HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for web sites crawling under very high loads while needing persistence or Layer7 processing.

Plugin Changelog

5.1

Added: * more conditions have support for converters * add support for mapfile URLs (#4825)

Fixed: * migration fails if a http-request/-response "lua" rule is configured

Changed: * modernize UI templates

5.0

WARNING: This is a new major release, which may result in incompatible changes for some users.

Added: * add support for HTTP/3 over QUIC to frontends (#4341) * add new rule: http-request silent-drop * add new rule: http-after-response * add new condition: HTTP method * support custom HTTP status code in "http-request deny" rules * add new backend option to control PROXY protocol for health checks (#2909) * add support for new map file types: beg,end,int,ip,reg,str,sub (#3641) * add support for more sample fetches: quic_enabled, stopping, wait_end (#3702) * add support for HTTP compression (#4867) * add all action keywords for http-request/-response and tcp-request/-response rules * add "enabled" field to rules * add support for all stick-table data types * add support for GPC/GPT/SC to conditions and rules (#1123, #5109) * add support for SSL SNI expression to servers (#3756) * add column "mode" to servers overview (#4632) * add support for loading mapfiles in conditions and rules * add support for sample fetches in rules

Fixed: * Maintenance tab "SSL Certificates" not working with only one cert

Changed: * upgrade to HAProxy 3.2 release series (#5147) * refactor http/tcp rules to make extensions easier * rename some labels in rules * change LUA boolean conversion (see tune.lua.bool-sample-conversion) * stick-table "size" and "expiration time" are no longer advanced options (now always visible) * replace stick-table type "ip" with "ipv4" (#5147) * show the actual HAProxy option name in conditions for clarity * allow stick-table types "binary", "integer" and "string" in backends * make mapfiles more useful in rules

4.6

Changed: * improve help text for "http-request redirect" rules (#4650) * rename "http-request redirect" input field (#4650)

4.5

Changed: * upgrade to HAProxy 3.0 release series (#4411) * migrate cert export to Trust MVC

4.4

Fixed: * Cron job "Sync SSL certificate changes" not working (#4035) * Template error with empty user group (#3364)

4.3

Added: * Add new global parameter: DNS prefer IP family (#3779)

Fixed: * SNI not working when automatic OCSP updates are enabled (#3779) * HAProxy error: has an OCSP URI but an error occurred (#3779)

Changed: * prefer IPv4 results when resolving DNS names (#3779) * disable OCSP updates if cert contains no OCSP data (#3779)

4.2

Added: * add support for built-in OCSP update feature * add support for forwarded header (RFC7239) * add option "X-Forwarded-For Header" to backend settings * add options for HTTP/2 performance tuning

Fixed: * fix SSL sync cron job (bulk sync was never working properly)

Changed: * upgrade to HAProxy 2.8 release series (#3459) * change default for HTTP/2 to enabled (only new frontends/backends) * add "no-alpn" option if HTTP/2 is not enabled (only TLS-enabled frontends) * move OCSP settings from "Service" to "Global" section * replace bundled haproxyctl library with haproxy-cli

Deprecated: * frontend option "X-Forwarded-For Header" (the backend option should be used)

Removed: * remove OSCP update cron job

4.1

Fixed: * fix SSL preferences in health checks (#3221)

4.0

Added: * add new service option "Gradual connection close time" (close-spread-time) (#3026) * add new frontend option "shards" (#3026)

Changed: * upgrade to HAProxy 2.6 release series (#3026) * rename frontend option "Type" to "Connection Mode" (#3026) * migrate options "http-tunnel" and "forceclose" to "http-keep-alive" (#3026) * replace "process" with "threads" bind keyword for CPU Affinity (#3026) * no longer duplicate global defaults in backends/frontends (#2642)

Removed: * remove Processes/nbproc option (use Threads/nbthread instead) (#3026) * remove "Process ID" from CPU Affinity settings (now always 1) (#3026) * remove "bind-process" option (replaced by the "threads" bind keyword) (#3026) * remove options "http-tunnel" and "forceclose" from "Connection Mode" (#3026)

3.12

Added: * add support for req.ssl_hello_type (#2311) * add support for Prometheus exporter (#2764) * add support for FastCGI applications (#2769) * add server option to override the multiplexer protocol

Fixed: * fix unix sockets in chrooted environment (#3093) * fix peers by automatically configuring the local peer (#3114)

Changed: * update HAProxy documentation URLs

3.11

Added: * add support for cache parameter (#2908)

3.10

WARNING: This release switches to the HAProxy 2.4 release series, which may result in incompatible changes for some users.

Added: * add support for DNS resolution over TCP (#2644)

Changed: * upgrade to HAProxy 2.4 release series (#2644) * disable strict-limits for safekeeping (#2644)

Removed: * remove deprecated option tune.chksize (#2644)

3.9

Added: * add SSL SNI setting to servers and health checks (#2388)

Fixed: * fix custom TCP health checks (#2653)

Changed: * replace "force SSL" setting with "SSL preferences" in health checks (#2388) * health check port is no longer an advanced option

3.8

Added: * add support for unix sockets (#2040) * add "max connections" option to servers (#2641)

Changed: * allow setting "max connections" to "0" (unlimited) * raise maximum value for "max connections" to 10000000

3.7

Added: * add options "preload" and "filename scheme" to Lua scripts (#2265) * add syslog-ng socket for logging (#2620) * show hint to apply changes after every config change (#2590) * show warning for pending configuration changes (#2590)

Fixed: * unable to use the "require" function in Lua scripts (#2265) * request logging not working (#2587) * fix syntax error in template (#2619)

Changed: * set "lua-prepend-path" so that Lua scripts can be found (#2265) * show "apply" and "test syntax" buttons on introduction pages

3.6

Added: * add support for advanced resolver properties (#2330) * add graceful stop timeout to service settings * support "monitor-uri" and "monitor fail" in rules (#2387) * add new option "case-sensitive" to conditions (#2576)

Fixed: * no haproxy.conf after restoring a config backup (#2474)

Changed: * deploy haproxy.conf if it does not exist (#2474) * add new timeout (60s) which will terminate open connections when using graceful stop * allow retries to be set to "0" (#2585)

3.5

Fixed: * fix maintenance page not loading (#2485)

3.4

Fixed: * fix empty resolve-prefer option (#2340)

3.3

Changed: * use HAProxy socket to apply updated OCSP stapling data (in cron job) (#2351)

3.2

Fixed: * fix config test when HAProxy service is not enabled

Changed: * ignore incompatible ciphersuites options when LibreSSL is used (#2013)

3.1

Fixed: * fix items that cannot be deleted (#2266)

Changed: * rules: only accept a single value for backend/server fields (#2266)

3.0

Added: * add new maintenance page to change server state and weight on-the-fly (#2213) * add new commands to update SSL certificates in runtime (#2244, #1882) * add new SSL bind option: prefer-client-ciphers * add global option to enable old buggy behaviour for PROXY v2 connections * add support for HTTP/2 in health checks * add config export (#2035) * add config diff * guard against broken config by using a staging config file * add basic OCSP stapling support (#1430) * add support for e-mail alerts and mailers (#1669) * add support for custom header checks (#1907) * add support for server templates (#1975) * add support for additional resolver options (#1975) * add support for resolve-prefer option (#1975) * add pre-defined cron jobs to maintenance page

Fixed: * prevent service outage by aborting "Apply" when configtest fails * fix direct links to individual statistics tabs * prevent the deletion of items that are still referenced elsewhere (core/#1897)

Changed: * upgrade to HAProxy 2.2 release series (#2092) * change default SSL version to TLSv1.2 (ssl-min-ver) * remove weak ciphers from (default) SSL settings * remove default SSL bind options that would conflict with ssl-min-ver * move SSL bind options below other SSL settings, they are rarely used nowadays * change default for tune.ssl.default-dh-param from 1024 to 2048 * use new "http-check send" command for HTTP health checks * change default for spreadChecks from 0 to 2 * no longer overwrite live config file when running a syntax check * make restart/reload commands usable in cron jobs * relax GUI input validation for servers, move validation to jinja template (#1975)

Deprecated: * nbproc is deprecated and will be removed in os-haproxy 4.0

2.26

Fixed: * preserve sort order of default SSL bind options

2.25

Added: * add support for TLSv1.3 (#790)

2.24

Added: * add support for http-request set-var and http-response set-var (#1796) * add group as userlist to HAProxy config to make it usable in rules/conditions (#1796) * add support for resolvers to customize how HAProxy handles name resolution (#1787) * add support for init-addr to allow HAProxy to start when DNS does not resolve (#1787)

Fixed: * honor sort order of all rules, remove special handling of "use_[backend|server]" options (#1925)

Changed: * add "Save & Test syntax" button to all "Settings" pages * add "introduction" page for Settings tab * streamline "Settings" subtabs

2.23

Fixed: * add missing acl SNI regex text field (#1883)

2.22

Added: * enable SSL verification for a server when "Force SSL" is enabled in the associated health check (#1761) * use the systems local Root CA Certificates for SSL verification when no CA was selected (#1761)

Fixed: * fix label of src_sess_cnt (#1780) * fix invalid use of option httplog (resolves a warning in config test) * fix invalid use of option forwardfor (resolves a warning in config test)

2.21

Fixed: * override "graceful" restart if required (#1745)

2.20

Changed: * update stats socket permission for easier (non-root) monitoring (#1232)

2.19

Added: * switch to HAProxy 2.0 release series (#1089) * add support for the "max-object-size" cache configuration option (#1458) * add end-to-end HTTP/2 support (details) * add support for the random balancing algorithm (details)

Fixed: * fix IPv6 validation in frontends (#540)

Changed: * add IPv6 example to listen address help text * update URLs to HAProxy 2.0 documentation * frontends: move HTTP/2 option to HTTP settings * change order of frontend options

2.18

Added: * add support for HAProxy cache (#1442)

Changed: * change http-reuse default (align with HAProxy's default value, #1439)

2.17

Added: * allow backends without servers (#1304) * add support for deciphered SNI check in ACLs (#1365) * allow to force SSL for health checks (#1282)

Changed: * improve wording for SNI conditions to differentiate between deciphered vs. not deciphered

2.16

Fixed: * allow hyphens in server, frontend and backend names (#1346)

2.15

Added: * rules can finally be sorted by using drag'n'drop (#582) * added "enabled" field to servers (#1208) * TCP inspection delays are supported in rules (#1188)

Changed: * server option "mode" is always visible, no longer requires "advanced mode" (#1208) * most dropdown fields finally have alphanumeric sorting (#687, opnsense/core#3251) * rules: align indentation of comments in haproxy.conf

2.14

Fixed: * bulk deleting does not work (#1164)

Changed: * migrate to mutable controller (required to fix #1164)

2.13

Added: * support multiple CAs for SSL verification for servers

Fixed: * fix export of CAs (#1074)

Changed: * export a frontend's default SSL certificate (#1088) * it is no longer required to add a default SSL certificate to a frontend's "certificates" list (#1088) * avoid duplicate entry in certlist file if a default SSL certificate is specified * always show "Default certificate" option in frontends, it's no longer an "advanced" option

2.12

Added: * add support for HTTP/2 (#1047)

2.11

Fixed: * fix warning: a 'http-request' rule placed after a 'use_backend' rule will still be processed before (#999) * fix wrong parameter name when using tcp-request content lua (#999)

Changed: * internal: trim whitespace, remove empty lines in haproxy.conf (#999)

2.10

Added: * add support for multithreading (available as new option in Settings -> Global Parameters) (#1003) * add support for client certificate authentication (#426) * add support for HTTP Basic Auth to frontends/backends/ACLs (#300) * add basic user/group management functionality (supports Basic Auth as well as stats users) * add new CPU Affinity Rules feature (which is a combination of HAProxy's cpu-map, bind-process and process options) (see #1003 for a short explanation)

Fixed: * function "http-request header-delete" generated a corrupted haproxy.conf (#882)

Changed: * migrate all stats users from old (and cumbersome) username:password format to new user management feature * internal: use /tmp for autogenerated files (now they are automatically cleaned up on boot) * internal: change filename of cert lists from id.crtlist to id.certlist

2.9

Added: * add "http-reuse" option (#836)

2.8

Added: * support truly seamless reloads (#224) * add support for the "map" feature (#180)

Fixed: * fix reload of service template in "reconfigure" action (#690; introduced in 7381101) * enabling "hard stop" mode resulted in an invalid "hardrestart" RC command

Changed: * use "reload" instead of "restart" RC action * if "reload" fails, also issue a "restart" command (required when enabling seamless reloads) * start progress animation (spinner) earlier when applying settings

2.7

Added: * support rise/fall parameters in backends and health checks * support set-path in ACLs * support for cookie-based persistence (#680)

Fixed: * fix X-Forwarded-For option disappeared (#647) * fix validation for source address fields (#695)

2.6

Added: * add support for http-response set-status in ACLs to manipulate HTTP status codes

Fixed: * fix invalid backend name when using nbsrv in ACLs

2.5

Added: * add support for the PROXY protocol (i.e. in combination with postfix or dovecot) * switch to HAProxy 1.8.4

2.4

Added: * add support for "preload" and "includeSubDomains" HSTS options (#447) * support session sync / HAProxy peers (#165) * add new HTTP timeout options (to mitigate slowloris attacks) (#202) * allow tracking additional values in stick-tables (#202) * add stick-table config for frontends (optional, disabled by default) (#202) * add support for many new conditions (#202) * enable sticky counters for frontend stick-tables (required for new conditions) (#202)

Changed: * relax validation masks for several "name" fields (to allow more "special" characters) * switch to new mutable service controller

2.3

Added: * new option to hide introduction pages (#340)

Fixed: * fix wrong introduction for "Advanced" tab (regression introduced in 8cdcbda)

2.2

Fixed: * fix for rules parameters (values could not be saved, leading to invalid rules)

2.1

Fixed: * do not enable HSTS unconditionally (now works as described in #380) * enable HSTS only for HTTP frontends

2.0

Added: * new GUI to guide new users and improve general usability (#208) * make server port optional (#341) * new SSL settings for frontends (#380) * new global SSL default values (#380) * new option for HTTP Strict Transport Security (#380)

Fixed: * rephrase text to make it clear that aliases cannot be used (#360) * rephrase text to make it clear that "use_server" will only work for backends (#361)