Configure the Upstream Host Allowlist

When an administrator saves an upstream channel or direct model route, CodePus validates the HTTPS scheme, public DNS hostname, port, and URL shape, then automatically adds the exact host to the server allowlist. The approval is persisted in the database, synchronized to runtime configuration, and activated immediately without an environment change or service restart.

Every automatic approval is recorded under the admin.upstream_host.auto_approve audit action. The workflow cannot approve localhost, IP literals, non-HTTPS URLs, non-443 ports, wildcards, or URLs containing credentials.

Administrator workflow

Open Admin → Settings → Upstream Routes.

Create or edit a channel plan or direct model route and enter its full HTTPS upstream URL.

Save it. If the host was not already approved, the system adds it automatically and shows a confirmation.

Enable the channel or route; activation still performs an upstream health probe first.

Environment variable compatibility

CODEPUS_UPSTREAM_ALLOWED_HOSTS remains available as a deployment-time seed allowlist. Separate exact hostnames with commas. Hosts approved in the admin panel are merged with environment-provided hosts and do not replace them.

Use the environment variable only when operations teams need to pre-approve proxy hosts before deployment. Normal admin-created upstreams require no manual deployment configuration.