# HAProxy TCP mode for SSL termination with PROXY Protocol v2
# Usage: haproxy -f /path/to/haproxy-stream.cfg
#
# This is Layer 4 (TCP) proxying - no HTTP inspection, just SSL termination.
# More efficient than HTTP mode when you only need SSL termination.
#
# PROXY Protocol v2 preserves:
#   - Real client IP address (REMOTE_ADDR)
#   - SSL/TLS connection info (PP2_TYPE_SSL TLV)
#   - Destination port (for https scheme inference)
#
# Backend options:
#   plackup -s Feersum -p 5000 --keepalive --proxy-protocol app.psgi
#
# Or native:
#   $feersum->set_proxy_protocol(1);
#   $feersum->set_keepalive(1);

global
    log stdout format raw local0
    maxconn 4096

    # SSL tuning
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2
    tune.ssl.default-dh-param 2048

defaults
    log     global
    mode    tcp          # TCP mode, not HTTP
    option  tcplog
    option  dontlognull

    # Timeouts
    timeout connect 5s
    timeout client  60s
    timeout server  60s

    retries 3

#=============================================================================
# Frontend: SSL termination
#=============================================================================
frontend ssl_front
    bind *:443 ssl crt /etc/ssl/certs/server.pem alpn h2,http/1.1

    # TCP keepalive
    option clitcpka

    default_backend feersum_tcp

#=============================================================================
# Frontend: Plain TCP (for testing)
#=============================================================================
frontend tcp_front
    bind *:8080

    option clitcpka

    default_backend feersum_tcp

#=============================================================================
# Backend: TCP to Feersum with PROXY Protocol v2
#=============================================================================
backend feersum_tcp
    mode tcp
    balance roundrobin

    # TCP keepalive to backend
    option srvtcpka

    # Health check (TCP connect)
    option tcp-check
    default-server check inter 5s fall 3 rise 2

    # PROXY Protocol v2 with SSL info (PP2_TYPE_SSL TLV)
    # This sends: client IP, destination port (443), and SSL/TLS status
    # Feersum will:
    #   - Set REMOTE_ADDR to real client IP
    #   - Set psgi.url_scheme to "https" (via PP2_TYPE_SSL or dst_port=443)
    server feersum1 127.0.0.1:5000 check send-proxy-v2-ssl
    # server feersum2 127.0.0.1:5001 check send-proxy-v2-ssl

    # Alternative: send-proxy-v2 (without SSL TLV, scheme inferred from port 443)
    # server feersum1 127.0.0.1:5000 check send-proxy-v2

#=============================================================================
# Backend: Unix socket with PROXY Protocol v2
#=============================================================================
backend feersum_unix
    mode tcp
    balance roundrobin
    option srvtcpka

    # Unix socket with PROXY Protocol v2 + SSL info
    server feersum_local /tmp/feersum.sock check send-proxy-v2-ssl

#=============================================================================
# Stats (optional)
#=============================================================================
frontend stats
    mode http
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
