global
        pidfile                 /var/run/haproxy.pid
        #chroot                 /var/lib/haproxy
        user                    haproxy
        group                   haproxy

        # Makes the process fork into background
        daemon

        ## Logging stdout/stderr because we are in docker
        log                     stdout format raw local0 debug

        ## Tuning
        tune.bufsize            64768
        maxconn                 500000

        ## Enable Authelia Redirects
        ##lua-prepend-path        /etc/haproxy/?/http.lua
        ##lua-load                /etc/haproxy/haproxy-lua-http/auth-request.lua

        ## Stats
        stats socket /var/lib/haproxy/stats level admin mode 660 group haproxy expose-fd listeners
        stats timeout 30s

        ## Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        ## SSL/TLS Cipher Suites
        tune.ssl.default-dh-param 4096
        ## See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM->
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

#### DEFAULTS ####
defaults
        default-server              init-addr none
        log                         global
        mode                        http
        retries                     3
        timeout http-request        60s
        timeout queue               1m
        timeout connect             30s
        timeout client              1m
        timeout server              1m
        timeout http-keep-alive     30s
        timeout check               10s
        timeout client-fin          30s
        maxconn                     500000
        option                      http-keep-alive
        option                      forwardfor
        option                      http-server-close
        option                      dontlognull
        option                      httplog
        option                      redispatch
        option                      tcpka
        http-error status 503 content-type "text/html; charset=utf-8"    lf-file /etc/haproxy/errors/html/503.html

http-errors allerrors
        errorfile 404 /etc/haproxy/errors/tpl/404.http
        errorfile 400 /etc/haproxy/errors/tpl/400.http
        errorfile 403 /etc/haproxy/errors/tpl/403.http
        errorfile 408 /etc/haproxy/errors/tpl/408.http
        errorfile 502 /etc/haproxy/errors/tpl/502.http
        errorfile 504 /etc/haproxy/errors/tpl/504.http

#        errorfile 500 /etc/haproxy/errors/tpl/500.http
#        errorfile 503 /etc/haproxy/errors/tpl/503.http

#---------------------------------------------------------------------
##### FRONTENDs: WEB/HTTP/HTTPS
#---------------------------------------------------------------------

## HAProxy stats web gui.
frontend  STATS
        mode http
        {% if selfsigned_enabled %}
        bind :::{{ startcloud_haproxy_port_forwards[2].guest }} ssl crt {{ cert_dir }}/combined/{{ settings.hostname }}.{{ settings.domain }}-self-signed.pem
        {% else %}
        bind :::{{ startcloud_haproxy_port_forwards[2].guest }} ssl crt {{ cert_dir }}/combined/default-signed.pem
        {% endif %}
        stats enable
        stats uri /
        stats admin if TRUE
        http-request use-service prometheus-exporter if { path /metrics }

frontend EXT-WEB:{{ startcloud_haproxy_port_forwards[0].guest}}
        bind :::{{ startcloud_haproxy_port_forwards[0].guest}}
        mode http
        log global

        # Redirections to Let's Encrypt local agent
        acl ispath_letsencrypt                  path_beg /.well-known/acme-challenge/

        # Redirect HTTP -> HTTPS (except let's encrypt)
        redirect  code 301 scheme https if !{ ssl_fc }   !ispath_letsencrypt
        use_backend     letsencrypt_80          if      ispath_letsencrypt

frontend  HTTPS-IN
        ## Primary Ingress point
        {% if selfsigned_enabled %}
        bind :::{{ startcloud_haproxy_port_forwards[1].guest}} v4v6 ssl crt  {{ cert_dir }}/combined/{{ settings.hostname }}.{{ settings.domain }}-self-signed.pem
        {% else %}
        bind :::{{ startcloud_haproxy_port_forwards[1].guest}} v4v6 ssl crt  {{ cert_dir }}/combined/default-signed.pem
        {% endif %}

        mode http
        {% if haproxy_ssl_redirect %}
        http-request redirect scheme https unless { ssl_fc }
        {% endif %}

        ## Dynamic Logging to Error Page

        errorfiles allerrors

        unique-id-format %{+X}o\ %ci:%cp_%fi:%fp_%Ts_%rt:%pid
        unique-id-header X-Unique-ID

        log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r %[unique-id]"


        #BEGIN CORS
        http-response set-header Access-Control-Allow-Origin "*"
        http-response set-header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId"
        http-response set-header Access-Control-Max-Age 3628800
        http-response set-header Access-Control-Allow-Methods "*"
        # END CORS


        #### ACL's  ####
        ## Source ACL Definitions
        #acl network_allowed             src          10.0.2.0/16 192.168.0.0/16 172.16.0.0/16


        ## Host ACL Definitions
        acl host_demo                 hdr(host)          -i {{ settings.hostname }}.{{ settings.domain }}

        acl host_console              hdr(host)          -i console.{{ settings.hostname }}.{{ settings.domain }}

        {% if domino_vagrant_rest_api_proxy_url is defined %}
        acl host_restapi              hdr(host)          -i {{ domino_vagrant_rest_api_proxy_url }}
        {% endif %}

        {% if domino_nomadweb_proxy_url is defined %}
        acl host_nomadweb             hdr(host)          -i {{  domino_nomadweb_proxy_url }}
        {% endif %}

        {% if domino_install_proxy_url is defined %}
        acl host_domino               hdr(host)          -i {{ domino_install_proxy_url }}
        {% endif %}

        {% if startcloud_quick_start_proxy_url is defined %}
        acl host_downloads            hdr(host)          -i {{ startcloud_quick_start_proxy_url }}
        {% endif %}

        {% if domino_leap_proxy_url is defined %}
        acl host_leap                 hdr(host)          -i {{ domino_leap_proxy_url }}
        {% endif %}

        {% if domino_traveler_proxy_url is defined %}
        acl host_traveler             hdr(host)          -i {{ domino_traveler_proxy_url }}
        {% endif %}

        {% if domino_sametime_proxy_url is defined %}
        acl host_sametime            hdr(host)          -i {{ domino_sametime_proxy_url }}
        {% endif %}

        {% if startcloud_guacamole_proxy_url is defined %}
        acl host_guacamole            hdr(host)          -i {{ startcloud_guacamole_proxy_url }}
        {% endif %}

        {% if domino_verse_proxy_url is defined %}
        acl host_verse                hdr(host)          -i {{ domino_verse_proxy_url }}
        {% endif %}

        {% if voltmx_port_forwards[0].url is defined %}
        acl host_voltmx                 hdr(host) -i             {{ voltmx_port_forwards[0].url }}.{{ settings.hostname }}.{{ settings.domain }}
        {% endif %}



        ## Application backends

        use_backend                     console              if host_console
        {% if domino_vagrant_rest_api_proxy_url is defined %}
        use_backend                     restapi              if host_restapi
        {% endif %}

        {% if domino_nomadweb_proxy_url is defined %}
        use_backend                     nomadweb             if host_nomadweb
        {% endif %}

        {% if domino_install_proxy_url is defined %}
        use_backend                     domino               if host_domino
        default_backend                 downloads
        {% endif %}

        {% if startcloud_quick_start_proxy_url is defined %}
        use_backend                     downloads            if host_downloads || host_demo
        {% endif %}

        {% if domino_leap_proxy_url is defined %}
        use_backend                     leap                 if host_leap
        {% endif %}

        {% if domino_traveler_proxy_url is defined %}
        use_backend                     traveler             if host_traveler
        {% endif %}

        {% if domino_sametime_proxy_url is defined %}
        use_backend                     sametime            if host_sametime
        {% endif %}

        {% if startcloud_guacamole_proxy_url is defined %}
        use_backend                     guacamole            if host_guacamole
        {% endif %}

        {% if domino_verse_proxy_url is defined %}
        use_backend                     verse                if host_verse
        {% endif %}

        {% if voltmx_port_forwards[0].url is defined %}
        use_backend                     voltmx                if host_voltmx
        default_backend                 voltmx
        {% endif %}


#---------------------------------------------------------------------
##### BACKENDS ####
#---------------------------------------------------------------------

## Let's Encrypt Cert-bot Tool
backend letsencrypt_80
        mode http
        log global
        http-response set-header Server haproxy
        server  letsencrypt             127.0.0.1:8080

# Console
backend console
        mode    http
        balance leastconn
        server  cockpit                 127.0.0.1:9090                                          ssl verify none  check cookie app1 init-addr last,libc,none

{% if domino_vagrant_rest_api_port_forwards[0].guest is defined %}
# Rest API
backend restapi
        mode    http
        balance leastconn
        server  restapi                 127.0.0.1:{{ domino_vagrant_rest_api_port_forwards[0].guest }}                         check cookie app1 init-addr last,libc,none
{% endif %}

{% if startcloud_quick_start_port_forwards[0].guest is defined %}
# Downloads
backend downloads
        mode    http
        balance leastconn
        server  downloads               127.0.0.1:{{ startcloud_quick_start_port_forwards[0].guest }}           ssl verify none check cookie app1 init-addr last,libc,none
{% endif %}

{% if domino_install_port_forwards[0].guest is defined %}
# Domino
backend domino
        mode    http
        balance leastconn
        server  domino-https            127.0.0.1:{{ domino_install_port_forwards[0].guest }}                        ssl verify none  check cookie app1 init-addr last,libc,none
{% if domino_install_port_forwards[1].guest is defined %}
        server  domino-http             127.0.0.1:{{ domino_install_port_forwards[1].guest }}                        backup check cookie app1 init-addr last,libc,none
{% endif %}
{% endif %}

{% if domino_nomadweb_port_forwards[0].guest is defined %}
# Nomad Web
backend nomadweb
        mode    http
        balance leastconn
        server  nomadweb                127.0.0.1:{{ domino_nomadweb_port_forwards[0].guest }}                           ssl verify none  check cookie app1 init-addr last,libc,none
{% endif %}


{% if domino_traveler_port_forwards[0].guest is defined %}
# Traveler
backend traveler
        mode    http
        balance leastconn
        server  domino-https            127.0.0.1:{{ domino_traveler_port_forwards[0].guest }}                       ssl verify none  check cookie app1 init-addr last,libc,none
{% if domino_traveler_port_forwards[1].guest is defined %}
        server  domino-http             127.0.0.1:{{ domino_traveler_port_forwards[1].guest }}                        backup check cookie app1 init-addr last,libc,none
{% endif %}
{% endif %}

{% if domino_leap_port_forwards[0].guest is defined %}
# Leap
backend leap
        mode    http
        balance leastconn
        server  domino-https            127.0.0.1:{{ domino_leap_port_forwards[0].guest }}                       ssl verify none  check cookie app1 init-addr last,libc,none
{% if domino_leap_port_forwards[1].guest is defined %}
        server  domino-http             127.0.0.1:{{ domino_leap_port_forwards[1].guest }}                        backup check cookie app1 init-addr last,libc,none
{% endif %}
{% endif %}

{% if startcloud_guacamole_port_forwards[0].guest is defined %}
# Guacamole
backend guacamole
        mode    http
        balance leastconn
        server  guacamole            127.0.0.1:{{ startcloud_guacamole_port_forwards[0].guest }}                      ssl verify none check cookie app1 init-addr last,libc,none
{% endif %}

{% if domino_verse_port_forwards[0].guest is defined %}
# Verse
backend verse
        mode    http
        balance leastconn
        server  domino-https            127.0.0.1:{{ domino_verse_port_forwards[0].guest }}                       ssl verify none  check cookie app1 init-addr last,libc,none
{% if domino_verse_port_forwards[1].guest is defined %}
        server  domino-http             127.0.0.1:{{ domino_verse_port_forwards[1].guest }}                        backup check cookie app1 init-addr last,libc,none
{% endif %}
{% endif %}

{% if domino_sametime_port_forwards[0].guest is defined %}
# Sametime
backend sametime
        mode    http
        balance leastconn
        server  domino-https            127.0.0.1:{{ domino_sametime_port_forwards[0].guest }}                       ssl verify none  check cookie app1 init-addr last,libc,none
{% if domino_sametime_port_forwards[1].guest is defined %}
        server  domino-http             127.0.0.1:{{ domino_sametime_port_forwards[0].guest }}                        backup check cookie app1 init-addr last,libc,none
{% endif %}
{% endif %}

{% if voltmx_port_forwards[0].guest is defined %}
# Voltmx
backend voltmx
        mode    http
        balance roundrobin  
        option forwardfor
        http-request set-header X-Forwarded-Port %[dst_port]  
        http-request add-header X-Forwarded-Proto https
{% if voltmx_port_forwards[1].guest is defined %}
        server  voltmx-https          127.0.0.1:{{ voltmx_port_forwards[1].guest }}           ssl verify none check cookie app1 init-addr last,libc,none
        server  voltmx-http           127.0.0.1:{{ voltmx_port_forwards[0].guest }}           backup check cookie web1 init-addr last,libc,none
{% else %}
        server  voltmx-http           127.0.0.1:{{ voltmx_port_forwards[0].guest }}           check cookie web1 init-addr last,libc,none
{% endif %}
{% endif %}
