weizhouapache commented on code in PR #11468:
URL: https://github.com/apache/cloudstack/pull/11468#discussion_r2291067732
##########
core/src/main/java/com/cloud/network/HAProxyConfigurator.java:
##########
@@ -469,46 +477,62 @@ private String getLbSubRuleForStickiness(final
LoadBalancerTO lbTO) {
return sb.toString();
}
- private List<String> getRulesForPool(final LoadBalancerTO lbTO, final
boolean keepAliveEnabled) {
+ private List<String> getRulesForPool(final LoadBalancerTO lbTO, final
LoadBalancerConfigCommand lbCmd) {
StringBuilder sb = new StringBuilder();
final String poolName = sb.append(lbTO.getSrcIp().replace(".",
"_")).append('-').append(lbTO.getSrcPort()).toString();
final String publicIP = lbTO.getSrcIp();
final int publicPort = lbTO.getSrcPort();
final String algorithm = lbTO.getAlgorithm();
- final List<String> result = new ArrayList<String>();
- // add line like this: "listen 65_37_141_30-80\n\tbind
65.37.141.30:80"
- sb = new StringBuilder();
- sb.append("listen ").append(poolName);
- result.add(sb.toString());
+ boolean sslOffloading = lbTO.getSslCert() != null &&
!lbTO.getSslCert().isRevoked()
+ && NetUtils.SSL_PROTO.equals(lbTO.getLbProtocol());
+
+ final List<String> frontendConfigs = new ArrayList<>();
+ final List<String> backendConfigs = new ArrayList<>();
+ final List<String> result = new ArrayList<>();
+
sb = new StringBuilder();
sb.append("\tbind ").append(publicIP).append(":").append(publicPort);
- result.add(sb.toString());
+
+ if (sslOffloading) {
+ sb.append(" ssl crt
").append(SSL_CERTS_DIR).append(poolName).append(".pem");
+ // check for http2 support
+ sb.append(" alpn h2,http/1.1");
Review Comment:
`h2` means `http2`.
we need to support both `http2` and `http 1.1`
this is an example of the settings
https://ssl-config.mozilla.org/#server=haproxy&version=2.6&config=intermediate&openssl=3.0.16&guideline=5.4
@DaanHoogland
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
