{% extends 'common/haproxy_base.j2' %}

{% from "common/haproxy_macros.j2" import bind_ip_tls, web_security_options, acme_challenge, csp %}

{% block frontend %}
frontend {{ site_name }}
    {{ bind_ip_tls(bind_ips, 443, tls_certificate_bundle) }}


    timeout http-request 10s
    timeout http-keep-alive 4s
    option forwardfor
    http-request set-header X-Forwarded-Proto https

    {{ web_security_options(['no_frames', 'block_xss', 'hsts', 'no_sniff', 'no_cache']) }}

    {{ csp(["default-src "               + [csp_app_src]|join(' '),
	    "script-src "                + [csp_script_src]|join(' '),
	    ]) }}

    {{ acme_challenge(letsencrypt_server) }}

    use_backend {{ site_name }}__default
{% endblock frontend %}