HAProxy 3.4

Apply these rules when configuring HAProxy Community 3.4 for HTTP reverse proxying, TLS termination, and TCP or QUIC forwarding. Separately review application authorization, custom extensions, and management products such as the Data Plane API or Kubernetes ingress controllers.

1. Supported builds and process isolation

• Run the newest patch of a HAProxy line that still receives security fixes. Let a trusted package manager or line-following image tag select the patch, look up the current release, never loosen an existing constraint to make installation succeed, and audit images and dependencies in CI. Check the running proxy, TLS library, Lua runtime, and compiled features separately from application package audits.
• Obtain binaries and extensions through trusted, authenticated distribution channels and verify release signatures or package integrity. Restrict changes to the deployed binary and configuration; an update alone does not clean a compromised host.
• Use a dedicated user and group, minimal capabilities, and an empty, non-writable chroot or chroot auto where compatible. Check file, resolver, socket, and reload requirements without expanding the jail to expose unrelated secrets.
• Keep insecure-fork-wanted and unnecessary external execution disabled. Treat Lua scripts, native modules, external checks, and agents as privileged code with access to decrypted traffic; reducing available Lua libraries does not make untrusted scripts safe to run.
• Validate configuration with the deployed binary using haproxy -c -f before a controlled reload. Inspect