nginx and HAProxy Configuration

nginx upstream blocks and proxy_pass directives, HAProxy ACLs and backend pools, stats page, and connection limit tuning.

Overview

Overview nginx and HAProxy are the two dominant open-source load balancers and reverse proxies used in production infrastructure.

nginx was designed as a high-performance web server and reverse proxy. Its event-driven, asynchronous architecture handles tens of thousands of concurrent connections per worker process with low memory overhead. nginx excels at HTTP/HTTPS proxying, SSL termination, static file serving, caching, rate limiting, and gzip compression — a full layer-7 feature set in one binary.

HAProxy (High Availability Proxy) is a dedicated TCP and HTTP proxy built specifically for load balancing. It has the richest feature set for traffic management: a powerful ACL system that can inspect any field in a TCP or HTTP request, health checking with fine-grained control, connection draining, and a real-time statistics interface. HAProxy's configuration model separates concerns cleanly into frontend (listen), backend (server pool), and defaults sections.

Key differences: nginx is a web server that also does load balancing, making it a natural choice when the proxy also serves static content or needs caching. HAProxy is a pure proxy with no web server capability, making it more focused for complex routing requirements.

Both support keepalive connections to backends (critical for performance), TLS termination, and health checks. Both are used at massive scale: nginx runs on a large fraction of all web servers; HAProxy routes traffic at major social networks and financial institutions.

Key concepts

nginx upstream block
Defines a named group of backend servers with their load balancing algorithm, weights, and health check parameters. Referenced by proxy_pass in server/location blocks.
HAProxy frontend/backend split
frontend defines what HAProxy listens on (IP, port, ACL rules, default backend). backend defines the pool of servers, algorithm, and health checks. This separation makes routing logic explicit and testable.
HAProxy ACL
Named conditions that match request attributes (URL path, HTTP method, header values, source IP). ACLs can be combined with AND/OR logic and used to select backends, block requests, or redirect traffic.
proxy_pass
nginx directive that forwards a request to an upstream group or a specific server. When pointing to an upstream block name, the upstream's algorithm applies.
keepalive (to backends)
Maintaining persistent TCP connections to backends rather than opening a new connection per request. Eliminates TCP handshake overhead. nginx uses keepalive N in upstream blocks.
HAProxy stats page
A built-in real-time HTTP dashboard showing backend health, current connections, request rate, error counts, and session statistics per server. Accessible via a dedicated frontend on a management port.

When to use it

  • Configuring a reverse proxy and load balancer for a multi-instance Node.js or Python application
  • Writing HAProxy ACL rules to route traffic based on URL path, Host header, or source IP
  • Tuning worker_connections and keepalive settings for high-throughput nginx deployments
  • Setting up the HAProxy stats page for real-time backend health monitoring
  • Comparing nginx and HAProxy for a new infrastructure decision
  • Implementing rate limiting and connection limits to protect backend services

Interview questions

  • Write an nginx configuration for load balancing a Node.js API across four backends with health checks, keepalive, and rate limiting.
  • How do you configure HAProxy with ACLs to route /api/* to one backend and /static/* to another?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio