Health Checks
Health Checks
SNI Router uses HAProxy's built-in health checking to monitor backend availability. When a backend is unhealthy, HAProxy stops sending connections to it and automatically restores it once it recovers.
Default — TCP health check
By default, every backend receives a plain TCP connect check every 2 seconds:
check inter 2s fall 3 rise 2
- A backend is marked down after 3 consecutive failed TCP connects
- A backend is marked up again after 2 consecutive successful TCP connects
No configuration is required to enable this — it is always active.
HTTPS application-level health check
For deeper verification, you can configure HAProxy to send an HTTP GET request over TLS (without certificate verification) to a specific endpoint on the backend. The Host header is set to the route hostname.
For SNI_ROUTE_N
Use SNI_HEALTH_N where N matches the route index:
environment:
SNI_ROUTE_1: "app1.example.com:192.168.1.10:443"
SNI_HEALTH_1: "/health" # GET https://app1.example.com/health
SNI_ROUTE_2: "api.example.com:192.168.1.20:443"
SNI_HEALTH_2: "/api/status" # GET https://api.example.com/api/status
SNI_ROUTE_3: "db-proxy.example.com:192.168.1.30:443"
# SNI_HEALTH_3 not set → plain TCP check
SNI_DEFAULT: "192.168.1.10:443"
SNI_DEFAULT_HEALTH: "/health" # GET https://<SNI_DEFAULT>/health
For SNI_ROUTES (multiline)
Use SNI_HEALTH_<norm> where <norm> is the hostname with ., *, and - replaced by _:
environment:
SNI_ROUTES: |
app1.example.com:192.168.1.10:443
api.example.com:192.168.1.20:443
*.staging.example.com:192.168.1.30:443
SNI_HEALTH_app1_example_com: "/health" # for app1.example.com
SNI_HEALTH_api_example_com: "/api/health" # for api.example.com
# SNI_HEALTH__staging_example_com not set → TCP check for the wildcard backend
SNI_DEFAULT: "192.168.1.10:443"
For TCP_ROUTE_N
environment:
TCP_ROUTE_1: "5432:192.168.1.40:5432"
TCP_HEALTH_1: "/health" # HTTPS GET to the TCP backend (unusual but supported)
Health check variable reference
| Variable | Applies to | Description |
|---|---|---|
SNI_HEALTH_N | SNI_ROUTE_N | HTTPS GET path. HAProxy connects to backend_ip:backend_port over TLS with Host: <hostname>. |
SNI_HEALTH_<norm> | SNI_ROUTES entry | Same as above. <norm> = hostname with ., *, - → _. |
SNI_DEFAULT_HEALTH | SNI_DEFAULT | HTTPS GET path for the default backend. |
TCP_HEALTH_N | TCP_ROUTE_N | HTTPS GET path for a TCP route backend. |
When a *_HEALTH_* variable is not set, the backend retains the default TCP connect check.
HAProxy stats UI
The built-in HAProxy stats dashboard shows live backend health status, connection counts, and error rates.
environment:
STATS_ENABLED: "true"
STATS_PORT: "8404"
STATS_PASSWORD: "changeme"
# Bind to a local network interface only — never expose to the internet
ports:
- "192.168.1.5:8404:8404"
Access the dashboard at http://192.168.1.5:8404/stats (user: admin, password: value of STATS_PASSWORD).