HAProxy Config Generator
High-Performance Load Balancing & Proxy Infrastructure

HAProxy Load Balancer Configuration Generator

Construct production HAProxy 2.x/3.x configs with frontend SSL termination, round-robin backends, health checks, ACLs, and rate limiting.

100% Client-Side Privacy
Zero Server Transmission
Presets:
HAProxy Architecture Configurator
Global & Performance Directivesglobal
Proxy Defaults & Resiliency Timeoutsdefaults
Frontend & SSL/TLS Offloadingfrontend
In-Memory Stick-Table DDoS Mitigation
Access Control Lists (ACLs)
→
Backend Server Pools (5 Nodes)
be_app_clusterhttp
:
:
:
be_static_cachehttp
:
:
HAProxy Web Dashboard & Prometheus Exporter
105 lines•4,129 chars•4,129 bytes
Dynamic AST Syntax Ready
#---------------------------------------------------------------------
# HAProxy 3.0 Production Configuration
# Generated via ToolsAA 100% Client-Side Engine
#---------------------------------------------------------------------
global
    log 127.0.0.1:514 local0 notice
    chroot /var/lib/haproxy
    user haproxy
    group haproxy
    daemon
    maxconn 50000
    nbthread 4
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s

    # Hardened Modern SSL/TLS Ciphers (OWASP & Mozilla Modern Standard)
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

#---------------------------------------------------------------------
# Common Defaults for all Frontend & Backend Proxies
#---------------------------------------------------------------------
defaults
    log global
    mode http
    option httplog
    option dontlognull
    option redispatch
    retries 3
    timeout connect 5s
    timeout client  50s
    timeout server  50s
    timeout http-keep-alive 15s
    timeout http-request    10s
    timeout queue   1m
    maxconn 30000

#---------------------------------------------------------------------
# Frontend: fe_web_https
#---------------------------------------------------------------------
frontend fe_web_https
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/site.pem alpn h2,http/1.1
    http-request redirect scheme https unless { ssl_fc }
    http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    option forwardfor
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http unless { ssl_fc }
    http-request set-header X-Forwarded-Port %[dst_port]
    compression algo gzip deflate
    compression type text/html text/plain text/css application/javascript application/json

    # Stick-table Rate Limiting & Anti-DDoS
    stick-table type ip size 100k expire 10s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 120 }

    # ACL Conditions
    acl is_static_assets path_beg /static /assets /favicon.ico

    # ACL Backend Routing Rules
    use_backend be_static_cache if is_static_assets
    default_backend be_app_cluster

#---------------------------------------------------------------------
# Backend: be_app_cluster
#---------------------------------------------------------------------
backend be_app_cluster
    mode http
    balance roundrobin
    cookie SERVERID insert indirect nocache
    option httpchk GET /healthz
    http-check expect status 200,204
    server web01 10.0.1.11:3000 weight 10 check inter 2000 rise 2 fall 3 cookie web01
    server web02 10.0.1.12:3000 weight 10 check inter 2000 rise 2 fall 3 cookie web02
    server web03 10.0.1.13:3000 weight 10 check inter 2000 rise 2 fall 3 cookie web03

#---------------------------------------------------------------------
# Backend: be_static_cache
#---------------------------------------------------------------------
backend be_static_cache
    mode http
    balance roundrobin
    option httpchk GET /healthz
    http-check expect status 200,204
    server nginx-cdn01 10.0.1.51:80 weight 10 check inter 2000 rise 2 fall 3
    server nginx-cdn02 10.0.1.52:80 weight 10 check inter 2000 rise 2 fall 3

#---------------------------------------------------------------------
# HAProxy Real-Time Statistics & Prometheus Metrics Hub
#---------------------------------------------------------------------
listen stats
    bind *:8404
    mode http
    stats enable
    stats uri /stats
    stats refresh 5s
    stats auth admin:SuperClusterSecret2026
    stats show-node
    stats show-legends

    # Prometheus Exporter Endpoint
    http-request use-service prometheus-exporter if { path /metrics }
105 lines•4,129 chars•4,129 bytes
Target:CONFIG| Ready for Production
Frontends & Ports
fe_web_https:80 & :443 (TLS)
Mode: HTTP • HTTP/2 ALPN Active
Backend Cluster
2 Pools (5 Upstream Nodes)
Strategy: roundrobin • Active Health Checks
Security & DDoS Defense
Stick-Table (100k IPs)
TLS 1.3 Ciphers & HSTS Active

100% Client-Side HAProxy Generator

Zero server transmission or analytics logging. All backend IPs, credentials, health check routes, and ACLs remain strictly inside your browser memory.

Production HAProxy 2.x & 3.x Directives

Generates battle-tested HAProxy syntax including modern TLS 1.3 ciphers, ALPN negotiation, active health checks, connection pooling, and stick-table rate limiting.

Enterprise Deployment Ready

Export production configuration files alongside Docker Compose setups, Systemd service definitions, and zero-downtime hot-reload CLI commands.

Technical Reference & Architecture Guide

HAProxy Config Generator — Reference Guide

Production-grade configuration generator and syntax validator for HAProxy load balancers.

Key Parameters & Controls

version'3.0' | '2.8' | '2.4'

Target HAProxy release branch determining keyword compatibility, thread defaults, and modern SSL cipher suites.

Default: '2.8'
mode'http' | 'tcp'

Proxy operating layer. Controls whether HAProxy parses L7 HTTP headers and cookies or operates as a transparent L4 TCP stream router.

Default: 'http'
algorithm'roundrobin' | 'leastconn' | 'source' | 'uri' | 'first' | 'random'

Backend load balancing policy determining how traffic is distributed across upstream server nodes.

Default: 'roundrobin'
enableRateLimitboolean

Provisions in-memory stick-table tracking client IP request rates and applies HTTP 429 deny rules when thresholds are exceeded.

Default: false
enableAlpnH2boolean

Appends 'alpn h2,http/1.1' negotiation tokens to TLS bind declarations for HTTP/2 multiplexing.

Default: true

Pro Tips & Best Practices

Tune Stick-Table Expiry Windows

Use expire intervals between 10s and 30s with http_req_rate(10s) instead of high values to minimize RAM consumption under DDoS attacks.

Optimize Health Check Intervals

Configure 'inter 3s fastinter 1s downinter 5s rise 2 fall 3' on backend servers to avoid cascading failover storms during transient network jitter.

Harden Dynamic Reloads with CLI

Bind 'stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners' to support zero-downtime master-worker reloads without dropped packets.

Common Gotchas & Troubleshooting

haproxy -c fails with 'SSL certificate not found' during dry-run validation

Ensure the sslCertPath directive points to a combined PEM file containing both fullchain and private key, or provision a dummy self-signed cert at the target path before running validation tests.

Backend health checks report 'L7STS: Layer7 invalid status 404'

Append 'http-check send hdr Host yourdomain.com' to your 'option httpchk' definition when backend applications require virtual host header matching to return HTTP 200.

Stick-table rate limiting blocks legitimate clients behind CDN reverse proxies

Switch tracking key from 'src' to 'http-request track-sc0 hdr(CF-Connecting-IP)' or 'hdr(X-Forwarded-For)' so the table inspects true client IPs instead of CDN edge egress nodes.

Frequently Asked Questions

How does HAProxy execute zero-downtime reloads across systemd updates?▼

Modern versions leverage master-worker mode (-W) combined with socket pair passing via 'expose-fd listeners'. The new worker process inherits existing listening sockets before the retiring process gracefully finishes active TCP connections.

Are configuration definitions processed or stored on an external server?▼

All configuration compilation, AST rendering, and template exports execute locally inside browser memory. Infrastructure parameters and internal IP topology never leave your client workstation.

What is the memory footprint of an HAProxy stick-table under heavy traffic?▼

Each tracked IPv4 record consumes approximately 64 bytes in memory. A stick-table sized for 100,000 entries (size 100k) requires approximately 6.4 MB of dedicated RAM.

Why does HAProxy require concatenated PEM files for TLS terminations?▼

HAProxy reads TLS assets via OpenSSL using a single file path per bind line. The PEM file must contain the private key, server certificate, and any intermediate CAs in consecutive blocks.

Related Tools & Utilities

All Tools →
Kubernetes Helm Chart (Chart.yaml & values.yaml) GeneratorDeveloper

Generate standard Kubernetes Helm v3 Chart.yaml, values.yaml, and deployment templates with service, ingress, and resource limits.

Open tool→
Multi-Stage Dockerfile Generator (Node, Go, Python, Rust)Developer

Create hardened, lightweight multi-stage Dockerfiles for Node.js, Golang, Python, Rust, and Java with non-root security and cache optimization.

Open tool→
SQL DDL to Kysely TypeScript Database Interface GeneratorDeveloper

Convert SQL CREATE TABLE DDL schemas into strongly-typed Kysely TypeScript database interfaces, Generated columns, and ColumnType definitions.

Open tool→
SQL DDL to MikroORM TypeScript Entity GeneratorDeveloper

Convert SQL CREATE TABLE definitions into MikroORM entity classes with @Entity, @PrimaryKey, @Property, @Index, and relationship decorators.

Open tool→
JSON to Mongoose Schema & TypeScript Model GeneratorDeveloper

Infer and generate MongoDB Mongoose schemas, TypeScript document interfaces, nested subdocuments, timestamps, and model exports from JSON.

Open tool→
JSON to Yup Validation Schema GeneratorDeveloper

Transform JSON samples into type-safe Yup object validation schemas with yup.string(), yup.number(), yup.array(), and required rules.

Open tool→