my_haproxy.cfg

# Listen on HTTP if URI is LetsEncrypt request, then forward to Certbot else redirect rest to HTTPS
frontend http
  bind *:80

  # Add X-Headers necessary for HTTPS; include:[port] if not running on port 443
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  http-request set-header X-Forwarded-Proto https

  # Force HTTPS
  acl is_letsencrypt path_beg /.well-known/acme-challenge/
  redirect scheme https if !{ ssl_fc } !is_letsencrypt

  use_backend LetsEncrypt if is_letsencrypt

# Listen on HTTPS and redirect to backend_default
frontend  https
  bind :443 ssl crt /certs/wildcard.pem
  default_backend backend_default

backend         backend_default
  server  local-server 127.0.0.1:8080 check

backend LetsEncrypt
  errorfile 503 /errors/certbot.http
  server certbot 127.0.0.1:8888