###############################################################################
##### haproxy.cfg created by puppet. manual changes will be overwritten.  #####
###############################################################################

global
<% if @hy_log_local0  == true -%>
    log         /dev/log local0
<% end -%>    
<% if @hy_log_local1  == true -%>
    log         /dev/log local1 notice
<% end -%>    
    chroot      <%= @hy_chroot %>
    pidfile     <%= @hy_pid %>
    maxconn     <%= @hy_maxconn %>
    user        <%= @hy_user_name %>
    group       <%= @hy_user_name %>
    daemon

<% if @hy_show_stats == true -%>
listen stats
    bind 127.0.0.1:8404  # Bind to localhost if only local access is needed
    mode http
    stats enable
    stats uri /haproxy?stats
    stats realm Strictly\ Private
    stats auth local_admin:jSAVu62MV+kr+>R.  # Use a strong password
    stats refresh 30s
    stats admin if TRUE  # Allow admin actions if logged in
<% end -%>

# utilize system-wide crypto-policies
    ssl-default-bind-ciphers PROFILE=SYSTEM
    ssl-default-server-ciphers PROFILE=SYSTEM

defaults
    mode                    <%= @hy_default_mode %>
    log                     global
<% if @hy_use_tcplog == true -%>
    option                  tcplog
<% end -%>
<% if @hy_use_httplog == true -%>
    option                  httplog
<% end -%>
<% if @hy_use_dontlognull == true -%>
    option                  dontlognull
<% end -%>
<% if @hy_use_http_server_close == true -%>
    option                  http-server-close
<% end -%>
<% if @hy_use_forward_for == true -%>
    option forwardfor       except 127.0.0.0/8
<% end -%>
<% if @hy_use_redispatch == true -%>
    option                  redispatch
<% end -%>
    retries                 <%= @hy_max_retries %>
    timeout http-request    <%= @hy_timeout_http_request %>
    timeout queue           <%= @hy_timeout_queue %>
    timeout connect         <%= @hy_timeout_connect %>
    timeout client          <%= @hy_timeout_client %>
    timeout server          <%= @hy_timeout_server %>
    timeout http-keep-alive <%= @hy_timeout_http_keep_alive %>
    timeout check           <%= @hy_timeout_check %>
    maxconn                 <%= @hy_maxconn %>

### custom rules below ###