How to Deploy HAProxy on Ubuntu 22.04

HAProxy (High Availability Proxy) is an open-source proxying application that serves as a reverse or forward proxy for TCP and HTTP-based applications. It examines incoming client connections and forwards each request to a backend server based on configurable routing rules, distributing the traffic load across the destination servers.

This article explains how to deploy HAProxy on an Ubuntu 22.04 server and distribute traffic to multiple servers running similar services in a single Virtual Private Cloud (VPC) network, forming a load-balanced cluster. You configure HAProxy as a load balancer that forwards external requests to backend servers to improve your web application's performance.

Prerequisites

Before you begin, you need to:

• Deploy an Ubuntu 22.04 server instance as a non-root user with sudo privileges to use as the HAProxy server.
• Deploy at least two additional Ubuntu 22.04 server instances as non-root users with sudo privileges to use as backend servers, in the same location as the HAProxy server.
• Attach all servers to the same VPC network.
• Set up a new domain A record that points to your HAProxy server IP address. For example, haproxy.example.com. See Introduction to Vultr DNS to create the record.

Sample HAProxy Load Balancing Topology

This article uses the following example topology to configure HAProxy as a load balancer that distributes traffic to multiple backend servers running the Apache web server application. HAProxy forwards connection requests to a backend server based on its health status and your chosen load balancing method.

Below are the respective IP address details for each server in the VPC network.

• HA-Proxy Server:
  • Public Hostname: haproxy.example.com
  • VPC IP: 10.128.0.2
• Server 1:
  • VPC IP: 10.128.0.3
• Server 2:
  • VPC IP: 10.128.0.4

Install HAProxy on Ubuntu 22.04

This section installs a recent stable release of HAProxy on the HAProxy server and enables it to start automatically on boot.

1. Access the HAProxy server using SSH with agent forwarding enabled.

   CONSOLE

   Copy

   $ ssh -A USERNAME@SERVER-IP

   Explain Code

   Powered by Vultr AgentBeta

   Replace USERNAME with your non-root sudo user, and SERVER-IP with the public IP address of your HAProxy server. The -A flag forwards your local SSH key through this session, which you need later to connect from the HAProxy server to each backend server over its private VPC address.

2. Create a new non-root user with sudo privileges. For example, haproxyadmin.

   CONSOLE

   Copy

   $ sudo adduser haproxyadmin && sudo adduser haproxyadmin sudo

   Explain Code

   Powered by Vultr AgentBeta

3. Switch to the new sudo user account.

   CONSOLE

   Copy

   $ sudo su - haproxyadmin

   Explain Code

   Powered by Vultr AgentBeta

4. Add the vbernat PPA repository to install a newer stable HAProxy release than the version available in the default Ubuntu repositories.

   CONSOLE

   Copy

   $ sudo add-apt-repository ppa:vbernat/haproxy-2.8 -y

   Explain Code

   Powered by Vultr AgentBeta

5. Update the package index.

   CONSOLE

   Copy

   $ sudo apt update

   Explain Code

   Powered by Vultr AgentBeta

6. Install HAProxy.

   CONSOLE

   Copy

   $ sudo apt install haproxy -y

   Explain Code

   Powered by Vultr AgentBeta

7. Enable HAProxy to start at boot time.

   CONSOLE

   Copy

   $ sudo systemctl enable haproxy

   Explain Code

   Powered by Vultr AgentBeta

8. View the HAProxy system service status to verify that the application is installed on your server.

   CONSOLE

   Copy

   $ sudo systemctl status haproxy

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   ...
   Active: active (running)

Configure the HAProxy Server

The HAProxy main configuration file /etc/haproxy/haproxy.cfg controls how the application runs and listens for incoming connections on the server. The configuration file includes the following sections by default:

• global: Contains settings that define how HAProxy runs on the server. Available options include logging, user/group, system service mode, and SSL configurations.
• defaults: Includes the default HAProxy parameters that define the application performance on your server. Available options include timeouts and the application mode. The default value http instructs HAProxy to treat all incoming traffic as HTTP while a value such as tcp treats traffic as raw TCP connections on the server.

Follow the steps below to modify the configuration file with new sections that define how HAProxy accepts and distributes traffic as a load balancer to backend servers in the VPC network.

1. Back up the original HAProxy configuration file.

   CONSOLE

   Copy

   $ sudo cp /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.backup

   Explain Code

   Powered by Vultr AgentBeta

2. Open the HAProxy main configuration file using a text editor like nano.

   CONSOLE

   Copy

   $ sudo nano /etc/haproxy/haproxy.cfg

   Explain Code

   Powered by Vultr AgentBeta

3. Add the following configurations at the end of the file:

   INI

   Copy

   frontend website-frontend
       bind *:80,*:443
       option httpchk GET /healthcheck
       default_backend servers
   
   backend servers
       balance roundrobin
       server server-1 10.128.0.3:80 weight 1 check
       server server-2 10.128.0.4:80 weight 1 check

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   The above configuration creates two new sections, frontend and backend, with custom labels for identification purposes. The frontend section website-frontend defines how HAProxy listens for incoming requests on the server. Within the section:

   • bind: Instructs HAProxy to listen for incoming connections on the HTTP port 80 and the HTTPS port 443.
   • option httpchk: Sets the URL path and request type to use with HAProxy when running health checks on the backend servers.
   • default_backend: Defines the backend policy and hosts to use with HAProxy. The servers value enables the backend group to load balance.

   The backend section with the custom label servers sets the target hosts to forward traffic and use with HAProxy. Within the section:

   • balance: Sets the HAProxy load balancing algorithm to use with the backend servers. The value roundrobin selects servers in turns where traffic is evenly distributed to all available servers. Other supported modes include leastconn and source that define how HAProxy load balances traffic between the defined servers.
   • server: Defines the backend servers to use with HAProxy. For example, the value server-1 10.128.0.3:80 weight 1 check creates a new backend server connection with the label server-1 on the VPC address 10.128.0.3 and the target port 80. The server has a weight of 1, which defines its share of the traffic load for uneven distribution, while the same weight on other servers such as server-2 creates an even distribution of traffic. The check option enables health checking to stop forwarding traffic to a server in case it's unable to handle requests.

4. Add a new listen section at the end of the file with the following configurations to enable monitoring:

   INI

   Copy

   listen stats
       bind *:8404
       mode http
       stats enable
       stats uri /stats
       stats auth admin:YOUR_PASSWORD
       stats refresh 10s

   Explain Code

   Powered by Vultr AgentBeta

   Replace YOUR_PASSWORD with a strong password of your choice.

   Note

   The stats auth directive stores this password in plaintext in the configuration file. Restrict read access to /etc/haproxy/haproxy.cfg to trusted users.

   Save and close the file.

   The above configuration enables access to the HAProxy web dashboard that provides real-time traffic monitoring and statistics about the active server processes. The stats page offers insights into various metrics such as the number of connections, session rates, request rates, response times, and errors. Within the above listen configuration:

   • stats: Sets the listener label to stats for identification purposes.
   • bind: Sets the target host port to listen for incoming connections to the HAProxy statistics page.
   • mode: Specifies the HAProxy connection mode. The value http enables HTTP requests and optimizations on the specified port.
   • stats enable: Enables the HAProxy statistics page.
   • stats uri: Specifies the URL path to access the HAProxy stats page.
   • stats auth: Sets the username and password for accessing the HAProxy statistics page.
   • stats refresh: Sets the HAProxy statistics refresh interval. The value 10s specifies a refresh rate of 10 seconds.

5. Restart the HAProxy service to apply your configuration changes.

   CONSOLE

   Copy

   $ sudo systemctl restart haproxy

   Explain Code

   Powered by Vultr AgentBeta

6. Uncomplicated Firewall (UFW) is active on Ubuntu servers by default and blocks connection requests. Allow the HAProxy port 80 through the firewall to enable HTTP connections on the server.

   CONSOLE

   Copy

   $ sudo ufw allow 80/tcp

   Explain Code

   Powered by Vultr AgentBeta

7. Allow the HAProxy statistics port 8404 to enable access to the statistics page.

   CONSOLE

   Copy

   $ sudo ufw allow 8404/tcp

   Explain Code

   Powered by Vultr AgentBeta

8. Restart the firewall to apply the connection rules.

   CONSOLE

   Copy

   $ sudo ufw reload

   Explain Code

   Powered by Vultr AgentBeta

9. Test connectivity to your backend server VPC addresses using the ping utility.

   • Server 1

     CONSOLE

     Copy

     $ ping 10.128.0.3

     Explain Code

     Powered by Vultr AgentBeta

     Output:

     PING 10.128.0.3 (10.128.0.3) 56(84) bytes of data.
     64 bytes from 10.128.0.3: icmp_seq=1 ttl=64 time=0.022 ms
     64 bytes from 10.128.0.3: icmp_seq=2 ttl=64 time=0.041 ms
     
     --- 10.128.0.3 ping statistics ---
     2 packets transmitted, 2 received, 0% packet loss, time 1021ms
     rtt min/avg/max/mdev = 0.022/0.031/0.041/0.009 ms

   • Server 2

     CONSOLE

     Copy

     $ ping 10.128.0.4

     Explain Code

     Powered by Vultr AgentBeta

     Output:

     PING 10.128.0.4 (10.128.0.4) 56(84) bytes of data.
     64 bytes from 10.128.0.4: icmp_seq=1 ttl=64 time=0.022 ms
     64 bytes from 10.128.0.4: icmp_seq=2 ttl=64 time=0.041 ms
     
     --- 10.128.0.4 ping statistics ---
     2 packets transmitted, 2 received, 0% packet loss, time 1021ms
     rtt min/avg/max/mdev = 0.022/0.031/0.041/0.009 ms

Configure the Backend Servers

HAProxy sends health check requests to the backend servers to verify connectivity and handle connection requests. When a server is unavailable, HAProxy does not forward traffic until it passes the health check process again. Follow the steps below to configure each backend server and allow connections to the target port 80 to process HAProxy requests.

1. Access each of your backend servers using the HAProxy server and the associated VPC address. For example, access server-1.

   CONSOLE

   Copy

   $ ssh USERNAME@10.128.0.3

   Explain Code

   Powered by Vultr AgentBeta

   Replace USERNAME with your non-root sudo user on the backend server. This requires the same SSH key you used to connect to the HAProxy server to also be authorized on the backend server, forwarded through the -A session from the previous step.

2. Create a new non-root user with sudo privileges. For example, sysadmin.

   CONSOLE

   Copy

   $ sudo adduser sysadmin && sudo adduser sysadmin sudo

   Explain Code

   Powered by Vultr AgentBeta

3. Switch to the non-root user account.

   CONSOLE

   Copy

   $ sudo su - sysadmin

   Explain Code

   Powered by Vultr AgentBeta

4. Update the package index.

   CONSOLE

   Copy

   $ sudo apt update

   Explain Code

   Powered by Vultr AgentBeta

5. Install the Apache web server package.

   CONSOLE

   Copy

   $ sudo apt install apache2 -y

   Explain Code

   Powered by Vultr AgentBeta

6. Enable Apache to start at boot time.

   CONSOLE

   Copy

   $ sudo systemctl enable apache2

   Explain Code

   Powered by Vultr AgentBeta

7. Navigate to the Apache web root directory /var/www/html/.

   CONSOLE

   Copy

   $ cd /var/www/html/

   Explain Code

   Powered by Vultr AgentBeta

8. Back up the default Apache index.html file as index.BAK.

   CONSOLE

   Copy

   $ sudo mv index.html index.BAK

   Explain Code

   Powered by Vultr AgentBeta

9. Create a new index.html file.

   CONSOLE

   Copy

   $ sudo nano index.html

   Explain Code

   Powered by Vultr AgentBeta

10. Add the following HTML content to the file on each server:

    • Server-1:
    HTML

    Copy

    <!DOCTYPE html>
    <html>
      <head>
       <title>Server 1</title>
      </head>
      <body>
       <h1>Hello</h1>
       <p>This content is served by Server 1.</p>
      </body>
    </html>

    Explain Code

    Powered by Vultr AgentBeta
    • Server-2:
    HTML

    Copy

    <!DOCTYPE html>
    <html>
      <head>
       <title>Server 2</title>
      </head>
      <body>
       <h1>Hello</h1>
       <p>This content is served by Server 2.</p>
      </body>
    </html>

    Explain Code

    Powered by Vultr AgentBeta

    Save and close the file.

    The above web page configuration displays a This content is served by Server [number] message in response to a user request. HAProxy distributes traffic to each of the servers using the round-robin algorithm. In a production environment, all servers should run similar web applications to ensure the same content is served to all clients.

11. Grant the Apache web server ownership privileges to the file.

    CONSOLE

    Copy

    $ sudo chown -R www-data:www-data /var/www/html/index.html

    Explain Code

    Powered by Vultr AgentBeta

12. Restart Apache to save the changes on each server.

    CONSOLE

    Copy

    $ sudo systemctl restart apache2

    Explain Code

    Powered by Vultr AgentBeta

13. View your server IP information to verify the VPC network interface name.

    CONSOLE

    Copy

    $ ip a

    Explain Code

    Powered by Vultr AgentBeta

    Your output should be similar to the one below:

    ...
    2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
        link/ether 56:00:04:ef:40:23 brd ff:ff:ff:ff:ff:ff
        inet 192.168.0.21/23 brd 192.168.0.255 scope global dynamic enp1s0
           valid_lft 86266sec preferred_lft 86266sec
        inet6 2a05:f000000:3/64 scope global dynamic mngtmpaddr noprefixroute
           valid_lft 2591872sec preferred_lft 604672sec
        inet6 fe80::5400:4ff:feef:4023/64 scope link
           valid_lft forever preferred_lft forever
    3: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc mq state UP group default qlen 1000
        link/ether 5a:00:04:ef:40:23 brd ff:ff:ff:ff:ff:ff
        inet 10.128.0.3/20 brd 10.128.15.255 scope global enp8s0
           valid_lft forever preferred_lft forever
        inet6 fe80::5800:4ff:feef:4023/64 scope link
           valid_lft forever preferred_lft forever

    Based on the above output, the VPC interface name is enp8s0.

14. Allow connection requests to the HTTP port 80 from your VPC network interface on each server.

    CONSOLE

    Copy

    $ sudo ufw allow in on enp8s0 to any port 80

    Explain Code

    Powered by Vultr AgentBeta

15. Restart UFW to apply your firewall changes.

    CONSOLE

    Copy

    $ sudo ufw reload

    Explain Code

    Powered by Vultr AgentBeta

    The HAProxy server listens for external web application requests and distributes traffic evenly to the backend servers. Each server returns its default web page content as a response to the user request.

Access the HAProxy Accelerated Web Application

HAProxy distributes traffic in rounds to the backend servers within the VPC network. Depending on the backend server health, a single server cannot process multiple requests at a time based on the round-robin algorithm that distributes the traffic evenly to all servers. Follow the steps below to access the HAProxy server and verify that your backend servers respond to all user requests.

1. Enter your HAProxy server's domain URL in a web browser such as Chrome.

   http://haproxy.example.com

2. Verify that your web application displays in your browser window. The first request may be forwarded to Server 1 and the next request to another server in the backend pool depending on the number of backend servers.

   

3. Refresh your web browser window and verify that Server 2 responds to the request.

   

4. Refresh the web page again and verify that Server 1 responds to your HTTP request again due to the round-robin algorithm.

   

5. Access the HAProxy statistics interface on the monitoring port 8404 to view your HAProxy connection requests and performance.

   http://haproxy.example.com:8404

   Enter the administrative user login details you created with the stats auth directive in your listen stats configuration.

6. Verify that the HAProxy statistics interface displays in your web browser with information about your frontend and backend performance.

   

   Within the HAProxy statistics interface, you can monitor real-time traffic, track connection rates, and identify potential bottlenecks to troubleshoot your web application performance.

Conclusion

You have deployed and configured HAProxy on your Ubuntu 22.04 servers to distribute traffic across multiple backend servers in a VPC network. HAProxy improves your application reliability and resilience by managing connection requests to your backend servers. Depending on your web application needs, you can scale your backend servers and experiment with multiple load balancing algorithms to improve your application's overall performance.

For more information, visit the official HAProxy documentation.