www/caddy: add possibility to import proxy_protocol

[jhubee]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
Since caddy v2.7.0 proxy_protocol directive inside the global server -> listener_wrappers block is merged into caddy core. See https://caddyserver.com/docs/caddyfile/options#proxy-protocol
Don't mix up with the "layer4" module proxy_protocol matcher/handler.
The core module can terminate and utilize the proxy_protocol header e.g. set client_ip placeholder to real client IP instead upstream (SNI) proxy ip.

With current setup of the caddy plugin, it's not possible to import custom configs to the global servers or inside servers -> listen_wrappers block. It's only possible to add custom configs inside the layer4 block.

Describe the solution you'd like
Add import directive to listen_wrappers block after layer4 module block but before "tls".

plugins/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile

Lines 76 to 123 in 9ee2cd4

	servers {
	protocols {{ generalSettings.HttpVersions.split(',') | join(' ') }}
	{% if accessList %}
	trusted_proxies static {{ accessList.clientIps.split(',') | join(' ') }}
	{% endif %}
	{% if generalSettings.ClientIpHeaders %}
	{% for header_uuid in generalSettings.ClientIpHeaders.split(',') %}
	{% set header = helpers.toList('Pischem.caddy.reverseproxy.header') | selectattr('@uuid', 'equalto', header_uuid) | first %}
	{% if header and header.HeaderType %}
	client_ip_headers {{ header.HeaderType }}
	{% endif %}
	{% endfor %}
	{% endif %}
	{% if generalSettings.LogCredentials|default("0") == "1" %}
	log_credentials
	{% endif %}
	{% if generalSettings.timeout_read_body or
	generalSettings.timeout_read_header or
	generalSettings.timeout_write or
	generalSettings.timeout_idle %}
	timeouts {
	{% if generalSettings.timeout_read_body %}
	read_body {{ generalSettings.timeout_read_body }}s
	{% endif %}
	{% if generalSettings.timeout_read_header %}
	read_header {{ generalSettings.timeout_read_header }}s
	{% endif %}
	{% if generalSettings.timeout_write %}
	write {{ generalSettings.timeout_write }}s
	{% endif %}
	{% if generalSettings.timeout_idle %}
	idle {{ generalSettings.timeout_idle }}s
	{% endif %}
	}
	{% endif %}
	{% if generalSettings.EnableLayer4|default("0") == "1" %}
	listener_wrappers {
	layer4 {
	import /usr/local/etc/caddy/caddy.d/*.layer4listener
	{% set context_var = "listener_wrappers" %}
	{% include "OPNsense/Caddy/includeLayer4" %}
	}
	{# Route all other traffic to HTTP App #}
	tls
	}
	{% endif %}
	}

Before "{# Route all other traffic to HTTP App #}" add e.g.:
import /usr/local/etc/caddy/caddy.d/*.listenerwrappers

Describe alternatives you've considered
Alternatively make proxy_protocol configurable via ui.

Additional context

[Monviech]

Why an import and not a GUI option that allows what you need? Whats the scope of adding it?

Can you show an example Caddyfile that has what you need so we can see the scope?

[jhubee]

Shure, GUI is preferred.
The scope is e.g. if there is a TCP SNI proxy (no TLS decryption, only layer 4 proxy) before opnsense/caddy, the TCP proxy cannot set the X-Forward-IP header. So caddy only get the TCP proxy IP-Address and not the real client IP. To overcome this issue HAProxy introduced the proxy_protocol https://github.com/haproxy/haproxy/blob/master/doc/proxy-protocol.txt.

Example Caddyfile:

{	
	servers {
		listener_wrappers {
			layer4 {
				....
			}
			proxy_protocol {
				timeout 2s
				allow 10.11.12.13/32
				deny 10.10.1.0/24
				fallback_policy ignore
			}
			tls
		}
	}
}

Hope this helps understanding my request.

[Monviech]

This looks like a global setting so should be relatively safe to offer it in the GUI in the general settings.

Im not interested in this myself though cause I don't use it. Lets wait if somebody offers a PR.