diff --git a/README.md b/README.md
index 7652b3a..560e878 100644
--- a/README.md
+++ b/README.md
@@ -32,12 +32,15 @@
 
 ### Features
 INSTALLATION
-* install binaries
+* install rpm binaries
 
 CONFIGURATION
+* manage haproxy user
+* manage directories (file system permissions, selinux context)
+* manage files (file system permissions, content, selinux context)
 
 SERVICE
-* manage service
+* manage haproxy service
 
 ### Repo Structure
 Repostructure has moved to REPOSTRUCTURE.md in repo.
@@ -49,7 +52,7 @@ See the full Puppet documentation in docs/index.html
 All dependencies must be included in the catalogue.
 
 * [cd_resources](https://gitlab.confdroid.com/12WW1160/cd_resources) for managing yum base repos
-* [cd_certbot](https://gitlab.confdroid.com/12WW1160/certbot) for automating TLS certificates for https
+* [cd_concat](https://gitlab.confdroid.com/12ww1160/cd_concat) or [concat](https://github.com/puppetlabs/puppetlabs-concat) for managing file fragments
 
 ### Deployment
 
diff --git a/manifests/main/dirs.pp b/manifests/main/dirs.pp
index b7a2638..46b2232 100644
--- a/manifests/main/dirs.pp
+++ b/manifests/main/dirs.pp
@@ -26,7 +26,17 @@ class cd_haproxy::main::dirs (
 
   if $fqdn == $hy_host_fqdn {
     require cd_haproxy::main::user
+
+    # main dir
+    file { $hy_main_dir:
+      ensure    =>  directory,
+      owner     =>  'root',
+      group     =>  'root',
+      mode      =>  '0755'.
+      selrange  =>  s0,
+      selrole   =>  object_r,
+      seltype   =>  etc_t,
+      seluser   =>  system_u,
+    }
   }
-
-
 }
diff --git a/manifests/main/files.pp b/manifests/main/files.pp
index ab41c6a..8235c4a 100644
--- a/manifests/main/files.pp
+++ b/manifests/main/files.pp
@@ -26,5 +26,24 @@ class cd_haproxy::main::files (
 
   if $fqdn == $hy_host_fqdn {
     require cd_haproxy::main::dirs
+
+    # create the concat target
+    concat {$hy_main_config:
+      ensure    =>  present,
+      owner     =>  'root',
+      group     =>  'root',
+      mode      =>  '0640',
+      selrange  =>  s0,
+      selrole   =>  object_r,
+      seltype   =>  etc_t,
+      seluser   =>  system_u,
+    }
+
+    # create the header
+    concat::fragment { 'header':
+      target    =>  $hy_main_config,
+      content   =>  $hy_config_head_erb,
+      order     =>  '001',
+    }
   }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index 9c3b866..2c00e5b 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -39,34 +39,36 @@
 ##############################################################################
 class cd_haproxy::params (
 
-$pkg_ensure       = 'latest',
-$reqpackages      = ['haproxy'],
+$pkg_ensure           = 'latest',
+$reqpackages          = ['haproxy'],
 
-$hy_host_fqdn     = "proxy.${::domain}",
+$hy_host_fqdn         = "proxy.${::domain}",
 
 # firewall
-$hy_manage_fw     = true,
-$hy_fw_order_no   = '50',
+$hy_manage_fw         = true,
+$hy_fw_order_no       = '50',
 
 # main config
-$hy_http_port     = '80',
-$hy_https_port    = '443',
+$hy_http_port         = '80',
+$hy_https_port        = '443',
 
 # user
-$hy_user_name     = 'haproxy',
-$hy_user_comment  = 'haproxy user',
-$hy_user_home     = '/var/lib/haproxy',
-$hy_user_shell    = '/sbin/nologin',
+$hy_user_name         = 'haproxy',
+$hy_user_comment      = 'haproxy user',
+$hy_user_home         = '/var/lib/haproxy',
+$hy_user_shell        = '/sbin/nologin',
 
 ) {
 
 # service
-$hy_service       = 'haproxy'
+$hy_service           = 'haproxy'
 
 # directories
-
+$hy_main_dir          = '/etc/haproxy'
 
 # files
+$hy_main_config       = "${hy_main_dir}/haproxy.cfg"
+$hy_config_head_erb   = 'cd_puppet/haproxy_head.erb'
 
 
 # includes must be last
diff --git a/templates/haproxy.cfg b/templates/haproxy.cfg
index fc78cb7..b0cc73f 100644
--- a/templates/haproxy.cfg
+++ b/templates/haproxy.cfg
@@ -1,4 +1,4 @@
-  #---------------------------------------------------------------------
+#---------------------------------------------------------------------
 # Example configuration for a possible web application.  See the
 # full configuration options online.
 #
diff --git a/templates/haproxy_head.erb b/templates/haproxy_head.erb
new file mode 100644
index 0000000..b406761
--- /dev/null
+++ b/templates/haproxy_head.erb
@@ -0,0 +1,5 @@
+###############################################################################
+##### haproxy.cfg created by puppet through concatenation. manual changes #####
+#####     will be overwritten. original full file available at            #####
+#####           https://confdroid.com/2018/12/haproxy-cfg/                #####
+###############################################################################