From dfaf242147cecc8a8737cd0ff67aa66f63cf8d02 Mon Sep 17 00:00:00 2001
From: Nobi <nobi@nobidev.com>
Date: Sat, 28 Jun 2025 02:20:34 +0700
Subject: T7595: Support PROXY protocol for haproxy

---
 data/templates/load-balancing/haproxy.cfg.j2       |  8 +++---
 .../include/haproxy/listen-address.xml.i           | 30 ++++++++++++++++++++++
 .../load-balancing_haproxy.xml.in                  |  2 +-
 3 files changed, 35 insertions(+), 5 deletions(-)
 create mode 100644 interface-definitions/include/haproxy/listen-address.xml.i

diff --git a/data/templates/load-balancing/haproxy.cfg.j2 b/data/templates/load-balancing/haproxy.cfg.j2
index 62934c612..b4c3505c9 100644
--- a/data/templates/load-balancing/haproxy.cfg.j2
+++ b/data/templates/load-balancing/haproxy.cfg.j2
@@ -62,8 +62,8 @@ backend buildin_acme_certbot
 frontend {{ front }}-http
     mode http
 {%             if front_config.listen_address is vyos_defined %}
-{%                 for address in front_config.listen_address %}
-    bind {{ address | bracketize_ipv6 }}:80
+{%                 for address, server_config in front_config.listen_address.items() %}
+    bind {{ address | bracketize_ipv6 }}:80 {{ 'accept-proxy' if server_config.accept_proxy is vyos_defined }}
 {%                 endfor %}
 {%             else %}
     bind [::]:80 v4v6
@@ -82,8 +82,8 @@ frontend {{ front }}
 {%         endif %}
 {%         set ssl_directive = 'ssl' if ssl_front else '' %}
 {%         if front_config.listen_address is vyos_defined %}
-{%             for address in front_config.listen_address %}
-    bind {{ address | bracketize_ipv6 }}:{{ front_config.port }} {{ ssl_directive }} {{ ssl_front | join(' ') }}
+{%             for address, server_config in front_config.listen_address.items() %}
+    bind {{ address | bracketize_ipv6 }}:{{ front_config.port }} {{ ssl_directive }} {{ ssl_front | join(' ') }} {{ 'accept-proxy' if server_config.accept_proxy is vyos_defined }}
 {%             endfor %}
 {%         else %}
     bind [::]:{{ front_config.port }} v4v6 {{ ssl_directive }} {{ ssl_front | join(' ') }}
diff --git a/interface-definitions/include/haproxy/listen-address.xml.i b/interface-definitions/include/haproxy/listen-address.xml.i
new file mode 100644
index 000000000..785b46117
--- /dev/null
+++ b/interface-definitions/include/haproxy/listen-address.xml.i
@@ -0,0 +1,30 @@
+<!-- include start from haproxy/listen-address.xml.i -->
+<tagNode name="listen-address">
+  <properties>
+    <help>Local IP addresses to listen on</help>
+    <completionHelp>
+      <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
+    </completionHelp>
+    <valueHelp>
+      <format>ipv4</format>
+      <description>IPv4 address to listen for incoming connections</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6</format>
+      <description>IPv6 address to listen for incoming connections</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ip-address"/>
+      <validator name="ipv6-link-local"/>
+    </constraint>
+  </properties>
+  <children>
+    <leafNode name="accept-proxy">
+      <properties>
+        <help>Accept PROXY protocol</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+  </children>
+</tagNode>
+<!-- include end -->
diff --git a/interface-definitions/load-balancing_haproxy.xml.in b/interface-definitions/load-balancing_haproxy.xml.in
index 61ff8bc81..399197366 100644
--- a/interface-definitions/load-balancing_haproxy.xml.in
+++ b/interface-definitions/load-balancing_haproxy.xml.in
@@ -35,7 +35,7 @@
                 </properties>
               </leafNode>
               #include <include/generic-description.xml.i>
-              #include <include/listen-address.xml.i>
+              #include <include/haproxy/listen-address.xml.i>
               #include <include/haproxy/logging.xml.i>
               #include <include/haproxy/mode.xml.i>
               #include <include/port-number.xml.i>
-- 
cgit v1.2.3