easyhaproxy 6.1.1__tar.gz → 6.2.0__tar.gz

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/.github/workflows/build.yml

@@ -31,6 +31,9 @@ jobs:
     permissions:
       contents: read
       packages: write
+    env:
+      # Secrets are empty on pull requests from forks and from Dependabot.
+      HAS_REGISTRY_LOGIN: ${{ secrets.DOCKER_REGISTRY_TOKEN != '' }}
 
     steps:
       - name: Checkout repository
@@ -44,6 +47,16 @@ jobs:
           export PATH="$HOME/.local/bin:$PATH"
           uv sync --group dev
 
+      # The tests pull byjg/static-httpserver. An anonymous pull counts against
+      # the runner's shared IP address and fails with "toomanyrequests".
+      - name: Log into registry
+        if: env.HAS_REGISTRY_LOGIN == 'true'
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ secrets.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKER_REGISTRY_USER }}
+          password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+
       - name: Run tests
         run: |
           export PATH="$HOME/.local/bin:$PATH"

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: easyhaproxy
-Version: 6.1.1
+Version: 6.2.0
 Summary: HAProxy label based routing with service discovery for Docker, Swarm, and Kubernetes
 License: MIT License
         
@@ -54,9 +54,10 @@ tags: [docker, devops]
 
 [![Sponsor](https://img.shields.io/badge/Sponsor-%23ea4aaa?logo=githubsponsors&logoColor=white&labelColor=0d1117)](https://github.com/sponsors/byjg)
 [![Opensource ByJG](https://img.shields.io/badge/opensource-byjg-success.svg)](http://opensource.byjg.com)
+[![Install MCP Server](https://img.shields.io/badge/Install-MCP_Server-8A2BE2?logo=modelcontextprotocol&logoColor=white)](https://opensource.byjg.com/docs/ai/mcpserver-byjg-docs/)
 [![Build Status](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml)
 [![GitHub source](https://img.shields.io/badge/Github-source-informational?logo=github)](https://github.com/byjg/docker-easy-haproxy/)
-[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/opensource/licensing.html)
+[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/license/)
 [![GitHub release](https://img.shields.io/github/release/byjg/docker-easy-haproxy.svg)](https://github.com/byjg/docker-easy-haproxy/releases/)
 [![Helm Version](https://img.shields.io/badge/dynamic/yaml?color=blue&label=Helm&query=%24.entries.easyhaproxy%5B0%5D.version&url=http%3A%2F%2Fopensource.byjg.com%2Fhelm%2Findex.yaml)](https://opensource.byjg.com/helm)
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/byjg)](https://artifacthub.io/packages/search?repo=byjg)

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/README.md

@@ -7,9 +7,10 @@ tags: [docker, devops]
 
 [![Sponsor](https://img.shields.io/badge/Sponsor-%23ea4aaa?logo=githubsponsors&logoColor=white&labelColor=0d1117)](https://github.com/sponsors/byjg)
 [![Opensource ByJG](https://img.shields.io/badge/opensource-byjg-success.svg)](http://opensource.byjg.com)
+[![Install MCP Server](https://img.shields.io/badge/Install-MCP_Server-8A2BE2?logo=modelcontextprotocol&logoColor=white)](https://opensource.byjg.com/docs/ai/mcpserver-byjg-docs/)
 [![Build Status](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml)
 [![GitHub source](https://img.shields.io/badge/Github-source-informational?logo=github)](https://github.com/byjg/docker-easy-haproxy/)
-[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/opensource/licensing.html)
+[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/license/)
 [![GitHub release](https://img.shields.io/github/release/byjg/docker-easy-haproxy.svg)](https://github.com/byjg/docker-easy-haproxy/releases/)
 [![Helm Version](https://img.shields.io/badge/dynamic/yaml?color=blue&label=Helm&query=%24.entries.easyhaproxy%5B0%5D.version&url=http%3A%2F%2Fopensource.byjg.com%2Fhelm%2Findex.yaml)](https://opensource.byjg.com/helm)
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/byjg)](https://artifacthub.io/packages/search?repo=byjg)

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/RELEASE.md

@@ -54,7 +54,7 @@ EasyHAProxy follows [Semantic Versioning](https://semver.org/):
   - **MINOR**: New features, plugin additions, backward-compatible changes
   - **PATCH**: Bug fixes, documentation updates, minor improvements
 
-**Current Version:** `6.1.1` (as of Chart.yaml)
+**Current Version:** `6.2.0` (as of Chart.yaml)
 
 ## Automated Release (Recommended)
 
@@ -329,6 +329,7 @@ helm show chart byjg/easyhaproxy
 
 | Version | Release Date | Type  | Highlights                                                                                                                            |
 |---------|--------------|-------|---------------------------------------------------------------------------------------------------------------------------------------|
+| 6.2.0   | 2026-10-21   | Minor | Ingress status follows a cloud LoadBalancer address, EASYHAPROXY_SERVICE_NAME, Helm chart LoadBalancer Service and certbot persistence |
 | 6.1.1   | 2026-06-25   | Patch | Add pass_headers support to FastCGI plugin, fix flaky ACME e2e test timeout |
 | 6.1.0   | 2026-06-24   | Minor | FastCGI protocol support, certbot sidecar plugin, dependency updates |
 | 6.0.1   | 2026-02-23   | Patch | HAProxy dashboard, real-time monitoring dashboard with live traffic charts, ACME e2e test fixes |

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/deploy/docker/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   easyhaproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.2.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - certs_certbot:/etc/easyhaproxy/certs/certbot

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/deploy/kubernetes/easyhaproxy-clusterip.yml

@@ -6,10 +6,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: easyhaproxy/templates/clusterrole.yaml
@@ -19,10 +19,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
@@ -83,10 +83,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -105,10 +105,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
     {}
@@ -140,10 +140,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -164,7 +164,7 @@ spec:
         - name: easyhaproxy
           securityContext:
             {}
-          image: "byjg/easy-haproxy:6.1.1"
+          image: "byjg/easy-haproxy:6.2.0"
           imagePullPolicy: Always
           ports:
             - name: http
@@ -217,10 +217,10 @@ kind: IngressClass
 metadata:
   name: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   controller: byjg.com/easyhaproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/deploy/kubernetes/easyhaproxy-daemonset.yml

@@ -6,10 +6,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: easyhaproxy/templates/clusterrole.yaml
@@ -19,10 +19,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
@@ -83,10 +83,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -104,10 +104,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   selector:
@@ -136,7 +136,7 @@ spec:
         - name: easyhaproxy
           securityContext:
             {}
-          image: "byjg/easy-haproxy:6.1.1"
+          image: "byjg/easy-haproxy:6.2.0"
           imagePullPolicy: Always
           ports:
             - name: http
@@ -189,10 +189,10 @@ kind: IngressClass
 metadata:
   name: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   controller: byjg.com/easyhaproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/deploy/kubernetes/easyhaproxy-nodeport.yml

@@ -6,10 +6,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: easyhaproxy/templates/clusterrole.yaml
@@ -19,10 +19,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
@@ -83,10 +83,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -105,10 +105,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
     {}
@@ -140,10 +140,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -164,7 +164,7 @@ spec:
         - name: easyhaproxy
           securityContext:
             {}
-          image: "byjg/easy-haproxy:6.1.1"
+          image: "byjg/easy-haproxy:6.2.0"
           imagePullPolicy: Always
           ports:
             - name: http
@@ -217,10 +217,10 @@ kind: IngressClass
 metadata:
   name: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.5
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.2.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   controller: byjg.com/easyhaproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/getting-started/kubernetes.md

@@ -41,7 +41,7 @@ Exposes HAProxy on NodePort `31080` (HTTP), `31443` (HTTPS), and `31936` (stats)
 
 ```bash
 kubectl apply -f \
-    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-nodeport.yml
+    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.2.0/deploy/kubernetes/easyhaproxy-nodeport.yml
 ```
 
 ### ClusterIP (behind a LoadBalancer)
@@ -50,7 +50,7 @@ Cluster-internal only. Pair with an external cloud LoadBalancer or `kubectl port
 
 ```bash
 kubectl apply -f \
-    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-clusterip.yml
+    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.2.0/deploy/kubernetes/easyhaproxy-clusterip.yml
 ```
 
 ### DaemonSet (special cases — requires node label)
@@ -64,7 +64,7 @@ The node label must be reapplied after any node replacement. Failing to do so wi
 kubectl label nodes node-01 "easyhaproxy/node=master"
 
 kubectl apply -f \
-    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-daemonset.yml
+    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.2.0/deploy/kubernetes/easyhaproxy-daemonset.yml
 ```
 
 If you need to configure environment variables (log levels, stats password, etc.), see the [environment variable reference](../reference/environment-variables.md).

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/getting-started/swarm.md

@@ -28,7 +28,7 @@ docker network create -d overlay --attachable easyhaproxy
 ```yaml
 services:
   haproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.2.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     deploy:

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/guides/acme.md

@@ -157,7 +157,7 @@ Here's a complete `docker-compose.yml` showing proper ACME configuration:
 ```yaml
 services:
   easyhaproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.2.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # REQUIRED: Persist Certbot certificates (ACME)

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/guides/helm.md

@@ -42,6 +42,28 @@ helm upgrade --install ingress byjg/easyhaproxy \
     --set service.type=ClusterIP
 ```
 
+```bash title="LoadBalancer (cloud providers)"
+helm upgrade --install ingress byjg/easyhaproxy \
+    --namespace easyhaproxy \
+    --set service.create=true \
+    --set service.type=LoadBalancer
+```
+
+On a cloud provider (DigitalOcean, AWS, GCP, Azure…), `LoadBalancer` asks the provider for an external load balancer in front of EasyHAProxy, and its address is written to your Ingress status. Use `service.annotations` for provider-specific load balancer settings.
+
+### 3) Persist ACME certificates
+
+If you use automatic certificates (`easyhaproxy.certbot` annotation), set the ACME e-mail and keep the issued certificates on a volume:
+
+```bash title="ACME with persisted certificates"
+helm upgrade --install ingress byjg/easyhaproxy \
+    --namespace easyhaproxy \
+    --set service.create=true \
+    --set service.type=LoadBalancer \
+    --set easyhaproxy.certbot.email=you@example.com \
+    --set persistence.certbot.enabled=true
+```
+
 See [Deployment Modes](../getting-started/kubernetes.md#deployment-modes) for a comparison of all three modes.
 
 For the complete list of configurable values, see the [Helm Values reference](../reference/helm.md).

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/guides/plugins.md

@@ -230,6 +230,8 @@ labels:
   easyhaproxy.http.plugins: cloudflare
 ```
 
+Using a Cloudflare Tunnel? See [Cloudflare Tunnel](../reference/plugins/cloudflare.md#cloudflare-tunnel).
+
 ### Multiple Plugins Together
 
 ```yaml

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/guides/ssl.md

@@ -83,7 +83,7 @@ docker cp single.pem easyhaproxy:/etc/easyhaproxy/certs/haproxy/example.com.pem
 ```yaml
 services:
   easyhaproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.2.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - certs_haproxy:/etc/easyhaproxy/certs/haproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/reference/cli.md

@@ -76,6 +76,7 @@ See the [plugins guide](../guides/plugins.md) for available plugins.
 | Flag                                       | Environment Variable                 | Default  | Description                                  |
 |--------------------------------------------|--------------------------------------|----------|----------------------------------------------|
 | `--update-ingress-status BOOL`             | `EASYHAPROXY_UPDATE_INGRESS_STATUS`  | `true`   | Update Ingress status with load-balancer IP  |
-| `--deployment-mode MODE`                   | `EASYHAPROXY_DEPLOYMENT_MODE`        | `auto`   | Deployment mode: `auto`, `single`, `cluster` |
+| `--deployment-mode MODE`                   | `EASYHAPROXY_DEPLOYMENT_MODE`        | `auto`   | Deployment mode: `auto`, `daemonset`, `nodeport`, `clusterip` |
 | `--external-hostname HOSTNAME`             | `EASYHAPROXY_EXTERNAL_HOSTNAME`      | *(none)* | External hostname reported in Ingress status |
+| `--service-name NAME`                      | `EASYHAPROXY_SERVICE_NAME`           | *(none)* | Name of the EasyHAProxy Service (set by the Helm chart) |
 | `--ingress-status-update-interval SECONDS` | `EASYHAPROXY_STATUS_UPDATE_INTERVAL` | `30`     | Interval to update Ingress status            |

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/reference/environment-variables.md

@@ -42,6 +42,7 @@ These variables apply only when `EASYHAPROXY_DISCOVER=kubernetes`. They control
 | EASYHAPROXY_UPDATE_INGRESS_STATUS  | Update Ingress resources with the load-balancer IP. Set to `false` to disable.                                                                              | `true`   |
 | EASYHAPROXY_DEPLOYMENT_MODE        | How to detect and report Ingress IPs: `auto`, `daemonset`, `nodeport`, or `clusterip`. `auto` inspects pod owner references and service type automatically. | `auto`   |
 | EASYHAPROXY_EXTERNAL_HOSTNAME      | Hostname to report in Ingress status when using ClusterIP mode without a cloud LoadBalancer.                                                                | *(none)* |
+| EASYHAPROXY_SERVICE_NAME           | Name of the EasyHAProxy Service, in the pod's namespace. The Helm chart sets it. When empty, `easyhaproxy` and `ingress-easyhaproxy` are tried. | *(none)* |
 | EASYHAPROXY_STATUS_UPDATE_INTERVAL | Seconds between Ingress status update cycles.                                                                                                               | `30`     |
 
 :::tip Deployment mode auto-detection

{easyhaproxy-6.1.1 → easyhaproxy-6.2.0}/docs/reference/helm.md

@@ -25,8 +25,8 @@ Controls whether EasyHAProxy runs as a **Deployment** (with a Service) or a **Da
 | Value                 | Description                                                                                 | Default     |
 |-----------------------|---------------------------------------------------------------------------------------------|-------------|
 | `replicaCount`        | Number of replicas (only used when `service.create: true`)                                  | `1`         |
-| `service.create`      | `true` → Deployment + Service (NodePort or ClusterIP). `false` → DaemonSet with host ports. | `false`     |
-| `service.type`        | Service type when `service.create: true`: `NodePort` or `ClusterIP`                         | `ClusterIP` |
+| `service.create`      | `true` → Deployment + Service (NodePort, ClusterIP or LoadBalancer). `false` → DaemonSet with host ports. | `false`     |
+| `service.type`        | Service type when `service.create: true`: `NodePort`, `ClusterIP` or `LoadBalancer`                       | `ClusterIP` |
 | `service.annotations` | Annotations to add to the Service resource                                                  | `{}`        |
 
 :::tip Recommended mode
@@ -58,6 +58,24 @@ Set `service.create: true` and `service.type: NodePort` for most setups. DaemonS
 | `easyhaproxy.logLevel.haproxy`     | Log level for HAProxy                               | `DEBUG`    |
 | `easyhaproxy.certbot.email`        | Email address for Let's Encrypt / ACME registration | `""`       |
 
+## Certificate Persistence
+
+Keeps the ACME/Certbot certificates (`/etc/easyhaproxy/certs/certbot`) on a PersistentVolumeClaim, so a pod restart does not request them again and run into the CA rate limits. Recommended whenever `easyhaproxy.certbot.email` is set.
+
+| Value                                  | Description                                          | Default         |
+|----------------------------------------|------------------------------------------------------|-----------------|
+| `persistence.certbot.enabled`          | Mount a PVC at `/etc/easyhaproxy/certs/certbot`      | `false`         |
+| `persistence.certbot.existingClaim`    | Use this existing PVC instead of creating one        | `""`            |
+| `persistence.certbot.storageClass`     | Storage class of the created PVC. Empty = default.   | `""`            |
+| `persistence.certbot.accessMode`       | Access mode of the created PVC                       | `ReadWriteOnce` |
+| `persistence.certbot.size`             | Size of the created PVC                              | `1Gi`           |
+
+:::note
+With `service.create: true` and persistence enabled, the Deployment uses the `Recreate` strategy: a `ReadWriteOnce` volume cannot attach to the new pod while the old one still holds it. Expect a short gap during upgrades.
+
+The created PVC has `helm.sh/resource-policy: keep`, so `helm uninstall` leaves the certificates in place. Delete the PVC by hand to remove them.
+:::
+
 ## Ingress Status
 
 Controls how EasyHAProxy updates Kubernetes Ingress resources with load-balancer IPs.
@@ -94,7 +112,7 @@ kubectl label nodes node-01 "easyhaproxy/node=master"
 | `resources`          | CPU/memory requests and limits for the pod | `{}`    |
 | `nodeSelector`       | Node selector for pod scheduling           | `{}`    |
 | `tolerations`        | Tolerations for pod scheduling             | `[]`    |
-| `affinity`           | Affinity rules for pod scheduling          | `{}`    |
+| `affinity`           | Affinity rules for pod scheduling. In DaemonSet mode `nodeAffinity` comes from `masterNode`; other keys (e.g. `podAntiAffinity`) are kept. | `{}`    |
 | `podSecurityContext` | Pod-level security context                 | `{}`    |
 | `securityContext`    | Container-level security context           | `{}`    |