haproxy.cfg

global
        maxconn 4096
        user haproxy
        group haproxy
        chroot /var/empty
        tune.ssl.default-dh-param 1024
        log 127.0.0.1 local1 debug

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        retries 3
        option redispatch
        option http-server-close
        option forwardfor
        maxconn 2000
        timeout connect 5s
        timeout client  15min
        timeout server  15min

frontend public
        bind *:80
        option forwardfor except 127.0.0.1
        use_backend webcam if { path_beg /webcam/ }
        default_backend octoprint
        errorfile 503 /etc/haproxy/errors/503-no-octoprint.http

frontend internet
        bind 0.0.0.0:443 ssl crt /etc/ssl/snakeoil.pem
        option forwardfor except 127.0.0.1
        acl Authorization http_auth(inetusers)
        http-request auth realm octoprint if !Authorization
        use_backend webcam if { path_beg /webcam/ }
        default_backend octoprint
        errorfile 503 /etc/haproxy/errors/503-no-octoprint.http

frontend webcamonly
        bind *:9080
        option forwardfor except 127.0.0.1
        default_backend webcamstream
        errorfile 503 /etc/haproxy/errors/503-no-octoprint.http

backend octoprint
        reqrep ^([^\ :]*)\ /(.*) \1\ /\2
        reqadd X-Scheme:\ https if { ssl_fc }
        option forwardfor
        server octoprint1 127.0.0.1:5000

backend webcam
        reqrep ^([^\ :]*)\ /webcam/(.*)     \1\ /\2
        server webcam1  127.0.0.1:8080

backend webcamstream
        reqrep ^([^\ :]*)\ /(.*)   \1\ /\?action=stream
        server webcam1  127.0.0.1:8080

userlist inetusers
        group G1
        user [user] insecure-password [password] groups G1