projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(haproxy+unbound): http_to_https per Domain + leere Forward-Zones überspringen

Browse Source 
haproxy: http_to_https=false Domains bekommen jetzt eigene use_backend-Regeln
im public_http-Frontend statt dem globalen HTTPS-Redirect. Das Feld war bisher
in DB + UI vorhanden aber vom Config-Generator komplett ignoriert.

unbound: Forward-Zones ohne forward-addr (ForwardTo=nil oder leer) werden jetzt
übersprungen. Unbound lehnt solche Blöcke beim Start ab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-24 12:36:53 +02:00
parent 519522b8ee
commit 92eece936d
7 changed files with 33 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
internal/haproxy/haproxy.cfg.tpl
View File

@@ -32,7 +32,8 @@ defaults
# ── Public :80 ─────────────────────────────────────────────────────────
# ACME-01 challenges proxy to edgeguard-api which serves the webroot.
# Everything else redirects to HTTPS.
# Domains with http_to_https=false bypass the redirect and are proxied
# directly. Everything else redirects to HTTPS.
frontend public_http
bind :80
{{- if .IPv6Enabled}}
@@ -40,11 +41,21 @@ frontend public_http
{{- end}}
acl is_acme path_beg /.well-known/acme-challenge/
{{- range $d := .HTTPDomains}}
acl is_http_only hdr(host) -i {{$d.Name}}
{{- end}}
# Redirect to HTTPS first (skipped for ACME paths) — must come
# before use_backend so HAProxy doesn't warn about ordering.
http-request redirect scheme https code 301 unless is_acme
# Redirect to HTTPS (skipped for ACME and http-only domains).
http-request redirect scheme https code 301 unless is_acme{{if .HTTPDomains}} or is_http_only{{end}}
{{- range $d := .HTTPDomains}}
{{- range $r := $d.Routes}}
use_backend eg_backend_{{$r.BackendID}} if { hdr(host) -i {{$d.Name}} } { path_beg {{$r.PathPrefix}} }
{{- end}}
{{- if $d.PrimaryBackendID}}
use_backend eg_backend_{{$d.PrimaryBackendID}} if { hdr(host) -i {{$d.Name}} }
{{- end}}
{{- end}}
use_backend api_backend if is_acme
# ── Public :443 (Customer-Backends only) ──────────────────────────────

12
internal/haproxy/haproxy.go
View File

@@ -133,6 +133,10 @@ type View struct {
Domains []DomainView
Backends []BackendView
// HTTPDomains: aktive Domains mit HTTPToHTTPS=false. Diese bekommen
// in public_http eigene use_backend-Regeln statt dem globalen Redirect.
HTTPDomains []DomainView
// GlobalMaintenance: wenn true emittiert public_https einen
// 503-Block ganz am Anfang (vor allen anderen ACLs), der
// alle Customer-Domains gleichzeitig stilllegt. mgmt_https
@@ -278,7 +282,13 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
domViews = append(domViews, dv)
}
v := &View{Domains: domViews, Backends: activeBackends}
httpDomains := make([]DomainView, 0)
for _, dv := range domViews {
if !dv.HTTPToHTTPS && (dv.PrimaryBackendID != nil || len(dv.Routes) > 0) {
httpDomains = append(httpDomains, dv)
}
}
v := &View{Domains: domViews, Backends: activeBackends, HTTPDomains: httpDomains}
if g.SetupStore != nil {
if st, err := g.SetupStore.Load(); err == nil && st != nil {
v.GlobalMaintenance = st.MaintenanceMode