# HAProxy configuration
# M. Haim, 30-Oct-2014
global
	daemon
	maxconn 256
	tune.ssl.default-dh-param 2048
	# set default parameters to the Intermediate configuration
	# see https://wiki.mozilla.org/Security/Server_Side_TLS
	ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

defaults
	mode http
	timeout connect 5000ms
	timeout client 50000ms
	timeout server 50000ms
	option forwardfor
### Monitoring ##################################################
listen stats *:1936
	stats enable
	stats uri /
	stats hide-version
	stats auth ha:passwd

### Frontends ###################################################

### porta 80 para o apache -  HTTP:80 ###
frontend http
	bind *:10080
	redirect scheme https code 301 if !{ ssl_fc }

### HTTPS:443 ###
frontend https
	bind *:10443 ssl no-sslv3 crt /etc/haproxy/pem/idp1v3-apache.pem
	# Enable this if your want HSTS (recommended)
	rspadd  Strict-Transport-Security:\ max-age=15768000
	reqadd X-Forwarded-Proto:\ https
	# check url:
	acl url_idp path_beg /idp
	# check cookie:
	acl cookie_idpv3 cook(_preselect_) idpv3
	acl cookie_idp2v3 cook(_preselect_) idp2v3
	use_backend tomcat-8080-idpv3 if url_idp cookie_idpv3
	use_backend tomcat-8080-idp2v3 if url_idp cookie_idp2v3
	use_backend tomcat-8080 if url_idp
	default_backend apache-443

### HTTPS:8443 ###
frontend https-soap
	bind *:18443 ssl no-sslv3 verify optional crt /etc/haproxy/pem/idp1v3-apache.pem ca-file /etc/haproxy/pem/idp1v3-apache.pem
	# Enable this if your want HSTS (recommended)
	rspadd  Strict-Transport-Security:\ max-age=15768000
	http-request set-header X-SSL			%[ssl_fc]
	http-request set-header X-SSL-Client-Verify	%[ssl_c_verify]
	http-request set-header X-SSL-Client-SHA1	%{+Q}[ssl_c_sha1]
	http-request set-header X-SSL-Client-DN		%{+Q}[ssl_c_s_dn]
	http-request set-header X-SSL-Client-CN		%{+Q}[ssl_c_s_dn(cn)]
	http-request set-header X-SSL-Issuer		%{+Q}[ssl_c_i_dn]
	http-request set-header X-SSL-Client-Not-Before	%{+Q}[ssl_c_notbefore]
	http-request set-header X-SSL-Client-Not-After	%{+Q}[ssl_c_notafter]
        # Since HAproxy 1.5.8: Client Cert forwarding
        # See http://comments.gmane.org/gmane.comp.web.haproxy/18796
        http-request add-header X-SSL-Client-Cert -----BEGIN\ CERTIFICATE-----\ %[ssl_c_der,base64]\ -----END\ CERTIFICATE-----\ # don't forget last space
	reqadd X-Forwarded-Proto:\ https
	acl url_idp path_beg /idp
	use_backend tomcat-8443 if url_idp
	default_backend apache-443

	
### Backends ###################################################

### Apache (www endpoint) ###
backend apache-443
	balance roundrobin
	server idpv3 idpv3.fedexpresso.edu.br:443 check
	server idp2v3 idp2v3.fedexpresso.edu.br:443 check

backend apache-443-idpv3
	server idpv3 idpv3.fedexpresso.edu.br:443 check

backend apache-443-idp2v3
	server idp2v3 idp2v3.fedexpresso.edu.br:443 check

### Shibboleth IdP (www endpoint) ###
backend tomcat-8080
	balance roundrobin
	# Stick to Java session cookie:
	appsession JSESSIONID len 52 timeout 1h
	server idpv3 idpv3.fedexpresso.edu.br:8080 check
	server idp2v3 idp2v3.fedexpresso.edu.br:8080 check

backend tomcat-8080-idpv3
	server idpv3 idpv3.fedexpresso.edu.br:8080 check

backend tomcat-8080-idp2v3
	server idp2v3 idp2v3.fedexpresso.edu.br:8080 check

### Shibboleth IdP (SOAP endpoint) ###
backend tomcat-8443
	balance roundrobin
	# Stick to Java session cookie:
	appsession JSESSIONID len 52 timeout 1h
	server idpv3 idpv3.fedexpresso.edu.br:8443 check
	server idp2v3 idp2v3.fedexpresso.edu.br:8443 check