Merge pull request #1109 from rabbitmq/proxy-protocol-configuration

Add proxy protocol to configuration

4 files changed, 98 insertions, 12 deletions

diff --git a/docs/rabbitmq.conf.example b/docs/rabbitmq.conf.example
index de59985471..0e8d1e0596 100644
--- a/docs/rabbitmq.conf.example
+++ b/docs/rabbitmq.conf.example
@@ -395,6 +395,16 @@
 ##
 # background_gc_target_interval = 60000
 
+## Whether or not to enable proxy protocol support.
+## Once enabled, clients cannot directly connect to the broker
+## anymore. They must connect through a load balancer that sends the
+## proxy protocol header to the broker at connection time.
+## This setting applies only to AMQP clients, other protocols
+## like MQTT or STOMP have their own setting to enable proxy protocol.
+## See the plugins documentation for more information.
+##
+# proxy_protocol = false
+
 ## ----------------------------------------------------------------------------
 ## Advanced Erlang Networking/Clustering Options.
 ##
@@ -515,6 +525,16 @@
 ##
 # stomp.implicit_connect = true
 
+## Whether or not to enable proxy protocol support.
+## Once enabled, clients cannot directly connect to the broker
+## anymore. They must connect through a load balancer that sends the
+## proxy protocol header to the broker at connection time.
+## This setting applies only to STOMP clients, other protocols
+## like MQTT or AMQP have their own setting to enable proxy protocol.
+## See the plugins or broker documentation for more information.
+##
+# stomp.proxy_protocol = false
+
 ## ----------------------------------------------------------------------------
 ## RabbitMQ MQTT Adapter
 ##
@@ -578,6 +598,16 @@
 # mqtt.tcp_listen_options.backlog = 128
 # mqtt.tcp_listen_options.nodelay = true
 
+## Whether or not to enable proxy protocol support.
+## Once enabled, clients cannot directly connect to the broker
+## anymore. They must connect through a load balancer that sends the
+## proxy protocol header to the broker at connection time.
+## This setting applies only to STOMP clients, other protocols
+## like STOMP or AMQP have their own setting to enable proxy protocol.
+## See the plugins or broker documentation for more information.
+##
+# mqtt.proxy_protocol = false
+
 ## ----------------------------------------------------------------------------
 ## RabbitMQ AMQP 1.0 Support
 ##
diff --git a/docs/rabbitmq.config.example b/docs/rabbitmq.config.example
index aaffcab2d8..50e97cd3bb 100644
--- a/docs/rabbitmq.config.example
+++ b/docs/rabbitmq.config.example
@@ -346,7 +346,17 @@
    %% the operation (can be higher than this interval). Values less than
    %% 30000 milliseconds are not recommended.
    %%
-   %% {background_gc_target_interval, 60000}
+   %% {background_gc_target_interval, 60000},
+
+   %% Whether or not to enable proxy protocol support.
+   %% Once enabled, clients cannot directly connect to the broker
+   %% anymore. They must connect through a load balancer that sends the
+   %% proxy protocol header to the broker at connection time.
+   %% This setting applies only to AMQP clients, other protocols
+   %% like MQTT or STOMP have their own setting to enable proxy protocol.
+   %% See the plugins documentation for more information.
+   %%
+   %% {proxy_protocol, false}
 
   ]},
 
@@ -517,7 +527,17 @@
    %% SSL certificate whenever the first frame sent on a session is not a
    %% CONNECT frame.
    %%
-   %% {implicit_connect, true}
+   %% {implicit_connect, true},
+
+   %% Whether or not to enable proxy protocol support.
+   %% Once enabled, clients cannot directly connect to the broker
+   %% anymore. They must connect through a load balancer that sends the
+   %% proxy protocol header to the broker at connection time.
+   %% This setting applies only to STOMP clients, other protocols
+   %% like MQTT or AMQP have their own setting to enable proxy protocol.
+   %% See the plugins or broker documentation for more information.
+   %%
+   %% {proxy_protocol, false}
   ]},
 
  %% ----------------------------------------------------------------------------
@@ -575,7 +595,17 @@
    %% TCP/Socket options (as per the broker configuration).
    %%
    %% {tcp_listen_options, [{backlog,   128},
-   %%                       {nodelay,   true}]}
+   %%                       {nodelay,   true}]},
+
+   %% Whether or not to enable proxy protocol support.
+   %% Once enabled, clients cannot directly connect to the broker
+   %% anymore. They must connect through a load balancer that sends the
+   %% proxy protocol header to the broker at connection time.
+   %% This setting applies only to MQTT clients, other protocols
+   %% like STOMP or AMQP have their own setting to enable proxy protocol.
+   %% See the plugins or broker documentation for more information.
+   %%
+   %% {proxy_protocol, false}
   ]},
 
  %% ----------------------------------------------------------------------------
diff --git a/priv/schema/rabbitmq.schema b/priv/schema/rabbitmq.schema
index a0d44f246b..6f3f42e4ed 100644
--- a/priv/schema/rabbitmq.schema
+++ b/priv/schema/rabbitmq.schema
@@ -942,6 +942,13 @@ end}.
 {mapping, "background_gc_target_interval", "rabbit.background_gc_target_interval",
     [{datatype, integer}]}.
 
+%% Whether or not to enable proxy protocol support.
+%%
+%% {proxy_protocol, false}
+
+{mapping, "proxy_protocol", "rabbit.proxy_protocol",
+    [{datatype, {enum, [true, false]}}]}.
+
 % ==========================
 % Lager section
 % ==========================
diff --git a/test/config_schema_SUITE_data/snippets.config b/test/config_schema_SUITE_data/snippets.config
index 09ddf95969..9fb0b7519b 100644
--- a/test/config_schema_SUITE_data/snippets.config
+++ b/test/config_schema_SUITE_data/snippets.config
@@ -263,7 +263,8 @@ mqtt.listeners.ssl    = none
 # mqtt.listeners.ssl.default = 8883
 mqtt.listeners.tcp.default = 1883
 mqtt.tcp_listen_options.backlog = 128
-mqtt.tcp_listen_options.nodelay = true",
+mqtt.tcp_listen_options.nodelay = true
+mqtt.proxy_protocol = false",
 [{rabbit,        [{tcp_listeners,    [5672]}]},
      {rabbitmq_mqtt, [{default_user,     <<"guest">>},
                       {default_pass,     <<"guest">>},
@@ -277,7 +278,8 @@ mqtt.tcp_listen_options.nodelay = true",
                       %% {ssl_listeners,    [8883]}
                       {tcp_listeners,    [1883]},
                       {tcp_listen_options, [{backlog,   128},
-                                            {nodelay,   true}]}]}
+                                            {nodelay,   true}]},
+                      {proxy_protocol, false}]}
     ],
 [rabbitmq_mqtt]}
 ,
@@ -323,7 +325,8 @@ mqtt.allow_anonymous  = true
 mqtt.vhost            = /
 mqtt.exchange         = amq.topic
 mqtt.subscription_ttl = undefined
-mqtt.prefetch         = 10",
+mqtt.prefetch         = 10
+mqtt.proxy_protocol = true",
 [{rabbit,        [{tcp_listeners,    [5672]}]},
      {rabbitmq_mqtt, [{default_user,     <<"guest">>},
                       {default_pass,     <<"guest">>},
@@ -331,7 +334,8 @@ mqtt.prefetch         = 10",
                       {vhost,            <<"/">>},
                       {exchange,         <<"amq.topic">>},
                       {subscription_ttl, undefined},
-                      {prefetch,         10}]}
+                      {prefetch,         10},
+                      {proxy_protocol,   true}]}
     ],
 [rabbitmq_mqtt]}
 ,
@@ -645,8 +649,10 @@ stomp.listeners.ssl.1 = 61614",
 
 {57,
 "stomp.default_user = guest
-stomp.default_pass = guest",
-[{rabbitmq_stomp, [{default_user, [{login, "guest"},{passcode, "guest"}]}]}],
+stomp.default_pass = guest
+stomp.proxy_protocol = false",
+[{rabbitmq_stomp, [{default_user, [{login, "guest"},{passcode, "guest"}]},
+                   {proxy_protocol, false}]}],
 [rabbitmq_stomp]}
 ,
 {58,
@@ -661,8 +667,10 @@ stomp.default_pass = guest",
 {60,
 "stomp.default_user = guest
 stomp.default_pass = guest
-stomp.implicit_connect = true",
-[{rabbitmq_stomp, [{default_user,[{login, "guest"}, {passcode, "guest"}]},{implicit_connect, true}]}],
+stomp.implicit_connect = true
+stomp.proxy_protocol = true",
+[{rabbitmq_stomp, [{default_user,[{login, "guest"}, {passcode, "guest"}]},
+                   {implicit_connect, true}, {proxy_protocol, true}]}],
 [rabbitmq_stomp]}
 ,
 {61,
@@ -878,6 +886,17 @@ auth_cache.cached_backend = ldap",
   auth_cache.cache_module = rabbit_auth_backend_ets_segmented",
  [{rabbit, [{auth_backends, [rabbit_auth_backend_cache]}]},
   {rabbitmq_auth_backend_cache, [{cache_module, rabbit_auth_backend_ets_segmented}]}],
- [rabbitmq_auth_backend_cache]}
+ [rabbitmq_auth_backend_cache]},
+
+{81.1,
+"proxy_protocol = true",
+[{rabbit, [
+    {proxy_protocol, true}
+]}],[]},
+{81.2,
+"proxy_protocol = false",
+[{rabbit, [
+    {proxy_protocol, false}
+]}],[]}
 
 ].