frostmoln_appgw_backend_pool (Resource)

Manages a backend pool on a Frostmoln Application Gateway: a set of backends sharing a protocol, a load-balancing algorithm and a health check.

Every setting below is changed in place. Only name forces a new resource — the API has no rename — and replacing a pool is refused with BACKEND_POOL_IN_USE while anything still forwards to it, so destroy the frostmoln_appgw_route or the tcp frostmoln_appgw_listener that holds it first.

Changes are authored, not live: they reach the appliance on the gateway's next configuration apply.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — gateway_id: the pool belongs to its gateway; moving it is a different pool.

Create-immutable — name: the pool's name is its identity on the gateway.

Observed, not enacted — tags_all: keys set outside Terraform — in the portal, by the fm CLI, or stamped by the platform — appear only here and are kept on every apply, never removed.

Example Usage

resource "frostmoln_appgw_backend_pool" "web" {
  gateway_id = frostmoln_application_gateway.edge.id
  name       = "web"
  protocol   = "http"
  algorithm  = "round_robin"

  # Resource tags: your own metadata for search and filtering. Merged with
  # the provider's default_tags; changing them updates in place.
  tags = {
    env = "prod"
  }
}

# Re-encrypt to the backend. tls_verify_backend is left to the platform default
# unless you have a reason: setting it to false silently disables certificate
# verification.
resource "frostmoln_appgw_backend_pool" "api" {
  gateway_id = frostmoln_application_gateway.edge.id
  name       = "api"
  protocol   = "https"

  tls_verify_backend = true
  tls_server_name    = "api.internal"
  tls_ca_certificate = file("${path.module}/internal-ca.pem")

  session_affinity    = "cookie"
  session_cookie_name = "FMSESSION"

  timeout_connect_ms  = 2000
  timeout_response_ms = 30000
}

# A pool behind a tcp listener. proxy_protocol is what lets the backend see the
# real client address: at layer 4 there is no X-Forwarded-For, so without it
# every connection appears to come from the gateway and spam scoring, rate
# limiting and abuse logging on that server are all useless.
#
# Turn the backend's own PROXY-protocol option on FIRST. A server that is not
# expecting the header reads it as the first bytes of your protocol and every
# connection fails.
#
# protocol must be "http" and session_affinity must not be "cookie": the gateway
# serves a pool in one mode, and a cookie is an HTTP header it never writes at
# layer 4.
resource "frostmoln_appgw_backend_pool" "mail" {
  gateway_id = frostmoln_application_gateway.edge.id
  name       = "mail"
  protocol   = "http"
  algorithm  = "least_connections"

  proxy_protocol = true
}

Schema

Required

• gateway_id (String) The Application Gateway this pool belongs to.
• name (String) The name of the pool.

Optional

• algorithm (String) How requests are distributed: round_robin, least_connections or source_ip.

• protocol (String) How the gateway talks to the backends: http or https. https re-encrypts traffic on the way to the backend.

• proxy_protocol (Boolean) Prepend a PROXY protocol v2 header to every connection to this pool's backends, so they see the real client address instead of the gateway's. Defaults to false.

  Worth turning on for a mail server behind a tcp listener: without it every connection appears to come from the gateway, which makes spam scoring, rate limiting and abuse logging on that server useless. There is no X-Forwarded-For equivalent at layer 4 — that is an HTTP header.

  ~> Turning this on changes the bytes the backend receives. Turn on the backend's own PROXY-protocol option FIRST — Postfix's smtpd_upstream_proxy_protocol, Dovecot's haproxy_trusted_networks, nginx's proxy_protocol on the listen line — then set this, then apply the gateway configuration. A server that is not expecting the header reads it as the first bytes of your protocol and every connection fails. Turning it off is the same change in reverse.

  ~> Restrict the port to the gateway before turning this on. A backend that accepts a PROXY header trusts whoever sends it: anything that can reach that port can then claim any source address it likes, which inverts the reason to enable this — an attacker chooses whose reputation to burn and whose rate limit to spend. Of the three options above only Dovecot's is itself a trust list; nginx needs set_real_ip_from alongside proxy_protocol, and Postfix has none, so its PROXY-enabled service must sit on a port reachable only from the gateway. Authorize the backend so the ingress rule is scoped to the gateway's security group, and do not open that port more widely.

  ~> After terraform import, set this explicitly if the pool has it on. It carries a false default, so a pool whose header is already enabled — set through the portal, the CLI or the API — plans proxy_protocol = true -> false against a configuration that omits it. That is the change described above, in the direction that breaks every connection to a backend now expecting the header. The plan says so; read it.

• session_affinity (String) Pin a client to one backend: none, cookie or source_ip.

• session_cookie_name (String) The cookie used for affinity. Required when session_affinity is cookie. Removing it from your configuration clears it on the pool.

• tags (Map of String) Resource tags on the backend pool: your own key/value metadata for search and filtering, stored by the platform only and never pushed to the appliance. Changing them updates the pool in place: no config apply, no config_generation change. At most 32 keys including the tenant's default tags, which the platform merges in at create; a key is 1-64 bytes matching ^[a-zA-Z0-9]([a-zA-Z0-9._:/-]*[a-zA-Z0-9])?$, a value at most 256 bytes; keys beginning frostmoln_ or frostmoln- (any case) are reserved. Merged with the provider's default_tags on every write (a key set here wins). Holds only the keys this configuration sets; the full set is in tags_all.

• timeout_connect_ms (Number) Connect timeout in milliseconds.

• timeout_response_ms (Number) Response timeout in milliseconds.

• tls_ca_certificate (String) PEM CA bundle used to verify backend certificates. Removing it from your configuration clears it on the pool.

• tls_server_name (String) The server name presented to the backend (SNI) and verified against its certificate. Removing it from your configuration clears it on the pool.

• tls_verify_backend (Boolean) Verify the backend's certificate on an https pool.

  Leave this unset to keep the platform default. It is deliberately not defaulted to false here: sending an explicit false for a practitioner who never mentioned it would silently disable certificate verification.

Read-Only

• created_at (String) The creation timestamp.
• id (String) The unique identifier of the backend pool.
• tags_all (Map of String) Every tag the platform holds on this resource: the provider's default_tags, this resource's own tags (which win on a shared key), and any key set outside Terraform — in the portal, by the fm CLI, or stamped by the platform. Keys set outside Terraform appear only here and are kept on every apply, never removed.
• updated_at (String) The last update timestamp.