summaryrefslogtreecommitdiff
path: root/data
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-12-20 07:42:48 +0100
committerGitHub <noreply@github.com>2023-12-20 07:42:48 +0100
commit316a930b8c54155a45e92796ad2ab69283aa1eb0 (patch)
tree85320c45ac82f7065e3e1648bd9cb2dd97c9c28b /data
parent01fd13f8e15f5309cd93d03db8603cd10d9785d8 (diff)
parenta3e059e7e8d340f6f5e623bbc17acf18cb296626 (diff)
downloadvyos-1x-316a930b8c54155a45e92796ad2ab69283aa1eb0.tar.gz
vyos-1x-316a930b8c54155a45e92796ad2ab69283aa1eb0.zip
Merge pull request #2660 from vyos/mergify/bp/sagitta/pr-2590
T5798: load-balancing revese-proxy add multiple SSL certificates (backport #2590)
Diffstat (limited to 'data')
-rw-r--r--data/templates/load-balancing/haproxy.cfg.j213
1 files changed, 9 insertions, 4 deletions
diff --git a/data/templates/load-balancing/haproxy.cfg.j2 b/data/templates/load-balancing/haproxy.cfg.j2
index a75ee9904..defb76fba 100644
--- a/data/templates/load-balancing/haproxy.cfg.j2
+++ b/data/templates/load-balancing/haproxy.cfg.j2
@@ -50,13 +50,19 @@ defaults
{% if service is vyos_defined %}
{% for front, front_config in service.items() %}
frontend {{ front }}
-{% set ssl_front = 'ssl crt /run/haproxy/' ~ front_config.ssl.certificate ~ '.pem' if front_config.ssl.certificate is vyos_defined else '' %}
+{% set ssl_front = [] %}
+{% if front_config.ssl.certificate is vyos_defined and front_config.ssl.certificate is iterable %}
+{% for cert in front_config.ssl.certificate %}
+{% set _ = ssl_front.append('crt /run/haproxy/' ~ cert ~ '.pem') %}
+{% endfor %}
+{% endif %}
+{% set ssl_directive = 'ssl' if ssl_front else '' %}
{% if front_config.listen_address is vyos_defined %}
{% for address in front_config.listen_address %}
- bind {{ address | bracketize_ipv6 }}:{{ front_config.port }} {{ ssl_front }}
+ bind {{ address | bracketize_ipv6 }}:{{ front_config.port }} {{ ssl_directive }} {{ ssl_front | join(' ') }}
{% endfor %}
{% else %}
- bind :::{{ front_config.port }} v4v6 {{ ssl_front }}
+ bind :::{{ front_config.port }} v4v6 {{ ssl_directive }} {{ ssl_front | join(' ') }}
{% endif %}
{% if front_config.redirect_http_to_https is vyos_defined %}
http-request redirect scheme https unless { ssl_fc }
@@ -161,4 +167,3 @@ backend {{ back }}
{% endfor %}
{% endif %}
-