Dustin C. Hatch
70909d1b13
Since the reverse proxy does TLS pass-through instead of termination, the original source address is lost. Since the source address is important for logging, rate limiting, and access control, we need to use the HAProxy PROXY protocol to pass it along to the web server. Since the PROXY protocol works at the TCP layer, _all_ connections must use it. Fortunately, all of the sites hosted by the public web server are in fact public and only accessed through HAProxy. Similarly, enabling it for one named virtual host enables it for all virtual hosts on that port. Thus, we only have to explicitly set it for one site, and all the rest will use it as well.