Paul Payne
6aa1e7d438
When haproxy -c fails, parse ALERT line numbers, map to service domains via # service: comments in generated config, exclude broken services, and regenerate. One retry — prevents a single bad registration from blocking all config updates.
19 lines
970 B
Markdown
19 lines
970 B
Markdown
# TODO
|
|
|
|
## Response headers don't work with host ACL conditions
|
|
|
|
`http-response set-header ... if host_X` doesn't work because `hdr(host)` is a request-phase fetch that HAProxy can't evaluate in the response phase. The headers are generated but silently ignored (HAProxy logs a WARNING).
|
|
|
|
Fix: capture the host in a transaction variable during the request phase, then use it in response rules:
|
|
```haproxy
|
|
http-request set-var(txn.host) hdr(host)
|
|
acl is_keila var(txn.host) -i keila.cloud.payne.io
|
|
http-response set-header Access-Control-Allow-Origin "https://cloud.payne.io" if is_keila
|
|
```
|
|
|
|
Affects: keila (CORS headers), plausible (Private-Network-Access header).
|
|
|
|
## Input validation for header values
|
|
|
|
Header values with special characters (newlines, NULs) should be rejected at registration time. Currently values are Go-`%q`-quoted in the HAProxy output which handles spaces/commas but may produce backslash escapes that HAProxy doesn't understand for edge cases.
|