global
  stats socket /var/run/api.sock user haproxy group haproxy mode 660 level admin expose-fd listeners
  log stdout format raw local0 info

defaults
  log global
  mode http
  retries 3
  timeout check 20s
  timeout client 400s
  timeout connect 20s
  timeout http-keep-alive 130s
  timeout queue 1m
  timeout server 400s
  timeout http-request 240s
  option  dontlognull
  option  http-server-close
  option  httplog
  option  redispatch
  balance roundrobin

{% if SETUP_ENV == 'local' -%}

frontend stats
  bind *:8404
  stats enable
  stats uri /
  stats refresh 10s
{% endif %}

frontend myfrontend
  log global
{% if SETUP_ENV == 'local' %}
  bind :80
  bind :443 ssl crt /usr/local/etc/haproxy/wildcard.127.0.0.1.nip.io.pem ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
  http-request redirect scheme https unless { ssl_fc }
{% else %}
  bind :80
{% endif %}
  mode http
  option httplog
  http-request add-header X-Forwarded-Proto http
  monitor-uri /hello/
  
  acl grass_api path_beg -i /api/
  acl grass_proxy path_beg -i /grass/
  acl php_oa hdr_dom(host) -i {{ VHOST_SERVER_NAME_OA }}
  acl php_alw hdr_dom(host) -i {{ VHOST_SERVER_NAME_WS }}
  acl php_vapi hdr_dom(host) -i {{ VHOST_SERVER_NAME_VAPI }}
  
  acl xls_paths path_end -i .xls
  acl xlsx_paths path_end -i .xlsx
  acl csv_paths path_end -i .csv

  use_backend alw_backend if xls_paths php_alw !grass_proxy !grass_api
  use_backend alw_backend if xlsx_paths php_alw !grass_proxy !grass_api
  use_backend alw_backend if csv_paths php_alw !grass_proxy !grass_api

  use_backend %[base,lower,map_reg(/usr/local/etc/haproxy/haproxy_map.map,spa_backend)] if php_alw !grass_proxy !grass_api

  use_backend oa_backend if php_oa !grass_proxy !grass_api
  use_backend vapi_backend if php_vapi !grass_proxy !grass_api
  use_backend spa_backend if php_alw !grass_proxy !grass_api

  use_backend grass_backend if grass_proxy
  use_backend api_grass_backend if grass_api

  acl authorized http_auth(AuthUsers)
  default_backend no-match

backend oa_backend
  balance leastconn
  http-response set-header X-Frame-Options SAMEORIGIN
  http-response set-header X-XSS-Protection 1;mode=block
  http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains
  http-response set-header Content-Security-Policy:script-src self
  http-response set-header X-Content-Type-Options nosniff
  http-response set-header Referrer-Policy no-referrer-when-downgrade
  server s1 oa:80 maxconn 256 check inter 3000 rise 2 fall 3

backend alw_backend
  balance leastconn
  http-response set-header X-Frame-Options SAMEORIGIN
  http-response set-header X-XSS-Protection 1;mode=block
  http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains
  http-response set-header Content-Security-Policy:script-src self
  http-response set-header X-Content-Type-Options nosniff
  http-response set-header Referrer-Policy no-referrer-when-downgrade
  server s2 workstation:80 maxconn 256 check inter 3000 rise 2 fall 3

backend vapi_backend
  server s3 api:80 check

backend grass_backend
  http-request replace-path /grass/(.*) /\1
  server grass01 qa-ows-grass.theorchard.io:443 ssl verify none check

backend api_grass_backend
  http-request replace-path /api/(.*) /\1
  server grass01 qa-ows-grass.theorchard.io:443 ssl verify none check

backend spa_backend_others
  http-request replace-path /(.*) /\1
  server cdn01 frontend:80 check

backend spa_backend
  http-request replace-path /(.*) /index.html
  server cdn02 frontend:80 check
  
backend no-match
  mode http
  http-request deny deny_status 400

userlist AuthUsers
  user release_editor password $6$2CMLVHSM85c$5jS6iLkFY76at8mpEJcDN4pmqPFpXLX9ex1P4BMOA8TN3bp6nAUieFO/e/L0KGs4tG5j39sVN.87ZVqlPP1qx1