From af0ddb9f3643b245defeee77bad728be4dff3c93 Mon Sep 17 00:00:00 2001
From: 12ww1160 <12ww1160@confdroid.com>
Date: Sat, 5 Sep 2026 12:56:23 +0200
Subject: [PATCH] OP#669 add fw rule for stats port

---
 manifests/firewall/iptables.pp | 8 ++++++++
 manifests/params.pp            | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/manifests/firewall/iptables.pp b/manifests/firewall/iptables.pp
index 682689f..2ad0553 100644
--- a/manifests/firewall/iptables.pp
+++ b/manifests/firewall/iptables.pp
@@ -18,5 +18,13 @@ class confdroid_haproxy::firewall::iptables (
       dport => $hy_https_port,
       jump  => 'accept',
     }
+
+    if $hy_show_stats == true {
+      firewall { "${hy_fw_order_no}${hy_stats_port} tcp port ${hy_stats_port}":
+        proto => 'tcp',
+        dport => $hy_stats_port,
+        jump  => 'accept',
+      }
+    }
   }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index deb58c6..f77bde4 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -55,6 +55,7 @@
 # @param [String] hy_be_userlist backend userlist comment
 # @param [Boolean] hy_manage_be_users  whether to manage backend users
 # @param [Boolean] hy_selinux_allow_stats whether to allow stats in selinux
+# @param [String] hy_stats_port the port to use for stats. used in firewall settings
 ###############################################################################
 class confdroid_haproxy::params (
 
@@ -76,6 +77,7 @@ class confdroid_haproxy::params (
 # main config
   String $hy_http_port                = '80',
   String $hy_https_port               = '443',
+  String $hy_stats_port               = '8404',
   String $hy_chroot                   = '/var/lib/haproxy',
   String $hy_pid                      = '/var/run/haproxy.pid',
   String $hy_maxconn                  = '4000',