HAProxy Cluster Manager

HAProxy Cluster Manager is a free and open source web interface for running HAProxy as a highly available reverse proxy and load balancer, with Let's Encrypt certificates and multi-node failover managed from the same application.

Publishing a service takes two inputs — the public URL and the backend address. The application generates the corresponding frontend, backend, ACLs, certificate, and HTTP-to-HTTPS redirect, and shows the exact haproxy.cfg it will write before anything is applied. Recipes pre-fill the configurations that are usually assembled by hand: PostgreSQL behind Patroni (TCP traffic on one port with an HTTP primary-election check on another), MariaDB Galera, and common self-hosted applications, complete with health checks, timeouts, and alert thresholds that match the workload.

Certificates come from Let's Encrypt through acme.sh, using HTTP-01 or DNS-01 validation with around 190 supported DNS providers. Renewals run automatically, HAProxy is reloaded so the new certificate is actually served, and certificates are distributed to every cluster node.

For high availability, any number of nodes share a virtual IP through Keepalived. Configuration and certificates synchronize across the cluster, nodes that were offline catch up automatically, and the dashboard surfaces the failure modes that are otherwise invisible: split brain, an unclaimed virtual IP, or a node running an outdated configuration.

Services can optionally require sign-in — HTTP basic authentication or OIDC single sign-on (Authentik, Keycloak, Authelia, Google, Microsoft Entra) — enforced by HAProxy itself without Lua, so unauthenticated requests never reach the application behind the proxy and a failover does not end user sessions.

Monitoring is built in: live statistics from the HAProxy admin socket, per-service traffic history, a service watchdog, periodic end-to-end probes of every published URL covering DNS, TCP, TLS, and HTTP, notifications by email, Pushover, or webhook, Home Assistant integration via MQTT discovery, and a Prometheus metrics endpoint.

The application is a single Python service that stores all state in one JSON file — no database required. Generated configurations are validated with haproxy -c before being written and are rolled back automatically if HAProxy fails to come back after a reload. It installs from .deb and .rpm packages, an install script for Debian-based distributions, or an all-in-one Docker image for amd64 and arm64. Licensed under GPL-3.0.