avandeputte/haproxy-manager v2.1.1

2.1.1: fixes from a review of 2.1

on GitHub

2.1.1: fixes from a review of 2.1

If the MCP server was on, read this first. Three ways a secret could reach an MCP client, read-only ones included, are closed:

• get_haproxy_config, and the dry runs of publish_service, create_object and update_object, returned rendered configuration lines as they are written. With single sign-on in use those include the key that signs SSO cookies, and with sign-in users, their password hashes. Such text is now shown with them replaced by [redacted].
• An ACME account's EAB HMAC key was not treated as a secret, and neither were a notification webhook's address and extra headers. They are now.
• A credential inside a tool's arguments (item, values) was written to the application log, which get_logs reads back. Arguments are now redacted at every depth before they are logged.

If an assistant was connected to a node that uses single sign-on, replace the SSO secret with Rotate secret on the single sign-on page (it signs everyone out), and consider replacing EAB keys and webhook addresses that were stored at the time.

Certificates

• Request a certificate for names an uploaded certificate covers no longer issues over the uploaded one. It used to overwrite the file while the certificate stayed marked as uploaded, so it was never renewed and expired. A new certificate is now created beside it, and nothing — the wizard, the API, MCP — can issue over an uploaded one.
• A renewal round no longer rewrites the file, reloads HAProxy, announces "issued" and pushes to the other nodes for certificates that were not due. The deployed file is compared with what acme.sh holds; only a change does any of that.

HAProxy

• IPv6: a listener on every address is now two binds, 0.0.0.0:port and :::port v6only, instead of one dual-stack :::port v4v6. On the dual-stack socket an IPv4 client reached HAProxy as ::ffff:203.0.113.7, and that is what the log, X-Forwarded-For, X-Real-IP, the PROXY protocol and CrowdSec were given. Apply once after updating.
• WebSocket idle timeout (timeout tunnel) is written on HTTP pools only. In defaults it also governed every tcp:// service, where it replaced the client and server timeouts: a database forward with 8-hour timeouts was cut at one hour.
• A redirect address containing % (/docs%20v2) is escaped. HAProxy reads that argument as a log-format string, so it rejected the whole file and every Apply failed until the service was edited.
• A pool's redirect address and code are checked when set outside the publish wizard too, and a code already stored that is not a number no longer breaks the Services page and Apply.

MCP tools

• request_certificate works: it takes an account and a challenge type by id or name (or the only one there is), and issues. It used to fail with HTTP 500.
• publish_service with redirect: null turns a redirecting service back into a forward, as documented.
• get_logs offers the log viewer's real sources (manager, haproxy, acme, keepalived); a source that does not exist is refused instead of answered with nothing. notify_mode offers outage.