haproxy.cfg

global
    tune.ssl.default-dh-param 2048
    # NOTE: haproxy can only log to syslog or a unix socket
    # needs a syslog daemon !
    log localhost local0

defaults
    log global
    option httplog
    mode http
    option forwardfor
    option http-server-close
    timeout connect 5000ms
    timeout client 5000ms
    timeout server 5000ms
    timeout tunnel 120s

    stats enable
    stats uri /haproxy
    stats realm Haproxy\ Statistics

backend hub
    balance leastconn
    cookie SMCSERVERID3 insert nocache
    option httpclose
    timeout server 20s
    option httpchk /alive
    server hub 127.0.0.1:5000 cookie server:127.0.0.1:5000 check inter 4000 maxconn 10000

backend proxy
    balance leastconn
    cookie SMCSERVERID3 insert nocache
    option httpclose
    timeout server 20s
    server proxy 127.0.0.1:5001 cookie server:127.0.0.1:5000 check inter 4000 maxconn 10000

backend share
    balance leastconn
    cookie SMCSERVERID3 insert nocache
    option httpclose
    timeout server 20s
    server proxy 127.0.0.1:5002 cookie server:127.0.0.1:5000 check inter 4000 maxconn 10000

frontend http
    bind *:80

    # permanent redirect to https
    redirect scheme https code 301

frontend https
    bind *:443 ssl crt /run/haproxy.pem no-sslv3
    timeout client 120s

    # we don't want to show known users the landing page -- hence redirect based on a cookie
    acl is_known_user hdr_sub(cookie) has_remember_me=true
    acl is_root_url   path /
    acl is_app        capture.req.uri -m beg /app

    http-request redirect code 302 location /app if is_root_url is_known_user

    # /app must not be cached
    http-response set-header Cache-Control "private, no-cache, max-age=0" if is_app

    acl is_proxy path_reg ^/[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}/port
    acl is_proxy path_reg ^/[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}/server
    acl is_proxy path_reg ^/[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}/raw
    use_backend proxy if is_proxy

    acl is_share path_beg /share
    use_backend share if is_share

    default_backend hub