opnsense / opnsense/plugins

net/haproxy: Allow to have no DNS servers defined in SYSTEM: SETTINGS: GENERAL -> Networking

Open
#4,159 0 comments 0 reactions 1 assignee View on GitHub

@fraenki is already working on this.

Since Aug 6, 2024.

Dominant language
PHP
Stars
1.2k
Forks
863
Avg merge
2d 6h
Merged PRs (30d)
10

Description

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Is your feature request related to a problem? Please describe.
Today I upgraded the firewall from 23.7 to 24.7 with 24.1 as first step. Reviewing the services I noticed a problem with HAProxy. I remembered seeing something similar.
From https://forum.opnsense.org/index.php?topic=39484.0
It seems that from OPN 24.1 onwards, if in SYSTEM: SETTINGS: GENERAL -> Networking there is no DNS server defined, HAProxy plugin syntax parsing will fail with the following errors:

HAProxy configtest found critical errors
[NOTICE] (58508) : haproxy version is 2.8.10-f28885f
[NOTICE] (58508) : path to executable is /usr/local/sbin/haproxy
[ALERT] (58508) : config : Proxy '<OCSP-UPDATE>': Can't find resolvers section 'default' for do-resolve action.
[ALERT] (58508) : config : Proxy '<HTTPCLIENT>': Can't find resolvers section 'default' for do-resolve action.
[ALERT] (58508) : config : Fatal errors found in configuration.

However I think the service does go ahead and start. After all these are alerts. My guess is that a new version of HAProxy shipped with new requirements.
That said we also have the message in the plugin's settings:
There are pending configuration changes that must be applied in order for them to take effect. To review them visit the [Config Diff](https://192.168.5.1:55443/ui/haproxy/export#diff) page.
That diff shows:

--- /usr/local/etc/haproxy.conf	2024-07-28 03:48:10.914848000 +0100
+++ /usr/local/etc/haproxy.conf.staging	2024-08-06 16:33:40.105273000 +0100
@@ -13,6 +13,9 @@
     hard-stop-after             60s
     no strict-limits
     maxconn                     10
+    tune.ssl.ocsp-update.mindelay 300
+    tune.ssl.ocsp-update.maxdelay 3600
+    httpclient.resolvers.prefer   ipv4
     tune.ssl.default-dh-param   2048

I have not applied the dfiff.

Describe the solution you'd like
I would like the plugin to satisfy the requirement of the service so we have a clean systax tester and we can apply any required diffs of changes without worry of breakage.

Describe alternatives you've considered
N/A

Additional context
N/A

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.