ini Stack Exchange HAProxy

Posted 2021-05-24

# This is an example of the Stack Exchange Tier 1 HAProxy config
# The only things that have been changed from what we are running are: 
# 1. User names have been removed
# 2. All Passwords have been remove
# 3. IPs have been changed to use the example/documentation ranges
# 4. Rate limit numbers have been changed to randome numbers, don't read into them

userlist stats-auth
        group admin users $admin_user
        user $admin_user insecure-password $some_password
        group readonly users $some_user
        user $some_user insecure-password $some_other_password

global
        daemon
        stats socket /var/run/haproxy-t1.stat level admin
        maxconn 100000 
        pidfile /var/run/haproxy-t1.pid
        log 127.0.0.1 local0
        log  192.0.2.17   local0
	tune.bufsize 16384
        tune.maxrewrite 1024
        spread-checks 4
	log-send-hostname ny-lb05
        

defaults
        errorfile 503 /etc/haproxy-shared/errors/503.http
        errorfile 502 /etc/haproxy-shared/errors/502.http
        mode    http
        timeout connect 15s
        timeout client 60s
        timeout server 150s
        timeout queue 60s
        timeout http-request 15s
        timeout http-keep-alive 15s
	option httplog
        option redispatch
        option dontlognull
        balance source

backend be_api_1.1
	mode http
	balance roundrobin
        reqirep ^([^\ ]*)\ /1.0/(.*) \1\ /\2
        reqirep ^([^\ ]*)\ /1.1/(.*) \1\ /\2

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD /ping HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:api.stackoverflow.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_api
	mode http
	balance roundrobin

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD /ping HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:api.stackexchange.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_area51_stackexchange_com
	mode http

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:area51.stackexchange.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_careers
	mode http

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD /ping HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:careers.stackoverflow.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_internal_api
	mode http
	balance roundrobin
        option http-server-close

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:stackoverflow.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_meta_so
	mode http

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:meta.stackoverflow.com

	server ny-web10 203.0.113.110:80 check
        server ny-web11 203.0.113.111:80 check
        

backend be_mobile
	mode http

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:mobile.stackexchange.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_openid
	mode http
	balance roundrobin

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD /ping HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:openid.stackexchange.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_others
	mode http

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:serverfault.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_so
	mode http

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:stackoverflow.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_so_crawler
	mode http
	balance roundrobin

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:stackoverflow.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_sstatic
	mode http
	balance roundrobin
        acl HTTP_OK status 200:399
        rspidel ^Cache-Control:.* unless HTTP_OK

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD / HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:sstatic.net

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

backend be_stackauth
	mode http
	balance roundrobin
        reqirep ^([^\ ]*)\ /1.0/(.*) \1\ /\2

	stick-table type ip size 999k expire 1m store conn_rate(30s)
	acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips
	tcp-request content  track-sc2 src
	acl conn_rate_abuse  sc2_conn_rate gt 10
	acl mark_as_abuser   sc1_inc_gpc0 gt 3
	tcp-request content  reject if conn_rate_abuse !rate_limit_whitelist mark_as_abuser

	stats enable
	acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN
	stats uri /ilovestats
	stats refresh 30s
	option httpchk HEAD /ping HTTP/1.1\r\nUser-Agent:HAProxy\r\nHost:stackauth.com

	server ny-web01 203.0.113.101:80 check
        server ny-web02 203.0.113.102:80 check
        server ny-web03 203.0.113.103:80 check
        server ny-web04 203.0.113.104:80 check
        server ny-web05 203.0.113.105:80 check
        server ny-web06 203.0.113.106:80 check
        server ny-web07 203.0.113.107:80 check
        server ny-web08 203.0.113.108:80 check
        server ny-web09 203.0.113.109:80 check
        

frontend fe_stackauth
	bind 198.51.100.21:80 name stackauth
	bind 198.51.100.145:80 name stackauth
	
	
	log global
	
	stick-table type ip size 999k expire 1m store conn_rate(30s)

        capture request header Referer               len 64
        capture request header User-Agent            len 128
        capture request header Host                  len 64
        capture request header X-Forwarded-For       len 64
        capture request header Accept-Encoding       len 64
        capture response header Content-Encoding     len 64
        capture response header X-Page-View          len 1
        capture response header X-Route-Name         len 64
        capture response header X-Account-Id         len 7     
        capture response header X-Sql-Count          len 4
        capture response header X-Sql-Duration-Ms    len 7
        capture response header X-AspNet-Duration-Ms len 7
        capture response header X-Application-Id     len 5
        capture response header X-Request-Guid       len 36
        capture response header X-Redis-Count        len 4
        capture response header X-Redis-Duration-Ms  len 7
        capture response header X-Http-Count         len 4
        capture response header X-Http-Duration-Ms   len 7
        capture response header X-TE-Count           len 4
        capture response header X-TE-Duration-Ms     len 7

	rspidel ^(X-Page-View|Server|X-Route-Name|X-Account-Id|X-Sql-Count|X-Sql-Duration-Ms|X-AspNet-Duration-Ms|X-Application-Id|X-Request-Guid|X-Redis-Count|X-Redis-Duration-Ms|X-Http-Count|X-Http-Duration-Ms|X-TE-Count|X-TE-Duration-Ms):

	maxconn 40000
	
	option http-server-close
	option forwardfor
	option httplog

	
        acl source_is_serious_abuse src_conn_rate(fe_stackauth) gt 20


        acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips

        acl api_only_ips src -f /etc/haproxy-shared/api-only-ips
        acl api_only_whitelist src -f /etc/haproxy-shared/api-only-whitelist

        acl is_crawler src -f /etc/haproxy-shared/crawlers
        acl is_crawler_ua hdr(user-agent) -f /etc/haproxy-shared/crawlers_ua
        
        acl source_is_abuser src_get_gpc0(fe_stackauth) gt 0

 

 

 

	


        tcp-request connection track-sc1 src if !source_is_abuser
	
 
	default_backend be_stackauth
frontend http-in
	bind 198.51.100.16:80 name stackexchange
	bind 198.51.100.17:80 name careers
	bind 198.51.100.30:80 name careers.sstatic.net
	bind 198.51.100.18:80 name openid
	bind 198.51.100.24:80 name misc
	bind 198.51.100.140:80 name stackexchange
	bind 198.51.100.141:80 name careers
	bind 198.51.100.154:80 name careers.sstatic.net
	bind 198.51.100.142:80 name openid
	bind 198.51.100.148:80 name misc
	
	
	log global
	
	stick-table type ip size 999k expire 1m store conn_rate(30s)

        capture request header Referer               len 64
        capture request header User-Agent            len 128
        capture request header Host                  len 64
        capture request header X-Forwarded-For       len 64
        capture request header Accept-Encoding       len 64
        capture response header Content-Encoding     len 64
        capture response header X-Page-View          len 1
        capture response header X-Route-Name         len 64
        capture response header X-Account-Id         len 7     
        capture response header X-Sql-Count          len 4
        capture response header X-Sql-Duration-Ms    len 7
        capture response header X-AspNet-Duration-Ms len 7
        capture response header X-Application-Id     len 5
        capture response header X-Request-Guid       len 36
        capture response header X-Redis-Count        len 4
        capture response header X-Redis-Duration-Ms  len 7
        capture response header X-Http-Count         len 4
        capture response header X-Http-Duration-Ms   len 7
        capture response header X-TE-Count           len 4
        capture response header X-TE-Duration-Ms     len 7

	rspidel ^(X-Page-View|Server|X-Route-Name|X-Account-Id|X-Sql-Count|X-Sql-Duration-Ms|X-AspNet-Duration-Ms|X-Application-Id|X-Request-Guid|X-Redis-Count|X-Redis-Duration-Ms|X-Http-Count|X-Http-Duration-Ms|X-TE-Count|X-TE-Duration-Ms):

	maxconn 40000
	
	option http-server-close
	option forwardfor
	option httplog

	
        acl source_is_serious_abuse src_conn_rate(http-in) gt 1000


        acl rate_limit_whitelist src -f /etc/haproxy-shared/whitelist-ips

        acl api_only_ips src -f /etc/haproxy-shared/api-only-ips
        acl api_only_whitelist src -f /etc/haproxy-shared/api-only-whitelist

        acl is_crawler src -f /etc/haproxy-shared/crawlers
        acl is_crawler_ua hdr(user-agent) -f /etc/haproxy-shared/crawlers_ua
        
        acl source_is_abuser src_get_gpc0(http-in) gt 2

	acl is_feeds path_beg /feeds/
	acl is_internal_api path_beg /api/
	acl is_careers hdr_beg(host) -i careers. jobs.
	acl is_so hdr_end(host) -i stackoverflow.com
	acl is_sstatic hdr_end(host) -i sstatic.net
	acl is_stackauth hdr_end(host) -i stackauth.com
	acl is_se hdr_end(host) -i stackexchange.com
	acl is_area51 hdr(host) -i area51.stackexchange.com
	acl is_mobile hdr(host) -i mobile.stackexchange.com
	acl is_stackexchange_com hdr(host) -i stackexchange.com
	acl is_meta_so hdr_end(host) -i meta.stackoverflow.com
	acl is_dev_meta_webapps hdr_end(host) -i meta.dev.webapps.stackexchange.com
	acl is_dev_fb hdr_end(host) -i fb.dev.stackoverflow.com
	acl is_api_2 hdr(host) -i api.stackexchange.com
	acl is_api hdr_sub(host) -i api
	acl is_api_1.0 path_beg /1.0/
	acl is_api_1.1 path_beg /1.1/
	acl is_api_root path /
	acl is_api_static path_beg -i /admin /content /crossdomain.xml /clientaccesspolicy.xml /robots.txt
	acl is_dev hdr_beg(host) -i dev.
	acl is_dev_discuss hdr_end(host) -i discuss.dev.area51.stackexchange.com
	acl is_openid hdr_beg(host) -i openid.stackexchange.com
	acl is_80 dst_port 80
	acl is_ssl hdr_beg(X-SSL) -i yes
	acl is_chat_yodeya hdr(host) -i chat.yodeya.com chat.miyodeya.com
	acl is_bam_yodeya hdr(host) -i bam.yodeya.com bam.miyodeya.com
	acl is_launchparty_yodeya hdr(host) -i launchparty.yodeya.com launchparty.miyodeya.com
	acl is_me_yodeya hdr(host) -i me.yodeya.com me.miyodeya.com
	acl is_kindle hdr_sub(user-agent) Silk-Accelerated
	acl is_akamai hdr(host) -i sstatic-a.akamaihd.net
 

 

	redirect prefix http://chat.stackexchange.com/rooms/468 code 301 if is_chat_yodeya
	redirect prefix http://chat.stackexchange.com/rooms/468 code 301 if is_bam_yodeya
	redirect prefix http://meta.judaism.stackexchange.com/questions/1134 code 301 if is_launchparty_yodeya
	redirect prefix http://judaism.stackexchange.com code 301 if is_me_yodeya
	redirect prefix https://openid.stackexchange.com code 301 if is_80 is_openid !is_ssl
 

	

        tcp-request connection track-sc1 src if !source_is_abuser
	
	use_backend be_internal_api if is_internal_api !is_careers
	use_backend be_api_1.1 if is_api is_api_1.0
	use_backend be_api_1.1 if is_api is_api_1.1
	use_backend be_api if is_api_2
	use_backend be_api_1.1 if is_api is_api_static
	use_backend be_api_1.1 if is_api is_api_root
	use_backend be_bad_api if is_api
	use_backend be_sstatic if is_sstatic
	use_backend be_sstatic if is_akamai
	use_backend be_mobile if is_mobile
	use_backend be_area51_stackexchange_com if is_area51
	use_backend be_area51_stackexchange_com if is_stackexchange_com
	use_backend be_meta_so if is_meta_so
	use_backend be_careers if is_careers
	use_backend be_so_crawler if is_so is_crawler
	use_backend be_so_crawler if is_so is_crawler_ua
	use_backend be_so if is_so
	use_backend be_stackauth if is_stackauth
	use_backend be_openid if is_openid
 
	default_backend be_others
backend be_api_only
	mode http
	errorfile 503 /etc/haproxy-shared/errors/503apionly.http

backend be_bad_api
	mode http
	errorfile 403 /etc/haproxy-shared/errors/403.http

backend be_go-away
	mode http
	errorfile 503 /etc/haproxy-shared/errors/503rate.http

backend be_no_ssl
	mode http
	errorfile 503 /etc/haproxy-shared/errors/503nossl.http

listen t1_internal_stats
	bind 203.0.113.15:7001
	


	mode http
	balance roundrobin

 
	


        stats enable
        stats uri /ilovestats
        acl AUTH http_auth(stats-auth)
        acl AUTH_ADMIN http_auth_group(stats-auth) admin
        stats http-request auth unless AUTH
        stats admin if AUTH_ADMIN