---

global
    log /dev/log local0
    log /dev/log local1 notice

    maxconn 8000
    chroot /var/lib/haproxy
    master-worker
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

    tune.ssl.default-dh-param 2048


defaults
    log global
    mode http
    option httplog
    option dontlognull

    retries 3
    timeout connect 5s
    timeout http-keep-alive 1s
    timeout http-request 15s
    timeout queue 30s
    timeout client 300s
    timeout server 300s

    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http


# ---------------------------------------------------------------------
# HAProxy Monitoring
# ---------------------------------------------------------------------
listen stats
    bind :1111
    mode http
    option forwardfor
    option http-server-close
    stats enable
    stats uri /
    stats refresh 5s
    stats show-legends
    stats realm Haproxy\ Statistics
    stats auth admin:1password2$


# -------------------
# FrontEnd Begins
# -------------------
frontend fe_mail
    bind *:80
    http-response set-header X-Frame-Options SAMEORIGIN
    http-response set-header X-Content-Type-Options nosniff
    http-response set-header Strict-Transport-Security max-age=63072000
    option forwardfor
    # Allow Exchange Admin Center to certain private network only
    acl private_network src 10.3.3.0/24 10.3.2.0/24
    acl ecp_req path_beg -i /ecp
    http-request deny if ecp_req !private_network

    redirect scheme https code 301 if !{ ssl_fc }

    bind *:443 ssl crt /etc/haproxy/proxy.pem alpn h2,http/1.1

    acl xmail hdr(host) -i mail.riskstudio.ru autodiscover.riskstudio.ru mail.corp.local mail.remind.ru autodiscover.remind.ru

    acl autodiscover path_beg -i /Autodiscover /autodiscover
    acl mapi         path_beg -i /mapi
    acl rpc          path_beg -i /rpc
    acl owa          path_beg -i /owa /OWA
    acl eas          path_beg -i /Microsoft-Server-ActiveSync /Microsoft-Server-activeSync
    acl ews          path_beg -i /EWS /ews
    acl oab          path_beg -i /OAB
    acl default_for_mail path_beg -i /


    acl internal_networks src 10.1.0.0/16 10.2.0.0/16 10.3.0.0/16 10.100.0.0/24

    http-request deny if mapi !internal_networks

    use_backend be_ex2019_owa          if xmail owa
    use_backend be_ex2019_autodiscover if xmail autodiscover
    use_backend be_ex2019_mapi         if xmail mapi
    use_backend be_ex2019_activesync   if xmail eas
    use_backend be_ex2019_ews          if xmail ews
    use_backend be_ex2019_rpc          if xmail rpc
    use_backend be_ex2019_ecp          if xmail ecp_req
    use_backend be_ex2019_default      if xmail default_for_mail


frontend fe_ex2019_25
    bind *:25 
    mode tcp
    option tcplog
    default_backend bk_ex2019_25 

#frontend fe_exchange_587
#    bind *:587
#    mode tcp
#    option tcplog
#    default_backend bk_exchange_587
#
#frontend fe_exchange_993
#    bind *:993
#    mode tcp
#    option tcplog
#    default_backend bk_exchange_993
#
#frontend fe_exchange_995
#    bind *:995
#    mode tcp
#    option tcplog
#    default_backend bk_exchange_995

#------------------------------
# Back-end section
#------------------------------
backend be_ex2019_autodiscover
    mode http
    option httpchk GET /autodiscover/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_mapi
    mode http
    balance source
    option httpchk GET /mapi/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    option http-keep-alive
    option prefer-last-server
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_rpc
    mode http
    balance source
    option httpchk GET /rpc/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_owa
    mode http
    balance source
    option httpchk GET /owa/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_activesync
    mode http
    option httpchk GET /microsoft-server-activesync/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_ews
    mode http
    balance source
    option httpchk GET /ews/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_ecp
    mode http
    balance source
    option httpchk GET /ecp/healthcheck.htm
    option log-health-checks
    http-check expect status 200
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend be_ex2019_default
    mode http
    balance source
    server rumow11ex01v rumow11ex01v.corp.local:443 check maxconn 1000 ssl verify none
    server rumow11ex02v rumow11ex02v.corp.local:443 check maxconn 1000 ssl verify none

backend bk_ex2019_25
    mode tcp
    source 0.0.0.0 usesrc clientip
    server rumow11ex01v rumow11ex01v.corp.local:25 check 
    server rumow11ex02v rumow11ex02v.corp.local:25 check

#backend bk_exchange_587
#    mode tcp
#    server rumow11ex01v rumow11ex01v.corp.local:587 check maxconn 1000 ssl verify none
#    server rumow11ex02v rumow11ex02v.corp.local:587 check maxconn 1000 ssl verify none
#
#backend bk_exchange_993
#    mode tcp
#    server rumow11ex01v rumow11ex01v.corp.local:993 check maxconn 1000 ssl verify none
#    server rumow11ex02v rumow11ex02v.corp.local:993 check maxconn 1000 ssl verify none
#
#backend bk_exchange_995
#    mode tcp
#    server rumow11ex01v rumow11ex01v.corp.local:995 check maxconn 1000 ssl verify none
#    server rumow11ex02v rumow11ex02v.corp.local:995 check maxconn 1000 ssl verify none