{%- if server %} 
global
	log /dev/log	local0
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin
	stats timeout 30s
	user {{taskserv.run_user}}
	group {{taskserv.run_group}}
	daemon

	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private

	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
	log	global
	mode	http
	option	httplog
	option	dontlognull
    timeout connect 5000
    timeout client  50000
    timeout server  50000
	errorfile 400 /etc/haproxy/errors/400.http
	errorfile 403 /etc/haproxy/errors/403.http
	errorfile 408 /etc/haproxy/errors/408.http
	errorfile 500 /etc/haproxy/errors/500.http
	errorfile 502 /etc/haproxy/errors/502.http
	errorfile 503 /etc/haproxy/errors/503.http
	errorfile 504 /etc/haproxy/errors/504.http

frontend https-in
{%- for bind in taskserv.https_in_binds %} 
  {%- if bind.ip == "$network_private_ip" %}
  bind {{server.network_private_ip}}:{{bind.port}}
  {%- elif bind.ip == "$network_public_ip" and settings[server_pos] and settings[server_pos].ip_addresses.pub %}
  bind {{settings[server_pos].ip_addresses.pub}}:{{bind.port}}
  {%- elif bind.ip == "$network_internal_ip" and settings[server_pos] and settings[server_pos].ip_addresses.int %}
  bind {{settings[server_pos].ip_addresses.int}}:{{bind.port}}
  {%- elif bind.ip != "$network_internal_ip" %}
  bind {{bind.ip}}:{{bind.port}}
  {%- endif %}
{%- endfor %}
  mode tcp
{%- for option in taskserv.https_options %} 
  option {{option}}
{%- endfor %}
  #option tcplog
  #option dontlognull
  #log-format "%H %ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"
  log-format "{{taskserv.https_log_format}}"
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
{%- for backend in taskserv.backends %} 
  use_backend {{backend.name}} if { req_ssl_sni -i {{backend.ssl_sni}} }
{%- endfor %}

{%- for backend in taskserv.backends %} 
backend {{backend.name}} 
  mode {{backend.mode}} 
  balance {{backend.balance}} 
  option {{backend.option}} 
  {% if backend.server_host_ip == "$network_private_ip" -%}
  server {{backend.server_name}} {{server.network_private_ip}}:{{backend.server_port}} {{backend.server_ops}} 
  {%- elif backend.server_host_ip == "$network_public_ip" and settings[server_pos] and settings[server_pos].ip_addresses.pub -%}
  server {{backend.server_name}} {{settings[server_pos].ip_addresses.pub}}:{{backend.server_port}} {{backend.server_ops}} 
  {%- elif backend.server_host_ip == "$network_internal_ip" and settings[server_pos] and settings[server_pos].ip_addresses.int -%}
  server {{backend.server_name}} {{settings[server_pos].ip_addresses.int}}:{{backend.server_port}} {{backend.server_ops}} 
  {%- else -%}
  server {{backend.server_name}} {{backend.server_host_ip}}:{{backend.server_port}} {{backend.server_ops}} 
  {%- endif %}
{%- endfor %}

{%- endif %}