net/haproxy: allow to force SSL for health checks, closes #1282

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogHealthcheck.xml

@@ -23,6 +23,12 @@
         <type>text</type>
         <help><![CDATA[Select interval (in milliseconds) between two consecutive health checks. This value can be overriden in backend pool and real server configuration.]]></help>
     </field>
+    <field>
+        <id>healthcheck.force_ssl</id>
+        <label>Force SSL</label>
+        <type>checkbox</type>
+        <help><![CDATA[This option forces encryption of all health checks over SSL, regardless of whether the server uses SSL or not for the normal traffic.]]></help>
+    </field>
     <field>
         <id>healthcheck.checkport</id>
         <label>Port to check</label>

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml

@@ -114,7 +114,6 @@
                 <label>Verify SSL Server Certificates</label>
                 <type>dropdown</type>
                 <help><![CDATA[This enforces a certain behavior for SSL verify on servers, ignoring per-server settings. If set to 'enforce verify', server certificates are verified. If set to 'disable verify', server certificates are not verified. The default is 'no preference' to only use per-server configurations and not enforce a global default for all servers.]]></help>
-                <advanced>true</advanced>
             </field>
             <field>
                 <id>haproxy.general.tuning.maxDHSize</id>

net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml

@@ -1134,6 +1134,10 @@
                     <ValidationMessage>Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us".</ValidationMessage>
                     <Required>Y</Required>
                 </interval>
+                <force_ssl type="BooleanField">
+                    <default>0</default>
+                    <Required>N</Required>
+                </force_ssl>
                 <checkport type="IntegerField">
                     <default></default>
                     <MinimumValue>1</MinimumValue>

net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf

@@ -1336,6 +1336,10 @@ backend {{backend.name}}
 {%               elif server_data.checkport|default("") != "" %}
 {%                 do server_options.append('port ' ~ server_data.checkport) %}
 {%               endif %}
+{#               # force SSL encryption for health checks #}
+{%               if healthcheck_data.force_ssl|default('') == '1' %}
+{%                 do server_options.append('check-ssl ') %}
+{%               endif %}
 {#               # add all additions from healthchecks here #}
 {%               do server_options.append(healthcheck_additions|join(' ')) if healthcheck_additions.length != '0' %}
 {%             endif %}