Real Servers can speak the PROXY protocol.
Behind a proxy, every connection seems to come from HAProxy. An HTTP service already tells its servers the visitor's address in an X-Forwarded-For header, but a tcp:// service has no headers to add. A Real Server now has a PROXY protocol setting that opens every connection to it with one line naming the real client (#8):
- Off, version 1 or version 2. Version 1 is a line of text and renders
send-proxy; version 2 is the binary form some software requires and renderssend-proxy-v2. - Per server on the Real Servers page, where the list names the keyword beside
sslandbackup, or for a whole service on the publish form under Balancing and timeouts, which sets it on every server behind it. Editing a service opens on what its servers use. - Off by default, and it has to stay off unless the servers expect it. nginx's
proxy_protocol, Postfix, Dovecot and Traefik all understand it once configured; a server that is not reads the line as garbage and refuses every connection. - Health checks on the traffic port carry the line too, as HAProxy does by default. Checks to a separate check port do not, since that port is usually a different service, such as Patroni's API.
The new strings are translated into all ten languages. The documentation is at Publishing a service.
Upgrading from 1.97.x: nothing to do. Existing servers have it off, and the generated configuration is unchanged until you turn it on.
Packages are attached below; the container image is at ghcr.io/avandeputte/haproxy-manager:1.98.0.