HAProxy Health Checks for a Squid Forward Proxy
Build an HAProxy health check that speaks to a forward proxy and distinguish listener reachability, CONNECT acceptance and origin retrieval.
A file named /check.txt on a proxy host sounds like an obvious health target. The catch is that Squid's explicit forward listener is not an ordinary website serving that host's document root.
An origin-style request such as HEAD /check.txt HTTP/1.1 leaves out the absolute target expected for an ordinary HTTP request through a forward proxy. Depending on configuration, it may be rejected or handled by a different local service. Either result can tell you less than the dashboard suggests.
Choose the service you need to keep available
| Probe | Useful evidence |
|---|---|
| TCP connection to the proxy listener | A reachable process accepts that connection. |
| CONNECT to a controlled target | The proxy accepts that tunnel request. |
| HTTP retrieval through the proxy | The selected request path can return an expected response. |
For the third case, the request needs a target, for example:
HEAD http://probe.example.internal/proxy-ready HTTP/1.1
Host: probe.example.internalThe hostname is illustrative. Use a controlled endpoint that the proxy can resolve and is intentionally permitted to reach. HAProxy's http-check send supports selecting the method, URI, version and headers; configure that request explicitly instead of inheriting an origin-server example unchanged.
HEAD can check a response status and headers. It cannot validate a response body that is never transferred. If the health contract requires a body marker, choose a suitable GET check and validate that marker.
Keep the check account and source restrictions narrow when proxy authentication is involved. Exempting the entire listener from authentication to obtain a green check changes the service being protected.
Finally, decide what a failed probe should remove. A controlled origin outage can make every proxy's forwarding check fail simultaneously. That may be exactly the dependency you want to measure, or it may be a reason to keep listener health and end-to-end availability as separate signals.