# -*- coding: utf-8 -*-
#
# Copyright (C) 2018 CERN.
#
# invenio-app-ils is free software; you can redistribute it and/or modify it
# under the terms of the MIT License; see LICENSE file for more details.

global
  chroot /usr/local/var/lib/haproxy/
  maxconn 4000
  stats socket /usr/local/var/lib/haproxy/stats level admin
  tune.ssl.default-dh-param 2048
  ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
  ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
  ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
  ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

defaults
  log global
  maxconn 3000
  mode http
  option dontlognull
  retries 2
  timeout http-request 10s
  timeout queue 2m
  timeout connect 10s
  timeout client 2m
  timeout server 2m
  timeout http-keep-alive 10s
  timeout check 10s

frontend in-http
  bind *:80
  redirect scheme https code 301 if !{ ssl_fc }

frontend in-https
  bind *:443 ssl crt /usr/local/etc/cert.pem
  acl is_static path_beg -i /static
  default_backend ssl_app
  use_backend ssl_static if is_static

frontend in-stats
  bind *:8080
  stats enable
  stats uri /
  stats hide-version

backend ssl_app
  balance leastconn
  http-check disable-on-404
  option http-server-close
  option forwardfor except 127.0.0.0/8
  option httpchk HEAD /ping HTTP/1.1\r\nHost:\ localhost
  server web1 frontend:443 check check-ssl fall 2 inter 20000 maxconn 30 rise 1 ssl verify none weight 2

backend ssl_static
  balance leastconn
  http-check disable-on-404
  option http-server-close
  option forwardfor except 127.0.0.0/8
  option httpchk HEAD /ping HTTP/1.1\r\nHost:\ localhost
  server web1 frontend:443 check check-ssl fall 2 inter 5000 maxconn 255 rise 1 ssl verify none weight 2
