{"slug": "haproxy", "name": "HAProxy", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 4, "commenters": 6, "warners": 0, "score": 4.37, "rising": 2.67, "first": "2025-11-15", "latest": "2026-10-25", "why": "an haproxy load balancer was much, much better on HTTP load balancing than Python code was", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 3, "compare": 1, "warn": 0}, "spark": [0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 2], "listed": true, "loved": [], "caveat": "", "short_quote": "an haproxy load balancer was much, much better on HTTP load balancing than Python code was", "icon": false, "domain": "haproxy.org", "github_repo": null, "official_url": "https://www.haproxy.org", "pricing": "", "aliases": ["HAProxy"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 803634385, "item_id": 50227149, "url": "https://news.ycombinator.com/item?id=50227149", "by": "Karrot_Kream", "date": "2026-10-25", "stance": "recommend", "quote": "an haproxy load balancer was much, much better on HTTP load balancing than Python code was", "excerpt": "I used Opus 5.5 to figure out that a language model we were serving at work for internal use (we don't really serve models, we only use this internally because it processes sensitive data that we can't send to external endpoints) was being bottlenecked by CPU contention on tokenization, by having Opus run in an autoresearch style loop. Opus's first proposal for a fix was to spawn multiple Python processes and build a", "context": "", "use_case": "HTTP load balancing", "switched_from": "", "story": "We should be more ambitious with the software we build"}, {"id": 802255473, "item_id": 50140967, "url": "https://news.ycombinator.com/item?id=50140967", "by": "Bender", "date": "2026-10-18", "stance": "recommend", "quote": "using NGinx on the front-end and HAProxy on the back-end to do the load balancing and health checks", "excerpt": "At the moment two large VM's using NGinx on the front-end and HAProxy on the back-end to do the load balancing and health checks. NGinx and HAProxy communicate with each other over a socket thus taking the network out of the picture. NGinx caches files to a tmpfs ram disk. The back-end HAProxy communicates over VPNs to the origin servers. I've automated scaling up edges but I still have work to do calculating the dyn", "context": "runs tiny hobby sites", "use_case": "back-end load balancing", "switched_from": "", "story": "Matthew Prince on why Cloudflare offers a free version and always will (2016)"}, {"id": 796420835, "item_id": 49776302, "url": "https://news.ycombinator.com/item?id=49776302", "by": "1vuio0pswjnm7", "date": "2026-09-20", "stance": "recommend", "quote": "Use a local forward proxy, e.g., stunnel, haproxy, etc.", "excerpt": "That superuser thread from 2018 (it's ECH now not ESNI) isn't much help Although I do like the comment at the bottom that states the problem as disabling SNI not encrypting it. Encrypting SNI/ClientHello is over complicated, which is why ESNI was flawed and (allegedly) why Cloudflare disabled it. The solution to the plaintext SNI problem is to not send SNI (I don't send it unless necessary) There is an alternative no", "context": "", "use_case": "avoid sending SNI", "switched_from": "", "story": "Spain orders blocks on Archive.today and its mirrors"}, {"id": 789230576, "item_id": 49326911, "url": "https://news.ycombinator.com/item?id=49326911", "by": "1vuio0pswjnm7", "date": "2026-08-16", "stance": "recommend", "quote": "After I saw that it worked, I started using other software like haproxy", "excerpt": "Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_ But this is what Cloudflare does and no one seems to mind Large companies also do this to protect their LANs I'm not running a CDN, only a small home LAN. I'm only procesing ", "context": "runs small home LAN", "use_case": "local TLS-terminating proxy", "switched_from": "socat", "story": "Tell HN: Cloudflare silently injects its analytics when you switch nameservers"}, {"id": 781928960, "item_id": 48870560, "url": "https://news.ycombinator.com/item?id=48870560", "by": "waynesonfire", "date": "2026-07-11", "stance": "recommend", "quote": "I use haproxy acl rules and the use_backend directive to enforce security policy and routing.", "excerpt": "> - Run two haproxy instances, This made me consider my haproxy architecture. I use haproxy acl rules and the use_backend directive to enforce security policy and routing. It denies http requests based on source ip address per service (host header) I think a good middle-ground is to use a single haproxy but two frontends; one binds to the public interface and one for private. haproxy is now no longer responsible for ", "context": "", "use_case": "routing and security policy", "switched_from": "", "story": "TLS certificates for internal services done right"}]}], "caveats": [], "who": [{"by": "Bender", "context": "runs tiny hobby sites", "url": "https://news.ycombinator.com/item?id=50140967", "date": "2026-10-18"}, {"by": "1vuio0pswjnm7", "context": "small home setup", "url": "https://news.ycombinator.com/item?id=49329681", "date": "2026-08-17"}], "tags": [], "use_cases": ["http load balancing", "back-end load balancing", "avoid sending sni", "reverse proxy for jellyfin", "forwarding proxy", "local tls-terminating proxy"], "compared": [{"slug": "apache", "name": "Apache", "co": 2, "switched_from": 1, "switched_to": 0}, {"slug": "socat", "name": "socat", "co": 1, "switched_from": 1, "switched_to": 0}, {"slug": "nginx", "name": "nginx", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49322107", "title": "Tell HN: Cloudflare silently injects its analytics when you switch nameservers", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50225695", "title": "We should be more ambitious with the software we build", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50138087", "title": "Matthew Prince on why Cloudflare offers a free version and always will (2016)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49772961", "title": "Spain orders blocks on Archive.today and its mirrors", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49604861", "title": "Jellyfin 12.0", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48846995", "title": "TLS certificates for internal services done right", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"neutral": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"compare": 1, "recommend": 1}, "2026-08": {"recommend": 1}, "2026-09": {"neutral": 1, "recommend": 1}, "2026-10": {"recommend": 2}}, "quotes": [{"id": 803634385, "item_id": 50227149, "url": "https://news.ycombinator.com/item?id=50227149", "by": "Karrot_Kream", "date": "2026-10-25", "stance": "recommend", "quote": "an haproxy load balancer was much, much better on HTTP load balancing than Python code was", "excerpt": "I used Opus 5.5 to figure out that a language model we were serving at work for internal use (we don't really serve models, we only use this internally because it processes sensitive data that we can't send to external endpoints) was being bottlenecked by CPU contention on tokenization, by having Opus run in an autoresearch style loop. Opus's first proposal for a fix was to spawn multiple Python processes and build a", "context": "", "use_case": "HTTP load balancing", "switched_from": "", "story": "We should be more ambitious with the software we build"}, {"id": 802255473, "item_id": 50140967, "url": "https://news.ycombinator.com/item?id=50140967", "by": "Bender", "date": "2026-10-18", "stance": "recommend", "quote": "using NGinx on the front-end and HAProxy on the back-end to do the load balancing and health checks", "excerpt": "At the moment two large VM's using NGinx on the front-end and HAProxy on the back-end to do the load balancing and health checks. NGinx and HAProxy communicate with each other over a socket thus taking the network out of the picture. NGinx caches files to a tmpfs ram disk. The back-end HAProxy communicates over VPNs to the origin servers. I've automated scaling up edges but I still have work to do calculating the dyn", "context": "runs tiny hobby sites", "use_case": "back-end load balancing", "switched_from": "", "story": "Matthew Prince on why Cloudflare offers a free version and always will (2016)"}, {"id": 796420835, "item_id": 49776302, "url": "https://news.ycombinator.com/item?id=49776302", "by": "1vuio0pswjnm7", "date": "2026-09-20", "stance": "recommend", "quote": "Use a local forward proxy, e.g., stunnel, haproxy, etc.", "excerpt": "That superuser thread from 2018 (it's ECH now not ESNI) isn't much help Although I do like the comment at the bottom that states the problem as disabling SNI not encrypting it. Encrypting SNI/ClientHello is over complicated, which is why ESNI was flawed and (allegedly) why Cloudflare disabled it. The solution to the plaintext SNI problem is to not send SNI (I don't send it unless necessary) There is an alternative no", "context": "", "use_case": "avoid sending SNI", "switched_from": "", "story": "Spain orders blocks on Archive.today and its mirrors"}, {"id": 794085105, "item_id": 49630319, "url": "https://news.ycombinator.com/item?id=49630319", "by": "nobody9999", "date": "2026-09-09", "stance": "neutral", "quote": "Initially, I stuffed jellyfin (and a bunch of other stuff) behind HAProxy[0], which was fine.", "excerpt": ">I don't believe in Jellyfin being secure enough to put on the public Internet. In my case, Jellyfin is on my home network, and the box has access to a lot of files and devices. Fair enough. IME, Jellyfin and (just as importantly -- at least for me) the distribution (Fedora) I use have been very good at patching/releasing updates to both the clients and servers when vulnerabilities are found. Initially, I stuffed jel", "context": "", "use_case": "reverse proxy for Jellyfin", "switched_from": "", "story": "Jellyfin 12.0"}, {"id": 789274896, "item_id": 49329681, "url": "https://news.ycombinator.com/item?id=49329681", "by": "1vuio0pswjnm7", "date": "2026-08-17", "stance": "neutral", "quote": "haproxy is the largest, tinyproxy is the smallest", "excerpt": "NB. I actually do not encrypt then re-encrypt for the majority of HTTP requests I make I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs I process response bodies, using own software, into SQL, CSV, simple HTML or plain text This design isn't for everybody, but it's what I strongly prefer", "context": "small home setup", "use_case": "forwarding proxy", "switched_from": "", "story": "Tell HN: Cloudflare silently injects its analytics when you switch nameservers"}, {"id": 789230576, "item_id": 49326911, "url": "https://news.ycombinator.com/item?id=49326911", "by": "1vuio0pswjnm7", "date": "2026-08-16", "stance": "recommend", "quote": "After I saw that it worked, I started using other software like haproxy", "excerpt": "Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_ But this is what Cloudflare does and no one seems to mind Large companies also do this to protect their LANs I'm not running a CDN, only a small home LAN. I'm only procesing ", "context": "runs small home LAN", "use_case": "local TLS-terminating proxy", "switched_from": "socat", "story": "Tell HN: Cloudflare silently injects its analytics when you switch nameservers"}, {"id": 781928960, "item_id": 48870560, "url": "https://news.ycombinator.com/item?id=48870560", "by": "waynesonfire", "date": "2026-07-11", "stance": "recommend", "quote": "I use haproxy acl rules and the use_backend directive to enforce security policy and routing.", "excerpt": "> - Run two haproxy instances, This made me consider my haproxy architecture. I use haproxy acl rules and the use_backend directive to enforce security policy and routing. It denies http requests based on source ip address per service (host header) I think a good middle-ground is to use a single haproxy but two frontends; one binds to the public interface and one for private. haproxy is now no longer responsible for ", "context": "", "use_case": "routing and security policy", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 780235634, "item_id": 48764727, "url": "https://news.ycombinator.com/item?id=48764727", "by": "ChocolateGod", "date": "2026-07-02", "stance": "compare", "quote": "Would need something like HAProxy to correctly handle failover for NFS though?", "excerpt": "The HA certainly makes this more of an alternative to JuiceFS now. Would need something like HAProxy to correctly handle failover for NFS though?", "context": "", "use_case": "failover for NFS", "switched_from": "", "story": "Show HN: ZeroFS \u2013 A log-structured filesystem for S3"}, {"id": 754581265, "item_id": 47161329, "url": "https://news.ycombinator.com/item?id=47161329", "by": "Bender", "date": "2026-02-25", "stance": "neutral", "quote": "These days if I have a lot of rewrites I do that in HAProxy or NGinx in maps", "excerpt": "I've gone through this exercise on my own personal hobby nodes long ago. In my case I was just on an under-powered node for the load but I made sure my rewrite rules were optimized in the virtualserver config vs .htaccess and that I closed all rules with a final L to cease processing rules when matches were found. I also jacked up all the worker/server limits as high as I could go for the memory in the node this was ", "context": "", "use_case": "rewrite rules", "switched_from": "Apache", "story": "Ask HN: Apache prefork under crawler load \u2013 main domains OK, subdomains fail"}, {"id": 735020322, "item_id": 45938770, "url": "https://news.ycombinator.com/item?id=45938770", "by": "Bender", "date": "2025-11-15", "stance": "neutral", "quote": "often have HAProxy in front of it on many nodes", "excerpt": "As I understand, the popular consensus today is that nginx+php-fpm performs faster than apache even with the mpm_event process management enabled? This was certainly true long ago in Apache HTTPD 2.2. They completely rewrite APR and as of the 2.4 branch it was on par with Nginx. Some use Apache for a tighter integration with some modules such as PHP resulting is a slightly better security stance with PHP. Nginx makes", "context": "sysadmin", "use_case": "load balancer in front", "switched_from": "", "story": "Why is Apache still popular even as Nginx has proven its mettle on performance?"}]}