title: Proxy Protocol and SSL
body: <p>I have the following configuration:</p>
  
  <p>HAProxy -> NGinx -> Backend</p>
  
  <p>(HAProxy is used for load balancing, NGinx for SSL termination)
  The configuration can not be changed</p>
  
  <p>I'm trying to pass the source IP to the backend using the proxy protocol.
  Working without SSL it all works fine. Adding SSL to the equation I either fail on the SSL handshake or that I don't see a way to make NGinx pass the proxy protocol to the backend.</p>
  
  <p>Sample configuration 1:</p>
  
  <p>proxy protocol is passed well on the non ssl connection but for the ssl connection the ssl handshake breaks</p>
  
  <p>HAProxy:</p>
  
  <pre><code>listen HTTP-TCP_8090
      bind :8090
  
      server nginx nginx:8090 send-proxy
  
  listen HTTPS-TCP_8092
      bind :8092
  
      server nginx nginx:8092 send-proxy
  </code></pre>
  
  <p>NGinx:</p>
  
  <pre><code>stream {
      upstream some_backend {
           server some_host:8090;
      }
  
      server {
          listen                8090;
          listen                8092 ssl;
          proxy_pass            some_backend;
          proxy_protocol        on;
  
          ssl_certificate       /etc/ssl/server.crt;
          ssl_certificate_key   /etc/ssl/server.key;
          ssl_protocols         SSLv3 TLSv1 TLSv1.1 TLSv1.2;
          ssl_ciphers           HIGH:!aNULL:!MD5;
          ssl_session_cache     shared:SSLTCP:20m;
          ssl_session_timeout   4h;
          ssl_handshake_timeout 30s;
      }
  }
  </code></pre>
  
  <p>Sample configuration 2:</p>
  
  <p>both connections, ssl and not, work well but the proxy protocol header is not passed to the backend on both cases</p>
  
  <p>HAProxy:</p>
  
  <pre><code>listen HTTP-TCP_8090
      bind :8090
  
      server nginx nginx:8090 send-proxy
  
  listen HTTPS-TCP_8092
      bind :8092
  
      server nginx nginx:8092 send-proxy
  </code></pre>
  
  <p>NGinx:</p>
  
  <pre><code>stream {
      upstream some_backend {
           server some_host:8090;
      }
  
      server {
          listen                8090 proxy_protocol;
          listen                8092 proxy_protocol ssl;
          proxy_pass            some_backend;
  
          ssl_certificate       /etc/ssl/server.crt;
          ssl_certificate_key   /etc/ssl/server.key;
          ssl_protocols         SSLv3 TLSv1 TLSv1.1 TLSv1.2;
          ssl_ciphers           HIGH:!aNULL:!MD5;
          ssl_session_cache     shared:SSLTCP:20m;
          ssl_session_timeout   4h;
          ssl_handshake_timeout 30s;
      }
  }
  </code></pre>
  
  <p>Any idea how do I create a configuration that it both aware to the proxy protocol on an SSL connection and also passed the header to the backend?</p>