An HA Proxy configuration for putting various APIs behind a single whitelistable IP address.

haproxy.cfg

global
    description prod
    maxconn 7777 # About 54k per connection; 400MB free on this machine.
    stats socket /var/run/haproxy.stat mode 600 level admin
    user haproxy
    group haproxy

defaults
    mode http
    maxconn 7700               # Should be slightly smaller than global.maxconn.
    timeout client 60s         # Client and server timeout must match the longest
    timeout server 60s         # time we may wait for a response from the server.
    timeout queue  10s         # Don't queue requests too long if saturated.
    timeout connect 4s         # There's no reason to change this one.
    timeout http-request 5s    # A complete request may never take that long.
    option httpclose
    option abortonclose
    option httplog
    option dontlognull
    option dontlog-normal
    log global
    log /dev/log local0
    balance leastconn

frontend http-in *:80
    # Remove :80 or similar from Host: header
    reqirep Host:\ (.*)(:\d+) Host:\ \1

    # Support a few Twitter ecosystem apps explicitly.
    acl twitpic hdr_beg(Host) twitpic.com
    reqirep Host:.* Host:\ twitpic.com if twitpic
    acl yfrog hdr_beg(Host) yfrog.com
    reqirep Host:.* Host:\ yfrog.com if yfrog
    acl plixi hdr_beg(Host) api.plixi.com if plixi
    reqirep Host:.* Host:\ api.plixi.com if plixi

    # Requests made (via DNS wildcard) for mybucket.proxy-east.example.com
    # are rewritten as mybucket.s3.amazonaws.com.
    reqirep Host:\ (.*)\.proxy- Host:\ \1.s3.amazonaws.com

    use_backend stats       if { path_beg /meta }
    use_backend twitpic     if twitpic
    use_backend yfrog       if yfrog
    use_backend plixi       if plixi
    default_backend s3

    monitor-uri /meta/check

# These could potentially fail if haproxy resolves the server name to an IP
# which subsequently changes. If that happens, a restart of haproxy should fix
# it. For this reason, a cron job reloads this config daily.
#
# Caveat/TODO: if any of these backends use DNS RR load balancing, we will send
# all traffic to whatever host we randomly choose at startup time. This
# configuration file should instead be templated, and these backends should all
# be IPs.
backend s3
    server s3 s3.amazonaws.com:80 check

backend twitpic
    option httpchk HEAD / HTTP/1.0
    server twitpic twitpic.com:80 check

backend yfrog
    server yfrog yfrog.com:80 check

backend plixi
    server plixi api.plixi.com:80 check
    option httpchk HEAD / HTTP/1.0

backend stats
    stats refresh 10s
    stats uri /meta/stats
    stats auth admin:admin