gsadmin/haproxy-openmanager
1
0
Fork 0
mirror of https://github.com/taylanbakircioglu/haproxy-openmanager.git synced 2026-10-04 04:21:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
142 Commits 11 Branches 25 Tags
08c500855e9538efbb22f47de3a5dfbd86f4b65f
Commit Graph

5 Commits

Author SHA1 Message Date
Taylan Bakırcıoğlu e8690245af fix(ssl): add change detection and validators for SSL advanced options 
Critical additions:
1. Change Detection (backend/routers/config.py)
   - Added SSL advanced options to bulk import change detection logic
   - Detects changes in ssl_alpn, ssl_npn, ssl_ciphers, ssl_ciphersuites
   - Detects changes in ssl_min_ver, ssl_max_ver, ssl_strict_sni
   - Changes will now appear in version diff

2. Pydantic Validators (backend/models/frontend.py, backend/models/backend.py)
   - TLS version validator: Only allows valid versions (SSLv3, TLSv1.0-1.3)
   - ALPN protocol validator: Only allows h2, http/1.1, http/1.0, h2c, spdy/*
   - NPN protocol validator: Only allows http/1.1, http/1.0, spdy/*
   - Prevents invalid values from being saved to database
   - HAProxy validation will not fail due to invalid SSL options

Impact:
- Bulk import will correctly detect SSL option changes
- Apply Management diff will show SSL changes
- User cannot enter invalid TLS versions or protocols
- Improved UX with early validation errors

Previous fixes in this series:
- Frontend GET API: Added SSL fields to response
- Bulk Import UPDATE: Added SSL fields to UPDATE statement
- Backend Server GET API: Added SSL fields to response

Test: Bulk import with ALPN change → Should see change in version diff
 2025-11-18 21:58:05 +03:00
Taylan Bakırcıoğlu b212fb92bc Add SSL Advanced Options support (Backend) - Part 1 
FEATURE: Complete SSL Advanced Options implementation for frontend and backend server SSL

✅ DATABASE:
- Added SSL parameter columns to frontends table:
  * ssl_alpn, ssl_npn, ssl_ciphers, ssl_ciphersuites
  * ssl_min_ver, ssl_max_ver, ssl_strict_sni
- Added SSL parameter columns to backend_servers table:
  * ssl_sni, ssl_min_ver, ssl_max_ver, ssl_ciphers
- Migration functions: add_ssl_advanced_options_to_frontends() and add_ssl_advanced_options_to_servers()

✅ MODELS:
- FrontendConfig: Added 7 new SSL fields for bind parameters
- ServerConfig: Added 4 new SSL fields for server parameters
- AgentHeartbeat: Added system_info field (fixes HTTP 422 validation error)

✅ BULK IMPORT PARSER:
- Parse alpn, npn, ciphers, ciphersuites, ssl-min-ver, ssl-max-ver, strict-sni from bind lines
- Parse sni, ssl-min-ver, ssl-max-ver, ciphers from server lines
- Store parsed values in frontend/server objects
- User-friendly warnings about imported SSL parameters

✅ CONFIG GENERATOR:
- Generate bind lines with SSL advanced options: 'bind :443 ssl crt file.pem alpn h2,http/1.1 ciphers ...'
- Generate server lines with SSL advanced options: 'server s1 addr:port ssl sni hostname ssl-min-ver TLSv1.2'
- Support both NEW MODE (multiple certs) and OLD MODE (single cert)

USER IMPACT:
- Bulk import now correctly parses SSL configs with alpn/npn/ciphers
- SSL parameters preserved during import (not lost anymore)
- Agent heartbeat fixed (no more offline agents)
- Ready for UI implementation (next commit)

EXAMPLE USAGE:
Frontend: bind 0.0.0.0:8443 ssl crt cert1.pem crt cert2.pem alpn h2,http/1.1
Server: server s1 10.1.1.1:443 ssl verify required sni backend.example.com ssl-min-ver TLSv1.2

NEXT: Frontend UI components for editing these SSL options
 2025-11-18 21:58:05 +03:00
taylanbakircioglu 0fc18fde38 feat: Add HAProxy options support for backends and frontends 
Implemented comprehensive HAProxy options field support for both backend and frontend entities to enable standard HAProxy directives like 'option http-keep-alive', 'option httplog', 'option forwardfor', etc.

Changes:
- Database: Added 'options' TEXT column to backends and frontends tables
- Models: Added options field to BackendConfig, BackendConfigUpdate, and FrontendConfig
- API Endpoints: Updated CREATE, UPDATE, and GET endpoints to handle options field
  * Backend: CREATE/UPDATE/GET with options support
  * Frontend: CREATE/UPDATE/GET with options support (fixed 5 SELECT queries)
- Config Generator: Added options block generation for both backends and frontends
- Bulk Import Parser:
  * Added options field to ParsedBackend and ParsedFrontend dataclasses
  * Implemented option directive parsing with validation
  * Added unknown option warnings
  * Fixed bulk parse response to include options field
- Bulk Import Merge: Added options field comparison in UPDATE logic
- UI Components:
  * BackendServers.js: Added options TextArea form field
  * FrontendManagement.js: Added options TextArea form field

Features:
- Multi-line options support (newline-separated format)
- Option validation with known HAProxy options list
- Backward compatible (NULL options for existing entities)
- Bulk import support with merge strategy
- Full CRUD support for both manual and bulk operations

Technical Details:
- Format: Newline-separated TEXT field for multiple options
- Validation: Warns about unknown options but allows them
- Config Generation: Each option written as separate directive
- Agent: Standard HAProxy config validation applies

Total: 10 files modified, ~195 lines added, 26 integration points verified
 2025-11-13 10:12:30 +03:00
taylanbakircioglu a5e281b284 Feature: Backend Server SSL certificate support + Frontend SSL dropdown enhancement 
✨ Backend Server SSL Certificate - Complete Implementation:

1. Model Update (backend/models/backend.py):
   - Added ssl_certificate_id field to ServerConfig model
   - Allows selecting SSL certificate from dropdown

2. API Endpoints (backend/routers/backend.py):
   - CREATE server: Added ssl_certificate_id to INSERT query
   - UPDATE server: Added ssl_certificate_id to allowed_fields
   - GET servers: Added ssl_certificate_id to SELECT queries (2 places)

3. Config Generation (backend/services/haproxy_config.py):
   - SSL certificate lookup by ID
   - Auto-generate ca-file path: /etc/ssl/haproxy/{cert_name}.pem
   - Added to server line in HAProxy config

Example Generated Config:
  Before: server es1 10.0.0.1:9200 ssl verify required
  After:  server es1 10.0.0.1:9200 ssl verify required ca-file /etc/ssl/haproxy/star-burgan-com-tr.pem

✨ Frontend SSL Dropdown Enhancement:
- Added Global/Cluster-specific tags to Frontend SSL dropdown
- Matches Backend Server SSL dropdown design
- Shows: [🌍 Global] or [📍 Cluster] with color coding

🔧 Complete SSL Workflow:
1. User edits Backend Server
2. Enables SSL
3. Selects SSL certificate from dropdown
4. Saves → ssl_certificate_id stored in DB
5. Apply Changes → Config generated with ca-file path
6. Agent downloads SSL cert to /etc/ssl/haproxy/
7. HAProxy uses ca-file for SSL verification

✅ Database Schema:
  backend_servers table now includes:
  - ssl_enabled (bool)
  - ssl_verify (str: none/required)
  - ssl_certificate_id (int, FK to ssl_certificates)

✅ HAProxy Config Format:
  server {name} {addr}:{port} ssl verify required ca-file {path}

Impact: Backend Server SSL now fully functional with certificate management
 2025-11-07 11:51:15 +03:00
taylanbakircioglu 6aae0f4309 Initial commit 2025-10-27 12:14:03 +03:00