From f489390a9ae9c940f53aaa97a6e853f61bd714c6 Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Sat, 27 Aug 2022 17:56:13 +0300
Subject: [PATCH] chrooted sockets binding

---
 .../src/opnsense/scripts/OPNsense/HAProxy/setup.sh        | 2 +-
 .../service/templates/OPNsense/HAProxy/haproxy.conf       | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh
index 72be06fa6..0e07ab1ba 100755
--- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh
+++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh
@@ -5,7 +5,7 @@ if [ -f /etc/rc.conf.d/haproxy ]; then
 fi
 
 # NOTE: Keep /var/haproxy on this list, see GH issue opnsense/plugins #39.
-HAPROXY_DIRS="/var/haproxy /var/haproxy/var/run /tmp/haproxy /tmp/haproxy/ssl /tmp/haproxy/lua /tmp/haproxy/errorfiles /tmp/haproxy/mapfiles /tmp/haproxy/sockets"
+HAPROXY_DIRS="/var/haproxy /var/haproxy/sockets /var/haproxy/var/run /tmp/haproxy /tmp/haproxy/ssl /tmp/haproxy/lua /tmp/haproxy/errorfiles /tmp/haproxy/mapfiles /tmp/haproxy/sockets"
 
 for directory in ${HAPROXY_DIRS}; do
     mkdir -p ${directory}
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index be90eff14..ea00d11a8 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -1375,11 +1375,13 @@ frontend {{frontend.name}}
 {%           if unix_bind == "TRUE" %}
 {#             # extract socket name and add full path #}
 {%             set socket_name = bind | regex_replace ("^unix@","") %}
-{%             set bind_address = "unix@/tmp/haproxy/sockets/" ~ socket_name %}
+{%             set bind_address = "/var/haproxy/sockets/" ~ socket_name ~ " user www" %}
+{%             set bind_name = "unix@" ~ socket_name %}
 {%           else %}
 {%             set bind_address = bind %}
+{%             set bind_name = bind %}
 {%           endif %}
-    bind {{bind_address}} name {{bind_address}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options|join(' ') }} {{ ssl_certs|join(' ') }} {% endif %}{% if adv_options|length > 0 %} {{ adv_options|join(' ') }} {% endif %}
+    bind {{bind_address}} name {{bind_name}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options|join(' ') }} {{ ssl_certs|join(' ') }} {% endif %}{% if adv_options|length > 0 %} {{ adv_options|join(' ') }} {% endif %}
 
 {%         endfor %}
 {%       endif %}
@@ -1690,7 +1692,7 @@ backend {{backend.name}}
 {%                   if unix_bind == "TRUE" %}
 {#                     # extract socket name and add full path #}
 {%                     set socket_name = bind | regex_replace ("^unix@","") %}
-{%                     set socket_path = "unix@/tmp/haproxy/sockets/" ~ socket_name %}
+{%                     set socket_path = "/sockets/" ~ socket_name %}
 {%                     do server_basics.append('server ' ~ server_data.name ~ ' ' ~ socket_path) %}
 {#                     # only the first unix socket is considered #}
 {%                     break %}