Mastering HAProxy: The Traffic Cop

In the previous lesson, we learned how to make our Load Balancer itself Redundant using Keepalived. Now, we will learn how that Load Balancer actually distributes work to 10 or 100 different web servers.

HAProxy (High Availability Proxy) is a super-fast, enterprise-grade load balancer used by companies like Github, Reddit, and Stack Overflow. It sits in front of your web servers and acts like a receptionist. It decides which server is less busy and sends the next visitor there.

If one web server crashes, HAProxy notices in milliseconds and quietly stops sending people there. To the end user, your website never went down.

---

1. The Frontend and the Backend

HAProxy configuration (found in /etc/haproxy/haproxy.cfg) is split into three main parts:

1. Global/Defaults: Settings for speed, logging, and user permissions.
2. Frontend: Defines how HAProxy talks to the Public (Which IP? Which Port? SSL?).
3. Backend: Defines the list of Internal servers that do the actual work.

graph TD
    User[Web Browser] -- Port 80/443 --> LB[HAProxy Frontend]
    LB -- Round Robin --> W1[Web Server A]
    LB -- Round Robin --> W2[Web Server B]
    LB -- Round Robin --> W3[Web Server C]

---

2. Load Balancing Algorithms

How does HAProxy decide who is next?

• Round Robin: Server A, then B, then C, then A again. Best for identical servers.
• LeastConn: Send the visitor to the server with the fewest active connections. Best for long-running tasks like processing videos.
• Source Hash: Uses the visitor's IP address to ensure they always go to the same server.

---

3. "Sticky Sessions": The Login Problem

If a user logs into Server A, and then the Load Balancer sends their next click to Server B, the user will be logged out! (Because Server B doesn't know about their session).

The Solution: Use HAProxy's cookie injection. HAProxy can add a tiny invisible cookie to the user's browser that says "I belong to Server A."

backend my_web_cluster
    balance roundrobin
    cookie SERVERID insert indirect nocache
    server web1 10.0.0.1:80 check cookie s1
    server web2 10.0.0.2:80 check cookie s2

---

4. Practical: The Stats Dashboard

HAProxy has a hidden feature: it can generate a real-time web page showing exactly how many people are on your site and which servers are healthy.

listen stats
    bind *:8404
    stats enable
    stats uri /monitor
    stats refresh 5s
    stats auth admin:secret123

---

5. Troubleshooting: The '503 Service Unavailable'

If your Load Balancer returns a 503 error, it means All of its backends are dead or unreachable.

• Check the 'check' flag: If you have server web1 10.0.0.1:80 check, HAProxy is pinging that server. If the server doesn't respond on port 80, HAProxy marks it as "DOWN."
• Check the Logs: /var/log/haproxy.log. Look for "Layer 4 timeout" (Firewall issue) or "Layer 7 error" (The app crashed).

---

6. Example: An HAProxy Configuration Generator (Python)

If you are a developer, you might want to automatically add a new web server to the load balancer every time you launch a new VM. Here is a Python snippet that generates a valid backend entry.

def add_backend_server(name, ip, port=80):
    """
    Generates a line for an HAProxy configuration.
    """
    # The 'check' flag is vital for health monitoring
    # 'inter 2s' means check every 2 seconds
    # 'fall 3' means mark down after 3 failures
    # 'rise 2' means mark up after 2 successes
    line = f"    server {name} {ip}:{port} check inter 2s fall 3 rise 2"
    return line

if __name__ == "__main__":
    print("Add this to your /etc/haproxy/haproxy.cfg:")
    print(add_backend_server("web-node-new", "10.0.0.25", 80))

---

7. Professional Tip: Use 'SSL Termination'

Let HAProxy handle the heavy work of encrypting and decrypting HTTPS (SSL Termination). This frees up your web servers to focus only on running your application logic. It also makes it much easier to manage your SSL certificates in one central place.

---

8. Summary

HAProxy is the "Brain" of a modern scalable web architecture.

• Frontends are your public face.
• Backends are your internal power.
• Health Checks (check) are mandatory for true High Availability.
• Algorithms like Round Robin control the flow.
• The Stats Page is your eyes on the network.

In the next lesson, we will look at how to keep the files on our 10 web servers identical: Data Synchronization with lsyncd and rsync.

Quiz Questions

1. What is the difference between "Least Connections" and "Round Robin" algorithms?
2. Why would a web developer need "Sticky Sessions" when using a load balancer?
3. What is "Health Checking" in HAProxy and why is it essential for zero-downtime?

---

Continue to Lesson 4: Data Synchronization—Syncing Files with lsyncd and rsync.