Debian Load Balancing with HAProxy and Keepalived

This article explains how the Debian operating system manages enterprise-grade load balancing deployments by pairing HAProxy with Keepalived. It explores the combined architecture where Keepalived provides high availability via Virtual Router Redundancy Protocol (VRRP) and a shared Virtual IP (VIP), while HAProxy manages Layer 4 and Layer 7 traffic distribution. Readers will learn how Debian handles package management, kernel-level networking parameters, daemon configuration, health monitoring scripts, and systemd service orchestration to maintain an active-passive or active-active load-balanced environment.

The Role of HAProxy and Keepalived

In a Debian deployment, high availability and load distribution are split into two distinct responsibilities:

  1. Keepalived (High Availability): Implements the Virtual Router Redundancy Protocol (VRRP) across two or more Debian nodes. It creates and manages a floating Virtual IP (VIP) address that automatically shifts between nodes if the active node fails.
  2. HAProxy (Load Balancing): Operates as a reverse proxy, accepting incoming traffic directed to the VIP and balancing requests across backend application servers based on configured algorithms such as round-robin, least connections, or source-IP hashing.

Package Installation and Repositories

Debian maintains pre-compiled, security-patched binaries of both tools in its official package repositories. System administrators install them using the native package manager:

sudo apt update
sudo apt install haproxy keepalived

Debian assigns systemd service units to both applications during installation (haproxy.service and keepalived.service), enabling standard service control and initialization at boot.

Kernel Network Configuration for Non-Local Binding

Because the floating VIP exists on only one node at any given time, the backup node's HAProxy instance must be allowed to bind to an IP address that is not yet assigned to any local network interface. Without this capability, HAProxy fails to start on the passive node.

Debian manages this through sysctl settings. Administrators enable non-local binding by creating a dedicated configuration file, typically /etc/sysctl.d/99-loadbalancer.conf:

net.ipv4.ip_nonlocal_bind = 1
net.ipv6.ip_nonlocal_bind = 1

Running sudo sysctl --system applies these parameters immediately without requiring a system reboot.

Keepalived Configuration and Failover Automation

Keepalived is configured through /etc/keepalived/keepalived.conf. In a standard two-node Debian setup, one node is designated as MASTER with a higher priority (e.g., 101), and the second node is configured as BACKUP with a lower priority (e.g., 100).

To make failover responsive to application-level outages rather than just node crashes, Keepalived uses a health-check script (vrrp_script) that monitors the status of HAProxy.

vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 101
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass SecureSecret123
    }

    virtual_ipaddress {
        192.168.1.100/24
    }

    track_script {
        check_haproxy
    }
}

If HAProxy crashes or stops responding on the master node, the track_script fails, the priority drops, and Keepalived shifts the floating VIP (192.168.1.100) to the backup node automatically.

HAProxy Configuration

HAProxy is configured via /etc/haproxy/haproxy.cfg. Debian provides a modular default configuration containing sensible global logging and performance settings. Administrators configure frontend and backend blocks to direct traffic:

frontend http_in
    bind 192.168.1.100:80
    mode http
    default_backend web_servers

backend web_servers
    mode http
    balance roundrobin
    option httpchk GET /health
    server web1 10.0.0.11:80 check
    server web2 10.0.0.12:80 check

HAProxy handles continuous health checking of the backend application nodes using the check parameter. If a backend server becomes unresponsive, HAProxy automatically routes traffic to the remaining healthy nodes without interrupting the Keepalived VIP routing.

Service Management and Logging

Debian integrates both services into systemd and standard logging frameworks:

  • Service Control: Services are managed using standard Debian systemd commands:

    sudo systemctl enable --now haproxy keepalived

  • Configuration Validation: Debian allows testing configuration files before applying changes to prevent service downtime:

    haproxy -c -f /etc/haproxy/haproxy.cfg

  • Logging Integration: HAProxy and Keepalived output operational and access logs directly to Debian’s journald or rsyslog. Keepalived state transitions are logged under /var/log/syslog, while HAProxy access logs can be isolated using custom rsyslog rules in /etc/rsyslog.d/49-haproxy.conf.