haproxy.cfg

global
  log 127.0.0.1 local0
  log 127.0.0.1 local0 notice
  maxconn 131070
  ulimit-n 262500

defaults
  mode http
  log global

  timeout client           1m
  timeout connect          5s
  timeout server           1m
  timeout tunnel           1h
  timeout http-keep-alive  1s
  timeout http-request    15s
  timeout queue           30s
  timeout tarpit          60s

  default-server fastinter 1s downinter 1s

  option http-server-close
  option redispatch
  option httplog
  option dontlognull

  # Kubernetes handles this for client requests
  # option forwardfor


################################################################################
# This is for basic-auth
#    It will eventually point to a central auth server
#
userlist admins
  user admin insecure-password ${ADMIN_PASSWORD}

#################################################################################
# Stats service
#
listen stats
  bind 127.0.0.1:1936
  stats enable
  stats uri /
  stats realm Haproxy\ Statistics

#################################################################################
# All port 80 traffic goes trough here
#
#
frontend main_http
  bind 0.0.0.0:80
  maxconn 262500

  #################################
  # Service Worker no cache
  #
  http-response set-header Cache-Control no-cache,\ max-age=0 if { capture.req.uri -m beg /service_worker.js }

  ##################################
  # Rate Limiting
  #
  #

  # 15 req every 15min
  # acl path_api_login_recovery path_beg /login/recovery
  #
  # stick-table type ip size 1m expire 15m store http_req_rate(15m)
  #
  # tcp-request content track-sc0 src if path_api_login_recovery
  # acl is_abuser src_http_req_rate gt 15
  #
  # http-request deny if path_api_login_recovery is_abuser

  ##################################
  #        ================        #
  #        Internal Domains        #
  #        ================        #
  ##################################

  acl host_load_balancer hdr(host) -i load-balancer.kiln.wtf
  acl host_load_balancer_staging hdr(host) -i load-balancer-staging.kiln.wtf
  use_backend local_stats if host_load_balancer or host_load_balancer_staging

  # acl host_kue hdr(host) -i kue.kiln.wtf
  # acl host_kue_staging hdr(host) -i kue-staging.kiln.wtf
  # use_backend kue if host_kue
  # use_backend kue_staging if host_kue_staging

  ##################################
  #       =================        #
  #        Public  Domains         #
  #       =================        #
  ##################################

  acl host_free_roam hdr(host) -i freeroam.app
  acl host_free_roam_www hdr(host) -i www.freeroam.app
  acl host_free_roam_staging hdr(host) -i staging.freeroam.app

  acl host_free_roam_tile_server hdr(host) -i tileserver.freeroam.app

  acl host_free_roam_local_maps_tile_server hdr(host) -i localmaps.freeroam.app

  acl host_proudly_gives hdr(host) -i proudly.gives

  acl host_parade hdr(host) -i proudlygives.com

  acl host_substance hdr(host) -i substance.fdn.uno

  use_backend free_roam if host_free_roam or host_free_roam_www
  use_backend free_roam_staging if host_free_roam_staging

  use_backend free_roam_tile_server if host_free_roam_tile_server

  use_backend free_roam_local_maps_tile_server if host_free_roam_local_maps_tile_server

  use_backend proudly_gives if host_proudly_gives

  use_backend parade if host_parade

  use_backend substance if host_substance

  acl host_fundraise hdr(host) -i fundraise.techby.org
  use_backend fundraise if host_fundraise

  acl host_impact hdr(host) -i impact.techby.org
  use_backend impact if host_impact

  acl host_techby hdr(host) -i api.techby.org
  acl path_990_api path_beg /990/v1
  use_backend irs_990_api if host_techby path_990_api

  acl path_impact_api path_beg /impact/v1
  use_backend impact_api if host_techby path_impact_api

  acl host_techby hdr(host) -i techby.org
  use_backend techby if host_techby

  default_backend free_roam

  backend fundraise
    option httpchk /ping
    server app fundraise.production:8080 check

  backend impact
    option httpchk /ping
    server app impact.production:8080 check

  backend techby
    option httpchk /ping
    server app tech-by.production:8080 check

  backend irs_990_api
    option httpchk /ping
    # replace /api/990/v1
    reqrep ^([^\ ]*\ /)990/v1[/]?(.*)     \1\2
    server app irs-990-api.production:80 check

  backend impact_api
    option httpchk /ping
    # replace /api/990/v1
    reqrep ^([^\ ]*\ /)impact/v1[/]?(.*)     \1\2
    server app impact-api.production:80 check

#################################################################################
# Internal
#
#

backend local_stats
  acl auth_ok http_auth(admins)
  http-request auth unless auth_ok
  server serv1 127.0.0.1:1936

# backend kue
#   acl auth_ok http_auth(admins)
#   http-request auth unless auth_ok
#   server app kue.production:8080 check

# backend kue_staging
#   acl auth_ok http_auth(admins)
#   http-request auth unless auth_ok
#   server app kue.staging:8080 check

#################################################################################
# Public
#
#

backend free_roam
  option httpchk /ping
  server app free-roam.production:8080 check

backend free_roam_staging
  option httpchk /ping
  server app free-roam.staging:8080 check

backend free_roam_tile_server
  option httpchk /ping
  server app tile-server.production:8080 check

backend free_roam_local_maps_tile_server
  option httpchk /ping
  server app local-maps-tile-server.production:8080 check

backend proudly_gives
  option httpchk /ping
  server app proudly-gives.production:8080 check

backend parade
  option httpchk /ping
  server app parade.production:8080 check

backend substance
  option httpchk /ping
  server app substance.production:8080 check