How to Install and Configure HAProxy on a Linux VPS: Complete Load Balancing Guide

As your web application grows, a single server can quickly become both a performance bottleneck and a single point of failure. HAProxy (High Availability Proxy) is one of the most battle-tested open-source load balancers and proxies available, trusted by companies like GitHub, Twitter, and Stack Overflow to handle millions of requests per day.

In this guide you'll learn how to install and configure HAProxy on a NVMe VPS running Ubuntu 22.04 LTS — from initial setup to a fully functional load-balanced environment with health checks, SSL termination, and a real-time monitoring dashboard.

---

What Is HAProxy and Why Do You Need It?

HAProxy is a Layer 4 (TCP) and Layer 7 (HTTP) load balancer and proxy server that distributes incoming traffic across multiple backend servers. Key benefits include:

• High Availability: if a backend server goes down, HAProxy automatically reroutes traffic to healthy nodes.
• Horizontal Scalability: add new servers to the pool at any time with zero downtime.
• Real-time Monitoring: built-in web dashboard with detailed statistics.
• Flexibility: multiple load-balancing algorithms to suit different use cases.

Whether you're running a WordPress site across multiple instances or a distributed Node.js API on a SSD VPS, HAProxy is an excellent choice.

---

Setup Architecture

For this tutorial, we'll configure:

• 1 HAProxy server (Frontend): receives all user traffic
• 2 backend servers (app1, app2): actually serve the application

Users → HAProxy (192.168.1.10) → app1 (192.168.1.11:80)
                                 → app2 (192.168.1.12:80)

You can easily extend this setup with more backend nodes as your traffic grows.

---

Step 1: Update the System and Install HAProxy

SSH into your server and run:

sudo apt update && sudo apt upgrade -y
sudo apt install haproxy -y

Verify the installed version:

haproxy -v

You should see something like HAProxy version 2.4.x. Check that the service is running:

sudo systemctl status haproxy

---

Step 2: Prepare the Backend Servers

On each backend server (app1 and app2), install Nginx to simulate a web application:

sudo apt install nginx -y

To tell the servers apart, customise the default page:

On app1:

echo "<h1>Backend: app1</h1>" | sudo tee /var/www/html/index.html

On app2:

echo "<h1>Backend: app2</h1>" | sudo tee /var/www/html/index.html

Enable and start Nginx on both servers:

sudo systemctl enable nginx && sudo systemctl start nginx

---

Step 3: Configure HAProxy

The main configuration file is located at /etc/haproxy/haproxy.cfg. Always back it up before making changes:

sudo cp /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.bak

Open the file for editing:

sudo nano /etc/haproxy/haproxy.cfg

Replace the contents with the following configuration:

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    maxconn 50000

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5s
    timeout client  30s
    timeout server  30s
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 503 /etc/haproxy/errors/503.http

# Frontend — receives incoming traffic
frontend http_front
    bind *:80
    default_backend http_back

# Backend — application servers
backend http_back
    balance roundrobin
    option httpchk GET /
    server app1 192.168.1.11:80 check
    server app2 192.168.1.12:80 check

# Statistics dashboard
listen stats
    bind *:8080
    stats enable
    stats uri /haproxy?stats
    stats refresh 10s
    stats auth admin:StrongPassword123

Note: Replace 192.168.1.11 and 192.168.1.12 with your actual backend server IP addresses, and change StrongPassword123 to a secure password.

---

Step 4: Validate the Configuration and Restart HAProxy

Before applying changes, validate the configuration syntax:

sudo haproxy -c -f /etc/haproxy/haproxy.cfg

If you see Configuration file is valid, you're good to go. Restart the service:

sudo systemctl restart haproxy
sudo systemctl enable haproxy

---

Step 5: Configure the Firewall

Open the required ports:

sudo ufw allow 80/tcp
sudo ufw allow 8080/tcp
sudo ufw enable

For more tips on hardening your Linux server, visit the CLIQHOST blog where you'll find in-depth security guides.

---

Step 6: Test Load Balancing

Send several requests to your HAProxy server's IP:

curl http://192.168.1.10
curl http://192.168.1.10
curl http://192.168.1.10

The responses should alternate between Backend: app1 and Backend: app2 — Round Robin in action.

Access the statistics dashboard at:

http://192.168.1.10:8080/haproxy?stats

You'll see the status of each backend server, active connections, request rates and much more.

---

Load Balancing Algorithms in HAProxy

HAProxy supports several algorithms. Change the balance directive in the backend section:

Algorithm	Description
roundrobin	Distributes requests cyclically
leastconn	Sends to the server with the fewest active connections
source	IP Hash — the same user always hits the same server
uri	Based on URI — useful for caching
random	Randomly selects a server

For stateful applications (e.g., shopping carts), use source or configure sticky sessions.

---

SSL Termination with HAProxy

In production, all traffic must be encrypted. HAProxy can handle SSL termination natively. You can obtain a trusted certificate through CLIQHOST SSL certificates.

Combine the certificate and private key into a single .pem file:

cat mydomain.crt mydomain.key > /etc/haproxy/certs/mydomain.pem

Update the frontend section:

frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/mydomain.pem
    redirect scheme https if !{ ssl_fc }
    default_backend http_back

frontend http_front
    bind *:80
    redirect scheme https code 301

---

Health Checks — Automatic Failure Detection

The check keyword next to each server entry enables health checks. HAProxy periodically sends a GET / request and automatically removes any non-responsive server from rotation.

You can fine-tune the behaviour:

server app1 192.168.1.11:80 check inter 3s rise 2 fall 3

• inter 3s — check every 3 seconds
• rise 2 — mark server healthy after 2 consecutive successes
• fall 3 — remove from rotation after 3 consecutive failures

---

Scaling HAProxy to Dedicated Servers

If your application has outgrown a single VPS, consider a managed dedicated server where CLIQHOST handles all administration for you, or an unmanaged dedicated server if you prefer full control. HAProxy scales effortlessly to handle millions of requests per day on powerful hardware.

For high-performance Intel-based infrastructure, check out CLIQHOST Intel dedicated servers.

---

Common Mistakes to Avoid

1. No configuration backup — always run cp haproxy.cfg haproxy.cfg.bak before edits.
2. Exposed stats dashboard without a password — always use stats auth.
3. Timeouts set too low — for slow applications, increase timeout server to 60s or more.
4. Missing option httpchk — without health checks, HAProxy will forward traffic to downed servers.
5. Forgetting systemctl enable — HAProxy won't restart automatically after a reboot.

---

Conclusion

HAProxy is a mature, high-performance tool that transforms your infrastructure from a single point of failure into a resilient, scalable system. With the configuration in this guide, you have a functional load balancer with automatic health checks, SSL termination, and a real-time monitoring dashboard.

Ready to get started? Launch a high-performance NVMe VPS and follow this guide — it only takes a few minutes to have HAProxy up and running. Prefer to let the experts handle it? CLIQHOST server management services cover setup, monitoring and ongoing maintenance. Have questions? Contact our team — we're happy to help.