avandeputte/haproxy-manager v2.1.0

2.1.0

on GitHub

2.1: an MCP server, and what an Nginx Proxy Manager user expects

The guide covers all of it: MCP server, publishing, certificates. Upgrading a cluster: update every node; a node still on 2.0 that holds the virtual IP does not understand the new settings (see Updates).

An MCP server

Settings › MCP server. An AI assistant -- Claude Code, Codex, Antigravity, Cursor, VS Code or any MCP client -- can read this node at /mcp and, if you allow it, change it. Off by default; when turned on it is read-only until you also tick Allow changes.

• Its own token, not the API key. Show the token, Copy and Replace the token; replacing it ends the old one.
• Connect a client. Pick the client and the page shows what to run or paste, with the address and, once shown, the token filled in: Claude Code, Claude Desktop, OpenAI Codex, Google Antigravity, Gemini CLI, OpenClaw, Cursor, VS Code (Copilot), GitHub Copilot CLI, Devin Desktop (Windsurf), Zed, Cline, opencode.
• 34 tools (the list): status, services, objects, settings, the rendered haproxy.cfg, haproxy -c, stats, traffic, probes, logs, cluster and VIP health, history, certificates; publish/edit/pause/delete services, rules and conditions, certificates, objects, settings, restore, Apply. Tools that have dry_run show the lines and HAProxy's verdict without storing anything, even while changes are off.
• Same checks as the UI. Every tool goes through the node's own API: nothing is stored that HAProxy would not load, nothing goes live before Apply, and the audit log names the client. The assistant is told to ask before Apply, a restore or a delete.
• Secrets stay on the node. Credentials and keys come back as [redacted], and [redacted] written back keeps the stored value. No tool hands over or takes in a private key.
• Clusters. The settings and token are copied to every node; point the client at the virtual IP. A change asked of a passive node is made on the node holding the virtual IP.
• No OAuth, so ChatGPT and claude.ai connectors cannot use it.

Wildcard hosts

https://*.example.com matches any one label under example.com. An exact name still wins over a wildcard. Wildcard certificates need a DNS challenge; the wizard warns when an HTTP one is picked.

Redirection hosts

The publish wizard's What it does can be redirect to another address: 301, 302, 307 or 308, keeping the path or not.

Your own certificates

Certificates › Upload a certificate: a certificate, its key and an optional chain, checked, stored at 0600 and synced like issued ones. Never renewed; Replace uploads a new one. Download gives the certificate with its chain, or the private key after a confirmation, which is logged.

HSTS, unknown hosts, IPv6, WebSockets, client headers

• HSTS: Send HSTS (and for subdomains too) in the wizard and on Backend Pools.
• Unknown hosts: what a request for a name no service answers gets -- HAProxy's 503, a 404, a dropped connection, or a redirect (Advanced · HAProxy › Settings).
• IPv6: services listening on every address answer over IPv6 too (bind :::port v4v6), skipped on a node without IPv6; Listen on IPv6 too turns it off.
• WebSockets: WebSocket idle timeout (timeout tunnel, default 1h) stops an idle WebSocket being cut after 50 seconds.
• Client headers: requests carry X-Real-IP and X-Forwarded-Host next to X-Forwarded-For.

Smaller things

• Conditions is back in the menu, under Rules.
• The service form's certificate note sits under the Certificate heading.