fix(haproxy): silence the ACL pattern warning on wp_admin_asset #6
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: cloud-hosting-platform/haproxy-manager-base#6
Reference in New Issue
Block a user
What
Adds HAProxy's
--end-of-flags marker to thewp_admin_assetACL, silencing awarning introduced in 2026.08.5.
Why
HAProxy warns on any pattern whose first character is
(, because it cannot tellan intended regex from a fetch-argument list with a stray space in it:
--is the remedy the warning itself names. This is cosmetic to matching but notto operations: unsilenced it fires on every config load and every reload on
every host, which trains people to skim past warnings and gives a real one
somewhere to hide.
wp_admin_pathneeds no--only because its-iflag already occupies the flagslot. It is not otherwise special.
Matching semantics are unchanged — verified, not assumed
The risk worth ruling out: if HAProxy had adopted
--as the pattern ratherthan consuming it as end-of-flags, the ACL would have matched paths containing
--and stopped matching css/js — gating every login page's own stylesheetsand password-strength meter while the page itself still returned 200. That is the
silent regression this ACL exists to avoid.
Both forms were run side by side as two frontends under real HAProxy
3.0.11-1+deb13u3and returned identical verdicts on all 8 vectors:----/wp-admin/css/login.min.css/wp-admin/js/user-profile.min.js/wp-admin/images/x.png/wp-admin/css/sub/deep.css/blog/wp-admin/css/a.css/wp-admin/css/x.php/wp-admin/plugins.php/some--path/file.cssThe last row is the one that matters — it is the control that proves
--wasconsumed as end-of-flags and not adopted as the pattern.
Confirmed in a built image that the warning is gone, with
haproxy -cstillexit 0 and only the pre-existing
Can't load stats filenotice remaining.Tests
test_wp_admin_asset_pattern_is_end_of_flags_guardedasserts both the--and the pattern it guards, so it cannot pass by the pattern having been
changed. Verified to fail when the
--is removed.config-rollback 26, cert-write-safety 22, cert-scripts 38.
haproxy -cgate passed during build.Version
Bumps
VERSIONto2026.08.6. This is required, not housekeeping: CI tags:latestand:<version>from theVERSIONfile, so merging without a bumpwould rebuild and overwrite the existing
2026.08.5tag with different content —while hosts are currently running that exact tag.
Deployment note
2026.08.5is deployed on test.148 and whp02 and is mid-rollout. Merging moves:latest, so anycontainer-manager.sh recreatewill pick this up. Rolloutorder remains test.148 → whp02 → sdbees → whp01.
HAProxy warns on any pattern whose first character is "(", because it cannot distinguish an intended regex from a fetch-argument list with a stray space: parsing acl 'wp_admin_asset' : matching 'path_reg' for pattern '(^|/)wp-admin/...' is likely a mistake and probably not what you want. "--" is HAProxy's documented end-of-flags marker and is the remedy the warning itself names. Cosmetic to matching, but not to operations: left unsilenced it fires on every config load and every reload on every host, which trains operators to skim past warnings and gives a real one somewhere to hide. Matching semantics are unchanged, verified rather than assumed. Both forms were run side by side as two frontends under real HAProxy 3.0.11-1+deb13u3 and gave identical verdicts on all 8 vectors: /wp-admin/css/login.min.css MATCH / MATCH /wp-admin/js/user-profile.min.js MATCH / MATCH /wp-admin/images/x.png MATCH / MATCH /wp-admin/css/sub/deep.css MATCH / MATCH /blog/wp-admin/css/a.css MATCH / MATCH /wp-admin/css/x.php NOMATCH / NOMATCH /wp-admin/plugins.php NOMATCH / NOMATCH /some--path/file.css NOMATCH / NOMATCH The last vector is the one that matters: it proves HAProxy consumed "--" as end-of-flags rather than adopting it as the pattern. Had it done the latter, the ACL would have matched paths containing "--" and stopped matching css/js -- gating every login page's own stylesheets while the page itself still returned 200. wp_admin_path needs no "--" only because its "-i" flag already occupies the flag slot; it is not otherwise special. Adds a regression test asserting both the "--" and the pattern it guards, so this cannot pass by the pattern having been changed. Verified to fail when the "--" is removed.