search

cloudfoundry / haproxy-boshrelease

A BOSH release for haproxy (based on cf-release's haproxy job)
Apache License 2.0
38 stars 81 forks source link

Enable PROXY protocol for specific CIDRs in HAProxy #711

Closed Dariquest closed 1 month ago

Dariquest commented 2 months ago

This PR introduces a new property expect_proxy_cidrs, which accepts a list of CIDR ranges for which to expect the PROXY protocol. This property allows selective enablement of PROXY protocol based on the source IP address. Expect_proxy_cidrs is mutually exclusive with the accept_proxy, which enables PROXY protocol for all connections, and will lead to validation failure if both are set to true.

Dariquest commented 2 months ago

Approving for CI.

Thanks!

Dariquest commented 1 month ago

LGTM. The description, or commit message, could be improved. @Dariquest received some feedback already on this. This PR os not about IPv6, but about conditional Proxy Protocol handling. It benefits dual-stack roll-out on AWS, but is not the only possible use.

Removed the IPv6 and adjusted the description. Thanks!

b1tamara commented 1 month ago

Hi @Dariquest , everything fine now. The only minor thing, you might want to add this sentence to spec expect_proxy_cidrs description: expect_proxy_cidrs is mutually exclusive with the accept_proxy and not only fail if these two properties are set at the same time.

Dariquest commented 1 month ago

Hi @Dariquest , everything fine now. The only minor thing, you might want to add this sentence to spec expect_proxy_cidrs description: expect_proxy_cidrs is mutually exclusive with the accept_proxy and not only fail if these two properties are set at the same time.

Done, thanks!