global
   log /dev/log local0
   log /dev/log local1 notice
   chroot /var/lib/haproxy
   maxconn 2048
   stats timeout 30s
   user haproxy
   group haproxy
   daemon

defaults
   log global
   mode http
   option httplog
   option dontlognull
   option forwardfor
   option http-server-close
   timeout connect 5000
   timeout client 5000
   timeout server 5000

listen stats
   bind *:8181
   stats enable
   stats uri /
   stats realm Haproxy\ Statistics
   stats auth username:password

frontend http_home
   bind 10.20.1.15:80
   mode http
   timeout http-request 5s
   option forwardfor
   reqadd X-Forwarded-Proto:\ http

   # privetdrive
   acl is_privetdrive      hdr_beg(host) -i privetdrive.net
   acl is_privetdrive      hdr_beg(host) -i www
   acl is_unifi            hdr_beg(host) -i unifi
   acl is_unms             hdr_beg(host) -i unms
   acl is_quake            hdr_beg(host) -i quake

   # sundsvallbbq
   acl is_sundsvallbbq          hdr_beg(host) -i sundsvallbbq.se
   acl is_sundsvallbbq          hdr_beg(host) -i www

   redirect scheme https if { hdr(dom) -i privetdrive.net } !{ ssl_fc }
   redirect scheme https if { hdr(host) -i www.privetdrive.net } !{ ssl_fc }
   redirect scheme https if { hdr(host) -i sundsvallbbq.se } !{ ssl_fc }
   redirect scheme https if { hdr(host) -i www.sundsvallbbq.se } !{ ssl_fc }

   use_backend             http_backend if is_privetdrive
   use_backend             http_backend if is_sundsvallbbq
   use_backend             unifi_backend if is_unifi
   use_backend             unms_backend if is_unms
   use_backend             quake_backend if is_quake

   default_backend http_backend

stats uri /haproxy?stats
   acl letsencrypt-acl path_beg /.well-known/acme-challenge/
   use_backend letsencrypt-backend if letsencrypt-acl
   default_backend http_backend

backend http_backend
   http-response set-header Strict-Transport-Security "max-age=15778463 includeSubDomains; preload;"
   server webserver 10.20.1.25:80 check

frontend https_backend
   bind *:443 ssl crt-list /etc/ssl/crt-list.txt alpn h2,http/1.1
   reqadd X-Forwarded-Proto:\ https
   default_backend http_backend

backend unifi_backend
   server unifi 10.20.1.11:8080 check

backend unms_backend
   server unms 10.20.1.12:80 check

backend quake_backend
   server q3a 10.20.1.5:27960 check

backend letsencrypt-backend
   server letsencrypt 127.0.0.1:8888