haproxy.cfg

global
    ca-base /etc/ssl/certs

frontend public
    bind 0.0.0.0:8080
    mode http
    timeout client 30s
    default_backend web_servers

backend web_servers
    mode http
    timeout connect 30s
    timeout server 30s
    http-request set-header Host "%[env(BACKEND_HOSTNAME)]"
    server server1 ${BACKEND_HOSTNAME}:${BACKEND_PORT} ssl verify required ca-file ca-certificates.crt