Hello @something, first of all welcome to balena community. And you have a funny nickname : )
HAproxy is used as a load balancer for the system, and it opens port 80, 443 and 3128. 80 is used for HTTP access to the API, registry, S3 and VPN services that listen on it. 443 is used for HTTPS access to all of these services.
HAproxy config is located here: https://github.com/balena-io/open-balena/blob/master/src/haproxy/haproxy.cfg
My teammates maintaining openBalena notes that 443 is absolutely core and fundamental to the operation of openBalena, and 3128 is for the HTTP CONNECT proxy built into the VPN and is used for things like the balena-cli tunnel command. You could drop 80 but be aware that the API is coded to reject non-HTTPS traffic.
Hope these help and we are happy to answer any follow-up question.