# HAProxy for MultTenant application

**URL:** <https://discourse.haproxy.org/t/haproxy-for-multtenant-application/1646>\
**Category:** Help!\
**Created:** [October 7, 2017, 1:41pm UTC](https://discourse.haproxy.org/t/haproxy-for-multtenant-application/1646 "2017-10-07T13:41:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hpasbor](https://avatars.discourse-cdn.com/v4/letter/h/a9adbd/32.png) [@hpasbor](https://discourse.haproxy.org/u/hpasbor)\
**Post date:** [October 7, 2017, 1:41pm UTC](https://discourse.haproxy.org/t/haproxy-for-multtenant-application/1646/1 "2017-10-07T13:41:17Z")

</div>

In a MultiTenanat application I would like to have the possibility to configure HAProxy at run time adding (and removing) HTTPS Frontend ports (one per Tenant) with different IPAddrress and URL/Domain .  
Each front end port will communicate with two backend ports with two Httpd/Apache internal instances (for load balancing) shared among all Tenants.  
I should give (dynamically adn automatically from an internal PKI system) a different X.509 certificate to each front end port, so each front end port will use its own certificate for HTTPS. Of course, in order to manage dynamic creation/deletion of Tenants, I need to reconfigure HAProxy (creating new port and providing new certificates for each ) in hitless way.  
What do you think about this configuration.? Do you see it as feasible? Any impediment or limitation? Problems to manage tens of Tenants (frontend) ?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 9, 2017, 5:32pm UTC](https://discourse.haproxy.org/t/haproxy-for-multtenant-application/1646/2 "2017-10-09T17:32:22Z")

</div>

Should work.

You can gracefully reload haproxy, that works pretty well and in haproxy 1.8 there will even be real hitless reloading:

> **[Truly Seamless Reloads with HAProxy - No More Hacks! - HAProxy Technologies](https://www.haproxy.com/blog/truly-seamless-reloads-with-haproxy-no-more-hacks/)**
>
> HAProxy Technologies' R&D has released a patchset to enable seamless reloads of HAProxy without dropping packets in the process.

---

<div class="post-metadata">

**Author:** ![hpasbor](https://avatars.discourse-cdn.com/v4/letter/h/a9adbd/32.png) [@hpasbor](https://discourse.haproxy.org/u/hpasbor)\
**Post date:** [October 16, 2017, 7:04am UTC](https://discourse.haproxy.org/t/haproxy-for-multtenant-application/1646/3 "2017-10-16T07:04:24Z")

</div>

Thanks a lot.  
Do you think that te patched HAproxy will be able to manage properly (hitless) the creation of new frontendTLS connections using an automatically issued and distributed (by a service in the application )certificate? and the automatic renewal of a certificate for an existing TLS connection (Frontend and backend)?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 16, 2017, 9:05am UTC](https://discourse.haproxy.org/t/haproxy-for-multtenant-application/1646/4 "2017-10-16T09:05:05Z")

</div>

Well the configuration can change completely between reloads and yes, the reload in 1.8 can be completely hitless, still the reload in 1.7 and earlier is mostly hitless as well, expect for some race conditions in the linux kernel (meaning some failed connetions while reloading - if the site is very busy).

I’m not sure what you mean by “the creation of new frontendTLS connections using an automatically issued and distributed (by a service in the application )certificate”. If your application or provisioning stack updates the haproxy configuration file and then reloads haproxy, then I would say it is possible.