How can I enable SSL while running on a different port + Issue with subdomain

Who is handling SSL here, HAProxy or Discourse? It seems like the answer is “both”, which is not good.

The usual approach is to let the front-end server handle SSL (HAProxy in your case), and then only use HTTP for the internal communication.