---
# Source: haproxy/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: certs-haproxy
  namespace: "kube-certs"
  labels:
    app.kubernetes.io/name: haproxy
    helm.sh/chart: haproxy-1.0.8
    app.kubernetes.io/instance: certs
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: haproxy
data:
  haproxy.cfg: |
    global
        log stdout format raw local0
        maxconn 4000
        # generated 2022-01-04, Mozilla Guideline v5.6, HAProxy 2.1, OpenSSL 1.1.1k, intermediate configuration
        # https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=intermediate&openssl=1.1.1k&guideline=5.6
        # intermediate configuration
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
    
        ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
    
        # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
        ssl-dh-param-file /usr/local/etc/haproxy/dhparam
    defaults
        mode http
    
        # See http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#option%20http-server-close
        option http-server-close
    
        log global
        option httplog
        option dontlognull
        option http-server-close
        option redispatch
        retries 3
        timeout http-request 10s
        timeout queue 1m
        timeout client 1m
        timeout server 1m
    
        timeout check 10s 
        maxconn 3000
    
        # From http://stackoverflow.com/questions/21419859/configuring-haproxy-to-work-with-server-sent-events
        # Set the max time to wait for a connection attempt to a server to succeed  
        timeout connect 30s
        # handle a client suddenly disappearing from the net
        timeout client-fin 30s
        option http-server-close
    
        errorfile 400 /usr/local/etc/haproxy/400.http
        errorfile 403 /usr/local/etc/haproxy/403.http
        errorfile 408 /usr/local/etc/haproxy/408.http
        errorfile 500 /usr/local/etc/haproxy/500.http
        errorfile 502 /usr/local/etc/haproxy/502.http
        errorfile 503 /usr/local/etc/haproxy/503.http
        errorfile 504 /usr/local/etc/haproxy/504.http
    frontend http-in
        bind            :80 name node-http
        mode            http
        redirect scheme https code 301 unless { path_beg /.well-known/acme-challenge/ }
        default_backend nodes-http
    backend nodes-http
        mode            http
        balance         roundrobin
        option          forwardfor
        http-request    set-header X-Forwarded-Port %[dst_port]
        http-request    add-header X-Forwarded-Proto https if { ssl_fc }
        server          ingress01-http ingress-nginx-controller.kube-ingress-nginx.svc.cluster.local:80 check inter 10000 send-proxy
    frontend https-in
        bind            :443 name node-https
        mode            tcp
        option          tcplog
        tcp-request     inspect-delay 5s
        tcp-request     content accept if { req.ssl_hello_type 1 }
        acl proto_tls   req.ssl_hello_type 1
        use_backend     nodes-https if proto_tls
        default_backend nodes-https
    backend nodes-https
        mode            tcp
        stick-table     type ip size 512k expire 30m
        stick on        dst
        balance         roundrobin
        server          ingress01-https ingress-nginx-controller.kube-ingress-nginx.svc.cluster.local:443 check inter 10000 send-proxy
  dhparam: |
    -----BEGIN DH PARAMETERS-----
    MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
    +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
    87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
    YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
    7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
    ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
    -----END DH PARAMETERS-----
  400.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
    
  403.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
    
  408.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
    
  500.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
    
  502.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
    
  503.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
    
  504.http: |
    HTTP/1.0 400 Bad request
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    
    <html><body><h1>400 Bad request</h1>
    Your browser sent an invalid request.
    </body></html>
