<commit_before>{% set haproxy = salt["pillar.get"]("haproxy", {}) %}
{% set psf_internal = salt["pillar.get"]("psf_internal_network") %}

{% set ciphers = pillar["tls"]["ciphers"].get("haproxy", pillar["tls"]["ciphers"]["default"]) %}

global
    log /dev/log    local0
    log /dev/log    local1 notice

    chroot /var/lib/haproxy

    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s

    user haproxy
    group haproxy

    daemon

    maxconn 4096

    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    ssl-default-bind-ciphers {{ ciphers }}
    ssl-default-server-ciphers {{ ciphers }}
    ssl-server-verify required

    # increase DH Param bits to match certificate bits
    tune.ssl.default-dh-param 2048

    # lower your record size to improve Time to First Byte (TTFB)
    tune.ssl.maxrecord 1400

    # Allow SSL sessions to last for ~2 hours in order to improve the session
    # hit rate.
    tune.ssl.lifetime 2h

defaults
    log     global

    mode    http

    retries 3

    option  httpchk
    option  httplog
    option  http-server-close
    option  splice-auto
    option  redispatch

    balance roundrobin

    timeout connect 5000
    timeout client  50000
    timeout server  50000

    monitor-uri /_haproxy_status

    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http


frontend main
    bind :20000

    # Advertise http/1.1 over NPN to enable TLS False Start
    # TODO: Switch this to alpn once we upgade to a newer OS
    bind :20001 ssl no-tls-tickets no-sslv3 npn http/1.1 crt ev.python.org.pem
    bind :20002 ssl no-tls-tickets no-sslv3 npn http/1.1 crt hg.python.org.pem
    bind :20003 ssl no-tls-tickets no-sslv3 npn http/1.1 crt star.python.org.pem
    bind :20004 ssl no-tls-tickets force-tlsv12          crt lb.psf.io.pem

    # Determine if this request is coming from Fastly or not.
    acl is_fastly hdr(Fastly-Token) -f /etc/haproxy/fastly_token
    acl fastly_tls hdr_cnt(Fastly-SSL) gt 0

    # Determine if this request is valid, if this has a Fastly-Token header but<commit_msg>Ubuntu 14.04 doesn't support ALPN either, so no reason to wait<commit_after>{% set haproxy = salt["pillar.get"]("haproxy", {}) %}
{% set psf_internal = salt["pillar.get"]("psf_internal_network") %}

{% set ciphers = pillar["tls"]["ciphers"].get("haproxy", pillar["tls"]["ciphers"]["default"]) %}

global
    log /dev/log    local0
    log /dev/log    local1 notice

    chroot /var/lib/haproxy

    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s

    user haproxy
    group haproxy

    daemon

    maxconn 4096

    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    ssl-default-bind-ciphers {{ ciphers }}
    ssl-default-server-ciphers {{ ciphers }}
    ssl-server-verify required

    # increase DH Param bits to match certificate bits
    tune.ssl.default-dh-param 2048

    # lower your record size to improve Time to First Byte (TTFB)
    tune.ssl.maxrecord 1400

    # Allow SSL sessions to last for ~2 hours in order to improve the session
    # hit rate.
    tune.ssl.lifetime 2h

defaults
    log     global

    mode    http

    retries 3

    option  httpchk
    option  httplog
    option  http-server-close
    option  splice-auto
    option  redispatch

    balance roundrobin

    timeout connect 5000
    timeout client  50000
    timeout server  50000

    monitor-uri /_haproxy_status

    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http


frontend main
    bind :20000

    # Advertise http/1.1 over NPN to enable TLS False Start
    bind :20001 ssl no-tls-tickets no-sslv3 npn http/1.1 crt ev.python.org.pem
    bind :20002 ssl no-tls-tickets no-sslv3 npn http/1.1 crt hg.python.org.pem
    bind :20003 ssl no-tls-tickets no-sslv3 npn http/1.1 crt star.python.org.pem
    bind :20004 ssl no-tls-tickets force-tlsv12          crt lb.psf.io.pem

    # Determine if this request is coming from Fastly or not.
    acl is_fastly hdr(Fastly-Token) -f /etc/haproxy/fastly_token
    acl fastly_tls hdr_cnt(Fastly-SSL) gt 0

    # Determine if this request is valid, if this has a Fastly-Token header but
{'fraction_non_alphanumeric': 0.09038461538461538, 'fraction_numerical': 0.050854700854700854, 'mean_word_length': 2.7121332275971453, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6067938', 'n_tokens_mistral': 1868, 'n_tokens_neox': 1632, 'n_words': 461}