global
  log /dev/log local0
  log /dev/log local1 notice
  chroot /var/lib/haproxy
  stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  stats timeout 30s
  user haproxy
  group haproxy
  daemon

  # TLS config
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private
  # generated 2024-08-10, Mozilla Guideline v5.7, HAProxy 2.8.5, OpenSSL 3.0.13, modern configuration, no OCSP
  # https://ssl-config.mozilla.org/#server=haproxy&version=2.8.5&config=modern&openssl=3.0.13&ocsp=false&guideline=5.7
  # modern configuration
  ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
  ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
  ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
  ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets