In which you have to take care to set firewalls or network controls carefully such that HAProxy is the only service able to talk to Puppet Server.