October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
VGSources
Blog

How to Run Multiple HAProxy Instances on a Linux VPS

A practical systemd-based guide to running multiple isolated HAProxy instances on one Linux VPS without listener, PID, socket, certificate, map, or state-file collisions.
Length11 min Posted Quest giverVGSources Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Run one HAProxy process tree per systemd unit. Give every unit its own configuration file, PID file, runtime directory, master or stats socket, state and log paths, and listener addresses or ports. Start each process in master-worker mode with -Ws, validate its configuration before reloading, and reload only the unit you changed. This keeps independent services on one VPS while preventing port, socket, PID, certificate, map, and state-file collisions.

What “multiple HAProxy instances” means

A separate instance is a separate HAProxy process tree managed by its own systemd service. For example, [email protected] can proxy a game API while [email protected] handles a different application. Each service has an independent configuration and lifecycle: you can start, stop, inspect, or reload one without issuing the same operation to the other.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The isolation is useful when configurations, certificates, maps, maintenance schedules, or failure domains must remain separate. It also has a cost: every instance adds process, socket, file-descriptor, memory, logging, and operational overhead. A single HAProxy process can be simpler when all front ends belong to one administrative domain and can share one carefully organized configuration.

Plan the namespaces before installing services

Write down the resources that must be unique before copying a unit. The most important rule is that no two instances may claim the same address:port pair on the host. A wildcard bind such as 0.0.0.0:443 conflicts with any other service attempting to use that port on the same address family and interface.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Resource Example for site-a Example for site-b Why it must be distinct
Configuration /etc/haproxy/site-a/haproxy.cfg /etc/haproxy/site-b/haproxy.cfg Each service must read the intended front ends, back ends, certificates, maps, and defaults.
PID file /run/haproxy-site-a/haproxy.pid /run/haproxy-site-b/haproxy.pid Reload and shutdown commands must target the correct process tree.
Runtime directory /run/haproxy-site-a/ /run/haproxy-site-b/ Runtime sockets and transient files must not overwrite one another.
Master CLI socket /run/haproxy-site-a/master.sock /run/haproxy-site-b/master.sock Control commands must reach the intended master process.
Stats socket, if enabled /run/haproxy-site-a/stats.sock /run/haproxy-site-b/stats.sock A shared path makes monitoring and runtime administration ambiguous.
State, logs, maps, and certificates Dedicated site-a paths or unique names Dedicated site-b paths or unique names Relative paths and runtime updates can otherwise resolve to the wrong instance.
Listeners An address and port set reserved for site-a A different address and port set reserved for site-b The kernel allows each address-port pair to be bound only once.

Keep persistent configuration under /etc/haproxy/ and persistent state under separate directories such as /var/lib/haproxy/site-a/ and /var/lib/haproxy/site-b/. Use systemd’s RuntimeDirectory= for paths under /run; systemd creates the directory for the unit and removes the transient runtime directory when the unit’s lifetime ends.

Choose listener addresses and ports

Different ports on one address

The straightforward arrangement is to give each service a different port, for example site-a on 203.0.113.10:443 and site-b on 203.0.113.10:8443. Firewall rules, DNS, and clients must use the corresponding port. This is easy to reason about but may not be suitable when users require one standard public port.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Different local IP addresses

If the VPS has multiple local addresses, both instances can use the same port while binding to different addresses, such as 198.51.100.20:443 and 198.51.100.21:443. Confirm that both addresses are assigned to the host and that upstream networking and firewall policy route traffic correctly. The address, not merely the port number, is part of the uniqueness check.

One front door for a shared public port

When several applications must appear on one public address and port, place a single front door on that pair and route internally by hostname, path, SNI, or another supported rule. The back-end HAProxy services then listen on distinct local ports or addresses. Do not make two independent instances compete for the same wildcard listener.

Create per-instance directories

Create the directory structure before writing units. The exact owner and mode depend on the distribution’s packaged HAProxy service and on whether certificates or maps are readable by a dedicated service account. Verify permissions rather than making every file world-readable.

sudo install -d /etc/haproxy/site-a
sudo install -d /etc/haproxy/site-b
sudo install -d /var/lib/haproxy/site-a
sudo install -d /var/lib/haproxy/site-b

The unit’s RuntimeDirectory=haproxy-site-a creates /run/haproxy-site-a/ during service startup. Use a different value, such as haproxy-site-b, for the second service. Put PID and socket paths inside those directories so they cannot collide with the other process or with a distribution’s default single-instance service.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

Write each HAProxy configuration

Make the global paths unique

In each configuration, set any PID, state, log, map, certificate, or runtime-control path to the instance’s namespace. If the configuration uses relative paths or default-path, give each instance a unique prefix and unique file names. HAProxy warns that shared names can make runtime updates ambiguous, especially for certificates, maps, and state files.

When enabling a stats socket, define a path under that instance’s runtime directory, for example /run/haproxy-site-a/stats.sock. The stats socket is not enabled by default; it exists only when the configuration adds it in the global section. Apply the same permissions and access controls to each socket independently.

Reserve listeners explicitly

Review every bind line and make a table of its address and port. Include IPv4 and IPv6 listeners, wildcard addresses, TLS and non-TLS ports, and any administrative listeners. Compare the complete table across instances before starting either service. A configuration can be syntactically valid and still fail at startup because another process already owns a listener.

Keep certificates, maps, and state separate

Use per-instance certificate directories or unambiguous file names. Do the same for maps and state files. This allows site-a to receive a certificate or map update without accidentally changing site-b’s runtime data. It also makes backups and rollback easier because each service has a recognizable set of files.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create one systemd unit per instance

The packaged HAProxy unit exposes variables such as CONFIG, PIDFILE, CFGDIR, and EXTRAOPTS. You can copy that unit for each service or create a template such as [email protected]. Confirm the binary path and distribution defaults first; the path below uses /usr/sbin/haproxy as an example.

[Unit]
Description=HAProxy site-a
After=network-online.target
Wants=network-online.target

[Service]
Environment="CONFIG=/etc/haproxy/site-a/haproxy.cfg" 
            "PIDFILE=/run/haproxy-site-a/haproxy.pid" 
            "EXTRAOPTS=-S /run/haproxy-site-a/master.sock"
ExecStart=/usr/sbin/haproxy -Ws -f $CONFIG -p $PIDFILE $EXTRAOPTS
ExecReload=/usr/sbin/haproxy -Ws -f $CONFIG -c
ExecReload=/bin/kill -USR2 $MAINPID
Type=notify
Restart=always
RuntimeDirectory=haproxy-site-a

Save it as a dedicated unit, for example /etc/systemd/system/haproxy-site-a.service, or adapt the distribution’s template naming convention. Create a second unit with site-b’s configuration, PID, socket, and runtime-directory values:

Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Environment="CONFIG=/etc/haproxy/site-b/haproxy.cfg" 
            "PIDFILE=/run/haproxy-site-b/haproxy.pid" 
            "EXTRAOPTS=-S /run/haproxy-site-b/master.sock"
ExecStart=/usr/sbin/haproxy -Ws -f $CONFIG -p $PIDFILE $EXTRAOPTS
RuntimeDirectory=haproxy-site-b

-Ws starts HAProxy in master-worker mode and lets systemd track the service through the notify interface. The -S option supplies a distinct master CLI socket. The first reload command validates the configuration with -c; the second sends USR2 to the service’s main process so the master can perform a graceful reload. Keep the two ExecReload entries in the same order if your systemd version supports multiple commands for that directive, or combine the validation and signal logic in a distribution-compatible wrapper.

Load, enable, and start the services

  1. Reload systemd’s unit definitions. Run sudo systemctl daemon-reload after creating or changing a unit.
  2. Validate each configuration directly. Run sudo haproxy -c -f /etc/haproxy/site-a/haproxy.cfg and the equivalent command for site-b. Do this before starting and before every reload.
  3. Check ownership and permissions. Confirm that the service can read its configuration, certificates, maps, and state files and can create its PID and socket files.
  4. Start one instance at a time. Use sudo systemctl start haproxy-site-a, inspect its status and logs, then start site-b. Staging startup makes a port collision easier to identify.
  5. Enable the desired boot behavior. Run sudo systemctl enable haproxy-site-a and sudo systemctl enable haproxy-site-b only after both services start cleanly.
  6. Verify the listener set. Inspect the service logs and the host’s listening sockets to ensure each expected address and port belongs to the intended unit.

If you use a template, the corresponding commands might be systemctl start haproxy@site-a and systemctl start haproxy@site-b. Use the actual unit names installed on your distribution; do not assume a packaged single-instance unit can coexist unchanged with your new services.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Reload one instance without interrupting the others

First validate only the configuration you intend to change:

sudo haproxy -c -f /etc/haproxy/site-a/haproxy.cfg

Then reload that unit:

sudo systemctl reload haproxy-site-a

The master-worker process receives the reload request, starts workers with the new configuration, and allows old workers to finish existing work gracefully. Site-b is not part of this command and keeps its own process tree, listeners, and sockets. Verify the result with:

sudo systemctl status haproxy-site-a
sudo journalctl -u haproxy-site-a

The traditional PID-file pattern is also available when you operate outside the packaged reload action: start HAProxy with -p /run/haproxy-site-a/haproxy.pid, then notify old processes with -sf $(cat /run/haproxy-site-a/haproxy.pid). Never substitute site-b’s PID file. A stale, shared, or incorrectly permissioned PID file can signal the wrong process or make a reload appear successful when it was not.

Use the correct control socket

The master CLI is a socket bound to the master process in master-worker mode and can address individual HAProxy processes. Give every instance a separate -S path. For example, query site-a’s socket with a local socket client such as socat, using the command syntax appropriate for your installed HAProxy version:

Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
sudo socat - UNIX-CONNECT:/run/haproxy-site-a/master.sock

If you enabled a stats socket, query the instance-specific stats path rather than reusing a path from another service:

sudo socat - UNIX-CONNECT:/run/haproxy-site-a/stats.sock

Protect these sockets. They can expose administrative or operational controls, so ownership, group permissions, and filesystem access should match the operators and monitoring processes that need them. A missing socket usually means the service is stopped, the path is wrong, the runtime directory was not created, or the configuration does not define that socket.

Logging, state, and observability

Inspect one unit at a time with systemctl status and journalctl -u. Include the unit name in monitoring labels so site-a and site-b metrics cannot be confused. If logs are written to files rather than the journal, use separate paths and rotation rules. A shared log file makes it difficult to attribute a failed bind, backend outage, or certificate warning to the correct instance.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Remember that the stats socket is optional, not an automatic feature. If monitoring requires it, add a distinct socket declaration to each configuration and verify that the monitoring account can access only the intended socket. Keep state files separate as well; restoring or replacing one instance’s state should not alter another instance’s backend history.

Size the VPS for the aggregate workload

Calculate limits for all instances together. Every listening socket consumes a file descriptor, and active client, server, health-check, logging, and control connections add more. Set systemd and operating-system file-descriptor and connection limits high enough for the combined workload, not merely for the busiest individual service.

  • Count every front-end and back-end connection across all instances.
  • Include TLS listeners, health checks, administrative sockets, and log destinations in capacity planning.
  • Leave headroom for graceful reloads, during which old and new workers can overlap temporarily.
  • Watch memory and CPU per service so one configuration cannot starve the others.
  • When the aggregate workload exceeds a small VPS’s practical limits, move to a larger VPS or distribute instances across hosts rather than relying on increasingly tight limits.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Separate instances or one larger configuration?

Decision factor Separate instances One HAProxy instance
Failure boundary A process or configuration failure is limited to one service more often. A process-level failure affects all front ends in that process.
Reload boundary Reload only the changed unit. A reload applies to the shared process and configuration.
Listener allocation Each instance needs its own address-port set. One process owns the listeners and routes internally.
Certificates and maps Ownership and updates are isolated, but files must be organized carefully. Shared files can be convenient, with stronger naming and change discipline required.
Operations Independent systemd units, logs, sockets, and alerts. Fewer units and less duplicated service plumbing.
Resource use Additional process, memory, socket, and file-descriptor overhead. Less duplicated overhead, but a larger shared configuration.
Observability Per-service metrics and troubleshooting boundaries are clear when paths are unique. One control plane is simpler, but labels and configuration sections must remain disciplined.

Choose separate units when independent ownership, reload schedules, or failure boundaries are more important than minimizing overhead. Choose one instance when the services can safely share a lifecycle and a single listener namespace.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.

Troubleshoot the common failure modes

“Address already in use”

Compare every bind address and port across the units, including wildcard and IPv6 bindings. Stop the conflicting service only if it is the one you intend to replace. Otherwise assign a different port, bind each instance to a different local IP, or introduce one front door.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The service starts and immediately exits

Run the instance’s exact validation command manually, then inspect journalctl -u for a missing certificate, map, state directory, permission error, malformed directive, or unavailable listener. Ensure the PID and socket parent directory is supplied by the matching RuntimeDirectory value.

Reload affects the wrong instance

Check the unit name, CONFIG, PIDFILE, and -S values. A shared PID file or master socket can direct a signal or CLI command to another service. Replace every copied path with the correct instance prefix before restarting.

The stats socket cannot be found

The stats socket is not enabled by default. Confirm that the configuration declares it, that the path matches the unit’s runtime directory, and that the service has restarted or reloaded after the declaration was added.

Runtime updates target the wrong certificate or map

Look for duplicate file names, relative paths, or a shared default-path. Give each instance unique prefixes and names, then issue the runtime command through that instance’s own master or stats socket.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

One service becomes unreliable under load

Check aggregate file-descriptor and connection limits, CPU, memory, and the overlap created by graceful reloads. Increasing a limit for one unit does not remove the host-wide resource demand created by all units.

Production checklist

  • Each unit has a distinct configuration, PID file, runtime directory, master socket, and optional stats socket.
  • Each persistent state, certificate, map, and log path is dedicated or has an unambiguous unique name.
  • Every address-port pair is unique across the host, or instances bind to different local IP addresses.
  • Both configurations pass haproxy -c -f before startup and reload.
  • Services use -Ws and a per-instance -S master CLI socket.
  • RuntimeDirectory= values match the paths used for PID and socket files.
  • Permissions allow the service and monitoring tools to access only their required files and sockets.
  • Reloads are issued to the changed unit and verified with that unit’s status and journal.
  • File-descriptor, connection, CPU, and memory capacity covers the combined workload and reload overlap.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.