default['haproxy']['share_stats_auth'] = 'admin:70c497a653eb22584ea30f5506d96967'

default['haproxy']['frontends']['internal']['acl_lines'] = [
  'forbidden_path path_beg /alfresco/s/enterprise/admin',
  'forbidden_path path_beg /alfresco/s/api/admin/jmxdump',
  'forbidden_path path_beg /alfresco/service/enterprise/admin',
  'forbidden_path path_beg /alfresco/service/api/admin/jmxdump'
]

default['haproxy']['frontends']['internal']['other_config'] = [
  'http-request deny if forbidden_path'
]

default['haproxy']['frontends']['external']['acl_lines'] = [
  'is_root path_reg ^$|^/$',
  'alfresco_path path_reg ^/alfresco/.*',
  'robots path_reg ^/robots.txt$',
  'solr_path path_reg ^/share/.*/proxy/alfresco/api/solr/.*',
  'activity_path path_reg ^/share/-default-/proxy/alfresco/api/.*',
  'webinf path_reg ^/share/res/WEB-INF/.*',
  'forbidden_path path_beg /alfresco/s/enterprise/admin',
  'forbidden_path path_beg /alfresco/s/api/admin/jmxdump',
  'forbidden_path path_beg /alfresco/service/enterprise/admin',
  'forbidden_path path_beg /alfresco/service/api/admin/jmxdump'
]

default['haproxy']['frontends']['external']['other_config'] = [
  'http-request deny if robots',
  'http-request deny if solr_path',
  'http-request deny if activity_path',
  'http-request deny if webinf',
  'http-request deny if forbidden_path'
]

default['haproxy']['frontends']['httpsp']['entries'] = [
  'bind 127.0.0.1:5140',
  'mode tcp',
  'option socket-stats',
  'option tcplog',
  'default_backend syslogp'
]

default['haproxy']['backends']['roles']['syslogp']['entries'] = [
  'mode tcp',
  'option tcplog',
  'balance roundrobin',
  'option forceclose',
  'option httpclose',
  'option ssl-hello-chk',
  'server localhost 127.0.0.1:514 check-ssl verify none'
]

default['haproxy']['frontends']['http']['acls']['S3'] = ['path_reg ^/robots.txt$']
default['haproxy']['backends']['roles']['S3']['entries'] = [
  'reqirep  ^Host:   Host:\\ s3.amazonaws.com',
  'reqrep  ^([^\\ ]*)\\ /(.*) \\1\\ /alfresco-static/\\2',
  'server CDN  s3.amazonaws.com:80 check inter 5000',
  'reqidel ^Authorization:.*'
]

default['haproxy']['acls'] = [
  'is_root path_reg ^$|^/$',
  "is_my hdr_beg(host) -i #{node['alfresco']['public_hostname']}",
  'alfresco_api path_reg ^/share/-default-/proxy/alfresco/api/.*',
  'webinf path_reg ^/share/res/WEB-INF/.*'
]

default['haproxy']['other_config'] = [
  '# Changes to header responses',
  'rspadd Strict-Transport-Security:\\ max-age=15768000',
  '# Blocked paths',
  'http-request deny if webinf',
  'http-request deny if is_solr is_my',
  'http-request deny if alfresco_api is_my'
]

default['haproxy']['enable_local_logging'] = true
default['haproxy']['logging_json_enabled'] = true
default['haproxy']['enable_rsyslog_server'] = false
