add proxy protocol support to loadbalancers

python · Jul 26, 2024 · 5f3d3eb · 5f3d3eb
1 parent c371c0c
commit 5f3d3eb
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 6 deletions.
diff --git a/Vagrantfile b/Vagrantfile
@@ -11,7 +11,7 @@ SERVERS = [
   "docs",
   "downloads",
   "hg",
-  {:name => "loadbalancer", :ports => [20000, 20001, 20002, 20003, 20004, 20005, 20010]},
+  {:name => "loadbalancer", :ports => [20000, 20001, 20002, 20003, 20004, 20005, 20010, 20011]},
   "mail",
   "moin",
   "planet",

diff --git a/pillar/base/firewall/loadbalancer.sls b/pillar/base/firewall/loadbalancer.sls
@@ -8,9 +8,6 @@ firewall:
   http_0:
     port: 20000
 
-  http_1:
-    port: 20001
-
   http_2:
     port: 20002
 
@@ -29,6 +26,12 @@ firewall:
   http_map:
     port: 20010
 
+  http_proxy:
+    port: 20001
+
+  http_proxy_map:
+    port: 20011
+
   "hg.python.org:ssh":
     port: 20100
 

diff --git a/pillar/base/haproxy.sls b/pillar/base/haproxy.sls
@@ -171,6 +171,8 @@ haproxy:
     roundup-{{ service }}:
       bind: :{{ port }} {% if ssl %} ssl crt /etc/ssl/private/bugs.python.org.pem {% endif %}
       service: roundup-{{ service }}
+      accept_proxy: True
+      send_proxy: True
       extra:
         - timeout client 30m
         - timeout server 30m

diff --git a/salt/haproxy/config/haproxy.cfg.jinja b/salt/haproxy/config/haproxy.cfg.jinja
@@ -89,6 +89,7 @@ listen tls:
     bind 0.0.0.0:443 ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
     bind :::443 ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem  crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
     bind :20010 ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
+    bind :20011 accept-proxy ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
 
     mode http
 
@@ -106,6 +107,7 @@ listen tls:
 
 frontend main
     bind :20000
+    bind :20001 accept-proxy
     bind 0.0.0.0:80
     bind :::80
     bind 127.0.0.1:19001  # This is our TLS socket.
@@ -236,7 +238,7 @@ backend {{ service }}
 
 {% for name, config in haproxy.listens.items() -%}
 listen {{ name }}
-    bind {{ config.bind }}
+    bind {{ config.bind }}{% if config.get("accept_proxy", False) %} accept-proxy{% endif %}
 
     mode tcp
     option tcplog
@@ -247,7 +249,7 @@ listen {{ name }}
     {% endfor %}
 
     {{ "{{" }}range service "{{ config.service }}@{{ pillar.dc }}"}}
-    {% raw %}server {{.Node}} {{.Address}}:{{.Port}} check{{end}}{% endraw %}
+    {% raw %}server {{.Node}} {{.Address}}:{{.Port}} check{{end}}{% endraw %}{% if config.get("send_proxy", False) %} send-proxy{% endif %}
 
 {% endfor %}