Why does the frontend use an ACL instead of just a default_backend?

A Host-header ACL is what makes this frontend able to grow into routing multiple domains to different backends later, you just add more acl/use_backend pairs. A bare default_backend works for a single-domain setup, but the ACL pattern is how HAProxy configs scale, so it's included even for the one-domain case as good habit and a template for adding more.

What does SSL termination mean here, and why add a redirect too?

SSL termination means HAProxy itself decrypts HTTPS traffic (via the `ssl crt` bind option) rather than passing encrypted traffic through to the backend. The `redirect scheme https` rule on the plain :80 bind sends anyone hitting HTTP straight to HTTPS, so the certificate path is actually used instead of leaving a live unencrypted listener.

What's the difference between option httpchk here and the check keyword on each server line?

`option httpchk GET /` tells the backend to use HTTP-level health checks instead of a plain TCP connect check; `check` on each server line is what actually enables health checking for that specific server. Both are needed together, `option httpchk` sets the method, `check` turns it on per server.

Can I point multiple domains at different backends with this config?

This generator produces one ACL/backend pair; to add a second domain, duplicate the `acl`/`use_backend` lines with a new host value and a new backend section, HAProxy evaluates ACLs in order and uses the first matching use_backend rule.

HAProxy haproxy.cfg Generator - ACL Routing + SSL Termination

Overview

Introduction

HAProxy's configuration is powerful but verbose: global/defaults boilerplate, a frontend with ACL-based routing, and a backend with health-checked servers are all separate sections that need to agree with each other, a mismatched ACL name or a missing `check` keyword fails quietly rather than loudly.

This tool generates all of it together: a sane global/defaults baseline, a Host-header-routed frontend, and a backend with your chosen balance algorithm and active health checks, with SSL termination as a single toggle.

What Is HAProxy Config Generator?

A generator for a complete haproxy.cfg: global (logging, connection limits), defaults (mode, timeouts), a frontend that matches the Host header via an ACL and routes to a named backend, and that backend with a selectable balance algorithm plus HTTP health checks on every server.

Enabling SSL adds a second bind on :443 with `ssl crt <path>` for termination, plus a redirect rule on the :80 bind so plain HTTP traffic is sent to HTTPS instead of served insecurely.

How HAProxy Config Generator Works

You provide the Host header value to match, a list of backend servers, a balance algorithm, and optionally enable SSL with a certificate bundle path. The generator validates the host and backend address formats.

It assembles the global/defaults sections, a frontend with an ACL keyed off the host value routing to `be_pool`, and a backend with the chosen `balance` algorithm, `option httpchk`, and one `server ... check` line per backend.

When To Use HAProxy Config Generator

Use it when you need HAProxy in front of one or more application servers with Host-header-based routing and want a config that's ready to extend to more domains later.

It's also useful when you need SSL termination at the load balancer rather than on each backend server.

Often used alongside Load Balancer Config Generator, Rate Limiting Config Generator and Nginx Reverse Proxy Generator.

Features

Advantages

Uses ACL-based routing from the start, so scaling to multiple domains later is additive rather than a restructure.
Pairs `option httpchk` with `check` on every server, so health checking actually activates instead of silently defaulting to a bare TCP check.
SSL termination correctly includes the HTTP-to-HTTPS redirect, so the plain-HTTP bind isn't left serving traffic insecurely alongside it.

Limitations

Generates one frontend/backend pair; multi-domain or path-based routing needs additional ACL/use_backend/backend blocks added by hand.
Doesn't configure HAProxy's stats page or Runtime API, which are commonly added alongside a production config.

Examples

Two-backend config with SSL termination

Input

hostHeader: example.com, backends: [10.0.0.1:8080, 10.0.0.2:8080], balanceAlgorithm: leastconn, sslEnabled: true, certPath: /etc/haproxy/certs/example.com.pem

Output

frontend fe_main
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    acl is_example_com hdr(host) -i example.com
    use_backend be_pool if is_example_com
    default_backend be_pool

backend be_pool
    balance leastconn
    option httpchk GET /
    server web1 10.0.0.1:8080 check
    server web2 10.0.0.2:8080 check

The :80 bind only redirects; the :443 bind terminates TLS using the certificate bundle path, and both share the same ACL-routed backend.

Best Practices & Notes

Best Practices

Combine multiple PEM files (full chain + private key) into a single bundle file for the `ssl crt` path, HAProxy expects one file containing both, unlike Nginx's separate cert/key directives.
Point `option httpchk` at a lightweight, dependency-free health endpoint rather than a page that hits a database, so checks reflect process health quickly.
Add the HAProxy stats page (`stats enable` in a dedicated listen block) in production so you can see server up/down state and request counts at a glance.

Developer Notes

HAProxy's ACL system (`acl <name> hdr(host) -i <value>`) does a case-insensitive match against the Host header; `use_backend ... if <acl>` rules are evaluated top-to-bottom with the first match winning, and `default_backend` is the fallback when no ACL matches. `ssl crt` on a bind line expects a single file containing the certificate chain followed by the private key (PEM-concatenated), which differs from Nginx's `ssl_certificate`/`ssl_certificate_key` pair of separate files.

HAProxy Config Generator Use Cases

Load-balancing HTTP traffic across multiple backend servers with active health checks
Terminating SSL/TLS at the load balancer in front of backend servers running plain HTTP
Building a Host-header-routed frontend that can grow into a multi-domain setup

Common Mistakes

Adding `option httpchk` without the `check` keyword on server lines (or vice versa), leaving health checking effectively disabled.
Providing separate certificate and key files to `ssl crt`, which expects one concatenated PEM bundle, not two paths.

Tips

When adding a second domain later, duplicate the acl/use_backend pair with the new host value and a new backend name, HAProxy's first-match ACL evaluation means order matters if hosts could overlap.

HAProxy Config Generator