global
        log /dev/log daemon debug
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # Default ciphers to use on SSL-enabled listening sockets.
        # For more information, see ciphers(1SSL).
        ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
        ssl-default-bind-options no-sslv3

defaults
        log     global
        mode    http
        option  httplog
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

userlist users-customer1
        user cust1 insecure-password cust1

userlist users-customer2
        user cust2 insecure-password cust2

frontend carbon-in
        mode tcp
        option tcplog
        bind *:9300
        acl customer1_carbon src 192.168.1.39/32
        acl customer2_carbon src 192.168.1.54/32
        use_backend customer1-metronome if customer1_carbon
        use_backend customer2-metronome if customer2_carbon

backend customer1-metronome
        mode tcp
        option tcplog
        server customer1-metronome 127.0.0.1:9301
        option tcp-check

backend customer2-metronome
        mode tcp
        option tcplog
        server customer2-metronome 127.0.0.1:9302
        option tcp-check

frontend http-in
        log global
        mode http
        bind *:80
        acl customer1-auth-ok http_auth(users-customer1)
        acl customer2-auth-ok http_auth(users-customer2)
        http-request allow if customer1-auth-ok
        http-request auth realm PowerDNS if !customer1-auth-ok or !customer2-auth-ok
        http-request deny
        use_backend customer1-http if customer1-auth-ok
        use_backend customer2-http if customer2-auth-ok

backend customer1-http
        mode http
        server customer1-http 127.0.0.1:8001
        option tcp-check

backend customer2-http
       mode http
       server customer2-http 127.0.0.1:8002
       option tcp-check