4 reasons I still love using HAProxy

I've used almost any reverse proxy solution you could name, from Nginx Proxy Manager to Caddy, various WireGuard-based options, and single-shot fixes like Tailscale Funnel and Cloudflare Tunnel. They've all got their pros and cons, some with advanced features baked in, others needing a slew of plugins to build the tool you need, but even though I've used them for a while now, the knowledge of how they work slides out of my brain as soon as I stop configuring them.

I mean, I understand the general concept, but I don't recall how each service works once I stop using it. Many of the configuration steps are "send port 3000 to port 3000 over there," and that has always felt like teleportation to me. Then I started using HAProxy, which is designed as a load balancer but also makes a fine reverse proxy solution, and things made more sense. It uses a configuration model that allows my brain to visualize each stage of what's happening, as if I can see the physical Ethernet cables between the servers, and everything just clicked.

4 It's fast

It was engineered for performance, efficiency, and low latency

Okay, I guess you'd expect a program that's used by plenty of big businesses as a load balancer between their servers would be fast, and able to process plenty of packets at once, but I'm not talking about the throughput. For me, HAProxy is fast to configure in the first place, with a fully functional reverse proxy that includes SSL offloading, two frontends (for HTTP and HTTPS traffic), and backend configuration that can be done in less time than some of the GUI-guided software packages I've used recently.

Part of that is because it's mature technology that's been around for ages, so there are tons of in-depth resources to get my head around, and more importantly, plenty of forum posts detailing troubleshooting steps for anything I might run into. That's not something I can count on with any of the newer reverse proxies, and I really appreciate that I don't have to trawl through GitHub comments to find actual fixes.

3 There's an OPNsense plugin

Honestly, this is the easiest way to get me to use networking tools

It's not that I'm lazy, per se, but meeting me on a platform I already use is a long way toward getting me to use one service over another. OPNsense has plugins for HAProxy, along with a few other reverse proxies, which means I'm more likely to use it. It's not just the ease of use and the ability to get back into OPNsense if something goes wrong with the configuration, thanks to the lock-out rules, but there's something about running the reverse proxy on my router and firewall that pleases me.

I can have my dynamic DNS service, ACME client to auto-renew Let's Encrypt certificates to ensure SSL is always available. I can use Unbound for split DNS, so that the reverse proxy I set up is available from both inside my network and from remote devices, with the system I'm most familiar with. No need to remember additional login details or another IP address of a Docker container running on my NAS, which may or may not be running, as power glitches can occur and the NAS may not automatically restart when power resumes. It might not be the best practice, but it's the one that works for me, and that counts for a lot.

2 Something about the architecture just clicks

The physical server, then pool, then services setup makes more sense to me

I've used plenty of reverse proxy solutions, including Nginx Proxy Manager, Caddy, Traefik, Pangolin, Nginx, and things like Tailscale Funnel, which can take their place in a pinch, but I've found that I either have to spend a lot of time figuring out why they work, or the whole process is abstracted away in a flurry of GUI clicks, leaving me without any real learning moments. Some of that is definitely a me thing, and how my brain works, but I like visual learning, like network diagrams and the such.

Reverse proxies designed for container use, like Caddy or Traefik, make it easy to set up complex architectures, but then I'm bad at documentation and my brain is even worse at remembering how things go together, and without the context of the microservices I'm setting up, I struggle. Perhaps that's why I prefer VMs to containers in the first place, because they still feel physical, even if they're not.

HAProxy lays out the reverse proxy chain in a way my brain can handle. One real server per service makes perfect sense to me, or several real servers if I need to set up load balancing. Then, having the backend pool as a place to group the real servers, serving as a management layer to send traffic from the frontend, makes sense too.

So does the plaintext map files implementation that matches incoming fully qualified domain names (FQDN) to individual backend pools. Breaking the ingress into its own frontend rules also makes things much easier for me. I enjoy assembling the system like little building blocks. Sometimes, other services attempt to set everything up in a single file, and my brain rebels against that approach.

1 It's built for stability

High availability, load balancing, health checks, and session persistence as standard

I've never been much for the 'move fast, break things' school of coding, and that philosophy extends to my home network and home lab. Containers are fine for playing with, but I don't like them long term, as I tend to forget they're running and turn things off. I like virtualization, though, and nested VMs don't faze me, but there's something about Docker and other containers that I still can't quite put my finger on.

That makes me prefer system services like HAProxy, because I know that when that device is on, the service will be as well. I like knowing that I can spin a second VM up, with the same services, and add it to the HAProxy backend for high availability, and for load balancing. Not that I do many things that cause enough traffic to one service to need load balancing, but it's nice to know it's there, how it works, and how to set it up if I did.

HAProxy is still great for many networking situations, including mine

After using so many reverse proxy solutions, I think I'm sticking with HAProxy long term. While I appreciate some of the advanced features of WireGuard-based solutions, they don't provide me with much insight into what's happening in my home lab network, and I appreciate that HAProxy presents things in a clear and logical manner. Plus, it's good to know about tools that are used in enterprise settings, and I feel that I'm able to learn the processes behind the reverse proxy better when I have to do the manual work.