<p>Nginx can be configured to support the HAProxy proxy protocol for inbound traffic: <a href="http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_protocol" rel="nofollow noreferrer">http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_protocol</a></p>
<p>However, using <code>proxy_protocol on;</code>, nginx cannot handle HTTP(S) traffic without the PROXY line.</p>
<p>The traefik reverse proxy, on the other hand, is able to treat the PROXY line as optional:</p>
<blockquote>
<p>If Proxy Protocol header parsing is enabled for the entry point, this entry point can accept connections with or without Proxy Protocol headers.
<a href="https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol" rel="nofollow noreferrer">https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol</a></p>
</blockquote>
<p><strong>Is it possible to configure nginx to treat the PROXY line as optional?</strong></p>
<p>My use case is nginx as a kubernetes ingress to handle proxy protocol traffic from outside via a load balancer and without the proxy protocol for cluster-internal HTTP(S) traffic.</p>
<p>I know there is <em>hairpin-proxy</em> that works, but it's a bit hacky as it adds rewrites for all CoreDNS cluster-internal DNS entries.
<a href="https://github.com/compumike/hairpin-proxy#:%7E:text=Modify%20nginx%20to%20treat%20the%20PROXY%20line%20as%20optional" rel="nofollow noreferrer">https://github.com/compumike/hairpin-proxy#:~:text=Modify%20nginx%20to%20treat%20the%20PROXY%20line%20as%20optional</a></p>
<hr />
<p>The K8s Cloud Setup used in this scenario:</p>
<ul>
<li>Rancher Kubernetes Engine (RKE)</li>
<li>Hetzner Cloud VMs for k8s Nodes</li>
<li>Hetzner Load Balancer as K8s Load Balancer</li>
<li>hcloud-cloud-controller-manager for provisioning Hetzner Cloud servers (<a href="https://github.com/hetznercloud/hcloud-cloud-controller-manager" rel="nofollow noreferrer">https://github.com/hetznercloud/hcloud-cloud-controller-manager</a>)</li>
<li>ingress-nginx as k8s ingress (<a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/</a>)</li>
<li>Worklaod deployments using helm3</li>
</ul>

Simon Schürg
<p><a href="https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt" rel="nofollow noreferrer">Proxy protocol specification</a> forbids this kind of mixing of proxy and non-proxy connections. The reason is that it would allow easy spoofing of ip addresses and other data.</p>
<p>Quote from the specification:</p>
<pre><code>The receiver MUST be configured to only receive the protocol described in this
specification and MUST not try to guess whether the protocol header is present
or not. This means that the protocol explicitly prevents port sharing between
public and private access. Otherwise it would open a major security breach by
allowing untrusted parties to spoof their connection addresses. The receiver
SHOULD ensure proper access filtering so that only trusted proxies are allowed
to use this protocol.
</code></pre>
