Configure use of Proxy-Protocol seperately for HTTP/HTTPS inbound traffic

[FelixDobler]

Wanted Feature

I would like to enable proxy-protocol for the incoming HTTPS connections but keep it disabled for HTTP.

Use Case

I have another nginx instance in front of the Ingress-Nginx that acts as a reverse proxy for HTTP and HTTPS traffic.
The routing for HTTPS is done using SNI inside a stream block and the traffic forwarded using proxy-protocol.
For HTTP the Host Header of the request needs to be inspected to determine the correct backend. For that, the http block is used, which doesn't allow forwarding using proxy-protocol. Instead the usual Headers can be used to preserve the original client IP-Address.

Change required?

I'm not entirely familiar with the templating system used for the nginx config in the nginx template and therefore am not sure if this behavior could be achieved there.
Otherwise, adjustment in the buildHTTP(S)Listener would be required.

Additionally the real-ip-header would need to be separately configured for the HTTP and HTTPS listener.

Feasibility

Nginx allows for enabling proxy_protocol per listen directive, so it is viable from the underlying nginx software.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[longwuyuan]

I had assumed that the proxy-protocol headers are set for the entire connection and can not be optionally set for HTTP or HTTPS. I am not a developer though.

The project does not have resources as all resources are occupied with security, stability and implementation of the Gateway-API. Hence I would not expect any traction on this.

Wait for other comments.

[strongjz]

/assign @Gacko

[github-actions]

This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach #ingress-nginx-dev on Kubernetes Slack.