diff --git a/README.md b/README.md
index 28cb482..a03d9ea 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,7 @@ Important: easyhaproxy needs to be in the same network of the containers or othe
 | Tag                                         | Description                                                                                             |
 |---------------------------------------------|---------------------------------------------------------------------------------------------------------|
 | com.byjg.easyhaproxy.definitions            | A Comma delimited list with the definitions. Each name requires the definition of the parameters below. |
+| com.byjg.easyhaproxy.mode.[definition]      | (Optional) Is this http or tcp mode in HAProxy. (Defaults to http)                           |
 | com.byjg.easyhaproxy.port.[definition]      | (Optional) What is the port that the HAProxy will listen to. (Defaults to 80)                           |
 | com.byjg.easyhaproxy.localport.[definition] | (Optional) What is the port that the container is listening. (Defaults to 80)                           |
 | com.byjg.easyhaproxy.host.[definition]      | What is the host that the HAProxy will listen to.                                                       |
@@ -126,6 +127,19 @@ docker run \
     some/myimage
 ```
 
+### TLS passthrough
+
+Used to pass on SSL-termination to a backend:
+
+```bash
+docker run \
+    -l com.byjg.easyhaproxy.defintions=tcp-service \
+    -l com.byjg.easyhaproxy.mode.tcp-service=tcp \
+    -l com.byjg.easyhaproxy.port.tcp-service=443
+    .... \
+    some/tcp-service
+```
+
 ### Redirect Example:
 
 ```bash
diff --git a/swarm.py b/swarm.py
index a74cef1..961f634 100644
--- a/swarm.py
+++ b/swarm.py
@@ -36,6 +36,7 @@ for line in lineList:
             if "com.byjg.easyhaproxy.host." + definition not in d:
                 continue
 
+            mode = d["com.byjg.easyhaproxy.mode." + definition] if "com.byjg.easyhaproxy.mode." + definition in d else "http"
             port = d["com.byjg.easyhaproxy.port." + definition] if "com.byjg.easyhaproxy.port." + definition in d else "80"
             hash = hashlib.md5(d["com.byjg.easyhaproxy.sslcert." + definition].encode('utf-8')).hexdigest() if "com.byjg.easyhaproxy.sslcert." + definition in d else ""
 
@@ -43,6 +44,7 @@ for line in lineList:
 
             if key not in easymapping:
                 easymapping[key] = {
+                    "mode": mode,
                     "port": port,
                     "hosts": dict(),
                     "redirect": dict(),
diff --git a/templates/haproxy.cfg.j2 b/templates/haproxy.cfg.j2
index 96862f3..732e48b 100644
--- a/templates/haproxy.cfg.j2
+++ b/templates/haproxy.cfg.j2
@@ -39,10 +39,17 @@ backend srv_stats
 {% endif %}
 
 {% for o in data["easymapping"] %}
+    {% set mode = o["mode"] or "http" %}
     {% set salt = loop.index %}
-frontend http_in_{{ o["port"] }}_{{ salt }}
+frontend {{ mode }}_in_{{ o["port"] }}_{{ salt }}
     bind *:{{ o["port"] }} {{ " ssl crt " + o["ssl_cert"] if "ssl_cert" in o else "" }}
-    mode http
+    mode {{ mode }}
+
+    {% if mode == "tcp" -%}
+    option tcplog
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req.ssl_hello_type 1 }
+    {% endif -%}
 
     {% for k in o["redirect"] -%}
     redirect prefix {{ o["redirect"][k] }} code 301 if { hdr(host) -i {{ k }} }
@@ -59,10 +66,14 @@ frontend http_in_{{ o["port"] }}_{{ salt }}
         {% set host = k.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) %}
 backend srv_{{ host }}
     balance roundrobin
-    mode http
+    mode {{ mode }}
+
+{% if mode == "http" %}
     option forwardfor
     http-request set-header X-Forwarded-Port %[dst_port]
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
+{% endif %}
+
     server srv {{ o["hosts"][k] }} check weight 1
     {% endfor %}
 {% endfor %}