{%- set proxy_append_list = [('', 'Default proxy configuration')] %}
{%- if slave_parameter['prefer-gzip-encoding-to-backend'] %}
{%- do proxy_append_list.append(('prefer-gzip', 'Proxy which always overrides Accept-Encoding to gzip if such is found')) %}
{%- endif %} {#- if slave_parameter['prefer-gzip-encoding-to-backend'] #}
{%- if slave_parameter['path'].strip().strip('/') %}
{%-   set zope_path = slave_parameter['path'].strip().strip('/') ~ '/' %}
{%- else %}
{%-   set zope_path = '' %}
{%- endif %}
{%- set http_host_list = [] %}
{%- set https_host_list = [] %}
{%- for host in slave_parameter['host_list'] %}
{%-   do http_host_list.append('http://%s:%s' % (host, slave_parameter['http_port'] )) %}
{%-   do https_host_list.append('https://%s:%s' % (host, slave_parameter['https_port'] )) %}
{%- endfor %} {#- for host in slave_parameter['host_list'] #}

{%- macro proxy_header() %}
    timeout {{ slave_parameter['request-timeout'] }}s
    # force reset of X-Forwarded-For
    header_upstream X-Forwarded-For {remote}
    # workaround for lost connection to haproxy by reconnecting
    try_duration 3s
    try_interval 250ms
{%- endmacro %} {# proxy_header #}

{%- macro hsts_header(tls) %}
{%-   if tls %}
{%-     if slave_parameter['strict-transport-security'] > 0 %}
{%-       set strict_transport_security = ['max-age=%i' % (slave_parameter['strict-transport-security'],)] %}
{%-       if slave_parameter['strict-transport-security-sub-domains'] %}
{%-         do strict_transport_security.append('; includeSubDomains') %}
{%-       endif %}
{%-       if slave_parameter['strict-transport-security-preload'] %}
{%-         do strict_transport_security.append('; preload') %}
{%-       endif %}
    header_downstream Strict-Transport-Security "{{ ''.join(strict_transport_security) }}"
{%-     endif %}
{%-   endif %}
{%- endmacro %} {# hsts_header #}

{%- for tls in [True, False] %}
{%- if tls %}
{%-   set backend_url = slave_parameter.get('backend-https-url', slave_parameter['backend-http-url']) %}
# SSL enabled hosts
{{ https_host_list|join(', ') }} {
{%- else %}
{%-   set backend_url = slave_parameter['backend-http-url'] %}
# SSL-disabled hosts
{{ http_host_list|join(', ') }} {
{%- endif %}
  bind {{ slave_parameter['local_ipv4'] }}
{%- if tls %}
  tls {{ slave_parameter['certificate'] }} {{ slave_parameter['certificate'] }} {
{%- if slave_parameter['ciphers'] %}
    ciphers {{ slave_parameter['ciphers'] }}
{%- endif %}
{%- if slave_parameter['enable_h2'] %}
    # Allow http2
    alpn h2 http/1.1
{%- else %} {#- if slave_parameter['enable_h2'] #}
    # Disallow HTTP2
    alpn http/1.1
{%- endif %} {#- if slave_parameter['enable_h2'] #}
  } {# tls #}
{%- endif %} {#- if tls #}
  log / {{ slave_parameter['access_log'] }} "{remote} - {>REMOTE_USER} [{when}] \"{method} {uri} {proto}\" {status} {size} \"{>Referer}\" \"{>User-Agent}\" {latency_ms}" {
    rotate_size 10000000
  }

  errors {{ slave_parameter['error_log'] }} {
    rotate_size 10000000
  }

{%- if not (slave_parameter['type'] == 'zope' and backend_url) %}
{%    if slave_parameter['prefer-gzip-encoding-to-backend'] and not (not tls and slave_parameter['https-only']) %}
  rewrite {
    regexp (.*)
    if {>Accept-Encoding} match "(^gzip,.*|.*, gzip,.*|.*, gzip$|^gzip$)"
    to /prefer-gzip{1}
  }
  rewrite {
    regexp (.*)
    if {>Accept-Encoding} not_match "(^gzip,.*|.*, gzip,.*|.*, gzip$|^gzip$)"
    to {1}
  }
{%    elif slave_parameter['type'] not in ['notebook', 'websocket'] %}
  rewrite {
    regexp (.*)
    to {1}
  }
{%    endif %} {#    elif slave_parameter['type'] != 'notebook' #}
{%- endif %} {#- if not (slave_parameter['type'] == 'zope' and backend_url) #}

{%- if not tls and slave_parameter['https-only'] %}
  # Enforced redirection to SSL-enabled host
  redir 302 {
    / https://{host}{rewrite_uri}
  }
{%- elif slave_parameter['type'] ==  'zope' and backend_url %}
  # Zope configuration
{%-   for (proxy_name, proxy_comment) in proxy_append_list %}
  # {{ proxy_comment }}
  proxy "/{{ proxy_name }}" {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
{%-     if proxy_name == 'prefer-gzip' %}
    without /prefer-gzip
    header_upstream Accept-Encoding gzip
{%-     endif %} {#-     if proxy_name == 'prefer-gzip' #}
{%- for disabled_cookie in slave_parameter['disabled-cookie-list'] %}
    # Remove cookie {{ disabled_cookie }} from client Cookies
    header_upstream Cookie "(.*)(^{{ disabled_cookie }}=[^;]*; |; {{ disabled_cookie }}=[^;]*|^{{ disabled_cookie }}=[^;]*$)(.*)" "$1 $3"
{%- endfor %} {#- for disabled_cookie in slave_parameter['disabled-cookie-list'] #}

{%-   if slave_parameter['disable-via-header'] %}
    header_downstream -Via
{%-   endif %} {#-   if slave_parameter['disable-via-header'] #}

{%-   if slave_parameter['disable-no-cache-request'] %}
    header_upstream -Cache-Control
    header_upstream -Pragma
{%-   endif %} {#-   if slave_parameter['disable-no-cache-request'] #}
    transparent
  } {# proxy #}
{%-   endfor %} {#-   for (proxy_name, proxy_comment) in proxy_append_list #}
  {%- if slave_parameter['default-path'] %}
  redir 301 {
    if {path} is /
    / {scheme}://{host}/{{ slave_parameter['default-path'] }}
  } {# redir #}
  {%- endif %} {#- if slave_parameter['default-path'] #}
{%- if slave_parameter['prefer-gzip-encoding-to-backend'] and not (not tls and slave_parameter['https-only']) %}
  rewrite {
    regexp (.*)
    if {>Accept-Encoding} match "(^gzip,.*|.*, gzip,.*|.*, gzip$|^gzip$)"
{%- if tls %}
    to /prefer-gzip/VirtualHostBase/{scheme}%2F{hostonly}:{{ slave_parameter['virtualhostroot-https-port'] }}%2F{{ zope_path }}VirtualHostRoot/{1}
{%- else %}
    to /prefer-gzip/VirtualHostBase/{scheme}%2F{hostonly}:{{ slave_parameter['virtualhostroot-http-port'] }}%2F{{ zope_path }}VirtualHostRoot/{1}
{%- endif %}
  }
  rewrite {
    regexp (.*)
    if {>Accept-Encoding} not_match "(^gzip,.*|.*, gzip,.*|.*, gzip$|^gzip$)"
{%- if tls %}
    to /VirtualHostBase/{scheme}%2F{hostonly}:{{ slave_parameter['virtualhostroot-https-port'] }}%2F{{ zope_path }}VirtualHostRoot/{1}
{%- else %}
    to /VirtualHostBase/{scheme}%2F{hostonly}:{{ slave_parameter['virtualhostroot-http-port'] }}%2F{{ zope_path }}VirtualHostRoot/{1}
{%- endif %}
  }
{%- else %}
  rewrite {
    regexp (.*)
{%- if tls %}
    to /VirtualHostBase/{scheme}%2F{hostonly}:{{ slave_parameter['virtualhostroot-https-port'] }}%2F{{ zope_path }}VirtualHostRoot/{1}
{%- else %}
    to /VirtualHostBase/{scheme}%2F{hostonly}:{{ slave_parameter['virtualhostroot-http-port'] }}%2F{{ zope_path }}VirtualHostRoot/{1}
{%- endif %}
  } {# rewrite #}
{%- endif %} {#- if slave_parameter['prefer-gzip-encoding-to-backend'] #}
{%- elif slave_parameter['type'] == 'redirect' %}
{%-   if backend_url %}
  # Redirect configuration
  redir 302 {
    /  {{ backend_url }}{rewrite_uri}
  }
{%-   endif %}
{%- elif slave_parameter['type'] == 'notebook' %}
  proxy / {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
    transparent
  }
  rewrite {
    regexp "/(api/kernels/[^/]+/(channels|iopub|shell|stdin)|terminals/websocket)/?"
    to /proxy/{1}
  }
  proxy /proxy/ {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
    transparent
    websocket
    without /proxy/
  }
{%- elif slave_parameter['type'] == 'websocket' %}
{%-   if slave_parameter['websocket-path-list'] %}
  proxy / {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
{%-     if slave_parameter['websocket-transparent'] %}
    transparent
{%-     else %}
    header_upstream Host {host}
{%-     endif %}
  }
{%-     for websocket_path in slave_parameter['websocket-path-list'] %}
  proxy "/{{ websocket_path }}" {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
    websocket
{%-       if slave_parameter['websocket-transparent'] %}
    transparent
{%-       else %}
    header_upstream Host {host}
{%-       endif %}
  }
{%-     endfor %}
{%-   else %}
  proxy / {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
    websocket
{%-   if slave_parameter['websocket-transparent'] %}
    transparent
{%-   else %}
    header_upstream Host {host}
{%-   endif %}
  }
{%-   endif %}
{%- else %} {#- if slave_parameter['type'] ==  'zope' and backend_url #}
  # Default configuration
{%-   if slave_parameter['default-path'] %}
  redir 301 {
    if {path} is /
    / {scheme}://{host}/{{ slave_parameter['default-path'] }}
  }  {# redir #}
{%-   endif %} {#-   if slave_parameter['default-path'] #}
{%-   if backend_url %}

{%-   for (proxy_name, proxy_comment) in proxy_append_list %}
  # {{ proxy_comment }}
  proxy "/{{ proxy_name }}" {{ backend_url }} {
{{ proxy_header() }}
{{ hsts_header(tls) }}
{%-     if proxy_name == 'prefer-gzip' %}
    without /prefer-gzip
    header_upstream Accept-Encoding gzip
{%-     endif %} {#-     if proxy_name == 'prefer-gzip' #}
{%- for disabled_cookie in slave_parameter['disabled-cookie-list'] %}
    # Remove cookie {{ disabled_cookie }} from client Cookies
    header_upstream Cookie "(.*)(^{{ disabled_cookie }}=[^;]*; |; {{ disabled_cookie }}=[^;]*|^{{ disabled_cookie }}=[^;]*$)(.*)" "$1 $3"
{%- endfor %} {#- for disabled_cookie in slave_parameter['disabled-cookie-list'] #}

{%-     if slave_parameter['disable-via-header'] %}
    header_downstream -Via
{%-     endif %} {#-     if slave_parameter['disable-via-header'] #}

{%-     if slave_parameter['disable-no-cache-request'] %}
    header_upstream -Cache-Control
    header_upstream -Pragma
{%-     endif %} {#-     if slave_parameter['disable-no-cache-request'] #}
    transparent
  }  {# proxy #}
{%-    endfor %} {#-   for (proxy_name, proxy_comment) in proxy_append_list #}
{%-   endif %} {#-   if backend_url #}
{%- endif %} {#- if slave_parameter['type'] ==  'zope' and backend_url #}
}  {# https_host_list|join(', ') #}
{%- endfor %} {#- for tls in [True, False] #}