global
    log        127.0.0.1 local4
    chroot     /var/lib/haproxy
    stats      socket /run/haproxy/admin.sock mode 660 level admin
    stats      timeout 30s
    user       haproxy
    group      haproxy
    daemon

    ca-base    /etc/ssl/certs
    crt-base   /etc/ssl/private
    tune.ssl.default-dh-param 2048
    ssl-default-bind-options no-tls-tickets
    ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

defaults
    log        global
    mode       http
    option     httplog
    option     dontlognull
    timeout    connect 5000
    timeout    client 50000
    timeout    server 50000
    errorfile  400 /etc/haproxy/errors/400.http
    errorfile  403 /etc/haproxy/errors/403.http
    errorfile  408 /etc/haproxy/errors/408.http
    errorfile  500 /etc/haproxy/errors/500.http
    errorfile  502 /etc/haproxy/errors/502.http
    errorfile  503 /etc/haproxy/errors/503.http
    errorfile  504 /etc/haproxy/errors/504.http


frontend http-in
    bind *:80
    bind *:443 ssl no-sslv3 no-tlsv10 crt /etc/ssl/haproxy.pem

    rspadd Strict-Transport-Security:\ max-age=15768000

    acl api path_beg /
    use_backend api if api

backend api
    server api_1 127.0.0.1:2222