global
  log 127.0.0.1   local0 info 
  log 127.0.0.1   local1 
  #log loghost local0 info
  maxconn 5000
  
  user haproxy
  group haproxy
  tune.ssl.default-dh-param 2048 

defaults
  log     global
  mode    http
  retries 3
  timeout check 10s
  timeout client 5m
  timeout connect 10s
  timeout http-keep-alive 1s
  timeout queue 1m
  timeout server 5m
  option dontlognull
  option http-server-close
  option httplog
  option redispatch
  balance  roundrobin

# Set up application listeners here.

listen stats
  bind 0.0.0.0:8080
  mode http
  option httpclose
  balance roundrobin
  stats refresh 10s
  stats uri /haproxy-status
  stats realm Haproxy\ Statistics


frontend web_frontend
  bind *:80
  mode http
  http-request set-header X-Forwarded-Proto http
  bind *:443 ssl crt /etc/haproxy/theorchard2048.com.pem crt /etc/haproxy/star.qaorch.com.pem ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
  mode http
  option httpclose
  option forwardfor
  timeout client 30m
  http-request set-header X-Forwarded-Proto https
  acl php_app_bacon hdr_dom(host) -i bacon.theorchard.com
  acl php_app_qa_bacon hdr_dom(host) -i bacon.qaorch.com
  acl php_app_rb hdr_dom(host) -i rb.qaorch.com
  acl qa_assets hdr_dom(host) -i assets.qaorch.com
  acl qa_wowza hdr_dom(host) -i wowza.qaorch.com
  acl qa_wowza_rest_api hdr_dom(host) -i wowza-rest-api.qaorch.com
  use_backend bacon_backend if php_app_bacon
  use_backend qa_bacon_backend if php_app_qa_bacon
  use_backend rb_backend if php_app_rb
  use_backend qa_assets_backend if qa_assets
  use_backend qa_wowza_backend if qa_wowza
  use_backend qa_wowza_rest_api_backend if qa_wowza_rest_api


backend bacon_backend
  redirect scheme https code 301 if !{ ssl_fc }
  balance leastconn
  server prod-bacon01 10.160.0.182:80 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  option httpchk GET /healthchk.html HTTP/1.0\r\nAuthorization:\ Basic\ aGFwcm94eTpJaHRxRmFKNmVOdV5uXlJsM2JoZjFKSXhHMDY=

backend qa_bacon_backend
  redirect scheme https code 301 if !{ ssl_fc }
  balance leastconn
  server qa-bacon01 10.160.0.219:80 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  option httpchk GET /healthchk.html HTTP/1.0\r\nAuthorization:\ Basic\ aGFwcm94eTpJaHRxRmFKNmVOdV5uXlJsM2JoZjFKSXhHMDY=

backend rb_backend
  balance leastconn
  server qa-rbenc01 192.168.31.54:80 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  option httpchk GET /

backend qa_assets_backend
  redirect scheme https code 301 if !{ ssl_fc }
  server qa-bulkupload01 10.40.1.157:80 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  server qa-bulkupload02 10.40.1.158:80 maxconn 256 cookie 2 check inter 3000 rise 2 fall 3 backup
  option httpchk GET /healthchk.php

backend qa_wowza_backend
  redirect scheme https code 301 if !{ ssl_fc }
  balance source
  stick store-request src
  stick-table type ip size 200k expire 20m
  stick on src
  server qa-wowza01 10.40.1.127:1935 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  server qa-wowza02 10.40.1.137:1935 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  option httpchk GET /

backend qa_wowza_rest_api_backend
  redirect scheme https code 301 if !{ ssl_fc }
  balance leastconn
  http-check expect status 401
  server qa-wowza01 10.40.1.127:8087 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  server qa-wowza02 10.40.1.137:8087 maxconn 256 check inter 3000 rise 2 fall 3 resolvers orchard_dns
  option httpchk GET /


resolvers orchard_dns
  nameserver dns1 10.160.0.26:53
  nameserver dns2 10.160.0.27:53
  resolve_retries 3
  timeout retry 1s
  hold valid 10s