# HAProxy — SRS 统一入口（HTTPS 隧道 443 -> 本机 18443）
# TLS终结 + 首字节嗅探：
#   RTMPS (解密后首字节 0x03) -> 127.0.0.1:1935  (SRS 推流)
#   HTTP  (拉流 /danmaku)     -> 127.0.0.1:8445  (nginx 明文口)
# 证书: /etc/haproxy/certs/*.pem (由 /home/srs/conf/certs/build-pems.sh 生成)

global
	log /dev/log	local0
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin
	stats timeout 30s
	user haproxy
	group haproxy
	daemon

defaults
	log	global
	mode	tcp
	option	tcplog
	option	dontlognull
	timeout connect 5s
	timeout client  3600s
	timeout server  3600s

frontend srs_18443
	bind *:18443 ssl crt /etc/haproxy/certs/tsk.aeolianchi.me.pem crt /etc/haproxy/certs/tsk.rrrosmontis.icu.pem
	tcp-request inspect-delay 5s
	# RTMP C0 握手首字节固定 0x03
	acl is_rtmp req.payload(0,1) -m bin 03
	tcp-request content accept if is_rtmp
	tcp-request content accept if HTTP
	tcp-request content reject
	use_backend srs_rtmp if is_rtmp
	default_backend srs_http

backend srs_rtmp
	server srs 127.0.0.1:1935 maxconn 100

backend srs_http
	server nginx 127.0.0.1:8445 maxconn 1000