diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
index 32a58f1..64b7d78 100644
--- a/roles/haproxy/tasks/main.yml
+++ b/roles/haproxy/tasks/main.yml
@@ -1,7 +1,30 @@
 ---
 - name: main haproxy block
-  vars: {}
+  vars:
+    install_certbot: true
   block:
   - debug:
       var: groups['containers']
 
+  - name: install pakages
+    apk:
+      name: [ haproxy ]
+
+  - name: create haproxy routes for other containers
+    template:
+      src: templates/haproxy.cfg.j2
+      dest: /etc/haproxy/haproxy.cfg
+
+  - name: restart haproxy service
+    service:
+      name: haproxy
+      enabled: yes
+      state: restarted
+
+  - name: install certbot
+    apk:
+      name: [ certbot ]
+    when: install_certbot
+
+# TODO: route web roots for each container in haproxy.conf
+# NOTE: can use *.lxd domain names in haproxy container
diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/haproxy/templates/haproxy.cfg.j2
new file mode 100644
index 0000000..26b793f
--- /dev/null
+++ b/roles/haproxy/templates/haproxy.cfg.j2
@@ -0,0 +1,52 @@
+global
+	log         127.0.0.1 local2
+
+	chroot      /var/lib/haproxy
+	pidfile     /var/run/haproxy.pid
+	maxconn     4000
+	user        haproxy
+	group       haproxy
+	daemon
+	stats socket /var/lib/haproxy/stats
+
+defaults
+	mode                    http
+	log                     global
+	option                  httplog
+	option                  dontlognull
+	option http-server-close
+	option forwardfor       except 127.0.0.0/8
+	option                  redispatch
+	retries                 3
+	timeout http-request    10s
+	timeout queue           1m
+	timeout connect         10s
+	timeout client          1m
+	timeout server          1m
+	timeout http-keep-alive 10s
+	timeout check           10s
+	maxconn                 3000
+
+frontend main
+	bind *:80
+
+{% for c in groups['containers'] %}
+{% if c != 'haproxy' %}
+	acl {{ c }}_path path_beg -i /{{ c }}
+	use_backend {{ c }} if {{ c }}_path
+
+{% endif %}
+{% endfor %}
+	# default_backend dokuwiki
+
+{% for c in groups['containers'] %}
+{# NOTE: don't add haproxy to list of containers :P #}
+{% if c != 'haproxy' %}
+backend {{ c }}
+{# NOTE: gallery container expects /gallery/ prefix #}
+{% if c != 'gallery' %}
+ 	http-request replace-path /{{ c }}/(.*) /\1
+{% endif %}
+	server {{ c }}_1 {{ c }}.lxd:80 check
+{% endif %}
+{% endfor %}