haproxy-no-post.cfg

global
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
    log /dev/log local0 warning
    
defaults
    timeout connect 10s
    timeout client 30s
    timeout server 30s

frontend dockerfrontend
    mode tcp
    bind :2375
    tcp-request inspect-delay 10s
    tcp-request content accept if HTTP
    tcp-request content accept if { req.ssl_hello_type 1 }
    use_backend http if HTTP
    default_backend https

backend http
    mode tcp
    server loopback-for-http abns@haproxy-http send-proxy-v2
backend https
    mode tcp
    server loopback-for-https abns@haproxy-https send-proxy-v2
    
frontend http
    mode http
    bind abns@haproxy-http accept-proxy
    http-request deny unless METH_GET
    default_backend dockerbackend

frontend https
    mode http
    bind abns@haproxy-https accept-proxy ssl crt /tmp/cert.pem alpn h3,h2,http/1.1
    http-request deny unless METH_GET
    default_backend dockerbackend

backend dockerbackend
    mode http
    server dockersocket $SOCKET_PATH