proxyglassGitHub Get started
Configuration

One file.
Your HAProxy fleet.

Proxyglass reads YAML configuration at startup. On a native install the default path is /etc/proxyglass/config.yml; use PROXYGLASS_CONFIG or --config to select another file.

OIDC and nginx →Deployment →

Full configuration example

Replace the example hostnames and credentials. Keep the file readable only by the Proxyglass service account and administrators; target passwords and the OIDC client secret are stored here.

server:
  listen: "127.0.0.1:8080"
  default_refresh: 5        # seconds; 0 disables automatic refresh

require_auth: true
tokens_file: "/etc/proxyglass/tokens.json"
token_ttl_days: 0           # 0 means tokens do not expire
log_path: "/var/log/proxyglass/proxyglass.log"

oidc:
  enabled: true
  issuer: "https://sso.example.net/realms/operations"
  client_id: "proxyglass"
  client_secret: "REPLACE_WITH_SECRET"
  session_ttl_hours: 8
  redirect_uri: "https://proxyglass.example.net/ui/oidc/callback"
  # Optional; the IdP must include a string-array "groups" claim.
  allowed_groups:
    - "network-operations"

targets:
  - name: edge-01
    url: "https://edge-01.example.net:8404/stats;csv"
    username: "proxyglass-reader"
    password: "REPLACE_WITH_STATS_PASSWORD"
    verify_tls: true
  - name: edge-02
    url: "https://edge-02.example.net:8404/stats;csv"
    username: "proxyglass-reader"
    password: "REPLACE_WITH_STATS_PASSWORD"
    verify_tls: true
Read-only requirement: enable HAProxy’s stats page with a dedicated account and expose the CSV endpoint (typically /stats;csv). Proxyglass only issues HTTP GET requests; it never sends HAProxy control commands.

Refresh and saved views

server.default_refresh sets the first dashboard refresh interval in seconds. The default is 5; set it to 0 to start with refresh disabled. Users can choose Off, 2, 5, 10 or 30 seconds in the dashboard.

Proxy selections, frontend/backend/server filters, sort order and refresh preference are saved in a browser cookie. The cookie is local to that browser and does not change HAProxy or the server config.

HAProxy targets

  • Give each proxy a unique, human-readable name.
  • Set url to the HAProxy stats CSV endpoint, including ;csv.
  • Set username and password when stats Basic Auth is enabled.
  • verify_tls defaults to true. Disable certificate verification only for a deliberate self-signed certificate setup.

For outbound network proxies, configure HTTP_PROXY, HTTPS_PROXY and NO_PROXY in the service environment. Use NO_PROXY for private HAProxy endpoints that should be reached directly.

Authentication

Keep require_auth: true for shared or production dashboards. Proxyglass supports locally generated bearer tokens and optional OIDC login. OIDC configuration is in the same file; see OIDC behind nginx.

sudo proxyglass --generate-token --config /etc/proxyglass/config.yml
sudo proxyglass --generate-token --quiet --config /etc/proxyglass/config.yml
sudo proxyglass --revoke-token TOKEN --config /etc/proxyglass/config.yml

Use the first command to create a token, the quiet form for automation, and revoke a token by supplying its value. The generated token is shown once.