global
  log 127.0.0.1   local0 info 
  log 127.0.0.1   local1 
  #log loghost local0 info
  maxconn 5000
  
  user haproxy
  group haproxy
  tune.ssl.default-dh-param 2048 

defaults
  log     global
  mode    http
  retries 3
  timeout check 10s
  timeout client 5m
  timeout connect 10s
  timeout http-keep-alive 1s
  timeout queue 1m
  timeout server 5m
  option dontlognull
  option http-server-close
  option httplog
  option redispatch
  balance  roundrobin

# Set up application listeners here.

listen stats
  bind 0.0.0.0:8080
  mode http
  option httpclose
  balance roundrobin
  stats refresh 10s
  stats uri /haproxy-status
  stats realm Haproxy\ Statistics


frontend http_frontend
  bind *:80
  mode http
  http-request set-header X-Forwarded-Proto http
  option forwardfor
  acl com hdr_dom(host) -i pki.theorchard.com
  acl ocsp hdr_dom(host) -i ocsp-avl.theorchard.com
  use_backend com_backend if com
  use_backend ocsp_backend if ocsp

frontend tls_frontend
  bind *:443
  mode tcp
  option tcplog
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend krb_auth_backend if { req.ssl_sni -i pki-avl-krb.theorchard.com }
  use_backend standard_auth_backend if { req.ssl_sni -i pki-avl-auth.theorchard.com }


backend com_backend
  mode http
  balance leastconn
  server prod-t0-fe10 10.10.60.245:80 check inter 3000 rise 2 fall 3
  server prod-t0-fe11 10.10.60.246:80 check inter 3000 rise 2 fall 3
  option httpchk GET /cps.txt

backend ocsp_backend
  mode http
  balance leastconn
  server prod-t0-fe10 10.10.60.245:80 check inter 3000 rise 2 fall 3
  server prod-t0-fe11 10.10.60.246:80 check inter 3000 rise 2 fall 3
  option httpchk GET /ocsp
  http-check expect status 500

backend krb_auth_backend
  mode tcp
  balance source
  option ssl-hello-chk
  server prod-t0-fe10 10.10.60.245:443 check sni req.ssl_sni
  server prod-t0-fe11 10.10.60.246:443 check sni req.ssl_sni
  option tcp-check

backend standard_auth_backend
  mode tcp
  balance source
  option ssl-hello-chk
  option tcp-check


resolvers orchard_dns
  nameserver dns1 10.10.60.26:53
  nameserver dns2 10.10.60.27:53
  resolve_retries 3
  timeout retry 1s
  hold valid 10s