Nginx/HAProxy Load Balancing Setup for Website

Load Balancing Setup with Nginx and HAProxy

Load balancer distributes incoming traffic across multiple backends, eliminates single point of failure, allows horizontal scaling without client code changes.

Nginx as load balancer

Nginx balances HTTP/HTTPS and TCP out of the box. Suitable for most web apps: proxies requests to backends, health checks, caches responses.

# /etc/nginx/conf.d/myapp.conf

upstream myapp_backend {
    # Round-robin by default
    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
    server 10.0.1.12:8080;

    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    location / {
        proxy_pass http://myapp_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        proxy_next_upstream error timeout http_502 http_503;
        proxy_next_upstream_tries 2;
    }
}

Nginx balancing algorithms

# Least Connections
upstream backend_lc {
    least_conn;
    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
}

# IP Hash
upstream backend_sticky {
    ip_hash;
    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
}

# Weighted Round-Robin
upstream backend_weighted {
    server 10.0.1.10:8080 weight=3;
    server 10.0.1.11:8080 weight=1;
}

# Backup server
upstream backend_backup {
    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
    server 10.0.1.20:8080 backup;
}

HAProxy for high loads

HAProxy is a specialized load balancer. Handles millions of concurrent connections, L4 (TCP) and L7 (HTTP), built-in stats and ACLs.

# /etc/haproxy/haproxy.cfg

global
    log /dev/log local0
    maxconn 100000
    nbthread 4
    tune.ssl.default-dh-param 2048

defaults
    log global
    mode http
    option httplog
    option forwardfor
    option http-server-close
    timeout connect 5s
    timeout client 30s
    timeout server 60s

frontend http_front
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem

    http-request redirect scheme https unless { ssl_fc }

    acl is_api path_beg /api/
    acl is_admin path_beg /admin/

    use_backend api_backend if is_api
    use_backend admin_backend if is_admin
    default_backend web_backend

backend web_backend
    balance leastconn
    option httpchk GET /health HTTP/1.1\r\nHost:\ example.com

    server web01 10.0.1.10:8080 check
    server web02 10.0.1.11:8080 check
    server web03 10.0.1.12:8080 check

backend api_backend
    balance roundrobin
    option httpchk GET /api/health

    server api01 10.0.2.10:3000 check
    server api02 10.0.2.11:3000 check

frontend stats
    bind *:8404
    stats enable
    stats uri /stats
    stats auth admin:strongpassword

Keepalived for HA

Two load balancers (primary + backup) with virtual IP — if primary fails, backup takes VIP in seconds.

# /etc/keepalived/keepalived.conf (primary)
vrrp_script check_haproxy {
    script "pidof haproxy"
    interval 2
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass secretpassword
    }

    virtual_ipaddress {
        10.0.0.100/24
    }

    track_script {
        check_haproxy
    }
}

Timeline