From 183b4fa9e2df861af2d1830319f3548231f631bf Mon Sep 17 00:00:00 2001
From: taylanbakircioglu <taylanb@outlook.com>
Date: Tue, 23 Dec 2025 13:28:49 +0300
Subject: [PATCH] fix: Auto-add 'verify none' for SSL backend servers without
 CA file

When ssl_enabled is true for a backend server but:
- No ssl_verify option is explicitly set AND
- No CA file (ssl_certificate_id) is specified

HAProxy 2.8+ defaults to 'verify required' which fails without a CA.
Now auto-adding 'verify none' in this case with a warning log.

Users can override this in UI by setting SSL Verification explicitly.

This fix is safe for:
- Bulk Import: Parser already sets ssl_verify='none' when removing ca-file
- Version Diff: Generated config correctly shows 'verify none'
- Restore: DB values unchanged, config regeneration applies same fix

Fixes: 'verify is enabled by default but no CA file specified' error
---
 backend/services/haproxy_config.py | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/backend/services/haproxy_config.py b/backend/services/haproxy_config.py
index b31485c..ae21034 100644
--- a/backend/services/haproxy_config.py
+++ b/backend/services/haproxy_config.py
@@ -659,9 +659,7 @@ async def generate_haproxy_config_for_cluster(cluster_id: int, conn: Optional[An
                 if server.get('ssl_enabled', False):
                     server_line += " ssl"
                     ssl_verify = server.get('ssl_verify', '').strip() if server.get('ssl_verify') else ''
-                    # Skip empty strings, "[]", or invalid values
-                    if ssl_verify and ssl_verify not in ('[]', '{}', 'null', 'None'):
-                        server_line += f" verify {ssl_verify}"
+                    has_ca_file = False
                     
                     # Add ca-file path if SSL certificate is selected
                     if server.get('ssl_certificate_id'):
@@ -676,8 +674,20 @@ async def generate_haproxy_config_for_cluster(cluster_id: int, conn: Optional[An
                             cert_filename = f"{ssl_cert['name']}.pem"
                             cert_path = f"/etc/ssl/haproxy/{cert_filename}"
                             server_line += f" ca-file {cert_path}"
+                            has_ca_file = True
                             logger.info(f"🔒 CONFIG SSL: Added ca-file for server {server_name}: {cert_path}")
                     
+                    # Handle ssl_verify option
+                    # Skip empty strings, "[]", or invalid values
+                    if ssl_verify and ssl_verify not in ('[]', '{}', 'null', 'None'):
+                        server_line += f" verify {ssl_verify}"
+                    elif not has_ca_file:
+                        # CRITICAL: If SSL is enabled but no CA file and no explicit verify option,
+                        # HAProxy 2.8+ defaults to 'verify required' which will fail without CA.
+                        # Default to 'verify none' to prevent validation errors.
+                        server_line += " verify none"
+                        logger.warning(f"⚠️ CONFIG SSL: Server {server_name} has SSL enabled but no CA file - defaulting to 'verify none'")
+                    
                     # Add SSL advanced options if present
                     if server.get('ssl_sni'):
                         server_line += f" sni {server['ssl_sni']}"