Install HAProxy (Hardened)

Prerequisites

• An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
• An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
• Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
• No internet access or external dependency is required at deploy time — the image is self-contained.

AWS

1. Subscribe and launch; open 80/443 in the security group for your frontends.
   Expected result haproxy -v prints the version and `systemctl is-active haproxy` says active (the AWS image has no stats frontend until you add one).

Google Cloud

1. Deploy from the listing; the package opens 80/443 to the network tag (LB posture) and keeps SSH IAP-only.
   Expected result gcloud compute start-iap-tunnel <vm> 8404 → http://localhost:8404/stats renders.
2. Declare a frontend/backend pair in haproxy.cfg, validate (`haproxy -c -f`), then `systemctl reload haproxy`.
   Expected result Traffic to the VM's 80 reaches your backend; stats page shows the backend UP.

Validate

GCE: curl -fsS http://127.0.0.1:8404/stats (on the instance). AWS: haproxy -c -f /etc/haproxy/haproxy.cfg && systemctl is-active haproxy

First boot: GCE: service enabled with a stats frontend appended on 127.0.0.1:8404. AWS: service enabled with the distro default haproxy.cfg (syntax-checked at build; no stats frontend). On both, adding your frontends/backends to haproxy.cfg IS the deployment step. No credential is generated.

First login / credentials

1. SSH in with the key pair you chose at launch (AWS: ssh ec2-user@<public-ip>; GCP: gcloud compute ssh <vm> --tunnel-through-iap).
2. There is no application credential. Declare a frontend/backend pair in /etc/haproxy/haproxy.cfg, validate with `haproxy -c -f /etc/haproxy/haproxy.cfg`, then `sudo systemctl reload haproxy`.
3. GCE only: the stats page is at http://127.0.0.1:8404/stats through an IAP tunnel. AWS: add `frontend stats / bind 127.0.0.1:8404 / stats enable / stats uri /stats` yourself if you want one.

Secure it

• Restrict SSH (22) to your own IP range in the cloud firewall/security group.
• Open application ports only per the ports table — closed-by-default is deliberate.
• Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.

Costs & quotas

Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed by your cloud at its standard rates. The recommended size fits default service quotas in most accounts — if you scale out, review your cloud's quota console before launch.

Next: configuration · troubleshooting · security notes