haproxy

#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    log stdout format raw local0 debug

    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy

    # Default SSL/TLS settings
    tune.ssl.default-dh-param 2048
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

#---------------------------------------------------------------------
# Default settings for all frontends and backends
#---------------------------------------------------------------------
defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5000ms
    timeout client  50000ms
    timeout server  50000ms

#---------------------------------------------------------------------
# Frontend for redirecting HTTP to HTTPS
#---------------------------------------------------------------------
frontend http_frontend
    bind *:80
    http-request redirect scheme https code 301 unless { ssl_fc }

#---------------------------------------------------------------------
# Main frontend for handling HTTPS traffic
#---------------------------------------------------------------------
frontend https_frontend
    bind *:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1

    use_backend backend_one if { ssl_fc_sni one.website.com }
    use_backend backend_two if { ssl_fc_sni two.website.com }
    use_backend backend_three if { ssl_fc_sni three.services.website.com }

    default_backend not_found_backend

#---------------------------------------------------------------------
# Backend server definitions
#---------------------------------------------------------------------

backend backend_one
    server one localhost:7880 check

backend backend_two
    server two localhost:5349 check

backend backend_three
    server three localhost:3200 check

backend not_found_backend
    http-request deny status 404