Configure and Optimize HAProxy Load Balancer

This skill guides HAProxy load balancer configuration end to end. It starts with global/defaults sections (daemon mode, connection limits, TLS cipher suites restricted to ECDHE/DHE with TLSv1.2 minimum, timeouts, and retry behavior), then frontend configuration with SSL termination, HTTPS redirect, ACL-based routing (path_beg, header-based websocket detection) to different backends, and security response headers (HSTS, X-Frame-Options, X-Content-Type-Options).

Backend configuration covers load balancing algorithms - roundrobin with cookie-based session persistence (cookie SERVERID insert indirect nocache) and leastconn with advanced HTTP health checks (custom method/URI/headers, rise/fall thresholds) and backup servers for failover. Advanced features include stick-table-based rate limiting and connection limiting (denying requests when a source IP exceeds a request-rate or concurrent-connection threshold), multi-certificate SSL with ALPN and OCSP stapling, and a stats frontend with authenticated access restricted by source IP.

backend api_servers
    balance leastconn
    option httpchk GET /api/health
    http-check expect string "healthy"
    server api1 10.0.2.10:8081 check inter 2000ms rise 2 fall 3

High-availability guidance covers Keepalived integration - a vrrp_script health-checking the HAProxy process and a vrrp_instance managing a floating virtual IP with MASTER/BACKUP failover. Performance optimization covers nbthread/cpu-map tuning, buffer size tuning, connection reuse (option http-server-close, prefer-last-server), and gzip compression by content type. Logging setup covers structured httplog output with captured request/response headers, and security hardening covers ACL-based blocking of bad bots, SQL-injection patterns in URLs, excessive request rates, and IP-restricted admin paths. Deployment guidance covers config validation (haproxy -c), graceful systemctl reload, and zero-downtime reload via the admin socket.

Use this skill when configuring or hardening an HAProxy deployment that needs SSL termination, ACL-based routing across multiple backends, health-checked load balancing with session persistence, rate limiting, high-availability failover, or security hardening against common attack patterns. It applies to both new HAProxy setups and tuning existing production configurations.

It is not the right tool for load balancers on other platforms (Nginx, Envoy, cloud-native ALBs) since the configuration syntax and stick-table/ACL mechanics are HAProxy-specific, or for simple single-backend setups with no routing, persistence, or rate-limiting needs where a minimal config is sufficient.

Input: the backend servers to load-balance, the routing rules needed (path/header-based ACLs), SSL certificate requirements, health check endpoints, and availability/security requirements (rate limits, IP restrictions, HA failover). Output: an haproxy.cfg with global/defaults, frontend(s) with ACL routing and security headers, backend(s) with load-balancing algorithm and health checks, optional Keepalived configuration for HA, and validated deployment commands for reload.

Built on native HAProxy configuration syntax (stick-tables, ACLs, health checks) and Keepalived for VRRP-based high availability. SSL/TLS handles certificate lists and OCSP stapling natively; logging integrates with syslog (log 127.0.0.1:514); zero-downtime reloads use the HAProxy admin socket via socat.

Infrastructure and platform engineers deploying or hardening HAProxy load balancers - particularly teams needing SSL termination, ACL-based routing, rate limiting, high-availability failover, and security hardening for production traffic.