OptionalcaCertificates?: string[]Host patterns this rule grants outbound network access to.
Every pattern must include an explicit port.
| Pattern | Meaning |
|---|---|
"localhost:8080" |
Port 8080 on localhost / 127.0.0.1 / ::1 |
"private:443" |
Port 443 on any RFC 1918 private address range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) |
"api.vendor.com:443" |
An exact hostname and port |
"*.vendor.com:443" |
A wildcard subdomain, exact port |
"foo.example.com:*" |
Any port on an exact hostname |
"[fd00::1]:443" |
An IPv6 literal, using bracket syntax |
"*:*" |
Any host, any port |
CIDR ranges (e.g. "192.168.1.0/24:443") are not supported.
Every port on localhost / 127.0.0.1 / ::1 is always implicitly reachable regardless of
these rules, since plugins connect to the COGS server at localhost:12095 — a "localhost:*"
pattern here is never required.
Paths, relative to the root of the packaged
.cogspluginarchive, of PEM-encoded CA certificates to trust for HTTPS connections to the hosts matched byhosts.Use this to reach local devices with vendor-issued certificates that aren't in the system CA store (e.g. a Philips Hue bridge). For matched hosts, the certificate chain is verified against these CAs instead of the system store; all other hosts continue to use the system store.