[2shiraz]

Loxy is a self-hosted management panel for HAProxy 3.4 LTS. You manage frontends and backends; Loxy renders haproxy.cfg, validates it with haproxy -c, swaps it in atomically, and uses runtime API ops where it can (a reload otherwise).

What's in it

• Frontends: binds (* or a specific IP, many ports), HTTP or TCP, TLS termination with a list of certificates, HTTP→HTTPS redirect, host/path routing rules to backends, a default backend, maintenance (503 / reject), enable/disable, client timeout, maxconn, forwarded headers.
• Backends: reusable server pools.
  • Servers: an IP, a host from the inventory, or a label selector.
  • Settings: algorithm, port overrides, weight and backup, health checks (tcp/http/https with path, status codes and body), sticky sessions, PROXY protocol v1/v2, server timeout.
  • Server changes are applied at runtime (add/del server, drain before removal).
• Inventory and node: hosts with labels and a label-selector preview; node addresses.
• TLS: uploaded and ACME certificates (lego, HTTP-01 through virt@acme_http01, DNS-01 through libdns), hot-swapped with set/commit ssl cert.
• Domains & DNS: domains attach to a frontend. Verification and auto A/AAAA records use the frontend's bind addresses, or the node's addresses when it binds *. A certificate issued from a domain is attached to its frontend if that frontend terminates TLS.
• Ops: config revisions with diff and rollback, metrics per frontend and per backend (1 s live, 1 min history), live logs, events and audit log, notifications filtered by label, users and roles, API tokens, TOTP, backup and restore, Prometheus endpoint.
• CLI: loxy frontends ls, loxy backends ls, loxy api …, render --dry-run, backup/restore, admin reset-password.

Direction change (ADR 0005)

The earlier load-balancer model is gone: LB objects, plans and sizes, rescaling, prices, quotas and delete protection. Everything is built on the frontend/backend model, and provider-specific wording has been removed. The schema was rewritten in place (pre-release). Loxy refuses an old load-balancer database with a clear error instead of failing later.

Decisions (defaults used)

• Names allow any printable characters, up to 64 (API and UI match).
• An HTTP frontend may have no default backend (unmatched requests get 503); a TCP frontend requires one.
• Route matching:
  • Hosts are matched exactly or as *.suffix, case-insensitive, with the port ignored.
  • The path is a prefix match.
  • Rules are evaluated in order, at most 100 per frontend.
• Health checks:
  • HTTP backends default to HTTP checks.
  • The interval is 3–3600 s, and the timeout must be less than the interval (§8.6).
  • An explicit check port is kept; null means each server's own port.
• A backend that is in use cannot be deleted (409), and its mode cannot change while it is in use.
• IPv6: * renders 0.0.0.0:<port> plus ipv6@:::<port> v6only. The IPv6 listener is added only when the host supports IPv6, because HAProxy exits at startup otherwise (verified). LOXY_IPV6=auto|on|off controls this; see ADR 0004 §9.
• Alert label filters scope frontend, backend and domain events. Node-wide events (apply, config, backup, node) always pass the filter.

Review

Two review passes (correctness, security, performance). Fixed:

• IPv6 wildcard listeners.
• :80 listener collisions:
  • when a frontend is enabled via PATCH;
  • when a frontend gets a managed HTTP-01 certificate or a domain;
  • collisions are now family-aware (*, 0.0.0.0, ::);
  • collision checks are serialized with their commit.
• secure on sticky cookies when every frontend using the backend has TLS.
• Duplicate certificate ids return 422 instead of 500.
• Explicit health-check port is preserved.
• HTTP check default and interval range now follow the spec.
• Alert scoping for node-wide events; domain events carry their frontend.
• Server listing is no longer O(servers × slots).
• One shared rule for when a frontend needs an ACME :80 listener.

Left as is:

• PUT stays a full replacement: an omitted health check takes the mode default, per the spec.
• No migration for health-check intervals of 1–2 s: those rows only exist in pre-release dev databases, which are refused anyway.

Verification

• golangci-lint (0 issues), go vet, go test ./... — all green, with new regression tests for each fix.
• make test-integration against haproxy:3.4.6-alpine passes, including Pebble ACME.
  • Under load, 20 reloads plus a runtime server add and remove gave 0 failed requests.
• Playwright e2e against a live stack: 2/2 passed. It covers backend + server → healthy, frontend → 200, maintenance → 503 → 200, typed-confirm delete, and domains on a frontend.
• npm run check: 0 errors and 0 warnings. The initial bundle is about 55 KB gzip (budget 150 KB).

Not done yet

• Multi-node (panel/agent) and keepalived VIP (Phase 3).
• Config import from an existing haproxy.cfg (backlog).
• The design-skill pass (critique → polish → quieter → harden) screen by screen.

Screenshots: docs/screenshots/.

🤖 Generated with Claude Code

https://claude.ai/code/session_0159fEExV6P6AdgP7HbsJNBc