Hi,

Our setup has stunnel and HAproxy running on same server. Our clients (postgresql clients) connect to port where stunnel is listening. Clients are sending encrypted data (setting sslmode=require in pgsql connection options). Stunnel listens to encrypted traffic and writes unencrypted traffic to another port on same host where HAproxy is listening. Then, HAProxy passes this request to one of many postgresql servers. These servers are custom written to implement postgresql protocol. We want IP of the postgresql clients to be captured at the server. HAProxy documentation says that proxy protocol is only way to pass original client IP for non-http traffic. Can you please suggest how we can configure Stunnel to listen to encrypted postgresql client traffic (pgsql protocol) and write unencrypted data to HAProxy instance in proxy protocol.

Following are our current configurations for stunnel and HAProxy:

Stunnel:

foreground = yes

debug = 5

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1

socket = l:SO_KEEPALIVE=1

socket = l:TCP_KEEPIDLE=120

socket = l:TCP_KEEPINTVL=30

socket = l:TCP_KEEPCNT=3

ciphers = HIGH:MEDIUM

[postgres-serverB]

protocol = pgsql

accept = 0.0.0.0:3255

connect = localhost:5433

retry = yes

cert = /etc/stunnel/stunnel.crt

delay = no

sslVersion = TLSv1.2

HAProxy:

listen pgsql

  mode tcp

  option tcplog

  bind *:5433

  balance leastconn

  timeout server 1d

  timeout client 1d

  option tcp-check

  option clitcpka

  server qspgsqlsvr1 host.docker.internal:5432 check

Thanks,

Ashok