diff --git a/roles/build/files/haproxy-entrypoint.sh b/roles/build/files/haproxy-entrypoint.sh
new file mode 100755
index 0000000000000000000000000000000000000000..8b2093b08f191f946b8630942d55e18e8f0d2582
--- /dev/null
+++ b/roles/build/files/haproxy-entrypoint.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+# first arg is `-f` or `--some-option`
+if [ "${1#-}" != "$1" ]; then
+	set -- haproxy "$@"
+fi
+
+if [ "$1" = 'haproxy' ]; then
+	shift # "haproxy"
+	# if the user wants "haproxy", let's add a couple useful flags
+	#   -W  -- "master-worker mode" (similar to the old "haproxy-systemd-wrapper"; allows for reload via "SIGUSR2")
+	#   -db -- disables background mode
+	set -- haproxy -W -db "$@"
+fi
+
+exec "$@"
diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/haproxy/templates/haproxy.cfg.j2
index 61539910dd36aa1e0afe3ebb01c417aa916372f1..67a02e7bb0208e57df664fecc9c9986bff1ff74f 100644
--- a/roles/haproxy/templates/haproxy.cfg.j2
+++ b/roles/haproxy/templates/haproxy.cfg.j2
@@ -21,7 +21,7 @@ listen stats
 
 listen nifiserv
 	bind *:9443
-	mode http
+	mode tcp
 	maxconn 5000
 	fullconn 5000
 	balance source
@@ -32,7 +32,7 @@ listen nifiserv
 
 listen odfeserv
         bind *:9200
-        mode http
+        mode tcp
         maxconn 5000
         fullconn 5000
         balance source