HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
haproxy
haproxy
C2020–2025
haproxy / haproxy

haproxy

HAProxy Load Balancer's development branch (mirror of git.haproxy.org)

Web DevelopmentDeveloper ToolsNetworking
Explore on GitHubRead Hacker News discussions
12Distinct people
17Mentions
2Explicit recommenders
7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

HAProxy Load Balancer's development branch (mirror of git.haproxy.org)

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

The dataplane API is an external product that itself uses the "stats socket". I personally don't have any experience with the dataplane API. Changing certificates…

TimWolla used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 11:56:56 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year17 dated mentions

Observed mentions: 2020-01-13 22:41:02 UTC to 2025-11-18 09:46:32 UTC.

0123452020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC303
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC303
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC505
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC211
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

What Hacker News says

17 sources
stacktrace·Nov 18, 2025
Very interesting read! But I want to point out a small correction - the DNS collapse issue at HAProxy, along with O(N^2), also had some O(N^3) code paths, which is just mind-blowing. Also, I believe this should be the correct GitHub issue link - https://github.com/haproxy/haproxy/issues/1404 > Production Lesson: Code that "works fine" at small scale may still hide O(N²) or worse behavior. At hundreds or thousands of nodes, those costs stop being theoretical and start breaking production.
In When Reverse Proxies Surprise You: Hard Lessons from Operating at Scale
wtarreau·May 29, 2024
I totally agree, that's what I had to do with my patchbot that evaluates haproxy patches to be backported ( https://github.com/haproxy/haproxy/tree/master/dev/patchbot/ ). Originally it would just provide a verdict and justify it and it worked extremely poorly, often with a justification that directly contradicted the verdict. I swapped that by asking the analysis and the final verdict and now the success rate is totally amazing (particularly with mistral that remains unbeatable at this task by obeying extremely well to instructions).
In What We Learned from a Year of Building with LLMs
TimWolla·Sep 16, 2022
It does not, because HAProxy does not perform any disk access at runtime and thus would be unable to persist the certificates anywhere. Disks accesses can be unpredictably slow and would block the entire thread which is not something you want when handling hundreds of thousands of requests per second. See this issue and especially the comment from Lukas Tribus: https://github.com/haproxy/haproxy/issues/1864 Disclosure: Community contributor to HAProxy, I help maintain HAProxy's issue tracker.
In 35M Hot Dogs: Benchmarking Caddy vs. Nginx
TimWolla·Sep 9, 2022Recommendation phrase
The dataplane API is an external product that itself uses the "stats socket". I personally don't have any experience with the dataplane API. Changing certificates (https://docs.haproxy.org/2.6/management.html#9.3-add%20ssl%2...) and adding servers (https://docs.haproxy.org/2.6/management.html#9.3-add%20serve...) using the stats socket is both officially documented. If you find the documentation insufficient or unclear, then this can be considered a documentation bug that I recommend filing here: https://github.com/haproxy/haproxy/issues
In Caddyhttp: Enable HTTP/3 by Default
terom·Mar 5, 2022Recommendation phrase
:+1: for the effort to document this, and coordinating the disclosure with the vendors. This mainly talks about rate-limiting bypass/DoS, but if XFF is also used for audit trail logging of IP addresses and/or IP-based access lists, then the security implications can be even more severe, with falsified audit logs and bypassed security controls. Setting up an application server behind a reverse proxy to use the "real" client IP is unfortunately very typically just a trial-and-error based process, with very little room for this kind of nuanced security-conciousness, because the configuration and exact behavior is all so non-standardized across different implementations of reverse-proxies and application servers... Typically users will just try different configuration settings until they find a combination that seems to work, and you would ac
Read the rest
tually need to dig in with curl and tshark to understand the edge cases, because the documentation of the application-specific implementation is typically just one brief sentence... Getting XFF working correctly through a complicated HTTP stack with multiple layers of nginx/haproxy/apache proxies (yes, they have different non-overlapping feature sets), custom backends implementing custom XFF handling/forwarding, and jetty/spring backends upgraded across a major version bump that changed the implementation and configuration properties related to XFF handling was insanely difficult. And of course it broke when migrating from a F5 LB to an AWS ALB, because it behaved differently for that one edge-case for an important customer... highly recommended to just override the entire XFF header with a single value at the appropriate point in your stack, if at all possible. If just the naive leftmost-first vs rightmost-ish-with-configurable-list-of-trusted-upstream-proxies wasn't enough, then yeah, HAProxy does the thing where it adds a new 100% standards-compliant header continuation line [1] that maybe 1% of backend application developers have ever tested with. And trying to configure HAProxy to interpret the incoming XFF headers for logging/access-control ~is~/was even more weird [2]. [1] https://github.com/haproxy/haproxy/issues/44 [2] https://github.com/haproxy/haproxy/issues/90
In The perils of the “real” client IP
pdevr·Aug 24, 2021
I am amazed at the variety of repos shared - by you, as well as others. Thanks! Repo links: https://github.com/facebook/zstd https://github.com/google/brotli https://github.com/ClickHouse/ClickHouse https://github.com/evanw/esbuild https://github.com/figma https://github.com/tailwindlabs/tailwindcss https://github.com/caddyserver/caddy https://github.com/haproxy/haproxy https://github.com/uNetworking/uWebSockets
In Ask HN: What are the best publicly available FAMANG code repos?
rogerdonut·May 23, 2021
You can pass along timing data from every aspect of the request [1] currently there are approximately 20 events supported. You can also send over just about anything that can be stored within an HAProxy variable / header through a tag. Here's an example configuration for HAProxy (simple) [2] (advanced) [3] and the OpenTracing specific configuration (simple) [4] (advanced) [5]. I've included both simple and advanced configurations. [1] https://github.com/haproxy/haproxy/blob/master/addons/ot/REA... [2] https://github.com/haproxy/haproxy/blob/master/addons/ot/tes... [3] https://github.com/haproxy/haproxy/blob/master/addons/ot/tes... [4] https://github.com/haproxy/haproxy/blob/master/addons/ot/tes... [5] https://github.com/haproxy/haproxy/blob/master/addons/ot/tes...
In HAProxy 2.4
TimWolla·Mar 25, 2021
This is the fix for the LibreSSL issue [1]: https://github.com/libressl-portable/openbsd/commit/5f00b800... This is the fix for the OpenSSL issue: https://github.com/openssl/openssl/commit/02b1636fe3db274497... They don't appear to be related to me. One is a UAF, the other is a NULL pointer dereference. [1] The LibreSSL issue was found by HAProxy's continuous integration pipeline: https://github.com/haproxy/haproxy/issues/1115. Disclosure: I'm a community contributor of HAProxy, I help maintain the issue tracker and I took part in debugging the issue.
In OpenSSL Security Advisory

Showing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.