HAProxy conifg

global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    timeout connect 10s
    timeout client 30s
    timeout server 30s
    log global
    mode http
    option httplog
    maxconn 2048
    tune.ssl.default-dh-param 2048
    option forwardfor
    option http-server-close

frontend homeservers
    bind *:80
    reqadd X-Forwarded-Proto:\ http
    default_backend webserver

backend webserver
    redirect scheme https if !{ ssl_fc }
    server webserver 10.1.1.25:80 check

backend webserver-https
    bind *:443 ssl crt /etc/haproxy/certs/mydomain.net.pem
    reqadd X-Forwarded-Proto:\ https
    acl letsencrypt-acl path_beg /.well-known/acme-challenge/
    use_backend letsencrypt-backend if letsencrypt-acl
    default_backend www-backend

backend letsencrypt-backend
    server letsencrypt 127.0.0.1:54321