Config with more frontends

# This configuration creates a classical reverse-proxy and load balancer for
# public services. It presents ports 80 and 443 (with 80 redirecting to 443),
# enables caching up to one hour, and load-balances the service on a farm of
# 4 servers on private IP addresses which are checked using HTTP checks and
# by maintaining stickiness via session cookies. It offloads TLS processing
# and enables HTTP compression. It uses HAProxy 2.4.

# The global section deals with process-wide settings (security, resource usage)
global
        nbthread 2
    # intermediate security for SSL, from https://ssl-config.mozilla.org/
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

# default settings common to all HTTP proxies below
defaults http
    mode http
    option httplog
    log global
    timeout client 1m
    timeout server 1m
    timeout connect 10s
    timeout http-keep-alive 2m
    timeout queue 15s
    timeout tunnel 4h  # for websocket

# provide a stats page on port 8181
frontend stats
    bind :8181
    # provide advanced stats (ssl, h2, ...)
    stats uri /
    stats show-modules
    # some users may want to protect the access to their stats and/or to
    # enable admin mode on the page from local networks
    #  stats auth admin:mystats
    #  stats admin if { src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.0/8 }

# First incoming public service. Supports HTTP/1.x, HTTP/2, and HTTP/3 over
# QUIC when built in, uses HSTS, redirects clear to TLS. Uses a dedicated host
# name for the stats page.
frontend pub1
    bind :8080 name clear
    option socket-stats  # provide per-bind line stats

    # set HSTS for one year after all responses
    http-after-response set-header Strict-Transport-Security "max-age=31536000"
    http-request redirect scheme https code 301 if !{ ssl_fc }

    # silently ignore connect probes and pre-connect without request
    option http-ignore-probes

    # pass client's IP address to the server and prevent against attempts
    # to inject bad contents
    http-request del-header x-forwarded-for
    option forwardfor

    # enable HTTP compression of text contents
    compression algo deflate gzip
    compression type text/ application/javascript application/xhtml+xml image/x-icon

    default_backend app1

frontend pub2
        bind :8081 name clear
        option socket-stats  # provide per-bind line stats

        # set HSTS for one year after all responses
        http-after-response set-header Strict-Transport-Security "max-age=31536000"
        http-request redirect scheme https code 301 if !{ ssl_fc }

        # silently ignore connect probes and pre-connect without request
        option http-ignore-probes

        # pass client's IP address to the server and prevent against attempts
        # to inject bad contents
        http-request del-header x-forwarded-for
        option forwardfor

        # enable HTTP compression of text contents
        compression algo deflate gzip
        compression type text/ application/javascript application/xhtml+xml image/x-icon

        default_backend app2


backend app2
        # Algorithm:
        #  - roundrobin is usually better for short requests,
        #  - leastconn is better for mixed slow ones, and long transfers,
        #  - random is generally good when using multiple load balancers
        balance random

        # abort if the client clicks on stop.
        option abortonclose

        # insert a session cookie for user stickiness
        cookie app1 insert indirect nocache

        # do not overload the servers (100 concurrent conns max each)
        server srv1 127.0.0.1:80 cookie s1

# First application
backend app1
    # Algorithm:
    #  - roundrobin is usually better for short requests,
    #  - leastconn is better for mixed slow ones, and long transfers,
    #  - random is generally good when using multiple load balancers
    balance random

    # abort if the client clicks on stop.
    option abortonclose

    # insert a session cookie for user stickiness
    cookie app1 insert indirect nocache

    # do not overload the servers (100 concurrent conns max each)
    server srv1 127.0.0.1:8081 cookie s1