HAProxy on a VPS: load balancing and high availability

Why host HAProxy on a dedicated VPS?

What you can do with HAProxy

• Distribute HTTP/HTTPS traffic among several application servers with configurable algorithms (roundrobin, leastconn, source…)
• Set up a reverse proxy to expose several internal services behind a single public IP address
• Monitor backend health with automatic health checks and remove a failing server without service interruption
• Terminate SSL/TLS connections at the front end (offloading) to relieve your application servers from encryption
• Route traffic by domain or path with ACLs (host_hdr, path_beg) on a single port 443
• Consult real-time traffic statistics via HAProxy's built-in web interface (stats uri /stats)

Install and configure HAProxy on your ServOrbit VPS

1. 01

   Order a ServOrbit Cloud VPS and launch the installation

   Go to /vps-cloud and choose a plan with at least 2 vCPU and 2 GB RAM. From your VPS dashboard, open the Marketplace, search for 'HAProxy' and click Install. ServOrbit's automatic provisioning installs HAProxy via apt and enables the service — no SSH connection required at this stage. You can also install manually: sudo apt update && sudo apt install -y haproxy

2. 02

   Understand the structure of haproxy.cfg

   The main configuration file is at /etc/haproxy/haproxy.cfg. It is organized into four sections: global (process, logs, system limits), defaults (inherited timeouts and modes), frontend (listening ports, ACL rules) and backend (target servers, algorithm, health checks). Edit it with: sudo nano /etc/haproxy/haproxy.cfg

3. 03

   Configure a complete HTTP/HTTPS frontend and backend

   Here is a complete configuration for two application servers with SSL termination:

   global
       log /dev/log local0
       maxconn 50000
       user haproxy
       group haproxy
   
   defaults
       log     global
       mode    http
       option  httplog
       timeout connect 5s
       timeout client  30s
       timeout server  30s
   
   frontend http_front
       bind *:80
       redirect scheme https code 301
   
   frontend https_front
       bind *:443 ssl crt /etc/haproxy/certs/bundle.pem
       default_backend app_servers
   
   backend app_servers
       balance roundrobin
       option httpchk GET /health
       server app1 192.168.1.10:3000 check weight 1 inter 2s fall 3 rise 2
       server app2 192.168.1.11:3000 check weight 2 inter 2s fall 3 rise 2

   The weight parameter sends proportionally more traffic to app2. The option httpchk GET /health directive sends an HTTP request to the /health endpoint of each backend to verify it responds correctly.

4. 04

   Configure ACLs for domain and path-based routing

   ACLs allow routing traffic to different backends based on the domain name or request path. Add to your frontend:

   frontend https_front
       bind *:443 ssl crt /etc/haproxy/certs/bundle.pem
   
       acl host_api   hdr(host) -i api.mysite.com
       acl host_app   hdr(host) -i app.mysite.com
       acl path_admin path_beg  /admin
   
       use_backend api_servers   if host_api
       use_backend admin_servers if path_admin
       use_backend app_servers   if host_app
       default_backend app_servers

   The hdr(host) directive inspects the HTTP Host header to identify the domain. path_beg /admin routes all requests whose path starts with /admin to a dedicated backend.

5. 05

   Terminate SSL/TLS with Let's Encrypt and create the PEM bundle

   HAProxy expects a .pem file containing the certificate, the intermediate chain and the private key in that order. After obtaining your certificate with Certbot, create the bundle:

   sudo mkdir -p /etc/haproxy/certs
   sudo cat /etc/letsencrypt/live/mysite.com/fullchain.pem \
            /etc/letsencrypt/live/mysite.com/privkey.pem \
     | sudo tee /etc/haproxy/certs/bundle.pem
   sudo chmod 600 /etc/haproxy/certs/bundle.pem

   To automate renewal, add a post-hook in /etc/letsencrypt/renewal-hooks/post/haproxy.sh that rebuilds the bundle and runs systemctl reload haproxy.

6. 06

   Enable the HAProxy statistics page

   The built-in statistics page gives a real-time view of each frontend, backend and server. Add a dedicated frontend block:

   frontend stats
       bind *:8404
       stats enable
       stats uri /stats
       stats refresh 10s
       stats auth admin:SecretPassword
       stats hide-version

   Access it at http://your-ip:8404/stats. The stats auth field protects the page with HTTP Basic authentication.

7. 07

   Validate the configuration and reload without interruption

   Before any reload, validate the configuration file syntax:

   sudo haproxy -c -f /etc/haproxy/haproxy.cfg

   If the command displays Configuration file is valid, reload HAProxy without dropping active connections:

   sudo systemctl reload haproxy

   Check that the service is active: sudo systemctl status haproxy. The reload command (not restart) guarantees a graceful reload: established connections finish normally before the old workers stop.

8. 08

   Check logs and monitor continuously

   HAProxy sends its logs to syslog. View them in real time:

   sudo journalctl -u haproxy -f

   Each line shows the frontend, backend, selected server, HTTP code and connection times — essential for diagnosing a routing issue or slow backend.

Advanced health checks: detecting failing backends

Load balancing algorithms: which one to choose?

Scroll the table

Troubleshooting: common errors and solutions

Common errors and how to resolve them

• [ALERT] Starting frontend http_front: cannot bind socket [0.0.0.0:80] — Port 80 is already used by another process (nginx, apache2). Identify it with sudo ss -tlnp | grep ':80', stop the competing service (sudo systemctl stop nginx) then reload HAProxy.
• [WARNING] Server app_servers/app1 is DOWN, reason: Layer4 connection problem — HAProxy cannot reach the backend IP address or port. Check the application server is running, its firewall allows connections from the HAProxy VPS IP, and the address in haproxy.cfg is correct.
• [ALERT] parsing [/etc/haproxy/haproxy.cfg:42] : unknown keyword 'serveur' — Syntax error in the configuration file. The command haproxy -c -f /etc/haproxy/haproxy.cfg gives the exact line number. HAProxy keywords are in English: server, frontend, backend. Also check indentation (HAProxy only accepts spaces).
• [ALERT] ssl library has no cert for frontend https_front or certificate expired — The bundle.pem file is missing, empty or contains an expired certificate. Rebuild the bundle from up-to-date Let's Encrypt files (fullchain.pem + privkey.pem) then reload.
• Statistics page returns HTTP 403 — The stats auth directive is configured but credentials are not sent, or the source IP is not in a stats allow-from whitelist. Check the URL (/stats by default), the credentials, and temporarily add stats allow-from 0.0.0.0/0 to diagnose.