Configure HAProxy (Hardened)

Configuration files

/etc/haproxy/haproxy.cfg — validate every change with `haproxy -c -f /etc/haproxy/haproxy.cfg`

Credential rotation

No application credential exists; rotate your SSH keys through your cloud's own key management.

Monitoring & logging

• Logs: journalctl -u haproxy -f (rsyslog target configurable)
• Health: curl -fsS http://127.0.0.1:8404/stats (on the instance) — the stats page — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Replace with the newest image version, or `apt upgrade haproxy` in place. Config is a single file — carry haproxy.cfg forward.

Backup & restore

Back up /etc/haproxy/haproxy.cfg (that's the whole state).