Haprion

Run small HAProxy clusters from one place - load balancing, failover, a WAF and certificates - without having to master HAProxy.

A hobby project for home labs and smaller companies, maintained best-effort. It has not reached 1.0 and is not yet declared ready for production. See Project status.

How an installation looks

Clients reach the virtual address, which keepalived keeps on node-a of the HAProxy cluster; node-a forwards to your servers, and node-b stands by to take the address over. The manager, outside the traffic path, runs the web interface and engine with PostgreSQL. It asks the nodes to fetch over SSH, and the nodes fetch releases and certificates from it.
The manager is outside the traffic path and never pushes to a node: it asks the node to fetch, and the node checks a release before it switches to it.

What it does

Proxies and clusters

  • HTTP, HTTPS and TCP objects, edited as drafts and published as versions
  • deploys rolled out node by node, bound to the version you saw
  • DNS load balancing through dnsdist, and syslog over UDP
  • a virtual address carried by keepalived; draining and maintenance per server

Access and protection

  • who may reach an object - by address, range, named network or country
  • rules on path, method and headers, and rate limits per source
  • a WAF: Coraza with the OWASP Core Rule Set, in log or block mode

Certificates

  • issued from one form through ACME, with HTTP-01 or DNS-01
  • enrollment from a Microsoft CA over NDES/SCEP, or import
  • distributed to the nodes and to other hosts that fetch them

Operations

  • status, metrics and a seven-day traffic log
  • node backups, and restoring a node onto an empty VM
  • OpenID Connect sign-in, and every change to a cluster recorded as a job

Screenshots

Made with invented clusters, names and addresses.

The dashboard. Every cluster and node at a glance: which node holds the virtual address, how much traffic passes, and what needs attention.
The dashboard: two clusters with two nodes each, the node holding the virtual address marked as owner, traffic figures per cluster, and a short list of what needs attention.
A proxy is a form. Hostnames, certificate, servers and health check. Haprion writes the HAProxy configuration from it.
Editing a proxy: name, hostnames, protocol, virtual address and certificate; three servers with round-robin balancing; an HTTP health check, and what each node reports for each server.
Certificates. Issued or imported once, used by every cluster that needs them, with the expiry dates in view.
The certificate list: one renewed by certbot and two imported, the clusters using each, when each expires, and one expired certificate marked.
The traffic log. Every request from every node, searchable, with the rule that stopped it.
The traffic log: requests with time, node, client, host and path, status, and the server that answered; a few stopped by the WAF, by dynamic blocking and by an access rule.
Every publish is a version. What changed in the proxy and in the configuration it produced, and a way back.
One version's changes: the proxy's health check interval shortened, and the HAProxy server line it changed.

Install

A manager and one or more nodes, each with Ubuntu 26.04 or Debian 13. Add the project's signed apt repository on every machine (sudo apt install curl first if the machine has no curl).

On Ubuntu 26.04:

sudo curl -fsSLo /usr/share/keyrings/haprion-archive-keyring.asc \
  https://haprion.github.io/haprion/haprion-archive-keyring.asc
sudo tee /etc/apt/sources.list.d/haprion.sources >/dev/null <<'EOF'
Types: deb
URIs: https://haprion.github.io/haprion/
Suites: ubuntu26.04
Components: main
Signed-By: /usr/share/keyrings/haprion-archive-keyring.asc
EOF
sudo apt update

On Debian 13:

sudo curl -fsSLo /usr/share/keyrings/haprion-archive-keyring.asc \
  https://haprion.github.io/haprion/haprion-archive-keyring.asc
sudo tee /etc/apt/sources.list.d/haprion.sources >/dev/null <<'EOF'
Types: deb
URIs: https://haprion.github.io/haprion/
Suites: deb13
Components: main
Signed-By: /usr/share/keyrings/haprion-archive-keyring.asc
EOF
sudo apt update

Then, on the manager:

sudo apt install haprion-ui
sudo haprion-setup

and on each node:

sudo apt install haprion-node

The quickstart goes on from there to a site served by your HAProxy nodes. The repository key's fingerprint is 927422B0C5F005E0B710E4FFF30F5055A9FC0A53.