# ramiel's front on 443 (ADR 0039, D3, D10): HAProxy reads the name a TLS connection
# asks for (SNI) and passes halkyon.li's, unopened, through the tunnel to its instance
# at home; every other name goes to ramiel's own Caddy on the loopback, which serves
# code.halkyon.app and halkyon.app as before. Both get the visitor's address in a PROXY
# header (v2). As /etc/haproxy/haproxy.cfg on ramiel; check it with
# `haproxy -c -f /etc/haproxy/haproxy.cfg`. Setting it up: forward/README.md.
#
# Nothing is logged: no `log` line, so neither the visitors of halkyon.li nor those of
# the forge are kept here (Caddy behind each side logs what it logs, as before).

global
	user haproxy
	group haproxy
	daemon
	maxconn 2000

defaults
	mode tcp
	timeout connect 5s
	# Jellyfin's streams, Serverpod's WebSockets and a forge's long clones stay open:
	# an hour without a byte either way, as a tunnel's idle time.
	timeout client 1h
	timeout server 1h
	timeout tunnel 1h

frontend tls
	bind :::443 v4v6
	# Wait for the ClientHello, which names the host; a connection that sends none
	# within 5 s goes to the local Caddy, which answers it as before.
	tcp-request inspect-delay 5s
	tcp-request content accept if { req.ssl_hello_type 1 }
	# halkyon.li's names exactly, as its DNS zone has them (D7): no wildcard, so no
	# other name reaches home.
	acl halkyon_li req.ssl_sni -i halkyon.li learn.halkyon.li todo.halkyon.li train.halkyon.li meditate.halkyon.li jellyfin.halkyon.li
	use_backend home if halkyon_li
	default_backend local

# halkyon.li's Caddy at home, at its address in the tunnel (D8), which it publishes
# 443 on alone.
backend home
	server balthasar 10.61.97.2:443 send-proxy-v2

# ramiel's own Caddy, moved off 443 (Caddyfile.halkyon-li).
backend local
	server caddy 127.0.0.1:8443 send-proxy-v2