global
  log stdout format raw local0
  maxconn 100000
  tune.http.logurilen 4096
  tune.ssl.default-dh-param 2048
  ssl-default-bind-options no-tlsv10 no-tlsv11
  ssl-default-server-options no-tlsv10 no-tlsv11
  # --- CROWDSEC SPOA START ---
  tune.bufsize 65536
  lua-prepend-path /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/?.lua
  tune.lua.bool-sample-conversion normal
  lua-load /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/crowdsec.lua
  setenv CROWDSEC_BAN_TEMPLATE_PATH /var/lib/crowdsec-haproxy-spoa-bouncer/html/ban.html
  setenv CROWDSEC_CAPTCHA_TEMPLATE_PATH /var/lib/crowdsec-haproxy-spoa-bouncer/html/captcha.html
  # --- CROWDSEC SPOA END ---

defaults
  log     global
  mode    http
  option  httplog
  timeout client  300s
  timeout server  300s
  timeout connect 5s
  default-server init-addr libc,none resolvers docker resolve-prefer ipv4
  # --- CROWDSEC SPOA START ---
  option http-buffer-request
  # --- CROWDSEC SPOA END ---

resolvers docker
  parse-resolv-conf
  resolve_retries 3
  timeout resolve 1s
  timeout retry   1s
  hold valid 10s

# -------- HTTP -> HTTPS --------
frontend fe_http
  bind :80
  mode http
  # --- CROWDSEC SPOA START ---
  filter spoe engine crowdsec config /usr/local/etc/haproxy/crowdsec.cfg
  acl body_within_limit req.body_size -m int le 51200
  http-request send-spoe-group crowdsec crowdsec-http-body if body_within_limit || !{ req.body_size -m found }
  http-request send-spoe-group crowdsec crowdsec-http-no-body if !body_within_limit { req.body_size -m found }
  # --- CROWDSEC SPOA END ---
  http-request redirect scheme https code 301 unless { ssl_fc }

# -------- HTTPS (SNI) ----------
frontend fe_https
  bind :443 ssl crt /etc/haproxy/certs alpn h2,http/1.1
  mode http
  option forwardfor header X-Forwarded-For if-none
  # Сохраняем request-phase поля в txn.*, потому что log-format выполняется на response-phase
  http-request set-var(txn.host)   req.hdr(Host),lower
  http-request set-var(txn.path)   path
  http-request set-var(txn.method) method
  log-format "%{+json}o %(client_ip)ci %(client_port)cp %(frontend_name)ft %(backend_name)b %(server_name)s %(host)[var(txn.host)] %(method)[var(txn.method)] %(path)[var(txn.path)] %(status_code)ST %(bytes_read)B %(time_to_receive)TR %(time_waiting)Tw %(time_to_connect)Tc %(time_server_response)Tr %(time_active)Ta %(termination_state)tsc %(request_line)r %(sni)[ssl_fc_sni]"
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-For %[src]
  http-request set-header X-Forwarded-Port 443
  http-request set-header X-Forwarded-Host %[req.hdr(host)]
  http-request set-header Host %[req.hdr(host)]
  http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  http-response set-header X-Content-Type-Options "nosniff"
  http-response set-header X-Frame-Options "SAMEORIGIN"
  http-response set-header Referrer-Policy "strict-origin-when-cross-origin"
  # --- CROWDSEC SPOA START ---
  filter spoe engine crowdsec config /usr/local/etc/haproxy/crowdsec.cfg
  acl body_within_limit req.body_size -m int le 51200
  http-request send-spoe-group crowdsec crowdsec-http-body if body_within_limit || !{ req.body_size -m found }
  http-request send-spoe-group crowdsec crowdsec-http-no-body if !body_within_limit { req.body_size -m found }

  http-request set-header X-Crowdsec-Remediation %[var(txn.crowdsec.remediation)]
  http-request redirect code 302 location %[url] if { var(txn.crowdsec.remediation) -m str "allow" } { var(txn.crowdsec.redirect) -m found }

  http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "captcha" }
  http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "ban" }

  http-after-response set-header Set-Cookie %[var(txn.crowdsec.captcha_cookie)] if { var(txn.crowdsec.captcha_status) -m found } { var(txn.crowdsec.captcha_cookie) -m found }
  http-after-response set-header Set-Cookie %[var(txn.crowdsec.captcha_cookie)] if { var(txn.crowdsec.captcha_cookie) -m found } !{ var(txn.crowdsec.captcha_status) -m found }
  # --- CROWDSEC SPOA END ---
  # Keycloak passthrough
  acl host_sso  hdr(host) -i sso.zk-tech.info
  # OnlyOffice engine
  acl host_of hdr(host) -i of.zk-tech.info
  # Jellyfin
  acl host_jellyfin hdr(host) -i jf.zk-tech.info
  # NextCloud
  acl host_nc hdr(host) -i nc.zk-tech.info
  # Immich
  acl host_immich hdr(host) -i im.zk-tech.info
  # Firefly III
  acl host_firefly hdr(host) -i ff.zk-tech.info 
  # Obsidian + CouchDB
  acl host_obsidian hdr(host) -i ob.zk-tech.info
  # Speedtest
  acl host_speedtest hdr(host) -i st.zk-tech.info
  # WUD + docker-socket-proxy
  acl host_wud hdr(host) -i wud.zk-tech.info
  acl allowed_wud src 172.19.0.0/16
  # Arr stack (media server)
  acl host_sonarr  hdr(host) -i sr.zk-tech.info
  acl host_radarr  hdr(host) -i rr.zk-tech.info
  acl host_qb      hdr(host) -i qb.zk-tech.info
  acl host_prowl   hdr(host) -i pr.zk-tech.info
  # Torrserver
  acl host_torrserv hdr(host) -i ts.zk-tech.info
  # Matrix (synapse, elements
  acl host_matrix hdr(host) -i mr.zk-tech.info
  acl path_synapse path_beg -i /_matrix /_synapse/client
  acl path_wellknown path_beg -i /.well-known/matrix
  # MAS
  acl host_mas hdr(host) -i ms.zk-tech.info
  # Rackula SSO
  acl host_rk hdr(host) -i rk.zk-tech.info
  # Zabbix SSO
  acl host_zb hdr(host) -i zb.zk-tech.info
  # WikiJS
  acl host_wiki hdr(host) -i wiki.zk-tech.info
  # mailcow web + sogo + EAS
  acl host_mailcow hdr(host) -i mail.zk-tech.info autodiscover.zk-tech.info autoconfig.zk-tech.info
  # Enable admin from home network
  acl mc_admin_path path_beg -i /admin
  acl mc_admin_allowed src 172.19.0.0/16
  http-request deny if host_mailcow mc_admin_path !mc_admin_allowed
  # Grafana local
  acl host_grafana hdr(host) -i gr.zk-tech.info
  # Gitea
  acl host_gitea hdr(host) -i git.zk-tech.info
  # Wishlist APP
  acl host_wishlist hdr(host) -i wish.zk-tech.info
  # PrivateBin
  acl host_privatebin hdr(host) -i pb.zk-tech.info
  # Vaultwarden
  acl host_vaultwarden hdr(host) -i vw.zk-tech.info

  # Deny access to WUD
  http-request deny if host_wud !allowed_wud
  # Immich backend
  use_backend bk_immich if host_immich
  # Keycloak backend
  use_backend bk_keycloak   if host_sso
  use_backend bk_jellyfin if host_jellyfin
  use_backend bk_nextcloud if host_nc
  use_backend bk_onlyoffice if host_of
  use_backend bk_firefly if host_firefly
  use_backend bk_obsidian if host_obsidian
  use_backend bk_speedtest if host_speedtest
  use_backend bk_wud if host_wud
  # Arr stack backends
  use_backend be_sonarr  if host_sonarr
  use_backend be_radarr  if host_radarr
  use_backend be_qb      if host_qb
  use_backend be_prowl   if host_prowl
  # Torrserver backend
  use_backend bk_torr    if host_torrserv
  # MAS redirection
  # Matrix Auth (MAS compat) - ОБЯЗАТЕЛЬНО ПЕРЕД path_synapse
  acl path_matrix_auth path_reg -i ^/_matrix/client/(v1|v3|r0)/(login|logout|refresh)(/.*)?$
  # (опционально) если хочешь, чтобы запросы регистрации тоже обрабатывал MAS (иначе будут 403/404 от Synapse)
  #  acl path_matrix_register path_reg -i ^/_matrix/client/(v1|v3|r0)/register(/.*)?$
  use_backend bk_matrix_mas if host_matrix path_matrix_auth
  # use_backend bk_matrix_mas if host_matrix path_matrix_register
  # Matrix (Synapse, Element)
  use_backend bk_matrix_synapse if host_matrix path_synapse
  use_backend bk_matrix_synapse if host_matrix path_wellknown
  use_backend bk_matrix_element if host_matrix
  #MAS
  use_backend bk_matrix_mas if host_mas
  # Rackula Backend
  use_backend bk_rackula_sso if host_rk
  # Zabbix Backend
  use_backend bk_zabbix if host_zb
  # Wiki backend
  use_backend bk_wiki if host_wiki
  # mailcow backend
  use_backend bk_mailcow if host_mailcow
  # Grafana Backend
  use_backend be_grafana if host_grafana
  # Gitea backend
  use_backend bk_gitea if host_gitea
  # Wishlist backend
  use_backend bk_whishlist if host_wishlist
  # PricateBin backend
  use_backend bk_privatebin if host_privatebin
  # Vaultwarden backend
  use_backend bk_vaultwarden if host_vaultwarden

  default_backend bk_404

# -------- HTTP backends --------
backend bk_keycloak
  mode http
  option httpchk GET /realms/zk-tech/.well-known/openid-configuration
  http-request set-header X-Forwarded-Proto https
  server keycloak keycloak:8080 check resolvers docker resolve-prefer ipv4 inter 5s fall 4 rise 2

# OnlyOffice
backend bk_onlyoffice
  option httpchk
  http-check send meth GET uri /healthcheck ver HTTP/1.1 hdr Host of.zk-tech.info
  http-check expect status 200
  http-check expect string true
  http-response del-header X-Frame-Options
  http-response set-header Content-Security-Policy "frame-ancestors 'self' https://nc.zk-tech.info"
  timeout connect 5s
  timeout server  1h
  server oods onlyoffice-docs:80 check resolvers docker resolve-prefer ipv4 inter 5s fall 4 rise 2

# Jellyfin
backend bk_jellyfin
    option httpchk GET /health
    http-check expect string Healthy
    http-request set-header X-Forwarded-Host %[req.hdr(host)]
    http-request set-header X-Forwarded-Server %[req.hdr(host)]
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request set-header X-Real-IP %[src]
    server jellyfin-server 172.19.0.18:8096 check inter 5s fall 4 rise 2

# --- Бэкенд Immich ---
backend bk_immich
    mode http
    balance roundrobin
    option httpchk GET /.well-known/immich
    http-check expect status 200
    timeout check 5s
    server immich01 172.19.0.16:2283 check resolvers docker resolve-prefer ipv4 inter 5s fall 4 rise 2

#Nextcloud
backend bk_nextcloud
  balance uri
  option httpchk GET /status.php
  http-check expect status 200
  timeout connect 5s
  timeout server  600s
  server nc1 nextcloud:80 check resolvers docker resolve-prefer ipv4 init-addr libc,none inter 5s fall 4 rise 2
# Firefly III
backend bk_firefly
  mode http
#  option httplog
  option httpclose
  option forwardfor except 127.0.0.1
  # заголовки для корректной работы за прокси
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  # при желании можно добавить health-check:
  # option httpchk GET /login
  server firefly_iii 172.19.0.15:8051 check
# Obsidian + CouchDB
backend bk_obsidian
  mode http
#  option httplog
  option httpclose
  option forwardfor except 127.0.0.1
   # option httpchk GET /
   # http-check expect status 200
  server couchdb-obsidian couchdb-obsidian:5984 check
# Speedtest
backend bk_speedtest
  mode http
#  option httplog
  option httpclose
  option forwardfor except 127.0.0.1
   # option httpchk GET /
   # http-check expect status 200
  server openspeedtest openspeedtest:3000 check
# WUD
backend bk_wud
  mode http
  option httpchk GET /
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  server wud wud:3000 check
# Arr stack Sonarr
backend be_sonarr
  mode http
  option httpclose
  option forwardfor except 127.0.0.1
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  option httpchk GET /
  server sonarr 172.19.0.16:8989 check
# Arr stack Radarr
backend be_radarr
  mode http
  option httpclose
  option forwardfor except 127.0.0.1
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]

  option httpchk GET /
  server radarr 172.19.0.16:7878 check
# Arr stack qbittorrent
backend be_qb
  mode http
  option httpclose
  option forwardfor except 127.0.0.1
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  #option httpchk GET /
  server qbittorrent 172.19.0.16:8085 check
# Arr stack Prowlarr
backend be_prowl
  mode http
  option httpclose
  option forwardfor except 127.0.0.1
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  option httpchk GET /
  server prowlarr 172.19.0.16:9696 check
# Torrserver for multimedia
backend bk_torr
  mode http
  option httpclose
  option forwardfor except 127.0.0.1
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  option httpchk GET /
  server prowlarr 172.19.0.16:8090 check
# Matrix (synapse, Element, MAS)
backend bk_matrix_synapse
  server synapse matrix-synapse:8008 check
backend bk_matrix_element
  server element matrix-element-web:80 check
backend bk_matrix_mas
  server mas matrix-mas:8080 check

backend bk_404
  mode http
  http-request deny deny_status 404
# Rackula with auth
backend bk_rackula_sso
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  http-request set-header X-Forwarded-Port 443
  server oauth2proxy oauth2-proxy-rackula:4180 check
# Zabbix backend
backend bk_zabbix
  mode http
  option httpchk GET /index.php
  http-check expect status 200
  server zabbix-web zabbix-web-nginx-pgsql:8080 check
# WikiJS backend
backend bk_wiki
  mode http
  server wikijs wikijs:3000 check
# Crowdsec Backend
backend crowdsec-spoa
  mode tcp
  server spoa crowdsec-spoa-bouncer:9000 check
# mailcow web + sogo + EAS
backend bk_mailcow
  option forwardfor
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
  server mailcow 172.19.0.15:8085 check
# Grafana
backend be_grafana
  mode http
  option httpchk GET /api/health
  http-check expect status 200
  http-request set-header X-Forwarded-Proto https
  http-request set-header X-Forwarded-Port 443
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  server grafana grafana:3000 check resolvers docker resolve-prefer ipv4 init-addr libc,none
# Gitea
backend bk_gitea
  mode http
  option httpchk GET /api/healthz
  http-check expect status 200
  http-request set-header Host %[req.hdr(Host)]
  http-request set-header X-Forwarded-Proto https
  http-request set-header X-Forwarded-For %[src]
  http-request set-header X-Real-IP %[src]
  server gitea gitea:3000 check
# Wishlist
backend bk_whishlist
  mode http
#  option httpchk GET /api/healthz
#  http-check expect status 200
  http-request set-header Host %[req.hdr(Host)]
  http-request set-header X-Forwarded-Proto https
  http-request set-header X-Forwarded-For %[src]
  http-request set-header X-Real-IP %[src]
  server wishlist 172.19.0.16:3280
# PrivateBin
backend bk_privatebin
  mode http
  option forwardfor
  http-request set-header Host %[req.hdr(Host)]
  http-request set-header X-Forwarded-Proto https
  http-request set-header X-Forwarded-For %[src]
  http-request set-header X-Real-IP %[src]
  server privatebin privatebin:8080 check
# Vaultwarden
backend bk_vaultwarden
    mode http
    option forwardfor
    option http-keep-alive
    http-request set-header X-Real-IP %[src]
    http-request set-header X-Forwarded-Proto https
    http-request set-header X-Forwarded-Port 443
    option httpchk GET /alive
    http-check expect status 200
    timeout tunnel 1h
    server vaultwarden vaultwarden:80 check
# TEST string