haproxy.cfg

global
    log stdout format raw local0
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
    ssl-default-bind-options ssl-min-ver TLSv1.1
    chroot /var/lib/haproxy
    user haproxy
    group haproxy
    lua-load /usr/local/share/lua/5.4/jwtverify.lua

    # Replace the Auth0 URL with your own:
    setenv OAUTH_ISSUER https://youraccount.auth0.com/
    setenv OAUTH_AUDIENCE https://api.mywebsite.com
    # Note that that you can use multiple keys, just make sure that kid length matches the number of keys
    setenv OAUTH_PUBKEY_PATH "/etc/haproxy/pem/pubkey.pem /etc/haproxy/pem/pubkey2.pem"
    setenv OAUTH_KID "key1 key2"

defaults
    log global
    mode http
    option httplog
    timeout connect 10s
    timeout client 30s
    timeout server 30s
    option http-buffer-request

frontend api_gateway
    bind :443 ssl crt /etc/haproxy/pem/test.com.pem alpn h2,http1.1
    default_backend apiservers
    http-request deny unless { req.hdr(authorization) -m found }
    http-request lua.jwtverify
    http-request deny unless { var(txn.authorized) -m bool }
    http-request deny if { path_beg /api/myapp } { method GET }             ! { var(txn.oauth.scope) -m sub read:myapp }
    http-request deny if { path_beg /api/myapp } { method POST PUT DELETE } ! { var(txn.oauth.scope) -m sub write:myapp }

backend apiservers
    balance roundrobin
    server server1 server1:80