What is the difference between HTTP and TCP mode?

HTTP mode (Layer 7) understands requests, so it can route on paths or headers, inject X-Forwarded-For, and run HTTP health checks. TCP mode (Layer 4) just forwards the stream and suits databases or any non-HTTP protocol.

Which balance algorithm should I choose?

roundrobin spreads requests evenly and is a safe default; leastconn favours servers with the fewest active connections, which helps with long-lived requests; source pins a client IP to one server for sticky sessions.

How does SSL termination work here?

Enabling it adds ssl crt with your combined PEM to the frontend bind line, so HAProxy decrypts TLS and forwards plain traffic to the backends. It also sets X-Forwarded-Proto https so apps know the original scheme.

What do the health checks do?

With checks enabled, each server line gets a check flag and the backend runs an HTTP GET /health expecting a 200. HAProxy stops sending traffic to a server that fails the check and resumes when it recovers.

What is the stats page for?

The optional stats listener exposes a live dashboard at port 8404 under /stats showing per-server health, sessions, and traffic. Protect or firewall it in production since it can also enable admin actions.

HAProxy Config Builder

Email me this result

Get this tool's output sent to your inbox, plus one useful tool a week. No spam, unsubscribe any time.

Load balancing config without the boilerplate

A working HAProxy setup needs a global block, sane defaults, a frontend that binds and routes, and a backend pool with health checks. This builder writes all of it from a form — pick the mode, list your servers, choose an algorithm, and optionally add SSL and a stats page.

How it works

The config starts with a global block (logging, max connections, dropping privileges to the haproxy user) and a defaults block with HTTP logging, forwardfor, and connection and server timeouts. The frontend binds to your chosen port; when SSL termination is on it adds ssl crt <pem> and sets X-Forwarded-Proto https. The backend applies your chosen balance algorithm and, if health checks are enabled, runs option httpchk GET /health with http-check expect status 200, tagging each server line with check. Each backend you enter as name host:port becomes a server directive. An optional listen stats block exposes the live dashboard on :8404/stats.

Tips and example

HAProxy wants a single combined PEM (certificate + key + chain) for ssl crt, unlike Apache which uses separate files.
Use leastconn rather than roundrobin when request durations vary a lot, such as file uploads or slow reports.
Always set health checks in production so a crashed backend is pulled from rotation automatically instead of returning errors.
Firewall the stats page or bind it to an internal interface — stats admin if TRUE lets anyone who reaches it disable servers.