frontend ft_eva
	##################
	##### main
	bind *:@@@listen_http_private%%%
	bind *:@@@eva_http_port%%%
	bind *:@@@listen_https_private%%% alpn http/1.1 ssl crt @@@eva_domain%%%.pem name eva
	bind *:@@@eva_https_port%%% alpn http/1.1 ssl crt @@@eva_domain%%%.pem name eva

	## logs
	log global
	capture request header Host len 30
	capture request header User-Agent len 130
	capture request header Content-Length len 20
	capture request header Referer len 20
	
	##################
	##### acl для переменных

	## Авторизация Web или API
	acl acl_token_nginx_auth req.cook(nginx_auth_token) password123
	acl acl_token_session cook_reg(session_token) .+
	acl acl_token_access cook_reg(access_token) .+
	acl acl_header_x_eva hdr_reg(X-Eva-Token) .+
	acl acl_header_auth hdr_reg(Authorization) Bearer.+
	acl acl_path_api path_beg /api/

	## Microsift Office, LibreOffice, etc
	acl acl_msoffice hdr_reg(User-Agent) .*office
	acl acl_msoffice hdr_reg(User-Agent) .*Office

	##################
	##### vars

	## Авторизация
	http-request set-var(txn.has_auth) str('true') if acl_token_nginx_auth acl_token_access
	http-request set-var(txn.has_auth) str('true') if acl_token_nginx_auth acl_token_session
	http-request set-var(txn.has_auth) str('true') if acl_path_api acl_header_x_eva
	http-request set-var(txn.has_auth) str('true') if acl_path_api acl_header_auth
	acl acl_has_auth var(txn.has_auth) -m str 'true'
	http-request set-var(txn.redirect_type) str('msoffice') if acl_msoffice
	http-request set-var(txn.redirect_type) str('noauth') unless acl_has_auth || acl_msoffice

	## Используется для хедеров
	# nginx variable "$scheme"
	http-request set-var(req.scheme) str(https) if { ssl_fc }
	http-request set-var(req.scheme) str(http) if ! { ssl_fc }
	# nginx "if ($scheme = https ) { set $ssl on; }"
	http-request set-var(req.ssl) str(https) if { ssl_fc }

	# Websockets
	http-request set-var(txn.connection_upgrade_ws) str("upgrade")
	http-request set-var(txn.connection_upgrade_ws) str("") if { hdr_reg(Upgrade) str('') }

	##################
	##### Redirect HTTP to HTTPS
	@@@https_redirect_schema%%%http-request redirect code 302 scheme https unless { ssl_fc }

	##################
	##### Общие хедеры для всех бекендов
	http-request set-header X-Real-IP %ci
	http-request set-header X-Forwarded-For %ci
	http-request set-header Host %[req.hdr(host)]
	http-request set-header X-Forwarded-Proto %[var(req.scheme)]
	http-request set-header HTTPS %[var(req.scheme)]
	http-request set-header X-Forwarded-HTTPS %[var(req.ssl)]
	http-request set-header X-Forwarded-Port %cp

	##################
	######### location в nginx
	use_backend unauth_webforms if { path /favicon.ico /js/webform/webform.js cmf-service-worker.js }
	use_backend unauth_webforms if { path_dir plugins sso drawio pub docs share files tinymce }
	use_backend unauth_webforms if { path_beg /crm/forms/CmfForm /app/assets/ /socket.io/ }
	use_backend unauth_webforms if { path_reg \/forms\/CmfForm:.*html$ \/ngsw-worker.js.*$ \/styles.*.css$ }
	use_backend unauth_webforms if { path_reg ^.*(styles|vendor|runtime|polyfills|main).*\.js$ }
	use_backend rdisk_file if { path_beg /rdisk/file }
	use_backend webdav if { path_beg /webdav }
	use_backend static if { path_beg /static }
	use_backend auth if { path_beg /auth }
	use_backend health_check if { path_beg /health_check }
	use_backend servicedesk if { path_beg /servicedesk }
	use_backend servicedesk_auth if { path_beg /servicedesk/auth }
	default_backend bk_eva

backend bk_eva
	acl acl_redirect_type_noauth var(txn.redirect_type) -m str 'noauth'
	acl acl_redirect_type_office var(txn.redirect_type) -m str 'msoffice'

	http-request redirect location /auth/not_authorized?next_url=%[capture.req.uri] if acl_redirect_type_noauth
	http-request return status 302 if acl_redirect_type_noauth
	http-request return status 200 content-type "text/plain" lf-string 'Nginx. MS Office blank page. Open this page in browser.' if acl_redirect_type_office

	# Для поддержки WebSocket
	option http-keep-alive
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]

	http-request set-header Connection %[var(req.ssl)]

	server eva-main 127.0.0.1:8080


backend rdisk_file
	acl acl_has_auth var(txn.has_auth) -m str 'true'
	http-request redirect location /auth/not_authorized?next_url=%[capture.req.uri] if ! acl_has_auth
	http-request return status 302 if ! acl_has_auth

	# nginx expires epoch;
	http-request set-header Expires 0
	http-request set-header Cache-Control no-cache

	option http-keep-alive
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]

	server eva-main 127.0.0.1:8080

# Веб-формы открываются неавторизованными пользователями
backend unauth_webforms
	http-request set-header X-Forwarded-User %[req.hdr(Authorization)]

	option http-keep-alive
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]

	server eva-main 127.0.0.1:8080

backend webdav
	server eva-main 127.0.0.1:8081

backend static
	http-request set-header Cache-Control private,max-age=259200

	# Для поддержки WebSocket
	option http-keep-alive
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]

	server eva-main 127.0.0.1:8080


backend auth
	# Для поддержки WebSocket
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]
	server eva-main 127.0.0.1:8080


backend health_check
	# Для поддержки WebSocket
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]

	server eva-main 127.0.0.1:8080


backend servicedesk
	# if ($has_auth = "FALSE") {
	# 	rewrite ^ https://$http_host/servicedesk/auth/signin?next_url=$scheme://$http_host$request_uri redirect;
	# }
	# Для поддержки WebSocket
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]

	server eva-main 127.0.0.1:8080


backend servicedesk_auth
	# Для поддержки WebSocket
	http-request set-header Upgrade %[var(req.scheme)]
	http-request set-header Connection %[var(txn.connection_upgrade_ws)]
	
	server eva-main 127.0.0.1:8080
