HAProxy

HAProxy is a fast, reliable load balancer and proxy for TCP and HTTP applications. It distributes traffic across backend servers, performs health checks, and terminates TLS, making it a common front door for high-availability web services.

Software included

Component	Version
HAProxy	3.2
Ubuntu	24.04 LTS

Getting started

1. Connect to your VM

ssh ubuntu@<your-vm-ip>

2. Verify HAProxy is running

There is no first-boot configuration. HAProxy starts immediately after the VM boots.

systemctl status haproxy

3. Test the HTTP frontend

Open the default frontend in a browser:

http://<your-vm-ip>

It returns:

HAProxy is running

The local statistics page listens on 127.0.0.1:8404. You can verify it from the VM:

curl http://127.0.0.1:8404/

Managing HAProxy

# Check service status
systemctl status haproxy

# Validate the configuration
sudo haproxy -c -f /etc/haproxy/haproxy.cfg

# Restart
sudo systemctl restart haproxy

# View logs
sudo journalctl -u haproxy -f

Path	Purpose
`/etc/haproxy/haproxy.cfg`	Main configuration
`/run/haproxy/admin.sock`	Local administrative statistics socket

Security

Port 80 is open on the VM’s network interface. UFW is enabled and allows HAProxy HTTP (port 80) and SSH (port 22). The statistics page on port 8404 is bound to localhost only. Port 443 is not open by default because the image does not provision a TLS certificate.

To restrict the HTTP frontend to a specific IP:

sudo ufw delete allow 80/tcp
sudo ufw allow from <trusted-ip> to any port 80

To access the frontend without leaving port 80 open, use an SSH tunnel:

First close the public port on the VM, since it is open by default:

sudo ufw delete allow 80/tcp

# Run this on your local machine
ssh -L 8080:localhost:80 ubuntu@<your-vm-ip>

# Then open in a browser
http://localhost:8080

For production use, configure TLS termination in HAProxy with a trusted certificate, or place it behind a TLS-enabled proxy before accepting sensitive traffic.