www/nginx: add hostnames; and proxy_protocol on; options for SNI upstream mapping

[muchachagrande]

Important notices

Before you submit a pull request, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I opened an issue first for non-trivial changes and linked it below.
• AI tools were used to create at least part of the code submitted herewith.

If AI was used, please disclose:

• Model used: Claude Sonnet 4.5/5
• Extent of AI involvement: Used to locate the relevant model/form/template files in the plugin source, and to help design and iterate on the hostname validation mask (nginx map key/regex syntax) and the rendering logic in streams.conf. All changes were reviewed and tested manually before submission.

---

Describe the problem

The SNI Upstream Mapping feature generates an nginx map {} block and a proxy_pass $hostmap...; directive, but two related nginx directives were not exposed in the GUI:

• hostnames; inside the generated map {} block, required for wildcard
  (*.example.com, www.example.*) or dot-prefixed (.example.com) map
  keys — and for regular expressions (~..., ~*...) — to actually be
  interpreted as patterns instead of literal strings. Without it, entries
  using this syntax are silently accepted by the GUI but never match
  anything at runtime.
• proxy_protocol on; inside the server {} block, to forward the client's real
  address to the backend selected via the SNI map. This was already possible
  for a fixed "Upstream", but not when routing dynamically via SNI Upstream
  Mapping.

The hostname field on each map entry was also a plain HostnameField, which rejects the wildcard/regex/dot-prefixed syntax nginx itself accepts for map keys.

---

Describe the proposed solution

• Added enable_hostnames (BooleanField) to sni_hostname_upstream_map,
  exposed as a checkbox on the map's edit form, rendered as hostnames;
  in the generated map {} block in streams.conf.
• Added map_proxy_protocol (BooleanField) to stream_server, exposed as
  a checkbox on the stream server form, rendered as proxy_protocol on|off;
  right after proxy_pass $hostmap...; in streams.conf (only applies to the
  sni_upstream_map routing mode).
• Widened sni_hostname_upstream_map_item.hostname from HostnameField
  to a TextField with a Mask covering nginx's full map key syntax:
  exact hostnames, *, *.example.com, www.example.*, .example.com,
  and case-sensitive/insensitive regular expressions (~..., ~*...), quoted
  (single or double) or unquoted. The mask explicitly excludes ;, { and } from
  every branch, since the value is written verbatim into the generated .conf file.

No controller or JS changes were required for the GUI options themselves; both new checkboxes are plain top-level fields already handled by the existing addBase()/setBase() flow.

While testing this feature I found and fixed an unrelated pre-existing bug (orphaned map/ACL items on edit, blocking deletion of referenced upstreams) — see #5654, tested together with these changes.

---

Related issue

Closes #5596

[kulikov-a]

Hi!
LGTM )

I'd probably just clarify the help for snihostname.enable_hostnames (to more closely match the nginx docs), something like: "Indicates that source values can be hostnames with a prefix or suffix mask, e.g. .example.com, www.example., or .example.com."

[muchachagrande]

Thanks! Updated the help text for enable_hostnames to match the nginx
docs wording more closely.

Separate question: since this PR adds two new model fields
(enable_hostnames, map_proxy_protocol) without a dedicated migration,
should <version> in Nginx.xml still be bumped here (relying on
BaseModelMigration's default checkDefaults() behavior), following the
same pattern as the 1.35.1 → 1.35.2 bump in this same model?