net/haproxy: disable strict-limits for safekeeping, refs #2644

net/haproxy/pkg-descr

@@ -13,6 +13,7 @@ which may result in incompatible changes for some users.
 
 Changed:
 * upgrade to HAProxy 2.4 release series (#2644)
+* disable strict-limits for safekeeping (#2644)
 
 Removed:
 * remove deprecated option tune.chksize (#2644)

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml

@@ -27,7 +27,7 @@
         <id>haproxy.general.tuning.maxConnections</id>
         <label>Maximum connections</label>
         <type>text</type>
-        <help><![CDATA[Sets the maximum number of concurrent connections per HAProxy process.<br/><div class="text-info"><b>NOTE:</b> HAProxy will not be able to allocate enough memory if you set this value too high. Consider raising the settings for kern.maxfiles and kern.maxfilesperproc if you need to specify a non-default value.</div>]]></help>
+        <help><![CDATA[Sets the maximum number of concurrent connections per HAProxy process.<br/><div class="text-info"><b>NOTE:</b> Consider raising the settings for kern.maxfiles and kern.maxfilesperproc in <a target="_blank" href="/ui/haproxy#general-settings">System: Settings: Tunables</a>, otherwise HAProxy will fail to open the specified number of connections.</div>]]></help>
     </field>
     <field>
         <id>haproxy.general.tuning.sslServerVerify</id>

net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf

@@ -958,6 +958,9 @@ global
 {% if OPNsense.HAProxy.general.hardStopAfter|default('') != '' %}
     hard-stop-after             {{OPNsense.HAProxy.general.hardStopAfter}}
 {% endif %}
+{# # Disable strict-limits because a syntax check will not reveal #}
+{# # whether kern.maxfilesperproc or kern.maxfiles are too low. #}
+    no strict-limits
 {% if helpers.exists('OPNsense.HAProxy.general.tuning.maxConnections') %}
     maxconn                     {{OPNsense.HAProxy.general.tuning.maxConnections}}
 {% endif %}