Web interface (user-friendly web GUI, alerting, monitoring, and secure) for managing HAProxy, Nginx, and Keepalived servers. Leave your feedback

Get involved

• Telegram Channel about Roxy-WI, talks and questions are welcome

Demo site

Demo site Login/password: admin/admin. Server resets every hour.

Features:

1. Installing and updating HAProxy, Nginx, Apache and Keepalived with Roxy-WI as a system service
2. Installing and updating HAProxy and Nginx with Roxy-WI as a Docker service
3. Installing and updating HAProxy, Nginx, Apache, Keepalived, and Node exporters with Roxy-WI
4. Downloading, updating, and formatting GeoIP to the acceptable format for HAProxy, and NGINX with Roxy-WI
5. Dynamic change of Maxconn, Black/white lists, add, edit, or delete backend's IP address and port with saving changes to the config file
6. Configuring HAProxy, Nginx, Apache and Keepalived in a jiffy with Roxy-WI
7. Viewing and analyzing the status of all Frontend/backend servers via Roxy-WI from a single control panel
8. Enabling/disabling servers through stats page without rebooting HAProxy
9. Viewing/Analyzing HAProxy, Nginx, Apache and Keepalived logs right from the Roxy-WI web interface
10. Creating and visualizing the HAProxy workflow from Web Ui
11. Pushing Your changes to your HAProxy, Nginx, Apache, and Keepalived servers with a single click via the web interface
12. Getting info on past changes, evaluating your config files, and restoring the previous stable config at any time with a single click right from the Web interface
13. Adding/Editing Frontend or backend servers via the web interface with a click
14. Editing the config of HAProxy, Nginx, Apache, and Keepalived and push interchanges to All Master/Slave servers by a single click
15. Adding Multiple servers to ensure the Config Sync between servers
16. Managing the ports assigned to Frontend automatically
17. Evaluating the changes of recent configs pushed to HAProxy, Nginx, Apache, and Keepalived instances right from the Web UI
18. Multiple User Roles support for privileged-based Viewing and editing of Config
19. Creating Groups and adding/removing servers to ensure the proper identification for your HAProxy, Nginx, and Apache Clusters
20. Sending notifications from Roxy-WI via Telegram, Slack, Email, PageDuty, Mattermost, and via the web interface
21. Supporting high Availability to ensure uptime to all Master slave servers configured
22. Support of SSL (including Let's Encrypt)
23. Support of SSH Key for managing multiple HAProxy, Nginx, Apache, and Keepalived Servers straight from Roxy-WI
24. SYN flood protect
25. Alerting about changes of the state of HAProxy backends, about approaching the limit of Maxconn
26. Alerting about the state of HAProxy, Nginx, Apache, and Keepalived service
27. Gathering metrics for incoming connections
28. Web acceleration settings
29. Firewall for web application (WAF)
30. LDAP support
31. Keep active HAProxy, Nginx, Apache, and Keepalived services
32. Possibility to hide parts of the config with tags for users with the "guest" role: "HideBlockStart" and "HideBlockEnd"
33. Mobile-ready design
34. SMON (Check: Ping, TCP/UDP, HTTP(s), SSL expiry, HTTP body answer, DNS records, Status pages)
35. Backup HAProxy, Nginx, Apache, and Keepalived config files through Roxy-WI

Install

RPM

Read instruction on the official site

DEB

Read instruction on the official site

OS support

Roxy-WI supports the following OSes:

1. EL7(RPM installation and manual installation). It must be "Infrastructure Server" at least. x86_64 only
2. EL8(RPM installation and manual installation). It must be "Infrastructure Server" at least. x86_64 only
3. EL9(RPM installation and manual installation). It must be "Infrastructure Server" at least. x86_64 only
4. Amazon Linux 2(RPM installation and manual installation). x86_64 only
5. Ubuntu (DEB installation and manual installation). x86_64 only
6. Other Linux distributions (manual installation only). x86_64 only

Database support

Default Roxy-WI use Sqlite, if you want use MySQL enable in config, and create database:

For MySQL support:

Read instruction on the official site

Settings

Login at https://roxy-wi-server/admin, then add users, groups, and servers. Set the initial admin password with ROXYWI_BOOTSTRAP_ADMIN_PASSWORD (at least 12 characters). If it is not set, Roxy-WI creates /var/lib/roxy-wi/bootstrap-admin-password with mode 0600 on first start.

Fresh installations generate random HAProxy, NGINX, Apache statistics passwords. Set ROXYWI_RABBITMQ_PASSWORD (at least 12 characters) before the first start when RabbitMQ is configured separately; otherwise a random value is stored in the admin settings. Existing installations that still use the old password or roxy-wi123 defaults must replace them in both Roxy-WI settings and the corresponding service.

Store a unique Fernet key as [main] secret_phrase in /etc/roxy-wi/roxy-wi.cfg. ROXYWI_SECRET_PHRASE is an optional override and, when non-empty, takes precedence over the config file. Existing installations must keep their current unique key; no credential rotation is required during a normal code upgrade. Rotate only when deliberately replacing a key: set the previous key as ROXYWI_OLD_SECRET_PHRASE, the replacement as ROXYWI_SECRET_PHRASE, and run python3 rotate_credential_secret.py once before restarting the application. Install the TLS certificate and private key as /etc/roxy-wi/certs/roxy-wi.crt and /etc/roxy-wi/certs/roxy-wi.key; the private key must not be stored below the web application root. SSH connections automatically accept previously unknown host keys; a changed key that conflicts with a known key is still rejected.

Scheduler

The scheduler HTTP API is permanently disabled. Web workers do not start background jobs by default, which prevents the same job from running once per worker. Run exactly one dedicated scheduler process under your service manager:

python3 scheduler_runner.py

scheduler_runner.py enables ROXYWI_SCHEDULER_ENABLED=1 for that process. Do not set this variable globally for the web service.

OpenID Connect

Super administrators can configure one or more OIDC providers under Admin → OIDC. Roxy-WI supports discovery metadata, signed ID token validation through JWKS, optional UserInfo claims, verified-email/domain policies, automatic user creation or email linking, and external-group mappings to Roxy-WI groups and roles. Local and LDAP login remain available.

When Roxy-WI is behind a reverse proxy, set ROXYWI_PUBLIC_URL to its canonical external origin, without a trailing slash, for example https://roxy-wi.example.com. Register the callback URL shown in the provider form at the identity provider. The usual scopes are openid email profile; add the provider-specific groups scope when group mapping is used.

OIDC client secrets are encrypted with the existing [main] secret_phrase Fernet key. Keep the same key during a normal upgrade; no new key or credential rotation is required.

Read instruction on the official site

Troubleshooting

If you have error:

Internal Server Error

Do this:

$ cd /var/www/haproxy-wi/app
$ ./create_db.py

Read more