final commit for now - back-end haproxy is still rejecting external traffic, but I can't determine why.  Will revisit later today.