Managed Edge — HAProxy & Caddy
The edge of your network, professionally operated: HAProxy distributes traffic to your applications as a load balancer in multiple instances, a Caddy cluster terminates TLS and obtains certificates fully automatically. The ACME certificate store lives in a Redis backing — distributed, so every Caddy instance knows all certificates at all times and renewals never collide.
Everything at the edge is redundant: multiple HAProxy instances behind CARP IPs, multiple Caddy nodes, a shared certificate store. An instance failure is a non-event, a certificate expiry practically impossible. Layers 01–03 are included — firewall and cluster below come from one hand.
Load balancing
HAProxy with health checks, sticky sessions and connection limits — traffic only lands on healthy backends.
Automatic TLS
Caddy obtains and renews certificates on its own — for any number of domains, including wildcards via DNS challenge.
Distributed ACME storage
Certificates live in Redis instead of on a single disk — every edge instance can serve every domain immediately.
What this layer contains.
Every layer contains all outer layers — here you see where layer 04 sits in the cosmos.
Advice that comes from the engine room.
The edge decides whether deployments feel dangerous or boring. We bring the patterns that make releases invisible: blue-green, canary, zero-downtime — proven in front of platforms with real traffic.
Zero-downtime deployments
Draining, health-check choreography, rollbacks at the balancer — we build the process that makes midday releases boring.
Blue-green & canary
Two environments, weighted traffic, automatic return on error rates — templates for HAProxy configurations included.
TLS & domain strategy
Wildcard or individual, DNS challenges, HSTS, TLS versions: we define a certificate strategy that scales and passes audits.
Calculate layer 04 now.
04 Managed Edge — HAProxy & Caddy
All resources are dedicated — no overcommit.
