From e7fe02a3ea9064ec02d6538effc2e6c539c8256b Mon Sep 17 00:00:00 2001 From: NetworkCats Date: Sat, 7 Mar 2026 22:49:36 +0800 Subject: [PATCH] fix: correct HAProxy 3.3.4 config syntax in prod template --- deploy/ansible/roles/app/templates/haproxy.cfg.j2 | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/deploy/ansible/roles/app/templates/haproxy.cfg.j2 b/deploy/ansible/roles/app/templates/haproxy.cfg.j2 index 4ab3a20..cea93df 100644 --- a/deploy/ansible/roles/app/templates/haproxy.cfg.j2 +++ b/deploy/ansible/roles/app/templates/haproxy.cfg.j2 @@ -16,7 +16,7 @@ defaults log global mode http option httplog - option dontlognormal + option dontlog-normal option http-keep-alive maxconn 10000 timeout connect 5s @@ -36,8 +36,7 @@ frontend https_in # Access to port 443 is already restricted to Cloudflare IPs at the firewall level # All requests reaching HAProxy come from Cloudflare; no additional ACL validation is required. - # HAProxy's own forwardfor must be disabled, otherwise it will insert Cloudflare node IPs - no option forwardfor + # HAProxy's own forwardfor is not enabled; real IP is set explicitly below via CF-Connecting-IP # Overwrite standard headers directly with the real IP forcibly added by Cloudflare http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)]