{% extends 'common/haproxy_base.j2' %}
# haproxy for SWAMIDs MDS load balancer nodes.
#
{% from "common/haproxy_macros.j2" import output_backends %}

{% block frontend %}
frontend {{ site_name }}
    {{ bind_ip_tls(bind_ips, 443, tls_certificate_bundle) }}

    timeout http-request 10s
    timeout http-keep-alive 4s
    option forwardfor
    http-request set-header X-Forwarded-Proto https

    {{ web_security_options(['no_frames', 'block_xss', 'hsts', 'no_sniff', 'no_cache']) }}

    {{ csp(["default-src "               + [csp_app_src]|join(' '),
            "script-src "                + ["'self'", "'unsafe-inline'"]|join(' '),
            "font-src "                  + ["'self'"]|join(' '),
            "style-src "                 + ["'self'", "'unsafe-inline'"]|join(' '),
            "img-src "                   + ["'self'"]|join(' '),
            ]) }}

    {{ acme_challenge(letsencrypt_server) }}

    {% block usebackend %}
    use_backend {{ site_name }}__default
    {% endblock usebackend %}
{% endblock frontend %}
{% block backend %}
{{ output_backends(backends,
      config=[
      'cookie SERVERID insert indirect nocache',
      'option httpchk'
      ]
   )
}}
{% endblock backend %}