haproxy.cfg

global
        log /dev/log    local0
        log /dev/log    local1 notice
        maxconn 4096
        chroot /var/lib/haproxy
        user haproxy
        group haproxy
        daemon

        # Default ciphers to use on SSL-enabled listening sockets.
        # For more information, see ciphers(1SSL). This list is from:
        #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
        #ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
        #ssl-default-bind-options no-sslv3

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 5000
        timeout client  500000
        timeout server  500000

frontend http-cp-web
	bind *:80
        redirect scheme https if !{ ssl_fc }
	
frontend https-cp-web
        bind *:443 ssl crt /opt/certs/blockchain.ibm.com.pem
        reqadd X-Forwarded-Proto:\ https
        default_backend www-backend

backend www-backend
        redirect scheme https if !{ ssl_fc }
        server cp-web localhost:3000