[root@localhost]# cat /etc/haproxy/haproxy.cfg

#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    log         127.0.0.1 local2
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     100000
    user        haproxy
    group       haproxy
    daemon
    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

    ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
    ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
#---------------------------------------------------------------------
# Defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option                  redispatch
    option                  forwardfor except 127.0.0.0/8
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 100000
#---------------------------------------------------------------------
# Frontend HTTP and HTTPS
#---------------------------------------------------------------------
frontend http_https
    mode    http
    bind    :443 ssl crt /etc/pki/tls/private/sds_haproxy.pem
    bind    :80
    redirect scheme https code 301 if !{ ssl_fc }

    # X-Forwarded-Proto for SSL offloading
    http-request set-header X-Forwarded-Proto https

    # HSTS
    http-response set-header Strict-Transport-Security max-age=31536000
    # X-Content-Type-Options
    http-response set-header X-Content-Type-Options nosniff
    # X-Xss-Protection (for Chrome, Safari, IE)
    http-response set-header X-Xss-Protection 1;\ mode=block
    # X-Frame-Options (DENY or SELF)
    http-response set-header X-Frame-Options DENY
    # X-Robots-Tag to not index our site
    http-response set-header X-Robots-Tag none
    # Delete Server Header
    http-response del-header Server

    # Stats page disabled if not needed
    #stats   enable
    #stats   auth haadmin:haadmin
    #stats   uri /hastats
    #stats   refresh 10s

    acl api_acl path_beg -i /api
    acl oauth_acl path_beg -i /oauth
    acl webdav_acl path_beg -i /webdav
    use_backend api_server if api_acl
    use_backend oauth_server if oauth_acl
    use_backend webdav_server if webdav_acl
    default_backend webui_server
#---------------------------------------------------------------------
# Backend API
#---------------------------------------------------------------------
backend api_server
    balance leastconn
    cookie APISERVER insert indirect nocache
    http-check disable-on-404
    http-check expect status 200
    option httpchk GET /api/v4/public/time

    server api01 api-server:8080 cookie api01 check inter 5s fastinter 1s downinter 3s rise 2 fall 5
#---------------------------------------------------------------------
# Backend Oauth
#---------------------------------------------------------------------
backend oauth_server
    balance roundrobin
    http-check disable-on-404
    http-check expect status 200
    option httpchk GET /oauth/ping

    server oauth01 oauth-server:8080 check inter 5s fastinter 1s downinter 3s rise 2 fall 5
#---------------------------------------------------------------------
# Backend WebDAV
#---------------------------------------------------------------------
backend webdav_server
    balance leastconn
    cookie  WEBDAVSERVER insert indirect nocache
    http-check disable-on-404
    http-check expect status 401
    option httpchk GET /webdav

    server webdav01 webdav-server:8090 cookie webdav01 check inter 5s fastinter 1s downinter 3s rise 2 fall 5
#---------------------------------------------------------------------
# Backend WebUI
#---------------------------------------------------------------------
backend webui_server
    balance roundrobin
    http-check disable-on-404
    http-check expect status 200
    option httpchk GET /version

    server webui01 webui-server:8080 check inter 5s fastinter 1s downinter 3s rise 2 fall 5