run TLS 1.3 service from another in TLS 1.2, how is it configured?
What do you mean ? You want a frontend in TLS1.2 and a backend in TLS1.3?
This could be done this way:
frontend front1
bind *:443 ssl crt /etc/haproxy/foobar.pem ssl-min-ver TLSv1.2
use_backend back1
backend back1
server srv1 1.2.3.4:443 ssl ssl-min-ver TLSv1.3