global
    log stdout format raw local0 info
    maxconn 8192

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option forwardfor
    option redispatch
    retries 3
    timeout connect 5000
    timeout client 50000
    timeout server 50000

frontend https
    bind *:80
    bind *:443 ssl crt /usr/local/etc/haproxy/mshossa.pem alpn h2,http/1.1 ssl-min-ver TLSv1.2

    # Force HTTPS
    http-request redirect scheme https code 301 unless { ssl_fc }

    http-request set-header X-Forwarded-Proto https if { ssl_fc }

    # Security headers
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"
    http-response set-header X-Content-Type-Options "nosniff"
    http-response set-header X-Frame-Options "SAMEORIGIN"

    acl valid_method method PUT DELETE GET POST HEAD PATCH
    http-request deny if !valid_method

    # ACLs zuerst deklarieren
    acl is_trusted          src         178.19.224.210 152.53.159.169
    acl is_public           hdr(host)   -i mshossa.de
    acl is_stats            hdr(host)   -i stats.mshossa.de
    acl is_seafile          hdr(host)   -i ftp.mshossa.de
    acl is_gitea            hdr(host)   -i gitea.mrhossa.de
    acl is_seafile_login    path_beg    /accounts/login /api2/auth-token

    stick-table type ip size 100k expire 60s store http_req_rate(60s)

    # Allgemeines Limit (nicht für Seafile, dort erzeugen Sync-Clients viele Requests)
    http-request track-sc0 src
    acl rate_too_high sc0_http_req_rate gt 240
    http-request deny deny_status 429 if rate_too_high !is_trusted !is_seafile

    # Strengeres Limit nur für Seafile-Logins
    http-request track-sc1 src table st_seafile_login if is_seafile is_seafile_login
    acl login_rate_too_high sc1_http_req_rate gt 10
    http-request deny deny_status 429 if is_seafile is_seafile_login login_rate_too_high !is_trusted

    use_backend stats            if is_stats
    use_backend seafile          if is_seafile
    use_backend web_gitea        if is_gitea

    default_backend seafile

backend st_seafile_login
    stick-table type ip size 100k expire 5m store http_req_rate(1m)

backend seafile
    timeout server 300s
    server seafile 172.30.0.12:80 check

backend web_gitea
    server gitea 172.30.0.13:3000 check

backend stats
    stats enable
    stats uri /
    stats realm Haproxy\ Statistics
    stats auth worker:bBHofurUJWKzPE8Z
    acl is_trusted src 178.19.224.210
    stats admin if TRUE is_trusted

# backend web_public: hier muss dein bestehendes Backend stehen