haproxy + letsencrypt + acl white_list

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        user haproxy
        group haproxy
        daemon
        debug
        stats socket /var/run/haproxy.sock mode 660 level admin
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private
        ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
        ssl-default-bind-options no-sslv3
        tune.ssl.default-dh-param 4096

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        contimeout 5000
        clitimeout 50000
        srvtimeout 50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http
        stats enable
        stats uri /stats
        stats realm Global\ statistics
        stats auth admin:password

frontend www-http
        bind :80
        reqadd X-Forwarded-Proto:\ http
        mode http
        option http-server-close
        option forwardfor
        option http-keep-alive
        use_backend cloud if { hdr_dom(host) -i cloud.site.ru }     { dst_port 80 }
        use_backend tfs if { hdr_dom(host) -i tfs.site.ru }    { dst_port 80 }
        use_backend vols if { hdr_dom(host) -i vols.site.ru } { dst_port 80 }
        use_backend admin if { hdr_dom(host) -i admin.site.ru } { dst_port 80 }
        use_backend partner if { hdr_dom(host) -i partner.site.ru } { dst_port 80 }

frontend www-https
        bind :443 ssl crt-list /etc/haproxy/certs/haproxy_ssl.txt
        reqadd X-Forwarded-Proto:\ https
        http-request set-header X-SSL %[ssl_fc]
        mode http
        option http-server-close
        option forwardfor
        option http-keep-alive
        acl letsencrypt-acl path_beg /.well-known/acme-challenge/
        use_backend letsencrypt-backend if letsencrypt-acl
        use_backend cloud if { hdr_dom(host) -i cloud.site.ru }     { dst_port 443 }
        use_backend tfs if { hdr_dom(host) -i tfs.site.ru }    { dst_port 443 }
        use_backend vols if { hdr_dom(host) -i vols.site.ru } { dst_port 443 }
        use_backend admin if { hdr_dom(host) -i admin.site.ru } { dst_port 443 }
        use_backend partner if { hdr_dom(host) -i partner.site.ru } { dst_port 443 }

backend letsencrypt-backend
        server letsencrypt 127.0.0.1:54321
        acl white_list src 0.0.0.0/0
        tcp-request content accept if white_list
        tcp-request content reject

backend cloud
        redirect scheme https if !{ ssl_fc }
        server cloud cloud.internal.site.ru:80 check

backend tfs
        redirect scheme https if !{ ssl_fc }
        server tfs tfs.internal.site.ru:8080 check
        option http-keep-alive
        mode http
        timeout server 30s
        timeout connect 4s

backend vols
        redirect scheme https if !{ ssl_fc }
        server vols vols2013.internal.site.ru:80 check

backend admin
        redirect scheme https if !{ ssl_fc }
        server cf test-admin.internal.site.ru:80 check
        acl white_list src 192.168.0.0/16 50.50.0.0/16
        tcp-request content accept if white_list
        tcp-request content reject

backend partner
        redirect scheme https if !{ ssl_fc }
        server cf test-partner.internal.site.ru:80 check
        acl white_list src 192.168.0.0/16 50.50.0.0/16
        tcp-request content accept if white_list
        tcp-request content reject

option http-keep-alive
mode http