diff --git a/templates/haproxy.cfg b/templates/haproxy.cfg
index 157de97..91c125d 100644
--- a/templates/haproxy.cfg
+++ b/templates/haproxy.cfg
@@ -1,3 +1,44 @@
+#---------------------------------------------------------------------
+# Example configuration for a possible web application.  See the
+# full configuration options online.
+#
+#   https://www.haproxy.org/download/1.8/doc/configuration.txt
+#
+#---------------------------------------------------------------------
+
+#---------------------------------------------------------------------
+# Global settings
+#---------------------------------------------------------------------
+global
+    # to have these messages end up in /var/log/haproxy.log you will
+    # need to:
+    #
+    # 1) configure syslog to accept network log events.  This is done
+    #    by adding the '-r' option to the SYSLOGD_OPTIONS in
+    #    /etc/sysconfig/syslog
+    #
+    # 2) configure local2 events to go to the /var/log/haproxy.log
+    #   file. A line like the following can be added to
+    #   /etc/sysconfig/syslog
+    #
+    #    local2.*                       /var/log/haproxy.log
+    #
+    log         127.0.0.1 local2
+
+    chroot      /var/lib/haproxy
+    pidfile     /var/run/haproxy.pid
+    maxconn     4000
+    user        haproxy
+    group       haproxy
+    daemon
+
+    # turn on stats unix socket
+    stats socket /var/lib/haproxy/stats
+
+    # utilize system-wide crypto-policies
+    ssl-default-bind-ciphers PROFILE=SYSTEM
+    ssl-default-server-ciphers PROFILE=SYSTEM
+
 #---------------------------------------------------------------------
 # common defaults that all the 'listen' and 'backend' sections will
 # use if not designated in their block
@@ -23,7 +64,8 @@ defaults
 #---------------------------------------------------------------------
 # main frontend which proxys to the backends
 #---------------------------------------------------------------------
-frontend  main *:5000
+frontend main
+    bind *:5000
     acl url_static       path_beg       -i /static /images /javascript /stylesheets
     acl url_static       path_end       -i .jpg .gif .png .css .js
 
diff --git a/templates/haproxy_head.erb b/templates/haproxy_head.erb
index be29d72..2d7cb6c 100644
--- a/templates/haproxy_head.erb
+++ b/templates/haproxy_head.erb
@@ -13,13 +13,14 @@ global
     daemon
 
 <% if @hy_show_stats == true -%>
-  listen stats
-    bind *:8080
-    stats enable
-    stats uri /stats
-    stats auth joe:brown:P@sS
+    # turn on stats unix socket
+    stats socket /var/lib/haproxy/stats
 <% end -%>
 
+# utilize system-wide crypto-policies
+    ssl-default-bind-ciphers PROFILE=SYSTEM
+    ssl-default-server-ciphers PROFILE=SYSTEM
+
 defaults
     mode                    <%= @hy_default_mode %>
     log                     global