haproxy_top.cfg

global
    log stdout format raw local0

    # log /dev/log    local0
    # log /dev/log    local1 notice
    # chroot /var/lib/haproxy
    # stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    # stats timeout 30s
    # user haproxy
    # group haproxy
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    # For more information, see ciphers(1SSL). This list is from:
    #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
    # An alternative list with additional directives can be obtained from
    #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3

defaults
    log global
    mode    http
    # option  httplog
    option  dontlognull
    timeout connect 5000
    timeout client  50000
    timeout server  50000
    errorfile 400 /usr/local/etc/haproxy/errors/400.http
    errorfile 403 /usr/local/etc/haproxy/errors/403.http
    errorfile 408 /usr/local/etc/haproxy/errors/408.http
    errorfile 500 /usr/local/etc/haproxy/errors/500.http
    errorfile 502 /usr/local/etc/haproxy/errors/502.http
    errorfile 503 /usr/local/etc/haproxy/errors/503.http
    errorfile 504 /usr/local/etc/haproxy/errors/504.http

frontend ccloud
        mode tcp
        bind *:9092
        bind *:443
        log global

        tcp-request inspect-delay 5s
        tcp-request content accept if { req.ssl_hello_type 1 }

###  Static SNI Config
        acl is_bootstrap req.ssl_sni -i BOOTSTRAP_HOSTNAME
        acl is_admin_api req.ssl_sni -i ADMIN_API_HOSTNAME
        use_backend bootstrap if is_bootstrap
        use_backend admin_api if is_admin_api

###  Dynamic SNI Config
        # acl is_brokerX req.ssl_sni -i bX-BOOTSTRAP_HOSTNAME
        # use_backend brokerX if is_brokerX