Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	3.4.0	$0.03/hr Recommended instance: t3.small · 5-day free trial	2026-09-03	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	3.4.0	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-06-25	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	GPL-2.0
Upstream	HAProxy (Willy Tarreau / HAProxy community)
Machine-readable	product.json · catalog.json

What is HAProxy

HAProxy is the world's most widely deployed open-source software load balancer and reverse proxy - a single, high-performance C binary trusted for its reliability at scale. It balances TCP and HTTP/HTTPS traffic across pools of backend servers with active and passive health checks, multiple balancing algorithms (round-robin, leastconn, source, URI hash), sticky sessions, connection queuing, rate limiting, ACL-based routing, and request and response header rewriting. This image builds HAProxy 3.4 LTS from the official release source linked against the system OpenSSL 3 library, so it terminates TLS itself with no separate web server, and exposes a built-in real-time statistics and administration dashboard. A Lua scripting engine, PCRE2 regular expressions, and zlib compression are compiled in. GPL-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Per-instance self-signed TLS certificate generated at first boot - HTTPS works immediately on port 443; drop in your own PEM or a Let's Encrypt certificate any time
Statistics and administration dashboard bound to 127.0.0.1 only, protected by a strong password generated at first boot - reach it over an SSH tunnel, never exposed to the network
Healthy default configuration - the instance boots and answers on ports 80 and 443 with no backend configured; you edit one section to route to your own servers
UFW firewall - SSH on 22, proxied traffic on 80 and 443 only
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/haproxy-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-qw5gqtqwtbq4m/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer haproxy --plan payg-gen2
az vm create -g my-rg -n haproxy --size Standard_D2s_v3 \
  --image lynxroute:haproxy:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

HAProxy v-3.4.0

AWS · 2026-09-03Azure · 2026-06-25

Re-release of HAProxy 3.4.0. The application version is unchanged; this build refreshes the underlying operating system image
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build