# Ansible managed

global
        log /dev/log local0
        chroot /var/lib/haproxy
        user haproxy
        group haproxy
        daemon
        maxconn 4096
        tune.maxrewrite 1280
        stats socket /var/run/haproxy.stat level admin mode 600
                ssl-default-bind-options ssl-min-ver TLSv1.2 prefer-client-ciphers
        ssl-default-server-options ssl-min-ver TLSv1.2
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-ciphers ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM
        ssl-default-server-ciphers ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM
        tune.ssl.default-dh-param 2048
        
defaults
        log global
        option dontlognull
        option redispatch
        option httpclose
        retries 3
        timeout client 50s
        timeout connect 10s
        timeout http-request 5s
        timeout server 50s
        maxconn 4096