projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(haproxy+unbound): http_to_https per Domain + leere Forward-Zones überspringen

Browse Source 
haproxy: http_to_https=false Domains bekommen jetzt eigene use_backend-Regeln
im public_http-Frontend statt dem globalen HTTPS-Redirect. Das Feld war bisher
in DB + UI vorhanden aber vom Config-Generator komplett ignoriert.

unbound: Forward-Zones ohne forward-addr (ForwardTo=nil oder leer) werden jetzt
übersprungen. Unbound lehnt solche Blöcke beim Start ab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-24 12:36:53 +02:00
parent 519522b8ee
commit 92eece936d
7 changed files with 33 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
internal/haproxy/haproxy.go
View File

@@ -133,6 +133,10 @@ type View struct {
Domains []DomainView
Backends []BackendView
// HTTPDomains: aktive Domains mit HTTPToHTTPS=false. Diese bekommen
// in public_http eigene use_backend-Regeln statt dem globalen Redirect.
HTTPDomains []DomainView
// GlobalMaintenance: wenn true emittiert public_https einen
// 503-Block ganz am Anfang (vor allen anderen ACLs), der
// alle Customer-Domains gleichzeitig stilllegt. mgmt_https
@@ -278,7 +282,13 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
domViews = append(domViews, dv)
}
v := &View{Domains: domViews, Backends: activeBackends}
httpDomains := make([]DomainView, 0)
for _, dv := range domViews {
if !dv.HTTPToHTTPS && (dv.PrimaryBackendID != nil || len(dv.Routes) > 0) {
httpDomains = append(httpDomains, dv)
}
}
v := &View{Domains: domViews, Backends: activeBackends, HTTPDomains: httpDomains}
if g.SetupStore != nil {
if st, err := g.SetupStore.Load(); err == nil && st != nil {
v.GlobalMaintenance = st.MaintenanceMode