global
    log stdout format raw local0 info
    maxconn 50000
    # Run as non-root inside the container
    # user haproxy
    # group haproxy

defaults
    log     global
    mode    tcp
    option  tcplog
    option  dontlognull
    retries 3
    timeout connect  10s
    timeout client   1m
    timeout server   1m
    timeout check    5s

# ── Docker embedded DNS ───────────────────────────────────────────────────────
resolvers docker_dns
    nameserver dns1 127.0.0.11:53
    resolve_retries 10
    timeout resolve 1s
    timeout retry   1s
    hold valid      10s
    hold other      10s
    hold refused    10s
    hold nx         10s

# ── SOCKS5 frontend (browsers / curl / etc. connect here) ────────────────────
frontend socks5_in
    bind *:1080
    default_backend vpn_exit_nodes

# ── Round-robin across all vpn-node containers ───────────────────────────────
backend vpn_exit_nodes
    balance roundrobin
    # server-template creates up to 10 slots; Docker DNS fills them dynamically
    # as you scale with: docker compose up --scale vpn-node=N (max 10)
    server-template vpn 1-10 vpn-node:1080 \
        resolvers docker_dns \
        resolve-prefer ipv4 \
        init-addr none \
        check inter 20s fall 2 rise 2

# ── Stats page — http://<host>:8404/stats ─────────────────────────────────────
frontend stats
    bind *:8404
    mode http
    stats enable
    stats uri /stats
    stats refresh 5s
    stats show-legends
    stats show-node
    stats auth admin:admin     # change this password