foreman_haproxy

frontend  https-in-7000
    mode tcp
    bind  *:7000

    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }

    acl cc req_ssl_sni -i foreman-client.localdomain
    acl dd req_ssl_sni -i foreman-internal.localdomain

    use_backend client-tcp if cc
    use_backend internal if dd

frontend https-in-ui
   mode http
   bind *:5000 ssl crt /etc/ssl/certs/test-server.hm.local.pem

   default_backend client-http

backend client-tcp
    mode tcp
    balance     roundrobin
    server      foreman1 127.0.0.1:443 check

backend client-http
    mode http
    balance     roundrobin
    server      foreman1 127.0.0.1:443 check ssl verify none

backend internal
    mode tcp
    balance     roundrobin
    server      foreman1 127.0.0.1:5000 check