global
  log stdout format raw daemon debug
  chroot /var/lib/haproxy
  maxconn 5000
  user haproxy
  group haproxy
  daemon
  tune.ssl.default-dh-param 2048

  # Default SSL material locations
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private

defaults
  log     global
  mode    http
  retries 3
  timeout check 10s
  timeout client 200s
  timeout connect 10s
  timeout http-keep-alive 65s
  timeout queue 1m
  timeout server 200s
  option  dontlognull
  option  http-server-close
  option  httplog
  option  redispatch
  balance roundrobin

listen stats
  bind *:8888
  mode http
  option httpclose
  stats refresh 10s
  stats uri /haproxy-status
  stats realm Haproxy\ Statistics

frontend web_frontend
  log global
  bind *:8080
  mode http
  option httplog
  http-request add-header X-Forwarded-Proto http
  acl grass_api path_beg -i /api
  acl grass_proxy path_beg -i /grass/
  acl php_app_workstation hdr_dom(host) -i workstation.theorchard.com
  use_backend api_grass_backend if grass_api php_app_workstation
  use_backend grass_backend if grass_proxy php_app_workstation
  use_backend workstation_backend if php_app_workstation !grass_api
  use_backend workstation_backend if php_app_workstation !grass_proxy
  acl authorized http_auth(AuthUsers)
  default_backend workstation_backend

backend workstation_backend
  balance leastconn
  http-response set-header X-Frame-Options SAMEORIGIN
  http-response set-header X-XSS-Protection 1;mode=block
  http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains
  http-response set-header Content-Security-Policy:script-src self
  http-response set-header X-Content-Type-Options nosniff
  http-response set-header Referrer-Policy no-referrer-when-downgrade
  server workstation01 127.0.0.1:80 maxconn 256 check inter 3000 rise 2 fall 3 resolvers dns_servers
  option httpchk GET /healthchk.php

backend api_grass_backend
  http-request replace-path /api/(.*) /\1
  server grass01 api.theorchard.io:443 ssl verify none check resolvers dns_servers

backend grass_backend
  http-request replace-path /grass/(.*) /\1
  server grass01 api.theorchard.io:443 ssl verify none check resolvers dns_servers

resolvers dns_servers
  nameserver dns1 DNS_PLACEHOLDER:53
  resolve_retries 3
  timeout retry 1s
  hold valid 10s

userlist AuthUsers
  user release_editor password $6$2CMLVHSM85c$5jS6iLkFY76at8mpEJcDN4pmqPFpXLX9ex1P4BMOA8TN3bp6nAUieFO/e/L0KGs4tG5j39sVN.87ZVqlPP1qx1