diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml
index d812696fb..683c22f4f 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml
@@ -130,6 +130,20 @@
NOTE: The syntax will not be checked, use at your own risk!
]]>
true
+
+ backend.tuning_defaultserver
+
+ text
+
+ true
+
+
+ backend.tuning_noport
+
+ checkbox
+
+ true
+
header
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
index 1a399cb2b..5bdcb978c 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
@@ -51,4 +51,11 @@
true
+
+ server.checkport
+
+ text
+
+ true
+
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
index 196da4983..efb2117e8 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
@@ -17,6 +17,13 @@
info
+
+ haproxy.general.tuning.root
+
+ checkbox
+ NOTE: Enabling root could be a security issue but it's required by some feature.
]]>
+ true
+
haproxy.general.tuning.chroot
@@ -118,6 +125,13 @@
dropdown
+
+ haproxy.general.defaults.customOptions
+
+ textbox
+ NOTE: The syntax will not be checked, use at your own risk!
]]>
+ true
+
@@ -189,6 +203,13 @@
Enter user:password here. Finish with TAB.
+
+ haproxy.general.stats.customOptions
+
+ textbox
+ NOTE: The syntax will not be checked, use at your own risk!
]]>
+ true
+
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index bbb01f0ca..d98297607 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -10,6 +10,10 @@
Y
+
+ 0
+ Y
+
0
Y
@@ -114,6 +118,9 @@
redispatch on the 3rd retry prior to the last retry
+
+ N
+
@@ -208,6 +215,9 @@
/^((([0-9a-zA-Z._\-]+:[0-9a-zA-Z._\-]+)([,]){0,1}))*/u
Please provide a valid user and password, i.e. user:secret123.
+
+ N
+
@@ -233,9 +243,9 @@
Y
Y
- /^((([0-9a-zA-Z._\-\*]+:[0-9]+)([,]){0,1}))*/u
+ /^((([0-9a-zA-Z._\-\*]+:[0-9]+(-[0-9]+)?)([,]){0,1}))*/u
lower
- Please provide a valid listen address, i.e. 127.0.0.1:8080 or www.example.com:443.
+ Please provide a valid listen address, i.e. 127.0.0.1:8080 or www.example.com:443. Port range as start-end, i.e. 127.0.0.1:1220-1240.
Y
@@ -476,6 +486,13 @@
N
+
+ N
+
+
+ 0
+ Y
+
@@ -526,6 +543,13 @@
Please specify a value between 1 and 65535.
Y
+
+ 80
+ 1
+ 65535
+ Please specify a value between 1 and 65535.
+ N
+
Y
active
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 81b5a454e..c7fe7377d 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -441,7 +441,10 @@
{# ############################### #}
global
+{% if OPNsense.HAProxy.general.tuning.root != "1" %}
+ # NOTE: Could be a security issue, but required for some feature.
uid 80
+{% endif %}
gid 80
{% if OPNsense.HAProxy.general.tuning.chroot == "1" %}
# NOTE: chroot prevents (most) local logging, you need to enable remote
@@ -491,7 +494,12 @@ global
{% endif %}
{% endfor %}
{% endif %}
-
+{% if OPNsense.HAProxy.general.tuning.customOptions|default("") != "" %}
+ # WARNING: pass through options below this line
+{% for customOpt in OPNsense.HAProxy.general.tuning.customOptions.split("\n") %}
+ {{customOpt}}
+{% endfor %}
+{% endif %}
{# ############################### #}
{# DEFAULTS #}
@@ -518,6 +526,12 @@ defaults
{% if OPNsense.HAProxy.general.defaults.retries|default("") != "" %}
retries {{OPNsense.HAProxy.general.defaults.retries}}
{% endif %}
+{% if OPNsense.HAProxy.general.defaults.customOptions|default("") != "" %}
+ # WARNING: pass through options below this line
+{% for customOpt in OPNsense.HAProxy.general.defaults.customOptions.split("\n") %}
+ {{customOpt}}
+{% endfor %}
+{% endif %}
{% endif %}
{# ############################### #}
@@ -526,30 +540,34 @@ defaults
{% if helpers.exists('OPNsense.HAProxy.frontends') %}
{% for frontend in helpers.toList('OPNsense.HAProxy.frontends.frontend') %}
-{% if frontend.enabled=='1' %}
+{% if frontend.enabled == '1' %}
# Frontend: {{frontend.name}} ({{frontend.description}})
frontend {{frontend.name}}
-{# # collect ssl certs (if configured) #}
-{% if frontend.ssl_certificates|default("") != "" %}
-{% set ssl_certs = [] %}
-{% for cert in frontend.ssl_certificates.split(",") %}
-{% do ssl_certs.append('crt /var/etc/haproxy/ssl/' ~ cert ~ '.pem') %}
-{% endfor %}
-{% endif %}
-{# # advanced ssl options #}
-{% if frontend.ssl_customOptions|default("") != "" %}
-{# # add a space to separate it from other ssl params #}
-{% set ssl_options = frontend.ssl_customOptions ~ ' ' %}
+{% set ssl_certs = [] %}
+{% if frontend.ssl_enabled == '1' %}
+{# # collect ssl certs (if configured) #}
+{% if frontend.ssl_certificates|default("") != "" %}
+{% for cert in frontend.ssl_certificates.split(",") %}
+{% do ssl_certs.append('crt /var/etc/haproxy/ssl/' ~ cert ~ '.pem') %}
+{% endfor %}
+{% endif %}
+{# # advanced ssl options #}
+{% if frontend.ssl_customOptions|default("") != "" %}
+{# # add a space to separate it from other ssl params #}
+{% set ssl_options = frontend.ssl_customOptions ~ ' ' %}
+{% endif %}
{% endif %}
{# # bind/listen configuration #}
{% if frontend.bind|default("") != "" %}
{% for bind in frontend.bind.split(",") %}
- bind {{bind}} name {{bind}} {% if ssl_certs|default("") != "" %}ssl {{ ssl_options }}{{ssl_certs|join(' ')}}{% endif %}
+ bind {{bind}} name {{bind}} {% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options }}{{ssl_certs|join(' ')}} {% endif %}
{% endfor %}
{% endif %}
mode {{frontend.mode}}
+{% if frontend.mode != "tcp" %}
option {{frontend.connectionBehaviour}}
+{% endif %}
{# # select backend #}
{% if frontend.defaultBackend|default("") != "" %}
{% set backend_data = helpers.getUUID(frontend.defaultBackend) %}
@@ -688,23 +706,6 @@ backend {{backend.name}}
# health checking is DISABLED
{% set healthcheck_enabled = '0' %}
{% endif %}
-{% for server in backend.linkedServers.split(",") %}
-{% set server_data = helpers.getUUID(server) %}
-{# # collect optional server parameters #}
-{% set server_options = [] %}
-{# # check if health check is enabled #}
-{% if healthcheck_enabled == '1' %}
-{% do server_options.append('check') %}
-{% do server_options.append('inter ' ~ server_data.checkInterval) %}
-{# # add all additions from healthchecks here #}
-{% do server_options.append(healthcheck_additions|join(' ')) if healthcheck_additions.length != '0' %}
-{% endif %}
-{# # server weight #}
-{% do server_options.append('weight ' ~ server_data.weight) if server_data.weight|default("") != "" %}
-{# # server role/mode #}
-{% do server_options.append(server_data.mode) if server_data.mode|default("") != "active" %}
- server {{server_data.name}} {{server_data.address}}:{{server_data.port}} {{server_options|join(' ')}}
-{% endfor %}
{# # XXX: Usually the frontend and the backend are in the same mode, #}
{# # but we have no way to know what frontend uses this backend. #}
{# # Hence we can't automatically set the mode and thus need a #}
@@ -759,6 +760,27 @@ backend {{backend.name}}
{{customOpt}}
{% endfor %}
{% endif %}
+{% if backend.tuning_defaultserver|default("") != "" %}
+ default-server {{backend.tuning_defaultserver}}
+{% endif %}
+
+{% for server in backend.linkedServers.split(",") %}
+{% set server_data = helpers.getUUID(server) %}
+{# # collect optional server parameters #}
+{% set server_options = [] %}
+{# if# check if health check is enabled #}("") != "" %}
+{% if healthcheck_enabled == '1' %}
+{% do server_options.append('check') %}
+{% do server_options.append('inter ' ~ server_data.checkInterval) %}
+{# # add all additions from healthchecks here #}
+{% do server_options.append(healthcheck_additions|join(' ')) if healthcheck_additions.length != '0' %}
+{% endif %}
+{# # server weight #}
+{% do server_options.append('weight ' ~ server_data.weight) if server_data.weight|default("") != "" %}
+{# # server role/mode #}
+{% do server_options.append(server_data.mode) if server_data.mode|default("") != "active" %}
+ server {{server_data.name}} {{server_data.address}}:{% if backend.tuning_noport != '1' %}{{server_data.port}}{% endif %}{% if server_data.checkport|default("") != "" %} port {{server_data.checkport}}{% endif %} {{server_options|join(' ')}}
+{% endfor %}
{% else %}
# Backend (DISABLED): {{backend.description}}
@@ -779,6 +801,12 @@ listen local_statistics
stats uri /haproxy?stats
stats realm HAProxy\ statistics
stats admin if TRUE
+{% if OPNsense.HAProxy.general.stats.customOptions|default("") != "" %}
+ # WARNING: pass through options below this line
+{% for customOpt in OPNsense.HAProxy.general.stats.customOptions.split("\n") %}
+ {{customOpt}}
+{% endfor %}
+{% endif %}
{# # remote stats are optional #}
{% if OPNsense.HAProxy.general.stats.remoteEnabled|default("") == "1" %}
@@ -799,9 +827,15 @@ listen remote_statistics
{% endfor %}
{% endif %}
{% endif %}
-{% else %}
+{% if OPNsense.HAProxy.general.stats.customOptions|default("") != "" %}
+ # WARNING: pass through options below this line
+{% for customOpt in OPNsense.HAProxy.general.stats.customOptions.split("\n") %}
+ {{customOpt}}
+{% endfor %}
+{% endif %}
+{% else %}
# ERROR: remote statistics disabled, because no listen address was specified
-{% endif %}
+{% endif %}
{% endif %}
{% else %}
# statistics are DISABLED