diff --git a/pkg/api/server.go b/pkg/api/server.go
index 3c94e99..86d6220 100644
--- a/pkg/api/server.go
+++ b/pkg/api/server.go
@@ -31,8 +31,8 @@ type Server struct {
 	stop         chan struct{}
 	stopKeyReset chan struct{}
 
-	cert   tls.Certificate
-	listen net.Listener
+	tlsConfig *tls.Config
+	listen    net.Listener
 }
 
 type notFoundHandler struct {
@@ -58,16 +58,44 @@ func NewServer(c *config.Config, log logr.Logger) (*Server, error) {
 		stop:         make(chan struct{}),
 		stopKeyReset: make(chan struct{}),
 	}
-	cert, err := tls.LoadX509KeyPair(c.Server.TLS.Cert, c.Server.TLS.Key)
-	if err != nil {
-		return nil, err
+	if c.Server.TLS != nil {
+		cert, err := tls.LoadX509KeyPair(c.Server.TLS.Cert, c.Server.TLS.Key)
+		if err != nil {
+			return nil, err
+		}
+		s.tlsConfig = &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			CipherSuites: []uint16{
+				tls.TLS_AES_256_GCM_SHA384,
+				tls.TLS_CHACHA20_POLY1305_SHA256,
+				tls.TLS_AES_128_GCM_SHA256,
+				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+				tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+				tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+				tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+			},
+			CurvePreferences: []tls.CurveID{
+				tls.X25519,
+				tls.CurveP384,
+				tls.CurveP521,
+			},
+			PreferServerCipherSuites: true,
+			Certificates:             []tls.Certificate{cert},
+		}
+		l, err := tls.Listen("tcp", c.Server.Listen, s.tlsConfig)
+		if err != nil {
+			return nil, err
+		}
+		s.listen = l
+	} else {
+		l, err := net.Listen("tcp", c.Server.Listen)
+		if err != nil {
+			return nil, err
+		}
+		s.listen = l
 	}
-	s.cert = cert
-	l, err := net.Listen("tcp", c.Server.Listen)
-	if err != nil {
-		return nil, err
-	}
-	s.listen = l
 
 	s.mux.NotFoundHandler = &notFoundHandler{s}
 	for _, v := range serverv1.Routes {
@@ -95,28 +123,8 @@ func (s *Server) UpdateDB(db *db.DB) error {
 func (s *Server) start() {
 	<-s.init
 	s.srv = &http.Server{
-		Handler: s.mux,
-		TLSConfig: &tls.Config{
-			MinVersion: tls.VersionTLS12,
-			CipherSuites: []uint16{
-				tls.TLS_AES_256_GCM_SHA384,
-				tls.TLS_CHACHA20_POLY1305_SHA256,
-				tls.TLS_AES_128_GCM_SHA256,
-				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-				tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-				tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
-				tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-			},
-			CurvePreferences: []tls.CurveID{
-				tls.X25519,
-				tls.CurveP384,
-				tls.CurveP521,
-			},
-			PreferServerCipherSuites: true,
-			Certificates:             []tls.Certificate{s.cert},
-		},
+		Handler:      s.mux,
+		TLSConfig:    s.tlsConfig,
 		ReadTimeout:  10 * time.Second,
 		WriteTimeout: 10 * time.Second,
 	}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 89b1085..e073906 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -144,7 +144,7 @@ type Config struct {
 
 type Server struct {
 	Listen    string      `yaml:"listen"`
-	TLS       TLS         `yaml:"tls"`
+	TLS       *TLS        `yaml:"tls"`
 	BasicAuth []BasicAuth `yaml:"basicAuth"`
 }
 
diff --git a/run_etcd.sh b/run_etcd.sh
index ab75ec7..021fe6e 100755
--- a/run_etcd.sh
+++ b/run_etcd.sh
@@ -1,6 +1,4 @@
 #!/bin/sh
 
 cd data
-../vipman -config etcd.yaml &
-../vipman -config etcd.yaml &
-../vipman -config etcd.yaml
+../haproxy-lb -config etcd.yaml
diff --git a/run_raft.sh b/run_raft.sh
index d218498..7081bc3 100755
--- a/run_raft.sh
+++ b/run_raft.sh
@@ -2,6 +2,6 @@
 
 cd data
 rm -rf node*
-../vipman -config raft1.yaml &
-../vipman -config raft2.yaml &
-../vipman -config raft3.yaml
+../haproxy-lb -config raft1.yaml &
+../haproxy-lb -config raft2.yaml &
+../haproxy-lb -config raft3.yaml