global
        default-path config
        zero-warning
        daemon
        hard-stop-after 5m
        stats timeout 1h
        log stderr local0 info

        # intermediate security for SSL, from https://ssl-config.mozilla.org/
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

defaults http
        mode http
        option httplog
        log global
        timeout client 1m
        timeout server 1m
        timeout connect 10s
        timeout http-keep-alive 2m
        timeout queue 15s
        timeout tunnel 4h


#---------------------------------------------------------------------
##### FRONTENDS
#---------------------------------------------------------------------
frontend stats
        mode http
        bind :444  ssl crt certs/{{ ssl_combined_pem }}
        stats enable
        stats realm Haproxy\ Statistics
        stats refresh 10s
        stats admin if TRUE
        stats uri /
        stats show-modules

frontend EXT-WEB:80
    bind :80  name clear
    mode http
    log global

    # Redirections to Let's Encrypt local agent
    acl ispath_letsencrypt                     path_beg /.well-known/acme-challenge/

    # Redirect HTTP -> HTTPS (except let's encrypt)
    redirect code 301 scheme https if !{ ssl_fc }  !ispath_letsencrypt
    use_backend letsencrypt_80     if ispath_letsencrypt


frontend EXT-WEB:443
    mode http
    bind :443 name secure ssl crt certs/{{ ssl_combined_pem }}
    option socket-stats
    option forwardfor except 127.0.0.1
    option http-ignore-probes

    http-after-response set-header Strict-Transport-Security "max-age=31536000"
    http-request capture req.hdr(Host) len 30
    http-request redirect scheme https code 301 if !{ ssl_fc }
    http-request del-header x-forwarded-for
    http-request  cache-use cache
    http-response cache-store cache

    redirect code 301 scheme https if !{ ssl_fc }

    compression algo deflate gzip
    compression type text/html text/plain text/css application/octet-stream application/amf application/x-amf application/javascript application/xhtml+xml image/x-icon

    timeout client 25s


    # Define ACL Macros for conditional actions (HOSTS)
    acl ishost_core.pkg.startcloud.com           hdr(host) -i core.pkg.startcloud.com
    acl ishost_extra.pkg.startcloud.com          hdr(host) -i extra.pkg.startcloud.com
    acl ishost_public.pkg.startcloud.com         hdr(host) -i public.pkg.startcloud.com
    acl ishost_private.pkg.startcloud.com        hdr(host) -i private.pkg.startcloud.com

    # Direct traffic to appropriate backend
    use_backend pkg-core                       if ishost_core.pkg.startcloud.com
    use_backend pkg-extra                      if ishost_extra.pkg.startcloud.com
    use_backend pkg-public                     if ishost_public.pkg.startcloud.com
    use_backend pkg-private                    if ishost_private.pkg.startcloud.com


cache cache
        total-max-size 200        # RAM cache size in megabytes
        max-object-size 10485760  # max cacheable object size in bytes
        max-age 3600              # max cache duration in seconds
        process-vary on           # handle the Vary header (otherwise don't cache)


#---------------------------------------------------------------------
##### BACKENDS
#---------------------------------------------------------------------
backend letsencrypt_80
    mode http
    log global
    http-response set-header Server haproxy
    server localhost:8080 127.0.0.1:8080

# pkg-core
backend pkg-core
        balance leastconn
        option abortonclose
        cookie app1 insert indirect nocache
        option httpchk
        server pkg-core 127.0.0.1:81 cookie s1 maxconn 100 check inter 1s

# pkg-extra
backend pkg-extra
        balance leastconn
        option abortonclose
        cookie app1 insert indirect nocache
        option httpchk
        server pkg-extra 127.0.0.1:82 cookie s2 maxconn 100 check inter 1s

# pkg-public
backend pkg-public
        balance leastconn
        option abortonclose
        cookie app1 insert indirect nocache
        option httpchk
        server pkg-public 127.0.0.1:83 cookie s3 maxconn 100 check inter 1s


# pkg-private
backend pkg-private
        balance leastconn
        option abortonclose
        cookie app1 insert indirect nocache
        option httpchk
        server pkg-private 127.0.0.1:84 cookie s4 maxconn 100 check inter 1s

