# ==========================================
# HAProxy global settings
# ==========================================
global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    pidfile /run/haproxy.pid
    maxconn {{ haproxy_global_maxconn | default(4096) }}
    user haproxy
    group haproxy
    daemon

defaults
    log global
    option httplog
    option dontlognull
    timeout connect {{ haproxy_timeout_connect_ms | default('5000') }}
    timeout client {{ haproxy_timeout_client_ms | default('60000') }}
    timeout server {{ haproxy_timeout_server_ms | default('60000') }}
    option http-server-close
    option forwardfor
    retries 3
    maxconn 2000

# ==========================================
# HAProxy frontends and backends template
# ==========================================

frontend https-in
    mode http
    bind *:443 ssl crt {{ haproxy_pem_path }} ca-file {{ haproxy_ca_path }} verify required alpn h2,http/1.1
    option httplog
    option forwardfor
    timeout client 30s

    http-request set-header X-Client-Cert %[ssl_c_der,base64]

{% for service_name, service in securemtls_services.items() %}
    acl host_{{ service_name }} hdr(host) -i {{ service.hostname }}
    use_backend {{ service_name }} if host_{{ service_name }}
{% endfor %}

# ==========================================
# Backends
# ==========================================
{% for service_name, service in securemtls_services.items() %}
backend {{ service_name }}
    balance {{ service.balance | default('roundrobin') }}
    mode {{ service.mode | default('http') }}
    timeout connect {{ service.timeout_connect | default('5s') }}
    timeout server {{ service.timeout_server | default('30s') }}
    option {{ service.options | default('http-server-close') }}
    default-server inter {{ service.default_server_inter | default('3s') }}
    default-server rise {{ service.default_server_rise | default('2') }}
    default-server fall {{ service.default_server_fall | default('3') }}

{% for server in service.backend_servers %}
    {% if server.proto == "https" %}
    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} ssl verify none check
    {% else %}
    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} check
    {% endif %}
{% endfor %}

{% if service.headers is defined %}
{% for hdr in service.headers %}
    {{ hdr }}
{% endfor %}
{% endif %}

{% if service.rewrites is defined %}
{% for rewrite in service.rewrites %}
    {{ rewrite }}
{% endfor %}
{% endif %}

{% endfor %}

# ==========================================
# Vault backend for HAProxy
# ==========================================
backend vault_backend
    mode tcp
    option ssl-hello-chk
    server vault1 VAULT_IP:VAULT_PORT ssl verify required ca-file {{ haproxy_ca_path }} crt {{ haproxy_cert_path }}