haproxy.cfg

global
    maxconn 4000
    tune.ssl.default-dh-param 2048
    ssl-default-bind-options no-sslv3
    ssl-default-bind-options force-tlsv12
    ssl-default-bind-ciphers ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:!aNULL:!MD5:!DSS

frontend http
    bind *:80
    mode http

    acl letsencrypt-acl path_beg -i /.well-known/acme-challenge/
    http-request redirect scheme https if !letsencrypt-acl
    use_backend letsencrypt if letsencrypt-acl

    timeout client 1h

frontend https
    bind *:443 ssl crt /certs/live/www.example.com/www.example.com.pem crt /certs/live/www.example2.com/www.example2.com.pem
    mode http
    tcp-request inspect-delay 5s
    http-response set-header Strict-Transport-Security max-age=31536000;\ includeSubdomains;\ preload
    http-response set-header X-Frame-Options DENY
    http-response set-header X-Content-Type-Options nosniff
    option forwardfor

    use_backend www.example.com if { ssl_fc_sni -i www.example.com }
    use_backend www.example2.com if { ssl_fc_sni -i www.example2.com }

    default_backend www.example.com
    timeout client 1h

backend letsencrypt
    mode http
    server le 10.12.10.1:8888
    timeout connect 1h
    timeout server 1h

backend www.example.com
    mode http
    server www.example.com 192.168.1.101:80 check
    timeout connect 1h
    timeout server 1h
    option forwardfor header X-Client

backend www.example2.com
    mode http
    server www.example2.com 192.168.1.102:80 check
    timeout connect 1h
    timeout server 1h
    option forwardfor header X-Client