I am running dovecot servers behind HAProxy. One of these runs in a docker container. A standard TCP health check has a cosmetic issue. Docker isn't very fast in closing the network connection, so it sends a packet after OPNsense has already closed the one originating from HAproxy. This leads to spurious logging on OPNsense of those too-late TCP close packets.
A solution is to have true IMAP health checking and HAProxy is capable of this as far as I know. But how do I configure this on OPNsense?