haproxy-v07.tmpl

{{- $ing := . -}}
{{- $cfg := .Cfg -}}
global
    daemon
{{- if gt $ing.Procs.Nbproc 1 }}
    nbproc {{ $ing.Procs.Nbproc }}
{{- end }}
{{- if gt $ing.Procs.Nbthread 1 }}
    nbthread {{ $ing.Procs.Nbthread }}
{{- end }}
{{- if ne $ing.Procs.CPUMap "" }}
    cpu-map {{ $ing.Procs.CPUMap }}
{{- end }}
    stats socket {{ $cfg.StatsSocket }} level admin expose-fd listeners{{ if gt $ing.Procs.Nbproc 1 }} process 1{{ end }}
{{- if $cfg.LoadServerState }}
    server-state-file state-global
    server-state-base /var/lib/haproxy/
{{- end}}
    maxconn {{ $cfg.MaxConn }}
{{- if ne $cfg.TimeoutStop "" }}
    hard-stop-after {{ $cfg.TimeoutStop }}
{{- end }}
{{- if ne $cfg.Syslog "" }}
    log {{ $cfg.Syslog }} format {{ $cfg.SyslogFormat }} local0
    log-tag {{ $cfg.SyslogTag }}
{{- end }}
    lua-load /usr/local/etc/haproxy/lua/send-response.lua
    lua-load /usr/local/etc/haproxy/lua/auth-request.lua
{{- if ne $cfg.SSLDHParam.Filename "" }}
    # DH PEM checksum: {{ $cfg.SSLDHParam.PemSHA }}
    ssl-dh-param-file {{ $cfg.SSLDHParam.Filename }}
{{- else }}
    tune.ssl.default-dh-param {{ $cfg.SSLDHParam.DefaultMaxSize }}
{{- end }}
{{- if ne $cfg.SSLEngine "" }}
    ssl-engine {{ $cfg.SSLEngine }}
{{- if $cfg.SSLModeAsync }}
    ssl-mode-async
{{- end }}
{{- end }}
    ssl-default-bind-ciphers {{ $cfg.SSLCiphers }}
    ssl-default-bind-options {{ $cfg.SSLOptions }}
{{- range $snippet := $ing.ConfigGlobal }}
    {{ $snippet }}
{{- end }}

defaults
    log global
{{- if $cfg.LoadServerState }}
    load-server-state-from-file global
{{- end }}
    maxconn {{ $cfg.MaxConn }}
{{- if $cfg.DrainSupport }}
    option persist
    {{- if $cfg.DrainSupportRedispatch }}
    option redispatch
    {{- end }}
{{- else }}
    option redispatch
{{- end }}
    option dontlognull
    option http-server-close
    option http-keep-alive
    timeout http-request    {{ $cfg.TimeoutHTTPRequest }}
    timeout connect         {{ $cfg.TimeoutConnect }}
    timeout client          {{ $cfg.TimeoutClient }}
    timeout client-fin      {{ $cfg.TimeoutClientFin }}
    timeout queue           {{ $cfg.TimeoutQueue }}
    timeout server          {{ $cfg.TimeoutServer }}
    timeout server-fin      {{ $cfg.TimeoutServerFin }}
    timeout tunnel          {{ $cfg.TimeoutTunnel }}
    timeout http-keep-alive {{ $cfg.TimeoutKeepAlive }}
{{- range $snippet := $ing.ConfigDefaults }}
    {{ $snippet }}
{{- end }}
{{- if ne (len $ing.DNSResolvers) 0 }}

######
###### DNS Resolvers
######
{{- range $name, $resolver := $ing.DNSResolvers }}
resolvers {{ $name }}
    {{- range $IP, $Port := $resolver.Nameservers }}
    nameserver ns_{{- $IP -}}_{{- $Port }} {{ $IP }}:{{ $Port}}
    {{- end }}
    timeout retry {{ $cfg.DNSTimeoutRetry }}
    hold obsolete {{ $cfg.DNSHoldObsolete }}
    hold valid {{ $cfg.DNSHoldValid }}
    accepted_payload_size {{ $cfg.DNSAcceptedPayloadSize }}
{{- end }}
{{- end }}
{{- if ne (len $ing.Userlists) 0 }}

######
###### Userlists
######
{{- range $userlist := $ing.Userlists }}
userlist {{ $userlist.ListName }}
{{- range $user := $userlist.Users }}
    user {{ $user.Username }} {{ if not $user.Encrypted }}insecure-{{ end }}password {{ $user.Password }}
{{- end }}
{{- end }}
{{- end }}
{{- if ne (len $ing.TCPEndpoints) 0 }}

######
###### TCP services
######
{{- range $tcp := $ing.TCPEndpoints }}
listen tcp-{{ $tcp.Port }}
{{- $inProxyProt := $tcp.Backend.ProxyProtocol.Decode }}
{{- $outProxyProtVersion := $tcp.Backend.ProxyProtocol.EncodeVersion }}
{{- $ssl := $tcp.Backend.SSLCert }}
{{- if ne $ssl.PemSHA "" }}
    # CRT PEM checksum: {{ $ssl.PemSHA }}
{{- end }}
    bind {{ $cfg.BindIPAddrTCP }}:{{ $tcp.Port }}{{ if ne $ssl.PemSHA "" }} ssl crt {{ $ssl.PemFileName }}{{ end }}{{ if $inProxyProt }} accept-proxy{{ end }}
{{- if gt $ing.Procs.Nbproc 1 }}
    bind-process {{ if ne $ssl.PemSHA "" }}{{ $ing.Procs.BindprocSSL }}{{ else }}{{ $ing.Procs.BindprocBalance }}{{ end }}
{{- end }}
    mode tcp
{{- if ne $cfg.Syslog "" }}
{{- if eq $cfg.TCPLogFormat "" }}
    option tcplog
{{- else }}
    log-format {{ $cfg.TCPLogFormat }}
{{- end }}
{{- end }}
{{- range $endpoint := $tcp.Endpoints }}
{{- $target := (print $endpoint.Address ":" $endpoint.Port) }}
    server {{ $target }} {{ $target }}{{ if ne $cfg.BackendCheckInterval "" }} check port {{ $endpoint.Port }} inter {{ $cfg.BackendCheckInterval }}{{ end }}{{ if eq $outProxyProtVersion "v1" }} send-proxy{{ else if eq $outProxyProtVersion "v2" }} send-proxy-v2{{ end }}
{{- end }}
{{- end }}{{/* range TCP services */}}
{{- end }}{{/* if has TCP services */}}

######
###### Backends
######
{{- range $backend := $ing.Backends }}
backend {{ $backend.Name }}
    mode {{ if $backend.SSLPassthrough }}tcp{{ else }}http{{ end }}
    balance {{ $backend.BalanceAlgorithm }}
    tcp-request content set-var(txn.namespace) str("{{ $backend.Service.Namespace }}")
{{- if ne $backend.Connection.TimeoutQueue "" }}
    timeout queue {{ $backend.Connection.TimeoutQueue }}
{{- end }}
{{- if ne $backend.HealthCheck.URI "" }}
    option httpchk {{ $backend.HealthCheck.URI }}
{{- end }}
{{- $sticky := $backend.SessionAffinity }}
{{- if eq $sticky.AffinityType "cookie" }}
    cookie {{ $sticky.CookieSessionAffinity.Name }} {{ $sticky.CookieSessionAffinity.Strategy }} {{ if eq $sticky.CookieSessionAffinity.Strategy "insert" }}indirect nocache httponly{{ end }}{{ if $sticky.CookieSessionAffinity.Dynamic }} dynamic{{ end }}
{{- if $sticky.CookieSessionAffinity.Dynamic }}
    dynamic-cookie-key "{{ $cfg.CookieKey }}"
{{- end }}
{{- end }}
{{- range $snippet := $backend.ConfigurationSnippet.Backend }}
    {{ $snippet }}
{{- end }}
{{- $clcert := $backend.Secure.Cert }}
{{- $cacert := $backend.Secure.CACert }}
{{- if ne $clcert.PemSHA "" }}
    # Cli cert PEM checksum: {{ $clcert.PemSHA }}
{{- end }}
{{- if ne $cacert.PemSHA "" }}
    # CA PEM checksum: {{ $cacert.PemSHA }}
{{- end }}
{{- $BackendSlots := index $ing.BackendSlots $backend.Name }}
{{- if $BackendSlots.UseResolver }}
{{- $portIsNumber := ne (int64 $backend.Port.String) 0 }}
    server-template server-dns {{ $BackendSlots.TotalSlots }} {{ if not $portIsNumber }}_{{ $backend.Port }}._tcp.{{ end }}{{ $backend.Service.Name }}.{{ $backend.Service.Namespace }}.svc.{{ $cfg.DNSClusterDomain }}{{ if $portIsNumber }}:{{ $backend.Port }}{{ end }} resolvers {{ $BackendSlots.UseResolver }} resolve-prefer ipv4 init-addr none
        {{- template "backend" map $cfg $backend }}
{{- else }}
{{- range $slot := $BackendSlots.Slots }}
    server {{ $slot.BackendServerName }}
        {{- if $slot.Target }} {{ $slot.Target }}
            {{- if ge $slot.BackendEndpoint.Weight 0 }} weight {{ $slot.BackendEndpoint.Weight }}{{ end }}
        {{- else }} 127.0.0.1:81 disabled{{ end }}
        {{- template "backend" map $cfg $backend }}
        {{- if eq $sticky.AffinityType "cookie" }}
            {{- if not $sticky.CookieSessionAffinity.Dynamic }} cookie {{ $slot.BackendServerName }}{{ end }}
        {{- end }}
{{- end }}
{{- end }}{{/* if $BackendSlots.UseResolver */}}
{{- end }}{{/* range Backends */}}

{{- define "backend" }}
    {{- $cfg := .p1 }}
    {{- $backend := .p2 }}
    {{- $clcert := $backend.Secure.Cert }}
    {{- $cacert := $backend.Secure.CACert }}
    {{- if gt $backend.Connection.MaxConnServer 0 }} maxconn {{ $backend.Connection.MaxConnServer }}{{ end }}
    {{- if gt $backend.Connection.MaxQueueServer 0 }} maxqueue {{ $backend.Connection.MaxQueueServer }}{{ end }}
    {{- if $backend.Secure.IsSecure }} ssl
        {{- if ne $clcert.CrtFileName "" }} crt {{ $clcert.CrtFileName }}{{ end }}
        {{- if ne $cacert.CAFileName "" }} verify required ca-file {{ $cacert.CAFileName }}
        {{- else }} verify none{{ end }}
    {{- end }}
    {{- if eq $backend.Proxy.ProxyProtocol "v1" }} send-proxy
        {{- else if eq $backend.Proxy.ProxyProtocol "v2" }} send-proxy-v2
        {{- else if eq $backend.Proxy.ProxyProtocol "v2-ssl" }} send-proxy-v2-ssl
        {{- else if eq $backend.Proxy.ProxyProtocol "v2-ssl-cn" }} send-proxy-v2-ssl-cn
    {{- end }}
    {{- $agent := $backend.AgentCheck }}
    {{- $hc := $backend.HealthCheck }}
    {{- $interval := default $cfg.BackendCheckInterval $hc.Interval }}
    {{- if coalesce $interval $hc.Port $hc.Addr $hc.RiseCount $hc.FallCount }} check
    {{- if $interval }} inter {{ $interval }}{{ end }}
        {{- if $hc.Port }} port {{ $hc.Port }}{{ end }}
        {{- if $hc.Addr }} addr {{ $hc.Addr }}{{ end }}
        {{- if $hc.RiseCount }} rise {{ $hc.RiseCount }}{{ end }}
        {{- if $hc.FallCount }} fall {{ $hc.FallCount }}{{ end }}
    {{- end }}
    {{- if $agent.Port }} agent-check agent-port {{ $agent.Port }}
        {{- if $agent.Interval }} agent-inter {{ $agent.Interval }}{{ end }}
        {{- if $agent.Addr }} agent-addr {{ $agent.Addr }}{{ end }}
        {{- if $agent.Send }} agent-send {{ $agent.Send }}{{ end }}
    {{- end }}
{{- end }}

######
###### HTTPS frontend (tcp mode)
######
frontend httpsfront
    bind {{ $cfg.BindIPAddrHTTP }}:{{ $cfg.HTTPSPort }}{{ if $cfg.UseProxyProtocol }} accept-proxy{{ end }}
{{- if gt $ing.Procs.Nbproc 1 }}
    bind-process {{ $ing.Procs.BindprocSSL }}
{{- end }}
    mode tcp

{{- if ne $cfg.Syslog "" }}
{{- if eq $cfg.HTTPSLogFormat "default" }}
    option tcplog
{{- else if ne $cfg.HTTPSLogFormat "" }}
    log-format {{ $cfg.HTTPSLogFormat }}
{{- end }}
{{- end }}
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }

{{- range $server := $ing.HAServers }}
{{- if $server.IsCACert }}
    {{- template "acl" map $cfg $server "req.ssl_sni" false }}
{{- end }}
{{- end }}

{{- range $server := $ing.HAPassthrough }}
{{- if $server.HostnameIsWildcard }}
    use_backend {{ $server.Backend }} if { req.ssl_sni -m reg -i {{ hostnameRegex $server.Hostname }} }
{{- else }}
    use_backend {{ $server.Backend }} if { req.ssl_sni -i {{ $server.Hostname }} }
{{- end }}
{{- end }}

{{- range $server := $ing.HAServers }}
{{- if $server.IsCACert }}
    use_backend httpsback-{{ $server.HostnameLabel }} if {{ $server.ACLLabel }}
{{- end }}
{{- end }}
    default_backend httpsback-shared-backend

######
###### HTTP(S) frontend - shared http mode
######
backend httpsback-shared-backend
    mode tcp
    server shared-https-frontend unix@/var/run/haproxy-https.sock send-proxy-v2
{{- if gt $ing.Procs.NbprocSSL 0 }}
    {{- template "http_front" map $ing $cfg nil false true }}
{{- end }}
backend httpback-shared-backend
    mode http
    server shared-http-frontend unix@/var/run/haproxy-http.sock send-proxy-v2
    {{- template "http_front" map $ing $cfg nil true (eq $ing.Procs.NbprocSSL 0) }}

{{- range $server := $ing.HAServers }}
{{- if $server.IsCACert }}

######
###### HTTPS frontend - cacert - {{ $server.Hostname }}
######
backend httpsback-{{ $server.HostnameLabel }}
    mode tcp
    server {{ $server.HostnameLabel }} unix@/var/run/haproxy-https-{{ $server.HostnameSocket }}.sock send-proxy-v2
    {{- template "http_front" map $ing $cfg $server (eq $ing.Procs.NbprocSSL 0) true }}
{{- if gt $ing.Procs.NbprocSSL 0 }}
backend httpback-{{ $server.HostnameLabel }}
    mode http
    server {{ $server.HostnameLabel }} unix@/var/run/haproxy-http-{{ $server.HostnameSocket }}.sock send-proxy-v2
    {{- template "http_front" map $ing $cfg $server true false }}
{{- end }}
{{- end }}
{{- end }}

######
###### HTTP frontend - default backend
######
backend httpback-default-backend
    mode http
    server shared-http-frontend unix@/var/run/haproxy-http-{{ $ing.DefaultServer.HostnameSocket }}.sock send-proxy-v2
    {{- template "http_front" map $ing $cfg $ing.DefaultServer true false }}

{{- /*------------------------------------*/}}
{{- /*------------------------------------*/}}
{{- define "http_front" }}
{{- $ing := .p1 }}
{{- $cfg := .p2 }}
{{- $singleserver := .p3 }}
{{- $hasBalance := .p4 }}
{{- $hasSSL := .p5 }}
{{- $isShared := isShared $singleserver }}
{{- $isDefault := isDefault $singleserver }}
{{- $isCACert := isCACert $singleserver }}
{{- $servers := getServers $ing.HAServers $singleserver }}
{{- $hasHTTPStoHTTP := gt $cfg.HTTPStoHTTPPort 0 }}
{{- $reuseHTTPPort := eq $cfg.HTTPStoHTTPPort $cfg.HTTPPort }}
frontend http{{ if and $hasSSL (not $hasBalance) }}s{{ end }}front-{{ if $isShared }}shared-frontend{{ else if $isDefault }}default-backend{{ else }}{{ $singleserver.Hostname }}{{ end }}

{{- /*------------------------------------*/}}
{{- if and $hasBalance $isShared }}
    bind {{ $cfg.BindIPAddrHTTP }}:{{ $cfg.HTTPPort }}{{ if $cfg.UseProxyProtocol }} accept-proxy{{ end }}
{{- if and $hasHTTPStoHTTP (not $reuseHTTPPort) }}
    bind {{ $cfg.BindIPAddrHTTP }}:{{ $cfg.HTTPStoHTTPPort }}{{ if $cfg.UseProxyProtocol }} accept-proxy{{ end }}
{{- end }}
    bind unix@/var/run/haproxy-http.sock accept-proxy
{{- end }}
{{- if $hasSSL }}
{{- range $server := $servers }}
{{- if $server.UseHTTPS }}
    # CRT PEM checksum: {{ $server.SSLPemChecksum }}{{ if $isShared }} - {{ $server.Hostname }}{{ end }}
{{- end }}
{{- end }}
{{- end }}
{{- if and $hasSSL $isCACert }}
    # CA PEM checksum: {{ $singleserver.CertificateAuth.AuthSSLCert.PemSHA }}
{{- end }}
{{- if or $isDefault (and $isCACert (not $hasSSL)) }}
    bind unix@/var/run/haproxy-http-{{ $singleserver.HostnameSocket }}.sock accept-proxy
{{- end }}
{{- if $hasSSL }}
    bind unix@/var/run/haproxy-https{{ if not $isShared }}-{{ $singleserver.HostnameSocket }}{{ end }}.sock ssl alpn {{ $cfg.TLSALPN }} crt {{ if $isShared }}/ingress-controller/ssl/shared-frontend/{{ else }}{{ $singleserver.SSLCertificate }}{{ end }}{{ if $isCACert }} ca-file {{ $singleserver.CertificateAuth.AuthSSLCert.CAFileName }} verify optional ca-ignore-err all crt-ignore-err all{{ end }} accept-proxy
{{- end }}
{{- if gt $ing.Procs.Nbproc 1 }}
{{- if and $hasBalance (not $hasSSL) }}
    bind-process {{ $ing.Procs.BindprocBalance }}
{{- else if and $hasSSL (not $hasBalance) }}
    bind-process {{ $ing.Procs.BindprocSSL }}
{{- end }}
{{- end }}
    mode http

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- if ne $cfg.Syslog "" }}
{{- if eq $cfg.HTTPLogFormat "" }}
    option httplog
{{- else }}
    log-format {{ $cfg.HTTPLogFormat }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if or (and $hasBalance $hasHTTPStoHTTP) (not $hasSSL) }}
    acl from-https var(txn.hdr_proto) https
{{- end }}
{{- if and $hasBalance $hasHTTPStoHTTP (not $reuseHTTPPort) }}
    acl from-https dst_port eq {{ $cfg.HTTPStoHTTPPort }}
{{- end }}
{{- if and $hasSSL $hasBalance }}
    acl from-https ssl_fc
    acl ssl-offload ssl_fc
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
    {{- template "acl" map $cfg $server "var(txn.hdr_host)" true }}
{{- end }}
{{- if $isShared }}
{{- range $server := $ing.HAPassthrough }}
    {{- template "acl" map $cfg $server "var(txn.hdr_host)" true }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- if or $isShared $singleserver.HasRateLimit }}
    stick-table type ip size 200k expire 5m store conn_cur,conn_rate(1s)
    tcp-request content track-sc1 src
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if and $hasBalance (not $isDefault) }}
{{- range $snippet := $ing.ConfigFrontend }}
    {{ $snippet }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
    http-request set-var(txn.hdr_host) req.hdr(host)
    http-request set-var(txn.hdr_proto) hdr(x-forwarded-proto)
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- range $location := $server.Locations }}
{{- $conn_cur_limit := $location.RateLimit.Connections.Limit }}
{{- $conn_rate_limit := $location.RateLimit.RPS.Limit }}
{{- if gt $conn_cur_limit 0 }}
    http-request deny if {{ $server.ACLLabel }}{{ $location.HAMatchPath }}{{ if ne $location.HARateLimitWhiteList "" }} !{ src{{ $location.HARateLimitWhiteList }} }{{ end }} { sc1_conn_cur gt {{ $conn_cur_limit }} }
{{- end }}
{{- if gt $conn_rate_limit 0 }}
    http-request deny if {{ $server.ACLLabel }}{{ $location.HAMatchPath }}{{ if ne $location.HARateLimitWhiteList "" }} !{ src{{ $location.HARateLimitWhiteList }} }{{ end }} { sc1_conn_rate gt {{ $conn_rate_limit }} }
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if not $reuseHTTPPort }}
    http-request set-header X-Forwarded-Proto https{{ if $hasBalance }} if from-https{{ end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- if ne $cfg.ModSecurity "" }}
    filter spoe engine modsecurity config /etc/haproxy/spoe-modsecurity.conf
{{- range $server := $servers }}
{{- if $server.WAF }}
{{- if eq $server.WAF.Mode "modsecurity" }}
    http-request deny if {{ $server.ACLLabel }} { var(txn.modsec.code) -m int gt 0 }
{{- end }}
{{- else }}{{/* this range only makes sense if $server.WAF is nil */}}
{{- range $location := $server.Locations }}
{{- if eq $location.WAF.Mode "modsecurity" }}
    http-request deny if {{ $server.ACLLabel }}{{ $location.HAMatchPath }} { var(txn.modsec.code) -m int gt 0 }
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- if and $server.IsCACert (not $isCACert) }}
    http-request deny if from-https {{ $server.ACLLabel }}
{{- else }}
{{- range $location := $server.Locations }}
{{- if ne $location.HAWhitelist "" }}
    http-request deny if {{ $server.ACLLabel }}{{ $location.HAMatchPath }} !{ src{{ $location.HAWhitelist }} }
{{- end }}
{{- $listName := $location.Userlist.ListName }}
{{- if ne $listName "" }}
{{- $realm := $location.Userlist.Realm }}
    http-request auth {{ if ne $realm "" }}realm "{{ $realm }}" {{ end }}if {{ $server.ACLLabel }}{{ $location.HAMatchPath }} !{ http_auth({{ $listName }}) }
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- if $server.OAuth }}
{{- $oauth := $server.OAuth }}
{{- if eq $oauth.OAuthImpl "oauth2_proxy" }}
    http-request set-header X-Real-IP %[src] if {{ $server.ACLLabel }}
    http-request lua.auth-request {{ $oauth.BackendName }} {{ $oauth.URIPrefix }}/auth if {{ $server.ACLLabel }}
    http-request redirect location {{ $oauth.URIPrefix }}/start?rd=%[path] if {{ $server.ACLLabel }} !{ path_beg {{ $oauth.URIPrefix }}/ } !{ var(txn.auth_response_successful) -m bool }
{{- range $header, $attr := $oauth.Headers }}
    http-request set-header {{ $header }} %[var(txn.{{ $attr }})] if {{ $server.ACLLabel }} { var(txn.{{ $attr }}) -m found }
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasSSL }}
{{- if $isCACert }}
    http-request set-header {{ $cfg.SSLHeadersPrefix }}-Client-SHA1  %{+Q}[ssl_c_sha1,hex]{{ if $hasBalance}}   if ssl-offload{{ end }}
    http-request set-header {{ $cfg.SSLHeadersPrefix }}-Client-DN    %{+Q}[ssl_c_s_dn]{{ if $hasBalance}}       if ssl-offload{{ end }}
    http-request set-header {{ $cfg.SSLHeadersPrefix }}-Client-CN    %{+Q}[ssl_c_s_dn(cn)]{{ if $hasBalance}}   if ssl-offload{{ end }}
{{- if $singleserver.CertificateAuth.CertHeader }}
    http-request set-header {{ $cfg.SSLHeadersPrefix }}-Client-Cert  %{+Q}[ssl_c_der,base64]{{ if $hasBalance}} if ssl-offload{{ end }}
{{- else }}
    http-request del-header {{ $cfg.SSLHeadersPrefix }}-Client-Cert{{ if $hasBalance}}  if ssl-offload{{ end }}
{{- end }}
{{- else }}
    http-request del-header {{ $cfg.SSLHeadersPrefix }}-Client-Cert{{ if $hasBalance}}  if ssl-offload{{ end }}
    http-request del-header {{ $cfg.SSLHeadersPrefix }}-Client-SHA1{{ if $hasBalance}}  if ssl-offload{{ end }}
    http-request del-header {{ $cfg.SSLHeadersPrefix }}-Client-DN{{ if $hasBalance}}    if ssl-offload{{ end }}
    http-request del-header {{ $cfg.SSLHeadersPrefix }}-Client-CN{{ if $hasBalance}}    if ssl-offload{{ end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
    http-request set-var(txn.path) path
{{- if eq $cfg.Forwardfor "add" }}
    http-request del-header x-forwarded-for
    option forwardfor
{{- else if eq $cfg.Forwardfor "ifmissing" }}
    option forwardfor if-none
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- if $server.CORS }}
{{- if $server.CORS.CorsEnabled }}
    # skip backend on CORS preflight - {{ $server.Hostname }}
    http-request use-service lua.send-response if METH_OPTIONS {{ $server.ACLLabel }}
{{- end }}
{{- else }}
{{- range $location := $server.Locations }}
{{- if $location.CORS.CorsEnabled }}
    # skip backend on CORS preflight - {{ $server.Hostname }}/{{ $location.Path }}
    http-request use-service lua.send-response if METH_OPTIONS {{ $server.ACLLabel }}{{ $location.HAMatchTxnPath }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- range $location := $server.Locations }}
{{- $rewriteTarget := $location.Rewrite.Target }}
{{- if ne $rewriteTarget "" }}
{{- if eq $rewriteTarget "/" }}
    reqrep ^([^\ :]*)\ {{ $location.Path }}/?(.*$) \1\ {{ $rewriteTarget }}\2 if {{ if $location.SSLRedirect }}from-https {{ end }}{{ $server.ACLLabel }}{{ $location.HAMatchTxnPath }}
{{- else }}
    reqrep ^([^\ :]*)\ {{ $location.Path }}(.*$) \1\ {{ $rewriteTarget }}{{ if hasSuffix $location.Path "/" }}/{{ end }}\2 if {{ if $location.SSLRedirect }}from-https {{ end }}{{ $server.ACLLabel }}{{ $location.HAMatchTxnPath }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- if $server.SSLRedirect }}
    redirect scheme https if !from-https {{ $server.ACLLabel }}
{{- else }}
{{- range $location := $server.Locations }}
{{- if $location.SSLRedirect }}
    redirect scheme https if !from-https {{ $server.ACLLabel }}{{ $location.HAMatchTxnPath }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if $isShared }}
{{- range $server := $ing.HAPassthrough }}
{{- if eq $server.HTTPPassBackend "" }}
    redirect scheme https if !from-https {{ $server.ACLLabel }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if and $hasSSL $isCACert }}
{{- if or ( eq $singleserver.CertificateAuth.VerifyClient "on" ) ( eq $singleserver.CertificateAuth.VerifyClient "optional" ) }}
{{- if eq $singleserver.CertificateAuth.ErrorPage "" }}
    use_backend error495 if { ssl_c_ca_err gt 0 } || { ssl_c_err gt 0 }
{{- if eq $singleserver.CertificateAuth.VerifyClient "on" }}
    use_backend error496 if { ssl_fc } !{ ssl_c_used }
{{- end }}
{{- else }}
    redirect location {{ $singleserver.CertificateAuth.ErrorPage }} if { ssl_c_ca_err gt 0 } || { ssl_c_err gt 0 }
{{- if eq $singleserver.CertificateAuth.VerifyClient "on" }}
    redirect location {{ $singleserver.CertificateAuth.ErrorPage }} if { ssl_fc } !{ ssl_c_used }
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- $appRoot := $server.RootLocation.Rewrite.AppRoot }}
{{- if ne $appRoot "" }}
    redirect location {{ $appRoot }} if {{ $server.ACLLabel }} { var(txn.path) -m str / }
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- range $location := $server.Locations }}
{{- if ne $location.Proxy.BodySize "" }}
    use_backend error413 if {{ $server.ACLLabel }}{{ $location.HAMatchTxnPath }} { req.body_size gt {{ sizeSuffix $location.Proxy.BodySize }} }
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- if $server.HSTS }}
{{- $hsts := $server.HSTS }}
{{- if $hsts.Enable }}
    http-response set-header Strict-Transport-Security "max-age={{ $hsts.MaxAge }}{{ if $hsts.Subdomains }}; includeSubDomains{{ end }}{{ if $hsts.Preload }}; preload{{ end }}" if from-https {{ $server.ACLLabel }}
{{- end }}
{{- else }}
{{- range $location := $server.Locations }}
{{- $hsts := $location.HSTS }}
{{- if $hsts.Enable }}
    http-response set-header Strict-Transport-Security "max-age={{ $hsts.MaxAge }}{{ if $hsts.Subdomains }}; includeSubDomains{{ end }}{{ if $hsts.Preload }}; preload{{ end }}" if from-https {{ $server.ACLLabel }}{{ $location.HAMatchTxnPath }}
{{- end }}
{{- end }}
{{- end }}{{/* if/else $server.HSTS */}}
{{- if $server.CORS }}
{{- if $server.CORS.CorsEnabled }}
    {{- template "CORS" map $server.CORS $server false }}
{{- end }}
{{- else }}
{{- range $location := $server.Locations }}
{{- if $location.CORS.CorsEnabled }}
    {{- template "CORS" map $location.CORS $server $location }}
{{- end }}
{{- end }}{{/* if $cors.CorsEnabled */}}
{{- end }}{{/* if/else $server.CORS */}}
{{- end }}{{/* range $servers */}}
{{- end }}{{/* if $hasBalance */}}

{{- /*------------------------------------*/}}
{{- if $hasBalance }}
{{- range $server := $servers }}
{{- range $location := $server.Locations }}
{{- if not $location.IsRootLocation }}
    use_backend {{ $location.Backend }} if {{ $server.ACLLabel }} { var(txn.path) -m beg {{ $location.Path }} }
{{- else if and $server.ACLLabel (or $cfg.StrictHost (not $location.IsDefBackend)) }}
    use_backend {{ $location.Backend }} if {{ $server.ACLLabel }}
{{- end }}
{{- end }}
{{- end }}
{{- if $isShared }}
{{- range $server := $ing.HAPassthrough }}
{{- if ne $server.HTTPPassBackend "" }}
    use_backend {{ $server.HTTPPassBackend }} if {{ $server.ACLLabel }}
{{- end }}
{{- end }}
{{- end }}
{{- if $isShared }}
    default_backend httpback-default-backend
{{- else if $isDefault }}
    default_backend {{ $ing.DefaultServer.RootLocation.Backend }}
{{- else if $isCACert }}
    default_backend httpback-shared-backend
{{- end }}
{{- end }}

{{- /*------------------------------------*/}}
{{- if not $hasBalance }}
{{- if $isShared }}
    default_backend httpback-shared-backend
{{- else if $isCACert }}
    default_backend httpback-{{ $singleserver.HostnameLabel }}
{{- end }}
{{- end }}

{{- end }}{{/* define "http_front" */}}

{{- /*------------------------------------*/}}
{{- /*------------------------------------*/}}
{{- define "acl" }}
{{- $cfg := .p1 }}
{{- $server := .p2 }}
{{- $fetch := .p3 }}
{{- $needport := .p4 }}
{{- if ne $server.ACLLabel "" }}
{{- if $server.HostnameIsWildcard }}
    acl {{ $server.ACLLabel }} {{ $fetch }} -m reg -i {{ hostnameRegex $server.Hostname }}
{{- else }}
    acl {{ $server.ACLLabel }} {{ $fetch }} -i {{ $server.Hostname }}{{ if $needport }} {{ $server.Hostname }}:{{ $cfg.HTTPPort }} {{ $server.Hostname }}:{{ $cfg.HTTPSPort }}{{ if and $cfg.HTTPStoHTTPPort (ne $cfg.HTTPStoHTTPPort $cfg.HTTPPort) }} {{ $server.Hostname }}:{{ $cfg.HTTPStoHTTPPort }}{{ end }}{{ end }}
{{- end }}
{{- if $server.AliasHost }}
{{- if $server.AliasHostIsRegex }}
    acl {{ $server.ACLLabel }} {{ $fetch }} -m reg -i '{{ hostnameRegex $server.AliasHost }}'
{{- else }}
    acl {{ $server.ACLLabel }} {{ $fetch }} -i {{ $server.AliasHost }}{{ if $needport }} {{ $server.AliasHost }}:{{ $cfg.HTTPPort }} {{ $server.AliasHost }}:{{ $cfg.HTTPSPort }}{{ end }}
{{- end }}
{{- end }}
{{- if $server.AliasRegex }}
    acl {{ $server.ACLLabel }} {{ $fetch }} -m reg -i '{{ $server.AliasRegex }}'
{{- end }}
{{- end }}
{{- end }}{{/* define "acl" */}}

{{- /*------------------------------------*/}}
{{- /*------------------------------------*/}}
{{- define "CORS" }}
{{- $cors := .p1 }}
{{- $server := .p2 }}
{{- $location := .p3 }}
    # start CORS preflight - {{ $server.Hostname }}{{ if $location }}{{ $location.Path }}{{ end }}
    http-response set-header Access-Control-Allow-Origin      "{{ $cors.CorsAllowOrigin }}" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    http-response set-header Access-Control-Allow-Methods     "{{ $cors.CorsAllowMethods }}" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    http-response set-header Access-Control-Allow-Headers     "{{ $cors.CorsAllowHeaders }}" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
{{- if $cors.CorsAllowCredentials }}
    http-response set-header Access-Control-Allow-Credentials "{{ $cors.CorsAllowCredentials }}" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
{{- end }}
    http-response set-header Access-Control-Max-Age           "{{ $cors.CorsMaxAge }}" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    http-response set-header Content-Type                     "text/plain" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    http-response set-header Content-Length                   "0" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    http-response set-status 204 reason "No Content" if METH_OPTIONS {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    # end CORS preflight - {{ $server.Hostname }}{{ if $location }}{{ $location.Path }}{{ end }}
    http-response set-header Access-Control-Allow-Origin      "{{ $cors.CorsAllowOrigin }}" if {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
{{- if $cors.CorsAllowCredentials }}
    http-response set-header Access-Control-Allow-Credentials "{{ $cors.CorsAllowCredentials }}" if {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
{{- end }}
{{- if $cors.CorsExportHeaders }}
    http-response set-header Access-Control-Expose-Headers    "{{ $cors.CorsExposeHeaders }}" if {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
{{- end }}
    http-response set-header Access-Control-Allow-Methods     "{{ $cors.CorsAllowMethods }}" if {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    http-response set-header Access-Control-Allow-Headers     "{{ $cors.CorsAllowHeaders }}" if {{ $server.ACLLabel }}{{ if $location }}{{ $location.HAMatchTxnPath }}{{ end }}
    # end CORS - {{ $server.Hostname }}{{ if $location }}{{ $location.Path }}{{ end }}
{{- end }}{{/* define "CORS" */}}

{{- if ne $cfg.ModSecurity "" }}

######
###### ModSecurity agent
######
backend spoe-modsecurity
    mode tcp
    timeout connect 5s
    timeout server  5s
{{- range $i, $endpoint := split $cfg.ModSecurity "," }}
    server modsec-spoa{{ $i }} {{ $endpoint }}
{{- end }}
{{- end }}

######
###### Error pages
######
backend error413
    mode http
    errorfile 400 /usr/local/etc/haproxy/errors/413.http
    http-request deny deny_status 400
backend error495
    mode http
    errorfile 400 /usr/local/etc/haproxy/errors/495.http
    http-request deny deny_status 400
backend error496
    mode http
    errorfile 400 /usr/local/etc/haproxy/errors/496.http
    http-request deny deny_status 400
listen error503noendpoints
    bind 127.0.0.1:8181{{ if gt $ing.Procs.Nbproc 1 }} process {{ $ing.Procs.BindprocBalance }}{{ end }}
    mode http
    errorfile 503 /usr/local/etc/haproxy/errors/503noendpoints.http

######
###### Stats page
######
listen stats
{{- $ssl := $ing.StatsSSLCert }}
{{- if ne $ssl.PemSHA "" }}
    # CRT PEM checksum: {{ $ssl.PemSHA }}
{{- end }}
    bind {{ $cfg.BindIPAddrStats }}:{{ $cfg.StatsPort }}{{ if ne $ssl.PemFileName "" }} ssl crt {{ $ssl.PemFileName }}{{ end }}{{ if $cfg.StatsProxyProtocol }} accept-proxy{{ end }}{{ if gt $ing.Procs.Nbproc 1 }} process 1{{ end }}
    mode http
    stats enable
    stats realm HAProxy\ Statistics
{{- if ne $cfg.StatsAuth "" }}
    stats auth {{ $cfg.StatsAuth }}
{{- end }}
    stats uri /
    no log
    option forceclose
    stats show-legends

######
###### Monitor URI
######
frontend healthz
    bind {{ $cfg.BindIPAddrHealthz }}:{{ $cfg.HealthzPort }}{{ if gt $ing.Procs.Nbproc 1 }} process 1{{ end }}
    mode http
    monitor-uri /healthz
    no log