Move the haproxy edge behind the external Traefik #492

Merged

benvin merged 3 commits from benvin/haproxy-behind-traefik into main 2026-09-26 23:38:08 +10:00

Conversation 0 Commits 3 Files Changed 7

+117 -50

unkin-agent commented 2026-09-26 21:13:24 +10:00

Member

Copy Link

Copy Source

The haproxy edge holds its own DMZ VIP, a second public entry point alongside
traefik-external that must be firewalled and DNS'd separately. Traefik can
front it with TLS passthrough, leaving haproxy's certs and backends untouched.

• Add a traefik-external Gateway: HTTP :80 plus Passthrough TLS :443.
• TLSRoute the 12 fe_https.map hostnames to haproxy:443; HTTPRoute 301s :80.
• Make the Service ClusterIP on 443 only, releasing 198.18.199.1.
• Drop fe_http, be_letsencrypt and fe_http.map; certs are DNS-01 only.

Client IP now reads as a Traefik pod — the Gateway provider cannot emit PROXY protocol to a TLSRoute backend. sessionAffinity goes too (it would pin Traefik pods, not clients); SRVNAME cookies keep persistence.

The haproxy edge holds its own DMZ VIP, a second public entry point alongside traefik-external that must be firewalled and DNS'd separately. Traefik can front it with TLS passthrough, leaving haproxy's certs and backends untouched. - Add a `traefik-external` Gateway: HTTP :80 plus Passthrough TLS :443. - TLSRoute the 12 `fe_https.map` hostnames to haproxy:443; HTTPRoute 301s :80. - Make the Service ClusterIP on 443 only, releasing 198.18.199.1. - Drop `fe_http`, `be_letsencrypt` and `fe_http.map`; certs are DNS-01 only. Client IP now reads as a Traefik pod — the Gateway provider cannot emit PROXY protocol to a TLSRoute backend. `sessionAffinity` goes too (it would pin Traefik pods, not clients); SRVNAME cookies keep persistence.

benvin changed target branch from benvin/haproxy-drop-stalwart to main 2026-09-26 21:25:53 +10:00

benvin added 2 commits 2026-09-26 21:25:53 +10:00

drop stalwart mail proxying 584524c80d

Move the haproxy edge behind the external Traefik 475477f9b5

unkin-agent added 1 commit 2026-09-26 21:44:09 +10:00

Merge main into the haproxy traefik branch c74ddd5333

benvin merged commit 20077f1029 into main 2026-09-26 23:38:08 +10:00

benvin deleted branch benvin/haproxy-behind-traefik 2026-09-26 23:38:13 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#492