Set "option forwardfor" by default for haproxy-route backends

docs/changelog.md

@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 Each revision is versioned by the date of the revision.
 
+## 2026-06-12
+
+- Added `option forwardfor` by default for `haproxy-route` backends.
+
 ## 2026-06-05
 
 - docs: Updated home page with additional information about HAProxy.

docs/release-notes/artifacts/pr0550.yaml

@@ -0,0 +1,19 @@
+version_schema: 2
+
+changes:
+  - title: Added option forwardfor by default to haproxy-route HTTP backends
+    author: Copilot
+    type: minor
+    description: >
+      Added `option forwardfor` to every HTTP backend in the
+      `haproxy_route.cfg.j2` template so HAProxy automatically set the
+      `X-Forwarded-For` header on proxied requests, allowing backend
+      applications to identify the original client IP. This restored
+      parity with the legacy configuration.
+    urls:
+      pr:
+        - https://github.com/canonical/haproxy-operator/pull/550
+      related_doc:
+      related_issue:
+    visibility: public
+    highlight: false

haproxy-operator/templates/haproxy_route.cfg.j2

@@ -80,6 +80,7 @@ peers haproxy_peers
 
 {% for backend in http_backends %}
 backend {{ backend.backend_name }}
+    option forwardfor
     balance {{ backend.load_balancing_configuration }}
 {% if backend.consistent_hashing %}
     hash-type consistent

haproxy-operator/tests/unit/test_haproxy_route_options.py

@@ -69,6 +69,7 @@ def test_protocol_https(
         " ssl ca-file /var/lib/haproxy/cas/cas.pem alpn h2,http/1.1 check-alpn h2,http/1.1\n"
         in haproxy_conf_contents
     )
+    assert "option forwardfor" in haproxy_conf_contents
     assert out.app_status == ActiveStatus("")