global
    maxconn 100000
    log stdout local0
    nbthread 4
    cpu-map auto:1/1-4 0-3
    stats socket /var/run/haproxy.sock mode 660 level admin
    stats timeout 30s
    tune.ssl.default-dh-param 2048

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  http-server-close
    option  forwardfor except 127.0.0.0/8
    option  redispatch
    retries 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 50000

# Statistics
stats enable
stats uri /haproxy-stats
stats refresh 30s
stats show-node
stats auth admin:admin123

# JSON-RPC Load Balancing
frontend jsonrpc_front
    bind *:8080
    mode http
    option httplog
    
    # Rate limiting
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny if { sc_http_req_rate(0) gt 100 }
    
    # CORS headers
    http-response set-header Access-Control-Allow-Origin "*"
    http-response set-header Access-Control-Allow-Methods "GET, POST, OPTIONS"
    http-response set-header Access-Control-Allow-Headers "Content-Type, Authorization"
    
    default_backend jsonrpc_back

backend jsonrpc_back
    mode http
    balance leastconn
    option httpchk GET /health
    
    # Sticky sessions for consistent routing
    cookie SERVERID insert indirect nocache
    
    server node1 dex-node-1:8080 check cookie node1 maxconn 10000
    server node2 dex-node-2:8080 check cookie node2 maxconn 10000
    server node3 dex-node-3:8080 check cookie node3 maxconn 10000

# WebSocket Load Balancing
frontend websocket_front
    bind *:8081
    mode http
    option httplog
    
    # WebSocket detection
    acl is_websocket hdr(Upgrade) -i WebSocket
    acl is_websocket hdr_beg(Host) -i ws
    
    # Use WebSocket backend for WS connections
    use_backend websocket_back if is_websocket
    
    default_backend websocket_back

backend websocket_back
    mode http
    balance source  # Sticky by source IP for WebSocket
    option http-server-close
    option forceclose
    
    # WebSocket specific timeouts
    timeout client 3600s
    timeout server 3600s
    timeout tunnel 3600s
    
    # Health checks
    option httpchk GET /health
    
    server node1 dex-node-1:8081 check maxconn 20000
    server node2 dex-node-2:8081 check maxconn 20000
    server node3 dex-node-3:8081 check maxconn 20000

# gRPC Load Balancing
frontend grpc_front
    bind *:50051
    mode tcp
    option tcplog
    
    default_backend grpc_back

backend grpc_back
    mode tcp
    balance roundrobin
    
    # gRPC health checks
    option tcp-check
    tcp-check connect
    
    # HTTP/2 support
    option http-use-htx
    
    server node1 dex-node-1:50051 check maxconn 5000
    server node2 dex-node-2:50051 check maxconn 5000
    server node3 dex-node-3:50051 check maxconn 5000

# HTTPS Frontend (with SSL termination)
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/lxdex.pem
    mode http
    option httplog
    
    # Security headers
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    http-response set-header X-Frame-Options "DENY"
    http-response set-header X-Content-Type-Options "nosniff"
    http-response set-header X-XSS-Protection "1; mode=block"
    
    # Path-based routing
    acl is_api path_beg /api
    acl is_rpc path_beg /rpc
    acl is_ws path_beg /ws
    acl is_metrics path_beg /metrics
    
    use_backend jsonrpc_back if is_api OR is_rpc
    use_backend websocket_back if is_ws
    use_backend metrics_back if is_metrics
    
    default_backend ui_back

# UI Backend
backend ui_back
    mode http
    balance roundrobin
    option httpchk GET /
    
    server ui1 dex-ui:3000 check maxconn 1000

# Metrics Backend (Prometheus)
backend metrics_back
    mode http
    balance roundrobin
    
    # Aggregate metrics from all nodes
    server node1_metrics dex-node-1:9090/metrics check
    server node2_metrics dex-node-2:9090/metrics check
    server node3_metrics dex-node-3:9090/metrics check

# HTTP to HTTPS redirect
frontend http_front
    bind *:80
    mode http
    redirect scheme https code 301 if !{ ssl_fc }