server {

    listen 80;
    server_name webmail.domain.com;
    return         301 https://$server_name$request_uri;
}

 server {

       listen         443 ssl;
       server_name    webmail.domain.com;

        location ~phpmyadmin* {
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
        proxy_pass http://webmail;
}



      ssl_certificate         /etc/nginx/certs/webmail.domain.com.chained.crt;
      ssl_certificate_key     /etc/nginx/certs/webmail.domain.com.key;
      ssl_session_cache  builtin:1000  shared:SSL:10m;
      ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-   SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-A$
      ssl_prefer_server_ciphers on;
      ssl_dhparam /usr/local/etc/nginx/certs/dhparams.pem;
      #add more option if using cert from CA see SSL hardening https://www.digitalocean.com/community/tutorials/how-to-set-up-nginx-load-balancing-with-ssl-termination



    location / {

        proxy_pass http://webmail;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_cache my_cache;
        proxy_cache_revalidate on;
        proxy_cache_min_uses 3;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        proxy_cache_lock on;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

    }
}

proxy_buffering         on;
proxy_redirect          off;
proxy_set_header        Host            $host;
proxy_set_header        X-Real-IP       $remote_addr;
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size    10m;
client_body_buffer_size 128k;
proxy_connect_timeout   90;
proxy_send_timeout      90;
proxy_read_timeout      90;
proxy_buffers           100 8k;
add_header              X-Cache $upstream_cache_status;

    user  www;
    worker_processes  1;
    error_log  /var/log/nginx/error.log;

    events {
    worker_connections  1024;
    }

    http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log;

    sendfile        on;
    keepalive_timeout  65;

    # Nginx cache configuration
    proxy_cache_path /var/nginx/cache levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m use_temp_path=off;
    proxy_cache my_cache;
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    proxy_temp_path     /var/nginx/cache/tmp;
    proxy_cache_key     "$scheme$host$request_uri";

    gzip  on;

    server {
    #listen       80;
    server_name  _;

    location /nginx_status {

    stub_status on;
    access_log off;
    }

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
    root   /usr/local/www/nginx-dist;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:8080
    #
    location ~ \.php$ {
    proxy_pass   http://127.0.0.1:8080;
    include /usr/local/etc/nginx/proxy.conf;
    }
    }

    include /usr/local/etc/nginx/vhost/*;

    }

frontend http
    bind :80
    # Enable http mode
    mode http

    # Passive HTTP connection closing
    option httpclose

    # Enable insertion of the X-Forwarded-For header to requests sent to servers
    option forwardfor

    # Strip the header off requests, used to fix the HTTPROXY vulnerability.
    # Reference: https://httpoxy.org/
    http-request del-header Proxy

    # adds the HTTP header to the end of the incoming request
    reqadd X-Forwarded-Proto:\ http

    default_backend bk_web

frontend https
    #
    # Let HAProxy handle SSL, not backend servers.
    #
    bind :443 ssl crt /etc/haproxy/ca-cert-key.pem
    # Enable http mode
    mode http

    # Passive HTTP connection closing
    option httpclose

    # Enable insertion of the X-Forwarded-For header to requests sent to servers
    option forwardfor

    # Delete Proxy header due to HTTPoxy vulnerability
    http-request del-header Proxy

    # adds the HTTPS header to the end of the incoming request
    reqadd X-Forwarded-Proto:\ https

    # HSTS header: security policy to prevent against downgrade attacks
    #rspadd Strict-Transport-Security:\ max-age=31536000

    default_backend bk_web

backend bk_web
    balance roundrobin

    # Enable http mode
    mode http

    # Redirect all http traffic to https
    redirect scheme https if !{ ssl_fc }
    
    # Session stick
    stick-table type ip size 200k expire 1h peers frontend_peers
    stick on src

    # reduces latency between HAProxy and end users by closing connections but
    # maintaining keep-alives.
    option http-server-close

    # HTTP check, tries to get /
    option httpchk GET /

    server u7 u7.iredmail.org:80 check on-marked-down shutdown-sessions
    server u8 u8.iredmail.org:80 check on-marked-down shutdown-sessions
    server u9 u9.iredmail.org:80 check on-marked-down shutdown-sessions