diff --git a/postgresql/haproxy.cfg b/postgresql/haproxy.cfg
new file mode 100644
index 0000000..0933a82
--- /dev/null
+++ b/postgresql/haproxy.cfg
@@ -0,0 +1,37 @@
+# ─────────────────────────────────────────────────────────────────────────
+# postgresql/haproxy.cfg — Patroni-aware TCP router (ADR-0001)
+# Routes to whichever Patroni node currently answers 200 on GET /primary.
+# No credentials needed here — Patroni's REST API leaves GET/health-check
+# endpoints (/primary, /replica, /health) open; only PATCH/POST config
+# endpoints require postgresql_patroni_password basic-auth.
+# ─────────────────────────────────────────────────────────────────────────
+
+global
+    maxconn 200
+    log stdout format raw local0
+
+defaults
+    log global
+    mode tcp
+    retries 2
+    timeout client 30m
+    timeout connect 4s
+    timeout server 30m
+    timeout check 5s
+
+# Internal-only stats page — reachable within postgresql_db-backend overlay
+# network only (no published port in postgresql.yaml), not exposed externally.
+listen stats
+    mode http
+    bind *:7000
+    stats enable
+    stats uri /
+    stats refresh 10s
+
+listen postgres
+    bind *:5432
+    option httpchk GET /primary
+    http-check expect status 200
+    default-server inter 3s fall 3 rise 2 on-marked-down shutdown-sessions maxconn 100
+    server patroni-0 patroni-0:5432 check port 8008
+    server patroni-1 patroni-1:5432 check port 8008