HAProxy — High-Performance TCP/HTTP Load Balancer

What it is

HAProxy is an open-source, high-performance TCP and HTTP load balancer and reverse proxy. It handles Layer 4 and Layer 7 load balancing, supports HTTP/2, HTTP/3 (QUIC), and TLS 1.3, and can reload configurations with zero downtime. HAProxy powers some of the highest-traffic websites and is a standard component in production infrastructure stacks.

HAProxy is designed for operations teams and platform engineers who need a reliable, fast, and configurable load balancer for production workloads.

How it saves time or tokens

HAProxy handles millions of concurrent connections on a single instance, reducing the need for complex multi-tier load balancing setups. Its configuration file is declarative and well-documented, meaning you can set up production-grade load balancing in a single config file rather than stitching together multiple tools. Hot reloads let you change routing rules, add backends, or update TLS certificates without dropping any connections.

How to use

1. Run HAProxy via Docker:

docker run -d --name haproxy -p 80:80 -p 8404:8404 \
  -v $(pwd)/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
  haproxy:3.1

1. Create a minimal haproxy.cfg:

global
    maxconn 4096

defaults
    mode http
    timeout connect 5s
    timeout client 30s
    timeout server 30s

frontend http_front
    bind *:80
    default_backend app_servers

backend app_servers
    balance roundrobin
    server app1 10.0.0.1:8080 check
    server app2 10.0.0.2:8080 check

listen stats
    bind *:8404
    stats enable
    stats uri /stats

1. Access the stats dashboard at http://localhost:8404/stats to monitor backend health and connection metrics.

Example

HTTPS termination with Let's Encrypt certificates and health checks:

frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1
    http-request redirect scheme https unless { ssl_fc }
    use_backend api_servers if { path_beg /api }
    default_backend web_servers

backend web_servers
    balance leastconn
    option httpchk GET /health
    server web1 10.0.0.1:3000 check inter 5s fall 3 rise 2
    server web2 10.0.0.2:3000 check inter 5s fall 3 rise 2

backend api_servers
    balance roundrobin
    server api1 10.0.0.3:8080 check
    server api2 10.0.0.4:8080 check

Related on TokRepo

• DevOps tools — Browse infrastructure and networking tools
• Self-hosted tools — Explore self-hosted infrastructure components

Common pitfalls

• Not setting proper health check intervals. Without health checks, HAProxy continues sending traffic to failed backends. Always configure option httpchk with reasonable inter, fall, and rise values.
• Using mode tcp when you need HTTP features like path-based routing or header manipulation. TCP mode is faster but lacks Layer 7 features.
• Not monitoring the stats page in production. The HAProxy stats dashboard provides real-time visibility into connection counts, error rates, and backend health. Enable it and monitor it.