{% extends 'common/haproxy_base.j2' %}

{% from "common/haproxy_macros.j2" import bind_ip_tls, web_security_options, acme_challenge, csp %}

{% block frontend %}
frontend {{ site_name }}
    {{ bind_ip_tls(bind_ips, 443, tls_certificate_bundle) }}


    timeout http-request 10s
    timeout http-keep-alive 4s

    http-request return status 200 content-type "text/plain" file "/opt/frontend/config/common/robots.txt" hdr "cache-control" "no-cache"  if { path /robots.txt }

    option forwardfor
    http-request set-header X-Forwarded-Proto https

    {{ web_security_options(['hsts', 'no_sniff', 'no_cache']) }}

    {{ csp(["default-src "               + ["'self'"]|join(' '),
            "frame-src "		 + ["ds.fidus.skolverket.se"]|join(' '),
	    "font-src "                  + ["data:", "'self'", "ds.fidus.skolverket.se"]|join(' '),
	    "script-src "                + ["'self'", "'unsafe-inline'", "'unsafe-eval'", "ds.fidus.skolverket.se"]|join(' '),
	    "connect-src "               + ["'self'"]|join(' '),
	    "img-src "                   + ["*", "data:", "'self'"]|join(' '),
	    "style-src "                 + ["'self'", "'unsafe-inline'", "ds.fidus.skolverket.se"]|join(' '),
            "object-src "                + ["'none'"]|join(' '),
	    ]) }}

    {{ acme_challenge(letsencrypt_server) }}

    {% block usebackend %}
    use_backend {{ site_name }}__default
    {% endblock usebackend %}
{% endblock frontend %}