Enable PROXY protocol for specific CIDRs in HAProxy

jobs/haproxy/spec

@@ -553,6 +553,9 @@ properties:
   ha_proxy.accept_proxy:
     description: "Turned off by default. Enforces the use of the PROXY protocol for all incoming connections to all frontends, with the exception of local requests to the health check endpoint, since Monit does not support PROXY protocol. When enabled, standard TCP connections to these ports no longer work."
     default: false
+  ha_proxy.expect_proxy:
+    description: "Turned off by default. Enables proxy protocol for the specified IP CIDR ranges. Only applies if `ha_proxy.accept_proxy` is disabled."
+    default: false
   ha_proxy.disable_tcp_accept_proxy:
     description: "Disables the PROXY protocol on tcp backends. Only applies if `ha_proxy.accept_proxy` is enabled."
     default: false

jobs/haproxy/templates/haproxy.config.erb

@@ -169,6 +169,9 @@ end
 # }}}
 
 # Error checking
+  if !p("ha_proxy.accept_proxy", true) && p("ha_proxy.expect_proxy", true)
+    abort "Conflicting configuration: accept_proxy and expect_proxy are mutually exclusive"
+  end
   if !p("ha_proxy.drain_enable", false) && p("ha_proxy.drain_frontend_grace_time") > 0
     abort "Conflicting configuration: drain_enable must be true to use drain_frontend_grace_time"
   end
@@ -366,6 +369,10 @@ listen health_check_http_url
     monitor fail if http-routers_down
 <% end -%>
 
+<% if p("ha_proxy.expect_proxy") -%>
+    tcp-request connection expect-proxy layer4 if { src -f /var/vcap/jobs/haproxy/config/proxies_cidrs.txt }
+<%- end -%>
+
 <% if_p("ha_proxy.resolvers") do |resolvers| -%>
 resolvers default
     hold valid <%= p("ha_proxy.dns_hold") %>