global
  log stdout format raw daemon debug
  chroot /var/lib/haproxy
  maxconn 5000
  user haproxy
  group haproxy
  daemon
  tune.ssl.default-dh-param 2048

  # Default SSL material locations
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private

defaults
  log     global
  mode    http
  retries 3
  timeout check 10s
  timeout client 200s
  timeout connect 10s
  timeout http-keep-alive 65s
  timeout queue 1m
  timeout server 200s
  option  dontlognull
  option  http-server-close
  option  httplog
  option  redispatch
  balance roundrobin

listen stats
  bind *:8888
  mode http
  option httpclose
  stats refresh 10s
  stats uri /haproxy-status
  stats realm Haproxy\ Statistics

frontend web_frontend
  log global
  bind *:8080
  mode http
  option httplog
  http-request add-header X-Forwarded-Proto http
  acl grass_api path_beg -i /api
  acl grass_proxy path_beg -i /grass/
  acl xls_paths path_end -i .xls
  acl xlsx_paths path_end -i .xlsx
  acl csv_paths path_end -i .csv
  acl php_app_workstation hdr_dom(host) -i workstation.qaorch.com
  acl php_app_workstation_qaawal hdr_dom(host) -i workstation.qaawal.com

  use_backend workstation_backend if xls_paths
  use_backend workstation_backend if xlsx_paths
  use_backend workstation_backend if csv_paths

  # This covers all path-based routing that requires logic.
  use_backend %[base,lower,map_reg(/etc/haproxy/haproxy_base_to_backend.map,spa_backend)] if php_app_workstation
  use_backend %[base,lower,map_reg(/etc/haproxy/haproxy_base_to_backend.map,spa_awal_backend)] if php_app_workstation_qaawal

  # Add default host-based routes for all apps in case map entries are not matched. SPA is now the default.
  use_backend spa_backend if php_app_workstation
  use_backend spa_awal_backend if php_app_workstation_qaawal
  acl authorized http_auth(AuthUsers)
  default_backend workstation_backend

backend workstation_backend
  balance leastconn
  http-response set-header X-Frame-Options SAMEORIGIN
  http-response set-header X-XSS-Protection 1;mode=block
  http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains
  http-response set-header Content-Security-Policy:script-src self
  http-response set-header X-Content-Type-Options nosniff
  http-response set-header Referrer-Policy no-referrer-when-downgrade
  server workstation01 127.0.0.1:80 maxconn 256 check inter 3000 rise 2 fall 3 resolvers dns_servers
  option httpchk GET /healthchk.php

backend api_grass_backend
  http-request replace-path /api/(.*) /\1
  server grass01 qa-ows-grass.theorchard.io:443 ssl verify none check resolvers dns_servers

backend grass_backend
  http-request replace-path /grass/(.*) /\1
  server grass01 qa-ows-grass.theorchard.io:443 ssl verify none check resolvers dns_servers

backend spa_backend
  http-request replace-path /(.*) /frontend-workstation/index.html
  http-request set-header Host qa-cdn.theorchard.io
  server cdn01 qa-cdn.theorchard.io:443 ssl verify none resolvers dns_servers resolve-prefer ipv4 sni req.hdr(Host)

backend spa_awal_backend
  http-request replace-path /(.*) /frontend-workstation/index-awal.html
  http-request set-header Host qa-cdn.theorchard.io
  server cdn01 qa-cdn.theorchard.io:443 ssl verify none resolvers dns_servers resolve-prefer ipv4 sni req.hdr(Host)

resolvers dns_servers
  nameserver dns1 DNS_PLACEHOLDER:53
  resolve_retries 3
  timeout retry 1s
  hold valid 10s

userlist AuthUsers
  user release_editor password $6$2CMLVHSM85c$5jS6iLkFY76at8mpEJcDN4pmqPFpXLX9ex1P4BMOA8TN3bp6nAUieFO/e/L0KGs4tG5j39sVN.87ZVqlPP1qx1