From e3ad6447b3072f996b9f07a110aee583955391e4 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 23 Feb 2021 17:34:43 +0100
Subject: [PATCH] net/haproxy: strip warning from final config, improve help
 text

---
 .../app/controllers/OPNsense/HAProxy/forms/generalTuning.xml    | 2 +-
 .../opnsense/service/templates/OPNsense/HAProxy/haproxy.conf    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml
index 0fd011d4d..9fdeb1e63 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml
@@ -7,7 +7,7 @@
         <id>haproxy.general.tuning.root</id>
         <label>Run as root</label>
         <type>checkbox</type>
-        <help><![CDATA[Enable or disable HAProxy running as root.<br/><div class="text-info"><b>NOTE:</b> Enabling root could be a security issue but it's required by some feature.</div>]]></help>
+        <help><![CDATA[Enable or disable HAProxy running as user root. Enabling this option is strongly discouraged.<br/><div class="text-info"><b>NOTE:</b> Running as user root could be a security issue but it may be required by some features.</div>]]></help>
         <advanced>true</advanced>
     </field>
     <field>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 091d1d4d0..536ce0814 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -836,8 +836,8 @@ userlist {{object.name | regex_replace ("[^A-Za-z0-9]","")}}
 {#- ############################### -#}
 
 global
+{#  # NOTE: Running as root could be a security issue, but is required for some features. #}
 {% if OPNsense.HAProxy.general.tuning.root != "1" %}
-    # NOTE: Could be a security issue, but required for some feature.
     uid                         80
 {% endif %}
     gid                         80