HAProxy Fundamentals
HAProxy is a proxy and load balancer that accepts network traffic, applies routing rules, and sends each connection or HTTP request to an available backend server.
itWeb servers, proxies, and traffic management | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - HAProxy Fundamentals
HAProxy sits between clients and application servers. A client connects to HAProxy. HAProxy accepts that connection, applies the configured policy, and opens or uses a connection to a backend server. That position gives HAProxy one clear job: control traffic before it reaches your application fleet. You can distribute work, route requests by HTTP information, terminate TLS, check server health, and keep unavailable servers out of rotation.
Treat the configuration as a traffic path. A frontend owns one or more listening sockets through bind. The frontend selects a backend, either as its default or through a conditional rule. The backend contains named server entries and a balancing policy. HAProxy selects an eligible server and proxies the traffic. A listen section combines frontend and backend roles for small proxies. Separate frontends and backends usually make HTTP routing and shared server pools easier to reason about. defaults supplies inherited settings; read both section boundaries and rule order.
In mode http, HAProxy parses HTTP so you can route by host, path, headers, cookies, or methods. In mode tcp, it proxies streams without HTTP request routing. Use TCP mode for opaque protocols or when traffic must remain untouched at the proxy layer. Frontend and backend modes that connect to each other must be compatible.
Health checks and server state decide who receives traffic. ACL and map-driven routing express policy as configuration, not as application code. TLS termination and pass-through are deliberate choices with certificate and trust consequences. Reloads replace active configuration; validate before you push a change that affects every listener.
Read the Intro for the traffic-path model. Use the Cheatsheet when you need frontend, backend, and ACL landmarks. Updates tracks HAProxy release tags published on the project's GitHub mirror. Canonical development remains on git.haproxy.org, so this course does not claim a GitHub Upstream vitals snapshot under ADR 0046.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/proxying-essentials/configuration-basics/
Supports
- HAProxy configuration uses global, defaults, frontend, backend, listen, and program sections
- Defaults provide inherited settings for later proxy sections
- A listen section combines frontend and backend roles
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/proxying-essentials/configuration-basics/frontends/
Supports
- A frontend defines client-facing addresses and ports
- Frontends can use HTTP or TCP mode
- Frontends use default_backend and ACL-based use_backend rules to choose backends
- A frontend mode should match the backend mode it sends traffic to
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/proxying-essentials/configuration-basics/backends/
Supports
- Backends contain servers that receive proxied traffic
- The balance directive selects a server selection algorithm
- Round robin suits similar-capacity servers with short requests
- Least connections suits long-lived connections
- HAProxy 3.3 and later defaults to random selection, while 3.2 and earlier defaults to round robin
- The check argument enables health checking for a server
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/reliability/health-checks/
Supports
- Active checks connect to a server or send an HTTP request at regular intervals
- Consecutive failed checks can remove a server from rotation
- Consecutive successful checks can restore a server to rotation
- HTTP checks can evaluate response status or content
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/security/ssl-tls/basics-enable-tls/
Supports
- HAProxy can encrypt client-side and server-side connections with TLS
- A bind line can enable client-side TLS with ssl and crt arguments
- Verify required validates a backend certificate against a configured CA file
- HTTP redirects and HSTS have different effects and HSTS should be tested with a low max-age value
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/protocol-support/tcp/
Supports
- HAProxy can operate as a TCP proxy that relays streams to backend server pools
- https://docs.haproxy.org/3.2/configuration.html
Supports
- The configuration manual provides directive syntax and scope for HAProxy 3.2