Add wildcard_matchAny routing mode for wildcard hosts

A *.example.com wildcard host now chooses between two routing modes:
- wildcard_matchAny=false (default): only subdomains explicitly defined
  in redis route; undefined subdomains get no match (406)
- wildcard_matchAny=true: any subdomain catches-all to the wildcard
  parent host, preserving the previous behavior

The gate lives in the host_lookup socket service, which is only reached
for domains missing a direct redis entry, so defined children and
**-style hosts are unaffected. Adds the matching-mode selector to the
host add/edit form, shown for wildcard hosts.

Note: existing wildcard hosts have no wildcard_matchAny field and so
default to the stricter "only defined" mode until re-saved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/services/host_lookup.js

@@ -35,6 +35,16 @@ const socket = new SocketServerJson({
 			// If we don't have a match, return empty object
 			if(!parentHost) return clientSocket.write(JSON.stringify({}));
 
+			// A wildcard host with matchAny disabled only serves subdomains that
+			// are explicitly defined in redis. Reaching this service means redis
+			// had no direct entry for the requested domain, so an inexact match
+			// here (the request isn't the wildcard host itself) is an undefined
+			// subdomain and must not be routed to the wildcard parent.
+			if(parentHost.is_wildcard && !parentHost.wildcard_matchAny
+					&& parentHost.host !== data['domain']){
+				return clientSocket.write(JSON.stringify({}));
+			}
+
 			// If the matched host belongs to a wildcard domain, set wildcard_parent
 			// This allows child domains to use the parent's wildcard SSL certificate
 			if(!parentHost.wildcard_parent){

nodejs/views/hosts.ejs

@@ -99,6 +99,8 @@
 
 		if(host.is_wildcard){
 			$('.hostEditPanel [name="host"]').attr('disabled', true);
+			// Allow toggling the wildcard matching mode when editing a wildcard host.
+			$('.hostEditPanel #wildcard_matchAny-container').removeClass('challengeType-container');
 		}
 
 		$.each(host, function( key, value ) {			if(typeof value == "boolean"){
@@ -173,6 +175,7 @@
 			// Reset the allowed types on start
 			$('#challengeType-child-container').addClass('challengeType-container');
 			$('#challengeType-DNS-01-wildcard-container').addClass('challengeType-container');
+			$('#wildcard_matchAny-container').addClass('challengeType-container');
 
 			let host = $hostField.val();
 
@@ -180,6 +183,8 @@
 			// provider.
 			if(host.startsWith("*.") && await verifyWildcardRequirements(host)){
 				$('#challengeType-DNS-01-wildcard-container').removeClass('challengeType-container');
+				// Wildcard matching mode only applies to wildcard hosts.
+				$('#wildcard_matchAny-container').removeClass('challengeType-container');
 
 				return;
 			}
@@ -363,6 +368,24 @@
 						</div>
 					</div>
 
+					<div class="form-group challengeType-container" id="wildcard_matchAny-container">
+						<label class="form-label">
+							Wildcard Matching
+						</label>
+						<div class="radio">
+							<label>
+								<input type="radio" name="wildcard_matchAny" id="wildcard_matchAny-false" value="false" checked>
+								Match only subdomains defined here <b>Recommended</b>
+							</label>
+						</div>
+						<div class="radio">
+							<label>
+								<input type="radio" name="wildcard_matchAny" id="wildcard_matchAny-true" value="true">
+								Match any subdomain and proxy to this host
+							</label>
+						</div>
+					</div>
+
 					<div class="mb-3 form-group">
 						<label for="ip" class="form-label">
 							Target IP or Host Name