201,8 +214,9 @@ done
 lmnsquid noauth all-students list && lmnsquid noauth all-students reload
 ```
 
-- **Not on the list, on purpose:** items for mail protocols and SMTP (ids 2 and 10: TCP 25,
-  143, 587, 993, 995 — not HTTP proxy traffic) and Teams media (id 11: UDP 3478–3481, no URLs;
+- **Not on the list, on purpose:** mail protocols and SMTP (id 10, required: TCP 25; id 2 is
+  not even required: TCP 143, 587, 993, 995 — none of it HTTP proxy traffic) and Teams media
+  (id 11: UDP 3478–3481, no URLs;
   a forward proxy cannot carry UDP — allow it at the firewall if Teams calls are needed).
   Endpoints of category **Default** keep going through the proxy with authentication.
 - **The list changes** (Microsoft recommends updating it automatically). Compare from time to
diff --git a/docs/threat-model.md b/docs/threat-model.md
index b0106e8..87209a6 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -36,7 +36,7 @@ Risks + countermeasures. Grows per roadmap phase; the negative tests for it live
 | T13 | **Access logs = personal data** (browsing behavior, GDPR) | retention = `log_retention_days` (documented deletion period, default 30), gzip-rotated; access logging disableable per instance (`access_log_enabled:false`); log access only via API token, queries into the audit log; no secrets in the log; `lmnsquid rm` deletes the log volume with the instance (`--keep-logs` only on request) | retention/rotation smoke; `access_log none` render test; rm test |
 | T14 | **SNI filter bypass: ECH / QUIC / DoH** | **ECH** (Encrypted Client Hello) encrypts the SNI → splice filter blind; **QUIC/HTTP3** runs over **UDP 443**, bypassing the TCP forward proxy; **DoH** circumvents the DNS view. Limit of name-based filtering — the proxy alone does not close this. **Mitigate at the network edge:** OPNsense **block UDP 443** (forces TCP/443 through the proxy), block known DoH resolvers + `use-application-dns.net` (canary disables Firefox DoH); observe ECH adoption. For real completeness you would need SSL interception (a deliberate non-goal, ADR-002). | firewall review at the site; documented limit |
 | T15 | **Poisoned build input** (supply chain of the `.deb`, installed as root) — a compromised or silently changed PyPI release, build image or GitHub Action lands in the package | Python deps (pip included) only from `controlplane/requirements.lock` with SHA-256 hashes (`--require-hashes --no-deps --only-binary :all:`, wheels only), nothing younger than 7 days picked (`--exclude-newer=P7D`), own wheel built without build isolation from a hashed setuptools; build container, data-plane base image and actions pinned by digest/commit SHA; changes only via human-merged PRs (raised by hand while Renovate is disabled); releases published draft-first (immutable releases) with the asset hash checked against the build (ADR-015) | `lock-deps.sh --gate` first in the fast tier AND in every build, before anything from a lock is installed or run (no venv `bin/` on PATH; `/usr/bin/python3 -I`; every entry point restarts itself under `env -i` through `/bin/bash -p` with an allowlist, `packaging/clean-env.sh`: fixed PATH and `LC_ALL`, the caller's `HOME`, `TMPDIR`, proxies, CA bundles (`SSL_CERT_FILE`, `SSL_CERT_DIR`, `REQUESTS_CA_BUNDLE`, `PIP_CERT`) and the repository's own switches, nothing else; not undone, because it ran before the restart: the caller's first bash for `bash <script>` (`BASH_ENV`, `SHELLOPTS=noexec`), the make running `make deb` (`MAKEFILES`, `MAKEFLAGS`, `GNUMAKEFLAGS`), `LD_PRELOAD` of that first process): only lines uv writes, uv from a uv-only lock proven with the standard library and run by absolute path, every hash one PyPI publishes for exactly that `name==version`, pins exactly the closure of pyproject/`.in` within 7 days, a cp312 wheel for every pin; so a tag on a commit whose lock never passed CI still cannot be built; `--verify-freeze` fails the build unless each venv is exactly its lock (plus lmnsquid / ensurepip's pip), all `name==version`; not caught: a pin moved to another real release of a needed package, older or newer, at least 7 days old and within the declared requirements (review); a wrong hash or an sdist-only pin stops the build; `scripts/tests/lock_gates.sh` (fast tier, `--build` in CI) keeps the manipulations of the cold verification rejected, also from a shell with a poisoned venv; `make deb` packs only tracked files and runs nothing configured in the checkout's git (`scripts/tests/make_deb.sh`) |
-| T16 | **Domains without proxy authentication** (`noauth.domains`, ADR-016) widen access: everyone in the school subnets reaches a listed domain without a ticket. **Exam mode:** exam accounts (and anyone else) reach the listed domains during an exam, e.g. OneDrive, Teams, Outlook for Microsoft 365, although the proxy rejects them otherwise (T12). **Internetsperre:** does not apply to listed domains (no identity, so no group check). **Accountability:** the access log shows `-` instead of a user for these requests. Tunnel abuse: a listed CDN/front-door domain could carry other content (domain fronting) | empty by default, no built-in content; entries only domains below a TLD (IP literals and single labels such as `com` refused, and ignored when hand-written); only from `school_net` (keep `--school-subnets` tight, the default `0.0.0.0/0` means "whoever reaches the port"); the blocklist wins (`deny noauth_domains blocked_domains` first, 403); the existing CONNECT rules stay before it (port 443 only, no IP literals); `dstdomain -n` (no reverse DNS for IP-literal URLs, a PTR cannot put an address on the list); a CONNECT on this path is terminated unless its SNI is listed too, and terminated without SNI; no decryption (ADR-002), so fronting via the encrypted Host header inside a listed name's TLS stays possible (as for any splice). Warnings in `operations.md`, `install.md` and `lmnsquid noauth --help` | E2E: listed → 200 / tunnel without ticket; unlisted → 407; listed+blocked → 403; foreign SNI, blocked SNI and no SNI → TLS cut; IP literal with a PTR to a listed name → 407; outside `school_net` → 407; with a ticket the 200/403/407 matrix unchanged; counter-runs without `-n` resp. without the SNI rule fail |
+| T16 | **Domains without proxy authentication** (`noauth.domains`, ADR-016) widen access: everyone in the school subnets reaches a listed domain without a ticket. **Exam mode:** exam accounts (and anyone else) reach the listed domains during an exam, e.g. OneDrive, Teams, Outlook for Microsoft 365, although the proxy rejects them otherwise (T12). **Internetsperre:** does not apply to listed domains (no identity, so no group check). **Accountability:** the access log shows `-` instead of a user for these requests. Tunnel abuse: a listed CDN/front-door domain could carry other content (domain fronting) | empty by default, no built-in content; entries only domains below a TLD (IP literals and single labels such as `com` refused, and ignored when hand-written); only from `school_net` (keep `--school-subnets` tight, the default `0.0.0.0/0` means "whoever reaches the port"); the blocklist wins (`deny noauth_domains blocked_domains` first, 403); the existing CONNECT rules stay before it (port 443 only, no IP literals); `dstdomain -n` (no reverse DNS for IP-literal URLs, a PTR cannot put an address on the list); a CONNECT on this path is terminated unless its SNI is listed too, and terminated without SNI; no decryption (ADR-002), so fronting via the encrypted Host header inside a listed name's TLS stays possible (as for any splice). Known limit: two-label public suffixes (`co.uk`, `github.io`) pass the name check and would open a whole registration space (no public-suffix list; operations.md). Warnings in `operations.md`, `install.md` and `lmnsquid noauth --help` | E2E: listed → 200 / tunnel without ticket; unlisted → 407; listed+blocked → 403; foreign SNI, blocked SNI and no SNI → TLS cut; IP literal with a PTR to a listed name → 407; outside `school_net` → 407; with a ticket the 200/403/407 matrix unchanged; counter-runs without `-n` resp. without the SNI rule fail |
 
 ## Non-goals (deliberate)
 

From fcd3581cf2a7801fdb6f60f8b3432f36a5586cf4 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 16:17:52 +0100
Subject: [PATCH 20/24] test(e2e): move the E2E network out of Docker's default
 address pools

The final `run.sh all` of this round failed twice in kerberos-e2e and both
DC smokes with "invalid pool request: Pool overlaps with other one on this
address space": another project on the build host created compose networks
every few minutes and Docker gave them its default /16 pools in turn
(172.28, 172.29, 172.30, 172.31.0.0/16), so the fixed 172.28.0.0/24 of the
E2E stack collided whenever one of them held 172.28. Waiting for one to go
away did not help, the next took its place.

The stack now uses 10.228.0.0/24, outside Docker's default pools
(172.17-31.0.0/16, 192.168.0.0/16) and not routed on the hosts in use (the
linuxmuster lab is 10.250.0.0/24). Same last octets as before; changed are
the compose network and addresses, the client's krb5.conf, the assertions,
the orchestrator, load_smoke.sh and the hand-written IP line in the noauth
test list. test-strategy.md names the network and why. Test data only; no
product code or image change. With it, `run.sh all`: 11 passed, 0 failed,
0 skipped.
---
 deploy/e2e/client/assert.sh            | 10 +++----
 deploy/e2e/client/krb5.conf            |  2 +-
 deploy/e2e/docker-compose.yml          | 38 +++++++++++++-------------
 deploy/e2e/lists-noauth/noauth.domains |  2 +-
 docs/test-strategy.md                  |  4 ++-
 scripts/tests/e2e_kerberos.sh          | 26 +++++++++---------
 scripts/tests/load_smoke.sh            |  2 +-
 7 files changed, 43 insertions(+), 41 deletions(-)

diff --git a/deploy/e2e/client/assert.sh b/deploy/e2e/client/assert.sh
index ea40c2a..86de25a 100755
--- a/deploy/e2e/client/assert.sh
+++ b/deploy/e2e/client/assert.sh
@@ -108,17 +108,17 @@ check_via "Internet-gate OR: teacher in 'schule2-internet' -> ok" inetor "$PROXY
 check_via "Internet-gate: teacher in NO internet group -> deny" inetno "$PROXY3" "$ALLOWED" 403
 
 # Domains without proxy auth (ADR-016). squid-noauth lists secure.example.internal and
-# both.example.internal (the latter also blocked); school_net = this client (172.28.0.30).
+# both.example.internal (the latter also blocked); school_net = this client (10.228.0.30).
 NA="http://squid4.example.internal:3128"
 NA_HOST="squid4.example.internal:3128"
-echo "-- noauth (client $(hostname -I 2>/dev/null | tr -d ' '), school_net 172.28.0.30/32) --"
+echo "-- noauth (client $(hostname -I 2>/dev/null | tr -d ' '), school_net 10.228.0.30/32) --"
 check_via    "noauth: listed HTTP, no ticket -> 200"              "" "$NA" "http://secure.example.internal/" 200
 check_via    "noauth: listed subdomain, no ticket -> 200"         "" "$NA" "http://www.secure.example.internal/" 200
 check_via    "noauth: not listed, no ticket -> 407"               "" "$NA" "$ALLOWED" 407
-# squid-noauth knows 172.28.0.21 -> secure.example.internal (extra_hosts = its reverse
+# squid-noauth knows 10.228.0.21 -> secure.example.internal (extra_hosts = its reverse
 # cache): without dstdomain -n this IP-literal URL would match the list (200, measured).
-check_via    "noauth: IP literal of a listed host -> 407"         "" "$NA" "http://172.28.0.21/" 407
-check_via    "noauth: IP written into the list -> 407"           "" "$NA" "http://172.28.0.20/" 407
+check_via    "noauth: IP literal of a listed host -> 407"         "" "$NA" "http://10.228.0.21/" 407
+check_via    "noauth: IP written into the list -> 407"           "" "$NA" "http://10.228.0.20/" 407
 check_via    "noauth: listed AND blocked HTTP, no ticket -> 403"  "" "$NA" "http://both.example.internal/" 403
 check_tunnel "noauth: listed HTTPS, no ticket -> tunnel + TLS"   "" "$NA" "https://secure.example.internal/" "200 200"
 check_tunnel "noauth: not listed HTTPS, no ticket -> 407"         "" "$NA" "https://secure2.example.internal/" "407 000"
diff --git a/deploy/e2e/client/krb5.conf b/deploy/e2e/client/krb5.conf
index 5c8feb0..183314f 100644
--- a/deploy/e2e/client/krb5.conf
+++ b/deploy/e2e/client/krb5.conf
@@ -14,7 +14,7 @@
 
 [realms]
     EXAMPLE.INTERNAL = {
-        kdc = 172.28.0.2
+        kdc = 10.228.0.2
     }
 
 [domain_realm]
diff --git a/deploy/e2e/docker-compose.yml b/deploy/e2e/docker-compose.yml
index e30a54b..62e1311 100644
--- a/deploy/e2e/docker-compose.yml
+++ b/deploy/e2e/docker-compose.yml
@@ -14,7 +14,7 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.28.0.0/24
+        - subnet: 10.228.0.0/24
 
 volumes:
   shared: {}          # DC exports the Keytab here, Squid reads it (ro)
@@ -29,11 +29,11 @@ services:
       DOMAIN: "EXAMPLE.INTERNAL"
       DOMAINPASS: "Passw0rd!"
       NOCOMPLEXITY: "true"
-      HOSTIP: "172.28.0.2"
+      HOSTIP: "10.228.0.2"
       INSECURELDAP: "true"
     networks:
       e2e:
-        ipv4_address: 172.28.0.2
+        ipv4_address: 10.228.0.2
     volumes:
       - shared:/shared
 
@@ -51,10 +51,10 @@ services:
       SCHOOL_SUBNETS: "0.0.0.0/0"      # Subnet scope is tested in P3
       KEYTAB: "/shared/squid.keytab"
       CACHE_SIZE_MB: "200"
-    dns: ["172.28.0.2"]               # AD-DNS: resolves SRV/_ldap._tcp + origin A-record
+    dns: ["10.228.0.2"]               # AD-DNS: resolves SRV/_ldap._tcp + origin A-record
     networks:
       e2e:
-        ipv4_address: 172.28.0.10
+        ipv4_address: 10.228.0.10
     volumes:
       - shared:/shared:ro
       - ./blocked.domains:/etc/squid/lists/blocked.domains:ro
@@ -78,10 +78,10 @@ services:
       SCHOOL_SUBNETS: "0.0.0.0/0"
       KEYTAB: "/shared/squid.keytab"
       CACHE_SIZE_MB: "200"
-    dns: ["172.28.0.2"]
+    dns: ["10.228.0.2"]
     networks:
       e2e:
-        ipv4_address: 172.28.0.11
+        ipv4_address: 10.228.0.11
     volumes:
       - shared:/shared:ro
       # The list directory of a control plane without ADR-016 (no noauth.domains).
@@ -108,10 +108,10 @@ services:
       SCHOOL_SUBNETS: "0.0.0.0/0"
       KEYTAB: "/shared/squid.keytab"
       CACHE_SIZE_MB: "200"
-    dns: ["172.28.0.2"]
+    dns: ["10.228.0.2"]
     networks:
       e2e:
-        ipv4_address: 172.28.0.12
+        ipv4_address: 10.228.0.12
     volumes:
       - shared:/shared:ro
       - ./blocked.domains:/etc/squid/lists/blocked.domains:ro
@@ -133,16 +133,16 @@ services:
       VISIBLE_HOSTNAME: "squid4.example.internal"
       REALM: "EXAMPLE.INTERNAL"
       AD_GROUP: "teachers"
-      SCHOOL_SUBNETS: "172.28.0.30/32"
+      SCHOOL_SUBNETS: "10.228.0.30/32"
       KEYTAB: "/shared/squid.keytab"
       CACHE_SIZE_MB: "200"
-    dns: ["172.28.0.2"]
+    dns: ["10.228.0.2"]
     # squid loads /etc/hosts into its reverse cache too: the IP-literal test needs the
     # address to map back to a listed name (proves dstdomain -n).
-    extra_hosts: ["secure.example.internal:172.28.0.21"]
+    extra_hosts: ["secure.example.internal:10.228.0.21"]
     networks:
       e2e:
-        ipv4_address: 172.28.0.13
+        ipv4_address: 10.228.0.13
     volumes:
       - shared:/shared:ro
       - ./lists-noauth:/etc/squid/lists:ro
@@ -168,10 +168,10 @@ services:
       SCHOOL_SUBNETS: "0.0.0.0/0"
       KEYTAB: "/shared/squid.keytab"
       CACHE_SIZE_MB: "200"
-    dns: ["172.28.0.2"]
+    dns: ["10.228.0.2"]
     networks:
       e2e:
-        ipv4_address: 172.28.0.14
+        ipv4_address: 10.228.0.14
     volumes:
       - shared:/shared:ro
       - ./lists-old:/etc/squid/lists:ro
@@ -187,7 +187,7 @@ services:
     hostname: origin.example.internal
     networks:
       e2e:
-        ipv4_address: 172.28.0.20
+        ipv4_address: 10.228.0.20
 
   # Allowed HTTPS target (self-signed) — for the splice test.
   origin-https:
@@ -195,13 +195,13 @@ services:
     hostname: secure.example.internal
     networks:
       e2e:
-        ipv4_address: 172.28.0.21
+        ipv4_address: 10.228.0.21
 
   # Kerberos client that runs the four assertions (ENTRYPOINT = /assert.sh).
   test-client:
     build: ./client
     depends_on: [squid]
-    dns: ["172.28.0.2"]
+    dns: ["10.228.0.2"]
     networks:
       e2e:
-        ipv4_address: 172.28.0.30
+        ipv4_address: 10.228.0.30
diff --git a/deploy/e2e/lists-noauth/noauth.domains b/deploy/e2e/lists-noauth/noauth.domains
index b038d93..55afb6a 100644
--- a/deploy/e2e/lists-noauth/noauth.domains
+++ b/deploy/e2e/lists-noauth/noauth.domains
@@ -10,6 +10,6 @@ secure.example.internal
 .secure.example.internal
 # Also hand-written, and ignored by lists-sync.sh for this list: an address (origin) and a
 # single label that would open every *.internal name.
-172.28.0.20
+10.228.0.20
 internal
 .both.example.internal
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index 425e8c8..4d09256 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -78,7 +78,9 @@ from the caller's PATH.
 ## Heavy tier — Kerberos E2E (Docker)
 
 docker-compose stack: `samba-dc` + `squid` + `origin` + `test-client` (details in
-the `/test` skill). `run.sh e2e` (and `all`) also runs the admin-script smokes against the
+the `/test` skill), on the fixed network `10.228.0.0/24`: outside Docker's default address
+pools (`172.17–31.0.0/16`, `192.168.0.0/16`), which other compose projects on the same host take
+one after the other, so the stack does not fail with "Pool overlaps". `run.sh e2e` (and `all`) also runs the admin-script smokes against the
 same Samba DC image: `provision_keytab_smoke.sh` (SPN/alias conflicts, idempotence, fail-closed
 cases) and `discover_ad_facts_smoke.sh` (groups, realm from the DC, templates). Not in GitHub
 CI: the heavy tier stays out of it (`ci.yml` header), and a new job would be a new required
diff --git a/scripts/tests/e2e_kerberos.sh b/scripts/tests/e2e_kerberos.sh
index da3a603..01e014d 100755
--- a/scripts/tests/e2e_kerberos.sh
+++ b/scripts/tests/e2e_kerberos.sh
@@ -14,8 +14,8 @@ DOCKER="docker"; docker info >/dev/null 2>&1 || DOCKER="sudo docker"
 DC="$DOCKER compose -f $CF"
 DLC="example.internal"
 PW="Passw0rd!"
-SQUID_IP="172.28.0.10"
-ORIGIN_IP="172.28.0.20"
+SQUID_IP="10.228.0.10"
+ORIGIN_IP="10.228.0.20"
 
 log(){ printf '\n== %s ==\n' "$1"; }
 dcx(){ $DC exec -T samba-dc "$@"; }        # exec in the DC, no TTY
@@ -60,13 +60,13 @@ dcx samba-tool domain exportkeytab /shared/squid.keytab --principal=squidsvc ||
 dcx chmod 0600 /shared/squid.keytab   # 0600: tests the production keytab path (proxy copy in the entrypoint)
 dcx samba-tool dns add 127.0.0.1 "$DLC" squid  A "$SQUID_IP"  -U "Administrator%$PW" >/dev/null 2>&1 || true
 dcx samba-tool dns add 127.0.0.1 "$DLC" origin A "$ORIGIN_IP"   -U "Administrator%$PW" >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" secure A 172.28.0.21    -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" secure A 10.228.0.21    -U "Administrator%$PW" >/dev/null 2>&1 || true
 # Multischool fixtures: 2nd school "schule2" with prefixed group + its own teacher
 dcx samba-tool user  create teacher2 "$PW"                      >/dev/null 2>&1 || true
 dcx samba-tool group add schule2-teachers                      >/dev/null 2>&1 || true
 dcx samba-tool group addmembers schule2-teachers teacher2      >/dev/null 2>&1 || true
 dcx samba-tool spn   add "HTTP/squid2.$DLC" squidsvc           >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" squid2 A 172.28.0.11   -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" squid2 A 10.228.0.11   -U "Administrator%$PW" >/dev/null 2>&1 || true
 # Internet-gate fixtures: 'internet' + 'schule2-internet' groups + 3 teachers that differ
 # ONLY by internet membership (in internet / in schule2-internet / in none). squid-inet
 # requires teachers AND (internet OR schule2-internet). The new SPN uses the squidsvc key.
@@ -79,16 +79,16 @@ dcx samba-tool group addmembers teachers "inetok,inetor,inetno"  >/dev/null 2>&1
 dcx samba-tool group addmembers internet inetok                  >/dev/null 2>&1 || true
 dcx samba-tool group addmembers schule2-internet inetor          >/dev/null 2>&1 || true
 dcx samba-tool spn   add "HTTP/squid3.$DLC" squidsvc             >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" squid3 A 172.28.0.12    -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" squid3 A 10.228.0.12    -U "Administrator%$PW" >/dev/null 2>&1 || true
 
 # Domains without proxy auth (ADR-016): squid4 = squid-noauth, squid5 = squid-old (image from before ADR-016);
 # more names on the HTTPS origin (a listed subdomain, an unlisted name).
 dcx samba-tool spn   add "HTTP/squid4.$DLC" squidsvc             >/dev/null 2>&1 || true
 dcx samba-tool spn   add "HTTP/squid5.$DLC" squidsvc             >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" squid4 A 172.28.0.13    -U "Administrator%$PW" >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" squid5 A 172.28.0.14    -U "Administrator%$PW" >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" www.secure A 172.28.0.21 -U "Administrator%$PW" >/dev/null 2>&1 || true
-dcx samba-tool dns add 127.0.0.1 "$DLC" secure2 A 172.28.0.21   -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" squid4 A 10.228.0.13    -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" squid5 A 10.228.0.14    -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" www.secure A 10.228.0.21 -U "Administrator%$PW" >/dev/null 2>&1 || true
+dcx samba-tool dns add 127.0.0.1 "$DLC" secure2 A 10.228.0.21   -U "Administrator%$PW" >/dev/null 2>&1 || true
 
 log "start origin + origin-https + squid + squid2 + squid-inet + squid-noauth + squid-old"
 $DC up -d origin origin-https squid squid2 squid-inet squid-noauth squid-old || exit 1
@@ -128,12 +128,12 @@ else
   echo "  [FAIL] internetsperre: expected 403, got '$tcode'"; rc=$((rc + 1))
 fi
 
-# Outside school_net (squid-noauth admits 172.28.0.30/32 only): from the squid container
-# (172.28.0.10) a listed domain without a ticket must still get 407, plain HTTP and CONNECT.
+# Outside school_net (squid-noauth admits 10.228.0.30/32 only): from the squid container
+# (10.228.0.10) a listed domain without a ticket must still get 407, plain HTTP and CONNECT.
 log "noauth: request from outside school_net, no ticket -> 407"
 for req in "http://secure.example.internal/" "-m CONNECT secure.example.internal:443"; do
   # shellcheck disable=SC2086  # $req carries squidclient's options on purpose
-  line=$($DC exec -T squid squidclient -T 10 -h 172.28.0.13 -p 3128 $req 2>/dev/null | head -1 | tr -d '\r')
+  line=$($DC exec -T squid squidclient -T 10 -h 10.228.0.13 -p 3128 $req 2>/dev/null | head -1 | tr -d '\r')
   case "$line" in
     *" 407 "*) echo "  [PASS] outside school_net: $req -> $line" ;;
     *) echo "  [FAIL] outside school_net: $req: expected 407, got '$line'"; rc=$((rc + 1)) ;;
@@ -157,7 +157,7 @@ if $DC logs squid-noauth 2>/dev/null | grep 'entries ignored, already covered' >
 else
   echo "  [FAIL] no notice about covered entries"; rc=$((rc + 1))
 fi
-if $DC logs squid-noauth 2>/dev/null | grep 'noauth.domains: ignored, not a domain name: 172.28.0.20' >/dev/null; then
+if $DC logs squid-noauth 2>/dev/null | grep 'noauth.domains: ignored, not a domain name: 10.228.0.20' >/dev/null; then
   echo "  [PASS] IP literal in noauth.domains ignored and logged"
 else
   echo "  [FAIL] no notice about the IP literal in noauth.domains"; rc=$((rc + 1))
diff --git a/scripts/tests/load_smoke.sh b/scripts/tests/load_smoke.sh
index e480aaf..071ce13 100755
--- a/scripts/tests/load_smoke.sh
+++ b/scripts/tests/load_smoke.sh
@@ -12,7 +12,7 @@ CF="$ROOT/deploy/e2e/docker-compose.yml"
 DOCKER="docker"; docker info >/dev/null 2>&1 || DOCKER="sudo docker"
 DC="$DOCKER compose -f $CF"
 DLC="example.internal"; REALM="EXAMPLE.INTERNAL"; PW="Passw0rd!"
-SQUID_IP="172.28.0.10"; ORIGIN_IP="172.28.0.20"
+SQUID_IP="10.228.0.10"; ORIGIN_IP="10.228.0.20"
 N="${LOAD_N:-50}"
 
 dcx(){ $DC exec -T samba-dc "$@"; }

From b1093b76611a861027fda6ba9d354d8546543ff6 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 16:33:42 +0100
Subject: [PATCH 21/24] test(cli): match the noauth --help warnings independent
 of the terminal

CI run 41471268667 (fast/pytest): test_cli_noauth_help_warns failed with
"AssertionError: school-subnets". On GitHub Actions Rich styles the help
(GITHUB_ACTIONS / FORCE_COLOR: ANSI codes inside words such as
--school-subnets) and wraps it to the runner's width. Reproduced locally
with GITHUB_ACTIONS=true or FORCE_COLOR=1; it passed with COLUMNS alone.

The test now invokes the help with the colour variables removed,
NO_COLOR=1, TERM=dumb and COLUMNS=200, and still strips escape codes and
collapses whitespace before matching. Passes with GITHUB_ACTIONS=true,
FORCE_COLOR=1, COLUMNS=80 and COLUMNS=40; the whole suite passes under
GITHUB_ACTIONS=true FORCE_COLOR=1 COLUMNS=80. It is the only test that
matches help text.
---
 controlplane/tests/test_noauth.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/controlplane/tests/test_noauth.py b/controlplane/tests/test_noauth.py
index d1259f3..a38a396 100644
--- a/controlplane/tests/test_noauth.py
+++ b/controlplane/tests/test_noauth.py
@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+import re
 from pathlib import Path
 from typing import Any
 
@@ -276,8 +277,12 @@ def test_cli_noauth(patch_client: None, instance_data: dict[str, Any], docker: A
 
 
 def test_cli_noauth_help_warns() -> None:
-    r = runner.invoke(cli.app, ["noauth", "--help"])
+    # Rich styles and wraps the help after the environment: on GitHub Actions (GITHUB_ACTIONS,
+    # FORCE_COLOR) it inserts ANSI codes inside words, and the width follows COLUMNS. So: no
+    # colour variables, a wide terminal, and still strip escape codes and line breaks.
+    plain = {"GITHUB_ACTIONS": None, "FORCE_COLOR": None, "NO_COLOR": "1", "TERM": "dumb"}
+    r = runner.invoke(cli.app, ["noauth", "--help"], env={**plain, "COLUMNS": "200"})
     assert r.exit_code == 0
-    text = " ".join(r.output.split())
+    text = " ".join(re.sub(r"\x1b\[[0-9;?]*[A-Za-z]", "", r.output).split())
     for needle in ("exam mode", "Internetsperre", "school-subnets", "blocklist still wins"):
         assert needle in text, needle

From 00af2c86c87615f6f64a0fd10572a21fdb1456e8 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 16:34:36 +0100
Subject: [PATCH 22/24] ci(upgrade-smoke): expect the empty noauth.domains the
 upgrade creates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI run 41471268667 (upgrade-smoke, "Assert that nothing was lost"): the
mode/owner diff of /etc/linuxmuster-squid failed on
"+644 113:119 /etc/linuxmuster-squid/blocklists/all-teachers/noauth.domains",
the file update-all/reconcile now create next to blocked.domains (ADR-016).

The assertion stays strict and allows exactly that: for every
blocked.domains of the previous release that has no noauth.domains beside
it, the expected list gains `<same mode> <same owner> <dir>/noauth.domains`,
the file must exist and be empty; then the full diff runs as before. A file
the old release already had is not expected again. The checks are spelled
out (`|| { …; exit 1; }`, `if …; then exit 1`) because `set -e` ignores a
failure inside `&&` lists and after `!`.

Tested locally on simulated trees with the block extracted from ci.yml:
the CI case passes; an extra file, a wrong mode, a non-empty or a missing
noauth.domains and a changed mode elsewhere fail; an existing noauth.domains
from the old release passes. Changed identically in release.yml (the blocks
are byte-identical); no job added, renamed or removed.
---
 .github/workflows/ci.yml      | 18 ++++++++++++++++--
 .github/workflows/release.yml | 18 ++++++++++++++++--
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b45f3a3..92057d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -569,9 +569,23 @@ jobs:
           test -s before/sha256
           sudo sha256sum -c before/sha256
 
-          # 3. modes and ownership in the config tree unchanged
+          # 3. modes and ownership in the config tree unchanged, with one expected addition
+          #    (since 7.3.8, ADR-016): update-all/reconcile create an EMPTY noauth.domains next
+          #    to every blocked.domains, with that file's mode and owner. It is expected only
+          #    where the previous release had none; any other difference still fails.
           sudo find /etc/linuxmuster-squid -printf '%m %U:%G %p\n' | sort > after/etc-modes
-          diff -u before/etc-modes after/etc-modes
+          cp before/etc-modes before/etc-modes.expected
+          while read -r mode owner path; do
+            new="${path%/blocked.domains}/noauth.domains"
+            if awk -v p="$new" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
+              continue
+            fi
+            echo "$mode $owner $new" >> before/etc-modes.expected
+            sudo test -f "$new" || { echo "missing: $new"; exit 1; }
+            if sudo test -s "$new"; then echo "not empty: $new"; exit 1; fi
+          done < <(awk '$3 ~ /\/blocked\.domains$/' before/etc-modes)
+          sort -o before/etc-modes.expected before/etc-modes.expected
+          diff -u before/etc-modes.expected after/etc-modes
 
           # 4. the instance record is written by the software, not the admin, and the
           #    postinst rewrites `image:` on purpose (update-all). Every key the admin
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 295dd10..d324ab2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -480,9 +480,23 @@ jobs:
           test -s before/sha256
           sudo sha256sum -c before/sha256
 
-          # 3. modes and ownership in the config tree unchanged
+          # 3. modes and ownership in the config tree unchanged, with one expected addition
+          #    (since 7.3.8, ADR-016): update-all/reconcile create an EMPTY noauth.domains next
+          #    to every blocked.domains, with that file's mode and owner. It is expected only
+          #    where the previous release had none; any other difference still fails.
           sudo find /etc/linuxmuster-squid -printf '%m %U:%G %p\n' | sort > after/etc-modes
-          diff -u before/etc-modes after/etc-modes
+          cp before/etc-modes before/etc-modes.expected
+          while read -r mode owner path; do
+            new="${path%/blocked.domains}/noauth.domains"
+            if awk -v p="$new" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
+              continue
+            fi
+            echo "$mode $owner $new" >> before/etc-modes.expected
+            sudo test -f "$new" || { echo "missing: $new"; exit 1; }
+            if sudo test -s "$new"; then echo "not empty: $new"; exit 1; fi
+          done < <(awk '$3 ~ /\/blocked\.domains$/' before/etc-modes)
+          sort -o before/etc-modes.expected before/etc-modes.expected
+          diff -u before/etc-modes.expected after/etc-modes
 
           # 4. the instance record is written by the software, not the admin, and the
           #    postinst rewrites `image:` on purpose (update-all). Every key the admin

From 3a7b33b16f65c16e021fd4f5f309e733e0cefc12 Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 16:41:31 +0100
Subject: [PATCH 23/24] ci(upgrade-smoke): expect noauth.domains only in the
 instance list dirs

CI run 41472957495 failed in the new check: "missing:
/etc/linuxmuster-squid/noauth.domains". The smoke also gives the admin a
top-level /etc/linuxmuster-squid/blocked.domains, and the check took every
blocked.domains as a place where the upgrade adds noauth.domains; the
control plane only creates it in blocklists/<name>/. The match is now
anchored to /etc/linuxmuster-squid/blocklists/<name>/blocked.domains. The
loop variable was also called `new`, which the step uses for the installed
version (the summary at its end); it is `noauth_file` now.

Retested locally with the CI layout (top-level blocked.domains, a version
in $new): the CI case passes and $new survives; an extra file, a
noauth.domains at the top level, a wrong mode, a non-empty or a missing
noauth.domains and another changed mode fail; an existing noauth.domains of
the old release passes. Identical in release.yml.
---
 .github/workflows/ci.yml      | 18 ++++++++++--------
 .github/workflows/release.yml | 18 ++++++++++--------
 2 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92057d6..aaa62a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -571,19 +571,21 @@ jobs:
 
           # 3. modes and ownership in the config tree unchanged, with one expected addition
           #    (since 7.3.8, ADR-016): update-all/reconcile create an EMPTY noauth.domains next
-          #    to every blocked.domains, with that file's mode and owner. It is expected only
-          #    where the previous release had none; any other difference still fails.
+          #    to every instance's blocklists/<name>/blocked.domains, with that file's mode and
+          #    owner. It is expected only where the previous release had none; any other
+          #    difference (also next to the admin's own /etc/linuxmuster-squid/blocked.domains)
+          #    still fails.
           sudo find /etc/linuxmuster-squid -printf '%m %U:%G %p\n' | sort > after/etc-modes
           cp before/etc-modes before/etc-modes.expected
           while read -r mode owner path; do
-            new="${path%/blocked.domains}/noauth.domains"
-            if awk -v p="$new" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
+            noauth_file="${path%/blocked.domains}/noauth.domains"
+            if awk -v p="$noauth_file" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
               continue
             fi
-            echo "$mode $owner $new" >> before/etc-modes.expected
-            sudo test -f "$new" || { echo "missing: $new"; exit 1; }
-            if sudo test -s "$new"; then echo "not empty: $new"; exit 1; fi
-          done < <(awk '$3 ~ /\/blocked\.domains$/' before/etc-modes)
+            echo "$mode $owner $noauth_file" >> before/etc-modes.expected
+            sudo test -f "$noauth_file" || { echo "missing: $noauth_file"; exit 1; }
+            if sudo test -s "$noauth_file"; then echo "not empty: $noauth_file"; exit 1; fi
+          done < <(awk '$3 ~ /^\/etc\/linuxmuster-squid\/blocklists\/[^\/]+\/blocked\.domains$/' before/etc-modes)
           sort -o before/etc-modes.expected before/etc-modes.expected
           diff -u before/etc-modes.expected after/etc-modes
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d324ab2..be05e2f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -482,19 +482,21 @@ jobs:
 
           # 3. modes and ownership in the config tree unchanged, with one expected addition
           #    (since 7.3.8, ADR-016): update-all/reconcile create an EMPTY noauth.domains next
-          #    to every blocked.domains, with that file's mode and owner. It is expected only
-          #    where the previous release had none; any other difference still fails.
+          #    to every instance's blocklists/<name>/blocked.domains, with that file's mode and
+          #    owner. It is expected only where the previous release had none; any other
+          #    difference (also next to the admin's own /etc/linuxmuster-squid/blocked.domains)
+          #    still fails.
           sudo find /etc/linuxmuster-squid -printf '%m %U:%G %p\n' | sort > after/etc-modes
           cp before/etc-modes before/etc-modes.expected
           while read -r mode owner path; do
-            new="${path%/blocked.domains}/noauth.domains"
-            if awk -v p="$new" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
+            noauth_file="${path%/blocked.domains}/noauth.domains"
+            if awk -v p="$noauth_file" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
               continue
             fi
-            echo "$mode $owner $new" >> before/etc-modes.expected
-            sudo test -f "$new" || { echo "missing: $new"; exit 1; }
-            if sudo test -s "$new"; then echo "not empty: $new"; exit 1; fi
-          done < <(awk '$3 ~ /\/blocked\.domains$/' before/etc-modes)
+            echo "$mode $owner $noauth_file" >> before/etc-modes.expected
+            sudo test -f "$noauth_file" || { echo "missing: $noauth_file"; exit 1; }
+            if sudo test -s "$noauth_file"; then echo "not empty: $noauth_file"; exit 1; fi
+          done < <(awk '$3 ~ /^\/etc\/linuxmuster-squid\/blocklists\/[^\/]+\/blocked\.domains$/' before/etc-modes)
           sort -o before/etc-modes.expected before/etc-modes.expected
           diff -u before/etc-modes.expected after/etc-modes
 

From 486254e7ffdec8ba0b6d61386e96e498dd9bbcdd Mon Sep 17 00:00:00 2001
From: Kevin Stenzel <mail@kevin-stenzel.de>
Date: Mon, 2 Nov 2026 16:56:29 +0100
Subject: [PATCH 24/24] docs: correct the access-log pattern of a blocked HTTPS
 host and the T4 evidence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cold verification 3:
- N1: operations.md gave `NONE_NONE/200 0 CONNECT <host>:443` for a blocked
  HTTPS host; measured is `TCP_DENIED/200 0 CONNECT <host>:443`, followed by
  `NONE_NONE/403 … GET https://<host>/…` when the client accepts the
  certificate. `NONE_NONE/200 0 CONNECT` followed by `TCP_TUNNEL/200` is an
  allowed, spliced connection; the doc now says so. No other doc has the
  pattern (grep).
- N4: threat model T4 (and T8, test-strategy) said the E2E checks the
  throwaway certificate. It asserts "not 200" behind the tunnel (and
  `200 403` in the noauth case); the certificate was only checked by hand in
  the lab. Worded accordingly; no new test.
- N2/N3 as one known-limit line in operations.md: control characters of a
  hand-written entry appear unescaped in `docker logs`, and lists-sync.log on
  the /run tmpfs grows with each reporting reload until a restart.
---
 docs/operations.md    | 8 ++++++--
 docs/test-strategy.md | 2 +-
 docs/threat-model.md  | 4 ++--
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/docs/operations.md b/docs/operations.md
index 37c0e20..4434687 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -89,8 +89,9 @@ lmnsquid blocklist default-school-students reload               # squid re-reads
   request (it never sees traffic of an allowed site, that is spliced). A blocked name only in
   the SNI (behind an allowed CONNECT host) is cut during the TLS handshake: connection error.
   ADR-002 (clarification) has the details. In the access log a blocked name shows up as
-  `TCP_DENIED/403 … GET http://…`, resp. `NONE_NONE/200 0 CONNECT <host>:443` followed by
-  `NONE_NONE/403 … GET https://<host>/…` when the client accepted the certificate.
+  `TCP_DENIED/403 … GET http://…`, resp. `TCP_DENIED/200 0 CONNECT <host>:443`, followed by
+  `NONE_NONE/403 … GET https://<host>/…` when the client accepted the certificate
+  (`NONE_NONE/200 0 CONNECT …` followed by `TCP_TUNNEL/200` is an allowed, spliced connection).
 - **Hand-editing / category lists:** the file may be edited directly (one domain per line,
   leading dot = with subdomains; `#` comments; Windows line endings are fine) followed by
   `lmnsquid blocklist <name> reload`.
@@ -178,6 +179,9 @@ lmnsquid noauth all-students reload                  # squid re-reads both lists
   - `noauth list` shows the file as it is: after a hand edit it can contain lines the
     container ignores (an address, a single label, a line with a trailing comment). What squid
     really uses is what `reload` and `lmnsquid logs` do not report as ignored.
+  - Control characters in a hand-written entry appear unescaped in `docker logs` (the reload
+    answer escapes them), and `/run/lmnsquid/lists-sync.log` (tmpfs) grows by the messages of
+    each reload until the container restarts (a few hundred bytes per reload).
 
 ### Recommended list: Microsoft 365
 
diff --git a/docs/test-strategy.md b/docs/test-strategy.md
index 4d09256..73d5937 100644
--- a/docs/test-strategy.md
+++ b/docs/test-strategy.md
@@ -91,7 +91,7 @@ check of the `main` ruleset. **Core proof** (P1), assertions on `%{http_code}`:
 | Teacher allowed | `kinit teacher1`; via teacher instance | **200** |
 | Student denied (authN ok, authZ fail) | `kinit student1`; via teacher instance | **403** (not 407) |
 | Blocked domain (HTTP) | Teacher → entry from `blocked.domains` | **403** |
-| Blocked domain (HTTPS) | Teacher → CONNECT to a blocked name | **not 200** behind the tunnel: squid answers the CONNECT itself and serves its 403 inside TLS with the throwaway certificate (`curl -k`: `200 403`; without `-k` curl fails the certificate) |
+| Blocked domain (HTTPS) | Teacher → CONNECT to a blocked name | **not 200** behind the tunnel (`curl -k`): squid answers the CONNECT itself and serves its 403 inside TLS with the throwaway certificate (the noauth case asserts `200 403`; the certificate itself is not asserted, it was checked by hand in the lab) |
 | No ticket | `kdestroy`; request | **407** |
 
 The 403-vs-407 split is the actual proof (authenticated-but-unauthorized
diff --git a/docs/threat-model.md b/docs/threat-model.md
index 87209a6..78a34dd 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -24,11 +24,11 @@ Risks + countermeasures. Grows per roadmap phase; the negative tests for it live
 | T1 | **Keytab theft** | Secret (tmpfs, `:ro`), `0600` host, readable only by `proxy`, isolated per instance, never in env/log; Compose file secrets not encrypted at rest → harden the host | perms test; no keytab in `docker inspect`/logs |
 | T2 | **Proxy bypass** (non-inline) | OPNsense blocks direct 80/443 egress (force-proxy); client subnets = `SCHOOL_SUBNETS` | E2E + firewall review |
 | T3 | **Authorization bypass** (student on the teacher proxy, wrong group assignment) | group ACL enforced server-side; GPO groups == ACL groups; prefix rule correct | E2E: student→403; multischool matrix |
-| T4 | **HTTPS privacy** | no SSL-bump MITM of traffic to a real target: allowed CONNECTs are spliced (SNI peek, CONNECT `dstdomain`); the peek certificate is never distributed or trusted. A CONNECT denied by `http_access` gets squid's own 403 inside TLS with that untrusted throwaway certificate (squid's error delivery on an ssl-bump port; the target is never contacted); a client that clicks through the certificate warning reveals the path and headers of that denied request to the proxy (ADR-002, clarification) | `squid.conf` review (`ssl_bump` only peek/splice/terminate); E2E: denied HTTPS → `200 403` with the throwaway certificate, allowed → spliced |
+| T4 | **HTTPS privacy** | no SSL-bump MITM of traffic to a real target: allowed CONNECTs are spliced (SNI peek, CONNECT `dstdomain`); the peek certificate is never distributed or trusted. A CONNECT denied by `http_access` gets squid's own 403 inside TLS with that untrusted throwaway certificate (squid's error delivery on an ssl-bump port; the target is never contacted); a client that clicks through the certificate warning reveals the path and headers of that denied request to the proxy (ADR-002, clarification) | `squid.conf` review (`ssl_bump` only peek/splice/terminate); E2E: denied HTTPS → not 200 behind the tunnel (`curl -k`; the noauth case asserts `200 403`), allowed → spliced; the throwaway certificate itself is not asserted, only checked by hand in the lab (2026-10-30) |
 | T5 | **Control-plane RCE = host root** (Docker socket) | API **only `127.0.0.1`** + token (`compare_digest`), hardened systemd service, audit log. The socket proxy reduces the endpoint surface, **but does NOT downgrade below host root** (`container create` with host bind is inherently root-equivalent) → the real answer is **rootless Docker**. In-app TLS not implemented; off-host only via an operator-provided TLS reverse proxy (`main.py` warns on non-loopback bind) | API 401/403 tests; bind check ≠ 0.0.0.0 |
 | T6 | **Auth all-or-nothing / SSO outage** | auth never globally disableable by default; fallback Kerberos→Basic/LDAP (no NTLM); monitor SSO health | E2E: no ticket→407 |
 | T7 | **DNS/SPN misconfig** (silent Kerberos fail) | fwd+rev DNS resp. `rdns=false`; FQDN==SPN==`VISIBLE_HOSTNAME`; NTP<5min; AES enctypes | E2E canonicalization; `klist -k` |
-| T8 | **Blocklist rot / tampering** (supply chain) | per-instance list on the host (`/etc/linuxmuster-squid/blocklists/<name>/blocked.domains`, mounted read-only into the container, writable only by root/`lmnsquid`), maintained via `lmnsquid blocklist` + `reload`; category lists via `blocklist-refresh.sh` from a host cron with a fail-closed size floor (a truncated download never replaces the list); make outage visible. A list squid 6 cannot load (a covered name before its parent: `FATAL: Bungled`) would take the instance down at the next start: squid reads a copy without such entries (`lists-sync.sh`), and neither the API nor the refresh writes them. **HTTPS limit:** no usable block page for HTTPS: a blocked CONNECT host gets squid's 403 inside TLS with an untrusted throwaway certificate (browser: certificate warning; the target is never contacted), a blocked SNI behind an allowed CONNECT host is cut during the handshake (`ssl_bump terminate`); HTTP gets 403 | blocklist smoke; lab proof 7.3.1 (HTTP 403, HTTPS no block page), re-measured in the lab and the E2E 2026-10-30: blocked CONNECT host → `200`, then 403 inside TLS with the throwaway certificate |
+| T8 | **Blocklist rot / tampering** (supply chain) | per-instance list on the host (`/etc/linuxmuster-squid/blocklists/<name>/blocked.domains`, mounted read-only into the container, writable only by root/`lmnsquid`), maintained via `lmnsquid blocklist` + `reload`; category lists via `blocklist-refresh.sh` from a host cron with a fail-closed size floor (a truncated download never replaces the list); make outage visible. A list squid 6 cannot load (a covered name before its parent: `FATAL: Bungled`) would take the instance down at the next start: squid reads a copy without such entries (`lists-sync.sh`), and neither the API nor the refresh writes them. **HTTPS limit:** no usable block page for HTTPS: a blocked CONNECT host gets squid's 403 inside TLS with an untrusted throwaway certificate (browser: certificate warning; the target is never contacted), a blocked SNI behind an allowed CONNECT host is cut during the handshake (`ssl_bump terminate`); HTTP gets 403 | blocklist smoke; lab proof 7.3.1 (HTTP 403, HTTPS no block page), re-measured 2026-10-30: blocked CONNECT host → `200`, then 403 inside TLS (E2E: `200 403`), with the throwaway certificate (checked by hand in the lab, not asserted) |
 | T9 | **Unattended bad update → dead school** | digest pin, human-merge (no automerge; bumps by hand while Renovate is disabled), health-gated update + auto-rollback, known-good persisted | E2E: bad image → rollback |
 | T10 | **DC/LDAP outage stalls every request** | external ACL `ttl/negative_ttl/grace` + tune helper concurrency | load test P10 |
 | T11 | **Container escape/privilege** | `read_only` rootfs + tmpfs, `cap_drop: ALL` (minimal caps), non-root `proxy`, manager ACL localhost | hardening review P10 |