diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg
index 43c883a629..3d4f075051 100644
--- a/roles/haproxy/templates/haproxy.cfg
+++ b/roles/haproxy/templates/haproxy.cfg
@@ -395,6 +395,7 @@ listen armkoji 0.0.0.0:10060
     server arm-koji01.qa.fedoraproject.org arm-koji01.qa.fedoraproject.org:80 check inter 10s rise 1 fall 2
     option httpchk GET /
 
+{% endif %}
 # This is an endpoint using only ipa01. This is used for API access, since sessions
 # are not synchronized.
 listen  ipa01 0.0.0.0:10061
@@ -402,7 +403,6 @@ listen  ipa01 0.0.0.0:10061
     server  ipa01 ipa01:443 check inter 10s rise 1 fall 2 ssl verify required ca-file /etc/haproxy/ipa.pem
     option  httpchk GET /ipa/ui/
 
-{% endif %}
 # Apache doesn't handle the initial connection here like the other proxy
 # entries.  This proxy also doesn't use the http mode like the others.
 # stunnel should be sitting on port 9939 (public) and redirecting