haproxy-config

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    maxconn 2048
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option forwardfor
    option http-server-close
    timeout connect 5000
    timeout client 5000
    timeout server 5000

listen stats
    bind *:8181
    stats enable
    stats uri /
    stats realm Haproxy\ Statistics
    stats auth admin:9zmq893f

frontend homes
    bind *:80
    mode http
    timeout http-request 5s
    option forwardfor
    reqadd X-Forwarded-Proto:\ http

    # privetdrive
    acl is_privetdrive          hdr_end(host) -i www.privetdrive.net
    acl is_privetdrive          hdr_end(host) -i privetdrive.net
    acl is_unifi                hdr_end(host) -i unifi.privetdrive.net
    acl is_unms                 hdr_end(host) -i unms.privetdrive.net
    acl is_quake                hdr_end(host) -i quake.privetdrive.net

    # sundsvallbbq
    acl is_sundsvallbbq         hdr_end(host) -i sundsvallbbq.se
    acl is_sundsvallbbq         hdr_end(host) -i www.sundsvallbbq.se

    redirect scheme https if { hdr(Host) -i www.privetdrive.net } !{ ssl_fc }
    redirect scheme https if { hdr(Host) -i privetdrive.net } !{ ssl_fc }
    redirect scheme https if { hdr(Host) -i www.sundsvallbbq.se } !{ ssl_fc }
    redirect scheme https if { hdr(Host) -i sundsvallbbq.se } !{ ssl_fc }

    use_backend             webserver if is_privetdrive
    use_backend             webserver if is_sundsvallbbq
    use_backend             unifi if is_unifi
    use_backend             unms if is_unms
    use_backend             quake if is_quake

stats uri /haproxy?stats
    acl letsencrypt-acl path_beg /.well-known/acme-challenge/
    use_backend letsencrypt-backend if letsencrypt-acl
    default_backend http_backend

frontend https_homes
    bind *:443 ssl crt-list /etc/ssl/crt-list.txt alpn h2,http/1.1
    reqadd X-Forwarded-Proto:\ https
    acl is_privetdrive  hdr_end(host) -i privetdrive.net
    acl is_privetdrive  hdr_end(host) -i www.privetdrive.net
    acl is_sundsvallbbq hdr_end(host) -i sundsvallbbq.se
    acl is_sundsvallbbq hdr_end(host) -i www.sundsvallbbq.se
    use_backend     unifi if is_unifi
    use_backend     unms if is_unms
    use_backend     quake if is_quake
    default_backend homes_backend

backend homes_backend
    http-response set-header Strict-Transport-Security "max-age=15778463; includeSubDomains; preload;"
    server webserver 10.20.1.85:80 check

backend unifi
    server unifi 10.20.1.11:8443 check

backend unms
    server unms 10.20.1.12:80 check

backend quake
    server quake 10.20.1.5 check

backend letsencrypt-backend
    server letsencrypt 127.0.0.1:8888