4 Commits

This Branch

This Branch

All Branches

• haproxy: don't leak private keys when doing --debug

  It was reported in issue #6267 that the private key was leaked when
  using the DEPLOY_HAPROXY_HOT_UPDATE=yes feature.
  
  Indeed, the debugging code which sends commands to HAProxy was using
  _debug even when passing the private key.
  
  This patch fixes the issue by using _secure_debug when doing that.

  William Lallemand 2025-03-11 12:04:59 +01:00
  7e320d2748
• haproxy; don't use '*' in the filename for wildcard domain

  By default acme.sh uses the '*' character in the filename for wildcard.
  That can be confusing within HAProxy since the * character in front of a
  filename in the stat socket is used to specified an uncommitted
  transaction.
  
  This patch replace the '*' by a '_' in the filename.
  This is only done when using the default filename, the name can still be
  forced with an asterisk.

  William Lallemand 2023-12-01 15:35:31 +01:00
  e09d45c844
• haproxy: use the master CLI for hot update

  DEPLOY_HAPROXY_MASTER_CLI allows to use the HAProxy master CLI instead
  of a stats socket for DEPLOY_HAPROXY_HOT_UPDATE="yes"
  
  The syntax of the master CLI is slightly different, a prefix with the
  process number need to be added before any command.
  
  This patch uses ${_cmdpfx} in front of every socat commands which is
  filled when the master CLI is used.

  William Lallemand 2023-11-30 15:22:51 +01:00
  36fc321096
• haproxy: sanitize the PEM in the deploy script

  Sanitize the PEM of the haproxy deploy script by removing the '\n', this
  way it could be injected directly over the CLI.

  William Lallemand 2023-11-30 14:00:41 +01:00
  7aaf4432d4