Page MenuHomeVyOS Platform
Create Task
Maniphest T8289

Load-balancer Haproxy should enable SNI configuration option for TLS backends
Open, LowPublic
Actions

Description

Most TLS backends require SNI

When using http termination in the load balancer, sometimes we have to set the SNI manually on the backend server configuration

Haproxy doc for SNI option: https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/#sni

An example of someone encountering the problem: https://hodari.be/posts/2020_09_04_configure_sni_for_haproxy_backends/
(I don't need the httpchk sni settings for my use-case)

Relevant section from /var/run/haproxy.cfg in a typical current configuration:

backend talos-1_be
    option httpchk
    http-check send meth GET uri /check/healthz
    http-check expect status 200
    balance roundrobin
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    mode http
    server talos-1 192.168.101.200:443 check port 80 ssl verify none

Anticipated /var/run/haproxy.cfg once a "sni" flag is added to the configuration with "req.hdr(Host)"

backend talos-1_be
    option httpchk
    http-check send meth GET uri /check/healthz
    http-check expect status 200
    balance roundrobin
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    mode http
    server talos-1 192.168.101.200:443 check port 80 ssl verify none sni req.hdr(Host)

Details

Version
-
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)

Event Timeline

jamcole created this task.Feb 21 2026, 3:27 AM
jamcole created this object in space S1 VyOS Public.
pasik subscribed.Feb 21 2026, 11:30 AM
Viacheslav subscribed.Feb 23 2026, 3:06 PM

Any idea about CLI?
Will it be enough?

set load-balancing haproxy backend foo server rs01 check sni
jamcole added a comment.Feb 23 2026, 3:27 PM

Sure, I think the check is a separate option, but otherwise, sure I think this cli would be fine as long as it added the sni req.hdr(Host) option to the haproxy.cfg

set load-balancing haproxy backend my_backend server my_server sni

natali-rs1985 subscribed.EditedApr 28 2026, 12:04 PM

Would it be worth considering additional SNI types beyond req.hdr(Host) to cover other common scenarios:
req.ssl_sni / ssl_fc_sni / str(<hostname>)

set load-balancing haproxy backend <name> server <name> sni req-hdr-host
set load-balancing haproxy backend <name> server <name> sni req-ssl-sni
set load-balancing haproxy backend <name> server <name> sni ssl-fc-sni
set load-balancing haproxy backend <name> server <name> sni string <hostname>