Module proxy_protocol 

Inbound PROXY protocol, versions 1 (text) and 2 (binary), as HAProxy, AWS NLB, GCP and most L4 load balancers send it: the client’s address, prepended to the connection. With proxy_protocol = true (RWS_CONFIG_PROXY_PROTOCOL) every connection to the main listener must start with one — before the TLS handshake on HTTPS — and its source address becomes the client address rws logs, rate-limits and forwards in X-Forwarded-For. A connection without a valid header is closed.

The header is read exactly, byte for byte where needed, so what follows it (a TLS ClientHello, an HTTP request) is untouched. LOCAL (v2) and UNKNOWN (v1) headers — a load balancer’s own health checks — keep the peer address. TLVs (v2) are skipped.

Enums

Parsed

What the bytes read so far say.

Constants

V1_MAX

Longest version 1 header, \r\n included (the spec’s limit).

V2_MAX

Largest version 2 header accepted: 16 bytes plus addresses and TLVs.

V2_SIGNATURE

The 12-byte version 2 signature.

Functions

enabled

Whether the main listener expects PROXY protocol headers. Read once from RWS_CONFIG_PROXY_PROTOCOL (default false); a change needs a restart.

parse

Parse the start of a connection. Never asks for more than V1_MAX or V2_MAX bytes, and for version 1 only one byte at a time past the first 12, so a reader following it never consumes what comes after the header.

read_async

Read and parse the header at the start of stream (async builds). Ok(None): a valid header without an address; keep the peer’s.

read_blocking

read_async for the blocking HTTP/1.1 server.