global
  log /dev/log    local0
  log /dev/log    local1 notice
  chroot /var/lib/haproxy
  #stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  stats socket /var/lib/haproxy/stats
  stats timeout 30s
  user haproxy
  group haproxy
  daemon

  # Default SSL material locations
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private

  # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
  ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
  ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
  ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
  tune.ssl.default-dh-param 2048
  tune.h2.initial-window-size 1048576

defaults
  log global
  mode    http
  option  httplog
  option  dontlognull
  timeout connect 5000
  timeout client 50000
  timeout server 50000
{% if ansible_os_family == 'Debian' %}
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 403 /etc/haproxy/errors/403.http
  errorfile 408 /etc/haproxy/errors/408.http
  errorfile 500 /etc/haproxy/errors/500.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http
{% endif %}

frontend ssh-in
  mode tcp
  bind {{ haproxy_shared_ip }}:22
  timeout connect 0ms
  timeout client 0ms
  timeout server 0ms
  use_backend example-ssh-backend

frontend http-in
  mode http
  bind {{ haproxy_shared_ip }}:80
  
  use_backend example-http-backend

frontend https-in
  mode tcp
  tcp-request inspect-delay 1s
  bind {{ haproxy_shared_ip }}:443
  tcp-request content accept if { req.ssl_hello_type 1 }

  use_backend example-https-backend

backend example-ssh-backend
  mode                    tcp
  timeout connect         0ms
  timeout client          0ms
  timeout server          0ms
  server                  example 10.1.1.11:22 check

backend example-http-backend
  mode                    http
  log                     global
  timeout connect         30000
  timeout server          30000
  retries                 3
  server                  example 10.10.2.11:80 check

backend example-https-backend
  mode                    tcp
  log                     global
  timeout connect         30000
  timeout server          30000
  retries                 3
  server                  example 10.10.2.11:443 check