vyos-1x.git/src/conf_mode/load-balancing_haproxy.py, branch fix/T8955-http-api-verify-tls

load-balancing: T7928: Fix port conflict check to respect `listen-address` (#5186)

2026-05-20T15:18:23+00:00

The port availability check in `verify()` was using `front_config.get('address')` which always resolved to `None`, causing the validator to treat any process holding a given port number as a conflict regardless of which IP it was bound to.

config: T8124: make get_config_dict() pki={} node purely optional

2025-12-26T11:17:11+00:00

Automatic parsing and integration of the PKI subsystem into the resulting config dict is now enabled by passing with_pki=True to get_config_dict(). However, when no PKI configuration is present, the resulting dictionary still includes an empty PKI key. This is undesirable; we should only include keys in the dictionary when they contain relevant data.

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

haproxy: T7122: add ACME/certbot bootstrap support

2025-05-05T15:22:57+00:00

When both the CLI PKI node for an ACME-issued certificate and HAProxy are configured during initial setup, the certbot challenge cannot be served via the reverse proxy because HAProxy has not yet been configured at all. This commit introduces a special case to handle this bootstrap scenario, ensuring that the certbot challenge can still be served correctly in standalone mode on port 80 despite initial config dependencies/priorities between PKI and HAProxy.

haproxy: T7122: always reverse-proxy ACL for certbot

2025-05-04T21:38:29+00:00

Always enable the ACL entry to reverse-proxy requests to the path "/.well-known/acme-challenge/" when "redirect-http-to-https" is configured for a given HAProxy frontend service. This is an intentional design decision to simplify the implementation and reduce overall code complexity. It poses no risk: a missing path returns a 404, and an unavailable backend yields an error 503. This approach avoids a chicken-and-egg problem where certbot might try to request a certificate via reverse-proxy before the proxy config is actually generated and active. By always routing through HAProxy, we also eliminate downtime as port 80 does not need to be freed for certbot's standalone mode.

haproxy: T7122: automatically reverse-proxy to certbot

2025-04-28T20:10:08+00:00

Automatically render HaProxy rules to reverse-proxy ACME challanges when the requested certificate was issued using ACME.

haproxy: T7122: do not use f'ormat strings without variable

2025-04-28T20:10:08+00:00

vyos.utils: T7122: fix IPv6 support in check_port_availability()

2025-04-28T20:10:08+00:00

Commit 4523e9c897b3 ("wireguard: T3763: Added check for listening port availability") added a function to check if a port is free to use or already occupied by a different running service. This has been done by trying to bind a socket to said given port. Unfortunately there is no support for IPv6 address-fdamily in both socketserver.TCPServer or socketserver.UDPServer. This must be done manually by deriving TCPServer and setting self.address_family for IPv6. The new implementation gets rid of both TCPServer and UDPServer and replaces it with a simple socket binding to a given IPv4/IPv6 address or any interface/ address if unspecified. In addition build time tests are added for the function to check for proper behavior during build time of vyos-1x.

haproxy: T7081: Support HTTP compression (#4314)

2025-01-27T20:57:27+00:00

haproxy: T6745: Rename `reverse-proxy` to `haproxy`

2024-10-09T13:55:15+00:00