HAProxy Config Validator

HAProxy (High Availability Proxy) is a free, open-source TCP/HTTP load balancer and proxy server. It's widely used in high-traffic websites including GitHub, Stack Overflow, and Twitter. It provides layer 4 (TCP) and layer 7 (HTTP) load balancing, SSL termination, health checks, and detailed stats.

A frontend defines how HAProxy accepts connections — the bind address/port, ACL rules, and which backend to use. A backend defines the pool of servers to send traffic to, including the load balancing algorithm (roundrobin, leastconn) and health check configuration. A 'listen' block combines both into one section.

roundrobin (default, equal distribution), leastconn (send to least-loaded server), source (IP hash, sticky sessions by client IP), static-rr (like roundrobin but static weights), first (fill servers sequentially), uri (hash on URI path, useful for caching), url_param (hash on URL parameter), hdr (hash on HTTP header), and random.

Add 'check' to a server line: 'server web1 127.0.0.1:8080 check'. By default, HAProxy makes a TCP connection. For HTTP health checks, add 'option httpchk GET /health HTTP/1.1' to the backend. Configure check interval with 'inter 2s', failure threshold with 'fall 3', and recovery with 'rise 2'. Failed servers are removed from rotation automatically.

In the frontend bind line: 'bind *:443 ssl crt /etc/ssl/certs/example.pem'. HAProxy expects the certificate and private key concatenated into one .pem file: cat fullchain.pem privkey.pem > example.pem. Add 'ssl-min-ver TLSv1.2' and 'ciphers ECDHE-ECDSA-AES256-GCM-SHA384:...'. For HTTP/2 support, add 'alpn h2,http/1.1'.

Run: haproxy -c -f /etc/haproxy/haproxy.cfg. The -c flag checks configuration without starting the service. To reload without dropping connections: haproxy -sf $(cat /var/run/haproxy.pid) -f /etc/haproxy/haproxy.cfg. Or with systemd: systemctl reload haproxy.