haproxy.cfg.template

global
    #log /dev/log    local0
    #log /dev/log    local1 notice
    #chroot /var/lib/haproxy
    stats socket /run/haproxy-admin.sock mode 660 level admin
    stats timeout 30s
    user proxy
    group proxy
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    # For more information, see ciphers(1SSL).
    ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL

defaults
    #log     global
    mode    http
    #option  httplog
    #option  dontlognull
    timeout connect 5000
    timeout client  50000
    timeout server  50000
    errorfile 400 /usr/local/etc/haproxy/errors/400.http
    errorfile 403 /usr/local/etc/haproxy/errors/403.http
    errorfile 408 /usr/local/etc/haproxy/errors/408.http
    errorfile 500 /usr/local/etc/haproxy/errors/500.http
    errorfile 502 /usr/local/etc/haproxy/errors/502.http
    errorfile 503 /usr/local/etc/haproxy/errors/503.http
    errorfile 504 /usr/local/etc/haproxy/errors/504.http

{% for pm in port_mappings %}
frontend front{{loop.index}}
    bind *:{{pm.proxy_port}}
    mode http
    default_backend nodes{{loop.index}}

backend nodes{{loop.index}}
    mode http
    balance roundrobin
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    option httpchk HEAD / HTTP/1.1\r\nHost:localhost
    {% for tn in target_nodes -%}
    server {{tn.name}} {{tn.ip}}:{{pm.dest_port}} check
    {% endfor %}

{% endfor %}