benoitjpnet/HAProxy
benoitjpnet/HAProxy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
HAProxy configuration files for my self-hosted setup.
154 commits 1 branch 0 tags 684 KiB
Find a file
Exact
Benoit d238c1a2d5 victoriametrics: prefer IPv4 resolution to fix failing health check 
VictoriaMetrics only listens on IPv4, but the incus resolver returns
both A and AAAA records. Without resolve-prefer ipv4, HAProxy picks
the AAAA record and health checks fail with connection refused.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-13 18:32:00 +09:00
00global.cfg remove HTTP/3 over QUIC support 2026-06-19 20:10:55 +09:00
01defaults.cfg perf and security hardening: HTTP/3, splice, silent-drop, L4 flood protection 2026-04-25 23:05:41 +09:00
02cache.cfg haproxy: tune cache, drop mastodon rate limiting, cache webfinger 2026-03-09 21:13:37 +09:00
03frontends.cfg incus: remove leftover commented-out ACL entries 2026-07-12 00:24:26 +00:00
04listen.cfg perf and security hardening: HTTP/3, splice, silent-drop, L4 flood protection 2026-04-25 23:05:41 +09:00
05backends.cfg victoriametrics: prefer IPv4 resolution to fix failing health check 2026-07-13 18:32:00 +09:00
CLAUDE.md incus: revert SNI passthrough and DNS redirect ACL changes 2026-07-12 00:24:02 +00:00
goaccess.conf fix: remove empty %hs from log format to fix GoAccess request parsing 2026-03-25 07:10:07 +09:00
LICENSE Initial commit 2024-10-08 10:10:10 +00:00
README.md docs: add GoAccess config and update README/CLAUDE.md 2026-03-25 06:51:22 +09:00

README.md

HAProxy

HAProxy configuration files for my self-hosted infrastructure.

Deployment

HAProxy loads all .cfg files from /etc/haproxy/config in order:

# /etc/systemd/system/haproxy.service.d/override.conf
[Service]
Environment="CONFIG=/etc/haproxy/config"

Files

File Purpose
00global.cfg Global settings, TLS (Mozilla modern, TLS 1.3 only)
01defaults.cfg Default timeouts, logging mode, error files
02cache.cfg HTTP cache (128MB, 50MB max object, 24h TTL)
03frontends.cfg HTTP/HTTPS frontend with scanner detection, rate limiting, geo-ACLs
04listen.cfg TCP listen blocks for SSH, SMTP, SMTPS, IMAPS, Sieve
05backends.cfg Backend definitions, DNS resolver, shared stick-tables
goaccess.conf GoAccess config for parsing HAProxy logs

Log analysis with GoAccess

The HTTP frontend logs in enriched httplog format (Referer, User-Agent, request ID appended). Logs are written to /var/log/haproxy.log via rsyslog.

# Terminal dashboard
goaccess /var/log/haproxy.log -p /etc/haproxy/config/goaccess.conf

# HTML report
goaccess /var/log/haproxy.log -p /etc/haproxy/config/goaccess.conf -o /tmp/report.html

Request IDs are logged at the end of each line for tracing:

grep 8d03b867-3521-4bce-8354-aabeaa097977 /var/log/haproxy.log

Quick reference

# Test configuration
haproxy -c -f /etc/haproxy/config/

# Reload (zero downtime)
systemctl reload haproxy

# View stats
curl http://localhost:8404/stats

# Admin socket
echo "show cache" | socat /run/haproxy/admin.sock -
echo "show table frontend_default" | socat /run/haproxy/admin.sock -