global
    stats socket /var/run/haproxy.sock mode 660 expose-fd listeners level admin
    log     	 stderr len 65535 format raw local0

    chroot  	 /var/lib/haproxy
    pidfile 	 /var/run/haproxy.pid
    maxconn 	 10000

    spread-checks 5
    user    	 haproxy
    group   	 haproxy

    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # see https://ssl-config.mozilla.org/#server=haproxy&version=2.8&config=intermediate&openssl=1.1.1k&guideline=5.7
    # intermediate configuration
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

    # utilize system-wide crypto-policies
    #ssl-default-bind-ciphers PROFILE=SYSTEM
    # ssl-default-server-ciphers PROFILE=SYSTEM
    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > ./dhparam
    ssl-dh-param-file /etc/haproxy/dhparam
    master-worker

resolvers docker
    # proably need to prefix with tcp@ if number of backends > 10
    nameserver dns1 127.0.0.11:53
    accepted_payload_size 8192 # allow larger DNS payloads
    resolve_retries 3

    timeout resolve 1s
    timeout retry   1s

    hold other      10s
    hold refused    10s
    hold nx         10s
    hold timeout    10s
    hold valid      10s
    hold obsolete   10s

defaults
    # fix many dockerd errors "[resolver] failed to query DNS server: 127.0.0.11:53, query: ;efk_kibana. IN AAAA"
    default-server resolve-prefer ipv4

    timeout queue           1m
    timeout connect         10s
    timeout client          30s
    timeout server          30s

    # Protection from Slowloris attacks
    timeout http-request    5s

    timeout http-keep-alive 10s
    timeout check           10s
    timeout tunnel          2m
    timeout client-fin      1s
    timeout server-fin      1s
    log-format '{"host":"%H","ident":"haproxy","pid":%pid,"time":"%Tl","haproxy":{"conn":{"act":%ac,"fe":%fc,"be":%bc,"srv":%sc},"queue":{"backend":%bq,"srv":%sq},"time":{"tq":%Tq,"tw":%Tw,"tc":%Tc,"tr":%Tr,"tt":%Tt},"termination_state":"%tsc","retries":%rc,"network":{"client_ip":"%ci","client_port":%cp,"frontend_ip":"%fi","frontend_port":%fp},"ssl":{"version":"%sslv","ciphers":"%sslc"},"request":{"method":"%HM","hu":"%HU","hp":"%HP","hq":"%[var(txn.querystring),json(utf8s)]","protocol":"%HV","header":{"host":"%[capture.req.hdr(0),json(utf8s)]","xforwardfor":"%[capture.req.hdr(1),json(utf8s)]","referer":"%[capture.req.hdr(2),json(utf8s)]"}},"name":{"backend":"%b","frontend":"%ft","server":"%s"},"response":{"status_code":%ST,"header":{"xrequestid":"%[capture.res.hdr(0),json(utf8s)]"}},"bytes":{"uploaded":%U,"read":%B}}}'
   
    error-log-format '{"host":"%H","ident":"haproxy","pid":%pid,"time":"%tr","haproxy":{"conn":{"act":%ac,"fe":%fc},"network":{"client_ip":"%ci","client_port":%cp},"ssl":{"version":"%sslv","ciphers":"%sslc","sni":"%[ssl_fc_sni,json(utf8s)]","is_resumed":%[ssl_fc_is_resumed,json(utf8s)]},"name":{"frontend":"%ft"}},"err":{"id":%[fc_err],"ssl_fc":%[ssl_fc_err],"ssl_c":%[ssl_c_err],"ssl_c_ca":%[ssl_c_ca_err]}}'
    log global

    mode http
    # options
    # option httplog
    option                  dontlognull
    option http-server-close
    # net yet supported by nginx, so skip adding IETF RFC7239 header
    option forwarded host by by_port for
    # add non-standard X-Forwarded-For header
    option forwardfor except 127.0.0.0/8
    option                  redispatch
    retries                 3
    # per frontend
    maxconn 	 5000
    backlog 131072

frontend fe_kibana
    bind *:5601 ssl crt /opt alpn h2,http/1.1
    http-request auth unless { http_auth(statcredentials) }
    http-request del-header Authorization
    acl host_app hdr_beg(host) -i "${APP_HOSTNAME}"
    use_backend be_kibana if host_app

backend be_kibana
    server-template kibana- 1 efk_kibana:5601 check resolvers docker init-addr libc,none

userlist statcredentials
    user "${HAPROXY_STATS_USER}"   insecure-password "${HAPROXY_STATS_PASSWORD}"