# OpenWrt HAProxy example: TLS on :443, API paths to VM :3000, web to VM :80.
# Merge into /etc/haproxy.cfg on the router (adjust IPs as needed).
#
# Verify after reload:
#   curl -skI https://cyberhybridhub.com/v1/me/profile | head -3   # expect 401
#   curl -skI https://cyberhybridhub.com/ | head -3                 # expect 200

global
    log 127.0.0.1 local0
    maxconn 4096
    daemon

defaults
    mode http
    log global
    option httplog
    timeout connect 10s
    timeout client 30s
    timeout server 30s

frontend https_frontend
    bind *:443 ssl crt /etc/haproxy/certs/cyberhybridhub.pem alpn h2,http/1.1
    http-response set-header Strict-Transport-Security "max-age=15768000"
    acl host_cyberhybridhub hdr(host) -i cyberhybridhub.com
    acl host_www hdr(host) -i www.cyberhybridhub.com
    acl host_mygit hdr(host) -i mygit.cyberhybridhub.com
    acl path_api path_beg /v1 /hubs
    http-request deny deny_status 403 if !host_cyberhybridhub !host_www !host_mygit
    use_backend cyberhybridhub_api if host_cyberhybridhub path_api
    use_backend cyberhybridhub_api if host_www path_api
    use_backend cyberhybridhub_backend if host_cyberhybridhub
    use_backend cyberhybridhub_backend if host_www
    use_backend mygit_http if host_mygit

backend cyberhybridhub_backend
    mode http
    option forwardfor
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    server cyberhybridhub_server 10.10.101.106:80 check

backend cyberhybridhub_api
    mode http
    option forwardfor
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    timeout tunnel 1h
    server api 10.10.101.106:3000 check

backend mygit_http
    mode http
    option forwardfor
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    server mygit_server 10.10.101.5:80 check

frontend http_redirect
    bind *:80
    mode http
    http-request redirect scheme https code 301