diff --git a/tasks/configure.yml b/tasks/configure.yml
index 668458808aec62609e13b582b23ac8b88b4a1efe..9d62797413111c386d8f501ab7d4454ea5beedcf 100644
--- a/tasks/configure.yml
+++ b/tasks/configure.yml
@@ -95,6 +95,16 @@
   when: haproxy_private is defined
   notify: "Check HAProxy Config"
 
+- name: "Update private domains"
+  template:
+    src='privatelist.domain.jinja2'
+    dest='/etc/haproxy/privatelist.domain'
+    owner='root'
+    group='root'
+    mode='644'
+  when: haproxy_private is defined and haproxy_private.domain
+  notify: "Check HAProxy Config"
+
 - name: "Create config file"
   template:
     src='haproxy_cfg.jinja2'
diff --git a/templates/haproxy_cfg.jinja2 b/templates/haproxy_cfg.jinja2
index ec28b999fb5d60d99ba2ea653a777908c1d81465..c252b7bd743afb5e4e4edbb1960da6ad504e4876 100644
--- a/templates/haproxy_cfg.jinja2
+++ b/templates/haproxy_cfg.jinja2
@@ -61,9 +61,14 @@ frontend http_in
   bind *:80
   http-request del-header Proxy
 {% if haproxy_private is defined %}
+{% if haproxy_private.domain is defined %}
+  acl privatedomain hdr(host) -i -n -f /etc/haproxy/privatelist.domain
+{% else %}
+  acl privatedomain if true
+{% endif %}
   acl privateip src -f /etc/haproxy/privatelist.ip
   acl private_auth http_auth(notprivate) if !privateip
-  http-request auth realm notprivate if !privateip !private_auth
+  http-request auth realm notprivate if privatedomain !privateip !private_auth
 {% endif %}
   acl blockedip src -f /etc/haproxy/blacklist.ip
   http-request deny if blockedip
@@ -183,9 +188,14 @@ frontend https_in_{{ cert.ip }}
   bind {{ cert.ip }}:443 ssl crt /etc/haproxy/certs/{{ cert.file }} no-sslv3
   http-request del-header Proxy
 {% if haproxy_private is defined %}
+{% if haproxy_private.domain is defined %}
+  acl privatedomain hdr(host) -i -n -f /etc/haproxy/privatelist.domain
+{% else %}
+  acl privatedomain if true
+{% endif %}
   acl privateip src -f /etc/haproxy/privatelist.ip
   acl private_auth http_auth(notprivate) if !privateip
-  http-request auth realm notprivate if !privateip !private_auth
+  http-request auth realm notprivate if privatedomain !privateip !private_auth
 {% endif %}
   acl blockedip src -f /etc/haproxy/blacklist.ip
   http-request deny if blockedip
diff --git a/templates/privatelist.domain.jinja2 b/templates/privatelist.domain.jinja2
new file mode 100644
index 0000000000000000000000000000000000000000..462cd0662797908ce01bf1c6d378c049dd451b29
--- /dev/null
+++ b/templates/privatelist.domain.jinja2
@@ -0,0 +1,3 @@
+{% for domain in haproxy_private.domain %}
+{{ domain }}
+{% endfor %}