HAProxy - Hardened Load Balancer & Reverse Proxy

What is HAProxy

HAProxy is the industry-standard open-source software load balancer and reverse proxy - a single, high-performance C binary trusted for its reliability at scale. It balances TCP and HTTP/HTTPS traffic across pools of backend servers with active and passive health checks, multiple balancing algorithms (round-robin, leastconn, source, URI hash), sticky sessions, connection queuing, rate limiting, ACL-based routing, and request and response header rewriting. This image builds HAProxy 3.4 LTS from the official release source linked against the system OpenSSL 3 library, so it terminates TLS itself with no separate web server, and exposes a built-in real-time statistics and administration dashboard. A Lua scripting engine, PCRE2 regular expressions, and zlib compression are compiled in. GPL-2.0 license, fully auditable, no vendor lock-in.

Why self-host HAProxy

Self-hosting your load balancer keeps every connection, certificate, and routing decision inside your own tenant - no managed-service fees and no third-party visibility into your traffic. The single GPL-2.0 binary is fully auditable and runs anywhere, so there is no platform lock-in. Ideal for teams that need predictable cost, full control over TLS termination and backend routing, and deployments under regulated frameworks (GDPR, ISO 27001, HIPAA).

What this VM image adds

Security hardening:

• Per-instance self-signed TLS certificate generated at first boot - HTTPS works immediately on port 443; drop in your own PEM or a Let's Encrypt certificate any time
• Statistics and administration dashboard bound to 127.0.0.1 only - protected by a strong password generated at first boot, reached over an SSH tunnel, never exposed to the network
• Healthy default configuration - the instance boots and answers on ports 80 and 443 with no backend configured; edit one section to route to your own servers
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - SSH on 22, proxied traffic on 80 and 443 only
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Server credentials file - /root/haproxy-credentials.txt with the stats dashboard user and per-instance password

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. Open NSG: TCP 80 and 443 from your client networks, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. Read credentials: sudo cat /root/haproxy-credentials.txt - contains the stats dashboard user and password
5. Open https://<PUBLIC_IP> and accept the self-signed certificate; route to your backends by editing the sample_backend section in /etc/haproxy/haproxy.cfg, then run sudo systemctl reload haproxy
6. Reach the stats dashboard over an SSH tunnel: ssh -L 8404:127.0.0.1:8404 -i key.pem <username>@<PUBLIC_IP>, then open http://127.0.0.1:8404/

The port 443 frontend uses a per-instance self-signed certificate so HTTPS works on first boot - replace it at /etc/haproxy/certs/default.pem (full chain + private key in one PEM) or obtain a Let's Encrypt certificate before exposing the proxy to end users.