[SOLVED] HAProxy plugin and X-Forwarded-For header, possible change by rule?

[TheEPOCH]

Hello everyone,

for becoming familiar with reverse proxy, I decided to use the HAProxy plugin in my runnig OPNsense installation. So build up a very basic HAProxy configuration close to the documentation "HAProxy" ("https://docs.opnsense.org/manual/how-tos/haproxy.html").

As backend servers for testing I have two simple apache webserver instances (one on :80 and the other on the random port :52317, i want to test if HAProxy forwarded from public :80 to any random port) running on an extra device in my network. Both are working.

My goal is to bring diffrent services from my homelab to the "outside" and one (big) of them is HomeAssistant, which struggle with the "X-Forwarded-For header" option in the frontends.

My actual situation is, that I have for testing purpose two frontends which listing on port 80,
- public_port80 with checked "X-Forwarded-For header" option
- public_port80_nonxforward with unchecked "X-Forwarded-For header" option

With "public_port80" activated (the other deactivated) the HomeAssitant Server runs in a 503 error.
With "public_port80_nonxforward" activated (sure, the other deactivated) HA works fine.

Because I read that the "X-Forwarded-For header" option is necessary for other services i struggle with deactivate it generally.

Now my question, is there a possibility to deactivate the "X-Forwarded-For header" by a rule for the HomeAssitant backend? Or is there a way to run the one frontend "public_port80_nonxforward" only for the HomeAssitant backend and then append the standard "public_port80" which activate then the "X-Forwarded-For header"? Or vice versa?

Sorry if this question, but reverse proxy is my new home-project and i only deal with this stuff for some days.

Please tell me when i am running the wrong way with my way of thinking of haproxy.

Thanks

[Fright]

Hi!
Basically, it's up to the backend to decide how to handle the XFF header.
sorry but why not try setting up the app first? it looks like your HAProxy isn't trusted by backend:
https://www.home-assistant.io/integrations/http/#trusted_proxies

[TheEPOCH]

Okay... thank you! That was more than easy.

Sorry, I don't expect the configuration at HomeAssistant side.

Thank you very much! It solved the basic problem!