Skip to content

Operations

This page covers running HAProxy Community LTS day to day: how it is secured, how it is updated, what to back up, where the logs are, and how to get help.

Security model

  • Loopback only. The frontend, the stats page and the sample backends listen on 127.0.0.1. Nothing is reachable from the network until you change the configuration and the security group yourself.
  • Separate users. HAProxy runs as the haproxy user. The sample backends run as sushi-haproxy-backend, which is not in the haproxy group, so they cannot read the configuration or the stats password. Neither can the ubuntu user.
  • Per-instance password. The stats password is generated on first boot. The image contains no password and no live configuration.
  • SSH. Password authentication and root login are turned off.
  • No AWS access. HAProxy does not call AWS APIs and needs no IAM permissions.

Manage the service

sudo systemctl status haproxy
sudo systemctl reload haproxy
sudo systemctl restart haproxy

haproxy.service waits for sushi-haproxy-firstboot.service, which writes the stats password and the configuration on first boot, and restarts automatically if it fails. Reload checks the configuration before it applies it.

The sample backends are sushi-haproxy-backend@a.service and sushi-haproxy-backend@b.service.

Logs

HAProxy logs each request to the systemd journal:

sudo journalctl -u haproxy --no-pager -n 100
sudo journalctl -u sushi-haproxy-firstboot --no-pager

Updates

  • Ubuntu packages, including OpenSSL, zlib and PCRE2, get security updates automatically through unattended upgrades.
  • HAProxy itself stays at 3.4.6. A new HAProxy release comes as a new version of the AMI. Launching it does not change running instances: launch the new version, copy your configuration and stats password, then point clients at the new host.

Backups

Back up these directories together:

  • /etc/haproxy/
  • /var/lib/haproxy/

Practice a restore on a test instance before you depend on it.

Check the installation

The image includes a self-test that runs as root:

sudo /opt/sushi/bin/smoke.sh

Like the walkthrough, it uses the sample backends and the default configuration, so run it before you change either.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with installation questions. Support coverage beyond that requires a separate agreement. This offer does not include support from the HAProxy project. Performance tuning and third-party modules are outside setup guidance.