HAProxy config generator

A complete haproxy.cfg for HAProxy 2.8 LTS (also fine on 2.4–3.0, differences are noted in the comments). The defaults fit HAProxy terminating TLS in front of Apache on port 80. Settings are kept in the URL; the stats password is not.

Start from

Frontend

HTTP on :80 HTTPS on :443 IPv6 too (:::443 v4v6)

Listen address (empty = all)

Certificates

Path (empty = default for the choice above)

HTTP/2 (alpn h2,http/1.1) Redirect HTTP → HTTPS Let ACME HTTP-01 challenges through

Redirect code

ACME client at

Backends

Servers: one per line, [name] address:port [weight N] [maxconn N] [backup], e.g. web1 10.0.0.11:80 weight 100.

Routing

By host name (Host header; SNI for TCP below)

Host	Backend	Remove

example.com exact · *.example.com subdomains only · .example.com both. Exact names are checked first.

By path (checked before the host rules)

Host (optional)	Match	Path	Backend	Remove

Default backend (no rule matched)

Forwarded headers

option forwardfor (X-Forwarded-For) Drop client-sent X-Forwarded-For X-Forwarded-Proto X-Forwarded-Host X-Real-IP Log the Host header

Security headers

HSTS includeSubDomains preload

max-age (s)

X-Content-Type-Options Hide Server, X-Powered-By

X-Frame-Options

Referrer-Policy

Headers are only added when the backend did not send its own. More headers (CSP, Permissions-Policy): header builder.

Compression (gzip)

Rate limiting per client IP

Requests / 10 s

Over the limit

Never limit (IPs or CIDR)

Admin paths only from some IPs

Paths (prefixes)

Allowed IPs

Block IPs

Always refuse (IPs or CIDR; 403)

Maintenance page

When

Still see the site

Page file (empty = built-in)

For http-request return the file is plain HTML. For errorfile it is a whole HTTP response with status line and headers.

Stats page

Port

Path

User

Password (not kept in the URL)

Allowed IPs (empty = anyone)

Admin actions (drain/disable servers) Prometheus /metrics

TCP services (mail, SSH, TLS passthrough)

Name	Port	SNI names (optional)	Servers	Check	PROXY	Remove

With SNI names the service is routed by req.ssl_sni without decrypting. On port 443 it shares the port with the HTTPS frontend.

Global and defaults

maxconn

Syslog target

Log format

TLS profile

chroot Runtime API socket Debian error pages option redispatch

connect

client

server

http-request

http-keep-alive

queue

tunnel

check

Times: 500ms, 5s, 1m, 1h. What each one does: timeouts cheat sheet.

haproxy.cfg

Check and reload

Save the file as /etc/haproxy/haproxy.cfg (keep a copy of the old one), then:

Version notes

2.4: everything here works except ca-file @system-ca (use a CA file path). option httpslog is new in 2.4.
2.6 / 2.8: the target. http-check send, http-request return, http-after-response and the converters used here are all available.
3.0: same syntax. Adds %{+json}o for JSON logs with named fields, and stricter checks of some deprecated keywords; run haproxy -c after upgrading.
Old reqadd/rspadd/reqrep and block were removed in 2.1; use http-request/http-response rules as below.