diff --git a/modules/enableit/common/manifests/software/rustdesk.pp b/modules/enableit/common/manifests/software/rustdesk.pp
index ae95d600..44870d07 100644
--- a/modules/enableit/common/manifests/software/rustdesk.pp
+++ b/modules/enableit/common/manifests/software/rustdesk.pp
@@ -20,16 +20,17 @@
 #
 # @groups server server_enable, server_version, server_extra_dependencies.
 #
+# @groups networking, domains.
 class common::software::rustdesk (
-  Boolean             $manage                    = false,
+  Boolean              $manage                    = false,
 
-  Boolean             $client_enable             = false,
-  Array[String]       $client_extra_dependencies = [],
-  Eit_types::Version  $client_version            = '1.4.3',
+  Boolean              $client_enable             = false,
+  Array[String]        $client_extra_dependencies = [],
+  Eit_types::Version   $client_version            = '1.4.3',
 
-  Boolean             $server_enable             = false,
-  Array[String]       $server_extra_dependencies = [],
-  Eit_types::Version  $server_version            = '1.7.1',
+  Boolean              $server_enable             = false,
+  Array[String]        $server_extra_dependencies = [],
+  Eit_types::Version   $server_version            = '1.7.1',
 ) {
   if $manage {
     include profile::software::rustdesk
diff --git a/modules/enableit/eit_haproxy/manifests/basic_config.pp b/modules/enableit/eit_haproxy/manifests/basic_config.pp
index 6fc27f51..f1f08648 100644
--- a/modules/enableit/eit_haproxy/manifests/basic_config.pp
+++ b/modules/enableit/eit_haproxy/manifests/basic_config.pp
@@ -20,7 +20,7 @@
 #
 # @param encryption_ciphers The encryption ciphers to use. Defaults to 'Modern'.
 #
-# @param version The version of haproxy. Defaults to 'latest'.
+# @param version The version of haproxy. Defaults to '3.2.0'.
 #
 # @param native_acme Internal switch for native ACME mode.
 #
@@ -47,8 +47,8 @@
   Enum['http','tcp']            $mode               = 'http',
   Array[Stdlib::IP::Address,1]  $listen_on          = ['0.0.0.0'],
   Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern',
-  Eit_types::Version            $version            = 'latest',
-  Boolean                       $native_acme        = false,
+  Eit_types::Version            $version            = '3.2.0',
+  Boolean                       $native_acme        = true,
   Eit_types::Email              $acme_contact       = $eit_haproxy::acme_contact,
   String                        $acme_ca            = 'https://acme-v02.api.letsencrypt.org/directory',
 ) {
diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp
index 29bd6f63..75e6de74 100644
--- a/modules/enableit/eit_haproxy/manifests/init.pp
+++ b/modules/enableit/eit_haproxy/manifests/init.pp
@@ -32,7 +32,7 @@
 #
 # @param encryption_ciphers The encryption ciphers to use. Defaults to 'Modern'.
 #
-# @param version The version of haproxy. Defaults to 'latest'.
+# @param version The version of haproxy. Defaults to '3.2.0'.
 #
 # @param acme_contact The contact email for Let's Encrypt ACME. Defaults to 'ops@enableit.dk'.
 #
@@ -81,7 +81,7 @@
   Enum['http','tcp']            $mode               = 'http',
   Array[Stdlib::IP::Address,1]  $listen_on          = ['0.0.0.0'],
   Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern',
-  Eit_types::Version            $version            = 'latest',
+  Eit_types::Version            $version            = '3.2.0',
   Eit_types::Email              $acme_contact       = 'ops@enableit.dk',
   Enum['production','staging']  $ca_type            = 'production',
   Eit_types::Service_Ensure     $service_ensure     = true,
@@ -102,7 +102,7 @@
   if $configure == 'auto' {
     $_is_ubuntu = $facts['os']['name'] == 'Ubuntu'
 
-    $_wants_haproxy3 = String($version) =~ /^\d+(\.\d+)*$/ and versioncmp(String($version), '3.0.0') >= 0
+    $_wants_haproxy3 = String($version) =~ /^\d+(\.\d+)*$/ and versioncmp(String($version), '3.2.0') >= 0
 
     if $_wants_haproxy3 and !$_is_ubuntu {
       fail("HAProxy 3.x is only supported on Ubuntu, not ${facts['os']['name']}")
@@ -125,15 +125,13 @@
         # Newer Ubuntu LTS (26.04+) ships HAProxy 3.x in stock repos,
         # so the PPA is unnecessary there.
         if $facts['os']['release']['major'] =~ /^24/ {
-          contain apt
-
           $haproxy_lts_version = '3.2'
           apt::ppa { "ppa:vbernat/haproxy-${haproxy_lts_version}": }
 
           Class['apt'] -> Apt::Ppa["ppa:vbernat/haproxy-${haproxy_lts_version}"] -> Class['eit_haproxy::basic_config']
         }
       } else {
-        warning('HAProxy 3.x auto-native ACME path is only supported on Ubuntu')
+        warning('HAProxy 3.2.x auto-native ACME path is only supported on Ubuntu')
       }
     }
 
diff --git a/modules/enableit/profile/manifests/web/haproxy.pp b/modules/enableit/profile/manifests/web/haproxy.pp
index a8f5302c..121a31ca 100644
--- a/modules/enableit/profile/manifests/web/haproxy.pp
+++ b/modules/enableit/profile/manifests/web/haproxy.pp
@@ -19,23 +19,23 @@
 # @groups mode http
 #
 class profile::web::haproxy (
-  Enum['auto', 'manual']        $configure,
-  Optional[String]              $manual_config,
-  Eit_haproxy::Domains          $domains                = {},
-  Eit_haproxy::Listen           $listens                = {},
-  Boolean                       $ddos_protection        = false,
-  Boolean                       $https                  = true,
-  Boolean                       $http                   = false,
-  Boolean                       $use_hsts               = true,
-  Boolean                       $use_lets_encrypt       = true,
-  Eit_types::Version            $version                = 'latest',
-  Eit_types::Email              $acme_contact           = 'ops@enableit.dk',
-  Enum['Modern','Intermediate'] $encryption_ciphers     = 'Modern',
+  Enum['auto', 'manual']        $configure              = $role::web::haproxy::configure,
+  Optional[String]              $manual_config          = $role::web::haproxy::manual_config,
+  Eit_haproxy::Domains          $domains                = $role::web::haproxy::domains,
+  Eit_haproxy::Listen           $listens                = $role::web::haproxy::listens,
+  Boolean                       $ddos_protection        = $role::web::haproxy::ddos_protection,
+  Boolean                       $https                  = $role::web::haproxy::https,
+  Boolean                       $http                   = $role::web::haproxy::http,
+  Boolean                       $use_hsts               = $role::web::haproxy::use_hsts,
+  Boolean                       $use_lets_encrypt       = $role::web::haproxy::use_lets_encrypt,
+  Eit_types::Version            $version                = $role::web::haproxy::version,
+  Eit_types::Email              $acme_contact           = $role::web::haproxy::acme_contact,
+  Enum['Modern','Intermediate'] $encryption_ciphers     = $role::web::haproxy::encryption_ciphers,
   Hash[Eit_types::IP,Variant[
       Array[Stdlib::Port],
       Stdlib::Port
-  ]]                            $firewall               = {},
-  Boolean                       $log_compressed         = true,
+  ]]                            $firewall               = $role::web::haproxy::firewall,
+  Boolean                       $log_compressed         = $role::web::haproxy::log_compressed,
 ) inherits profile {
   # Monitoring
   $facts.dig('haproxy_version').then |$_haproxy_version| {
diff --git a/modules/enableit/role/data/role/role::storage::rustfs.yaml b/modules/enableit/role/data/role/role::storage::rustfs.yaml
new file mode 100644
index 00000000..2b3417e8
--- /dev/null
+++ b/modules/enableit/role/data/role/role::storage::rustfs.yaml
@@ -0,0 +1,2 @@
+---
+role::web::haproxy::configure: "auto"
diff --git a/modules/enableit/role/data/role/role::web::haproxy.yaml b/modules/enableit/role/data/role/role::web::haproxy.yaml
new file mode 100644
index 00000000..6fbb6522
--- /dev/null
+++ b/modules/enableit/role/data/role/role::web::haproxy.yaml
@@ -0,0 +1,15 @@
+---
+role::web::haproxy::configure: "auto"
+role::web::haproxy::manual_config:
+role::web::haproxy::domains: {}
+role::web::haproxy::listens: {}
+role::web::haproxy::ddos_protection: false
+role::web::haproxy::https: true
+role::web::haproxy::http: false
+role::web::haproxy::use_hsts: true
+role::web::haproxy::use_lets_encrypt: true
+role::web::haproxy::version: "3.2.0"
+role::web::haproxy::acme_contact: "ops@enableit.dk"
+role::web::haproxy::encryption_ciphers: "Modern"
+role::web::haproxy::firewall: {}
+role::web::haproxy::log_compressed: true
diff --git a/modules/enableit/role/manifests/storage/rustfs.pp b/modules/enableit/role/manifests/storage/rustfs.pp
index d1855c66..39e32313 100644
--- a/modules/enableit/role/manifests/storage/rustfs.pp
+++ b/modules/enableit/role/manifests/storage/rustfs.pp
@@ -5,7 +5,6 @@
 # @param secret_key The S3 secret access key.
 # @param enable Whether to enable and manage the rustfs component.
 # @param expose Whether to expose the service via HAProxy.
-# @param domains HAProxy domain configuration.
 #
 # @example Usage
 #   include role::storage::rustfs
@@ -16,17 +15,10 @@
   Stdlib::Unixpath     $data_dir,
   Boolean              $enable        = true,
   Boolean              $expose        = false,
-  Eit_haproxy::Domains $domains       = {},
 ) inherits role::storage {
   contain role::virtualization::docker
   contain profile::storage::rustfs
   if $expose {
-    confine($expose, $domains.empty, 'Exposing rustfs via HAProxy requires domains to be provided')
-
-    class { 'role::web::haproxy':
-      domains            => $domains,
-      version            => '3.2.0',
-      encryption_ciphers => 'Intermediate',
-    }
+    include role::web::haproxy
   }
 }
diff --git a/modules/enableit/role/manifests/web/haproxy.pp b/modules/enableit/role/manifests/web/haproxy.pp
index 1d84f8ce..79057b23 100644
--- a/modules/enableit/role/manifests/web/haproxy.pp
+++ b/modules/enableit/role/manifests/web/haproxy.pp
@@ -22,7 +22,7 @@
 #
 # @param firewall The firewall configurations. Defaults to an empty hash.
 #
-# @param version The version of haproxy. Defaults to 'present'.
+# @param version The version of haproxy. Defaults to '3.2.0'.
 #
 # @param acme_contact The contact email for Let's Encrypt ACME. Defaults to 'ops@enableit.dk'.
 #
@@ -56,27 +56,12 @@
       Array[Stdlib::Port],
       Stdlib::Port
   ]]                            $firewall               = {},
-  Eit_types::Version            $version                = 'latest',
+  Eit_types::Version            $version                = '3.2.0',
   Eit_types::Email              $acme_contact           = 'ops@enableit.dk',
   Boolean                       $log_compressed         = true,
   Boolean                       $__blendable,
 ) inherits role::web {
   confine($configure == 'manual', !$manual_config, 'Manual configuration need static haproxy config file')
 
-  class { 'profile::web::haproxy':
-    domains            => $domains,
-    listens            => $listens,
-    ddos_protection    => $ddos_protection,
-    https              => $https,
-    http               => $http,
-    use_hsts           => $use_hsts,
-    use_lets_encrypt   => $use_lets_encrypt,
-    manual_config      => $manual_config,
-    version            => $version,
-    acme_contact       => $acme_contact,
-    configure          => $configure,
-    encryption_ciphers => $encryption_ciphers,
-    firewall           => $firewall,
-    log_compressed     => $log_compressed,
-  }
+  contain profile::web::haproxy
 }