HAProxy: High Availability, Layer 4/7 Load Balancing, and Health Checking

HAProxy (High Availability Proxy) is an ultra-fast, reliable, event-driven reverse proxy and load balancer supporting both Layer 4 (TCP) and Layer 7 (HTTP) traffic routing. Known for its low memory footprint and high saturation resilience, it is the standard engine for balancing database clusters and high-throughput microservices.

⚡ Quick Dive

Layer 4 (TCP) vs. Layer 7 (HTTP) Proxying

Feature Layer 4 TCP Mode (mode tcp) Layer 7 HTTP Mode (mode http)
Inspection Level IP and Port only (Zero packet inspection) HTTP Headers, Cookies, URIs, Methods
Throughput & Speed ⚡ Maximum (Zero-copy TCP splice) High (Requires parsing HTTP stream)
SSL/TLS Handling TCP Passthrough (End-to-end encryption) SSL Termination / Decryption
Ideal Workloads Database clusters (PostgreSQL, MySQL, Redis), SSH Web APIs, path routing, sticky cookies

Core haproxy.cfg Configuration Sections

global
    log /dev/log local0
    maxconn 50000
    user haproxy
    group haproxy
    daemon

defaults
    log global
    mode http
    option httplog
    option dontlognull
    timeout connect 5000ms
    timeout client  50000ms
    timeout server  50000ms

# Public-facing HTTP listener
frontend http_in
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/site.pem
    http-request redirect scheme https unless { ssl_fc }
    
    # Path-based routing ACLs
    acl is_api path_beg /api/
    use_backend api_cluster if is_api
    default_backend web_cluster

# Backend application pool with active health checking
backend web_cluster
    balance roundrobin
    cookie SERVERID insert indirect nocache
    server web1 10.0.1.10:8080 check inter 2000ms rise 2 fall 3 cookie srv1
    server web2 10.0.1.11:8080 check inter 2000ms rise 2 fall 3 cookie srv2

# Built-in live monitoring dashboard
listen stats
    bind *:9000
    mode http
    stats enable
    stats uri /
    stats refresh 5s

📖 Extended Guide

1. Active Health Checking & Failure Detection

HAProxy sends continuous background health probes to backend servers:

  • inter 2000ms: Probe interval (every 2 seconds).
  • fall 3: Mark server down after 3 consecutive failed health checks.
  • rise 2: Reintroduce server to active pool after 2 consecutive successful checks.
# Layer 7 HTTP Health Check Probe
backend api_cluster
    option httpchk GET /healthz
    http-check expect status 200
    server api1 10.0.2.10:8080 check
    server api2 10.0.2.11:8080 check

2. High Availability with Keepalived & Virtual IP (VRRP)

To eliminate HAProxy itself as a single point of failure (SPOF), deploy two HAProxy nodes in an Active/Passive cluster using Keepalived and Virtual Router Redundancy Protocol (VRRP):

[ DNS Points to Virtual IP: 198.51.100.1 ]
                     │
         ┌───────────┴───────────┐
         ▼ (Active Node)         │ (Standby Node)
┌──────────────────┐    ┌──────────────────┐
│ HAProxy Master   │    │ HAProxy Backup   │
│ Keepalived       │    │ Keepalived       │
└────────┬─────────┘    └────────┬─────────┘
         │ (VRRP Heartbeat over LAN)
         └───────────────────────┘

If the Master HAProxy node hardware fails or crashes, Keepalived transfers the Virtual IP (VIP) to the Backup node within milliseconds with zero packet loss.

⌂ All Guides