diff --git a/haproxy.conf b/haproxy.conf
new file mode 100644
index 0000000..43d101e
--- /dev/null
+++ b/haproxy.conf
@@ -0,0 +1,54 @@
+global
+  daemon
+  log     /var/log/haproxy.log local0
+  maxconn 4096
+
+defaults
+  log global
+  mode http
+  option httplog
+  timeout connect 10s
+  timeout client  30s
+  timeout server  30s
+  timeout client-fin 30s
+  timeout tunnel  30m
+
+frontend http
+  mode http
+  bind ip4.stashbox:80
+  http-request set-header X-Forwarded-For %[src]
+  use_backend http.plex if { hdr(host) -m sub plex   }
+  use_backend http.app  if { hdr(host) -m sub clip   }
+  use_backend http.app  if { hdr(host) -m sub browse }
+  use_backend http.app  if { hdr(host) -m sub notes  }
+  use_backend http.web  if { hdr(host) -m sub stash  }
+
+backend http.plex
+  mode   http
+  server feed plex.stashbox:80 check
+backend http.web
+  mode   http
+  server web web.stashbox:80 check
+backend http.app
+  mode   http
+  server app app.stashbox:80 check
+
+frontend tcp-sni
+  bind        ip4.stashbox:443
+  mode        tcp
+  option      tcplog
+  log         global
+  log         /var/log/haproxy-https.log local0
+  tcp-request inspect-delay 5s
+  tcp-request content accept if { req.ssl_hello_type 1 }
+  use_backend https.app  if { req.ssl_sni -m sub clip   }
+  use_backend https.app  if { req.ssl_sni -m sub browse }
+  use_backend https.app  if { req.ssl_sni -m sub notes  }
+  use_backend https.web  if { req.ssl_sni -m sub stash  }
+
+backend https.web
+  mode    tcp
+  server  web web.stashbox:443 send-proxy
+backend https.app
+  mode    tcp
+  server  app app.stashbox:443 send-proxy