easyhaproxy 6.1.1__tar.gz → 6.3.0__tar.gz

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/.github/workflows/build.yml

@@ -31,6 +31,9 @@ jobs:
     permissions:
       contents: read
       packages: write
+    env:
+      # Secrets are empty on pull requests from forks and from Dependabot.
+      HAS_REGISTRY_LOGIN: ${{ secrets.DOCKER_REGISTRY_TOKEN != '' }}
 
     steps:
       - name: Checkout repository
@@ -44,6 +47,16 @@ jobs:
           export PATH="$HOME/.local/bin:$PATH"
           uv sync --group dev
 
+      # The tests pull byjg/static-httpserver. An anonymous pull counts against
+      # the runner's shared IP address and fails with "toomanyrequests".
+      - name: Log into registry
+        if: env.HAS_REGISTRY_LOGIN == 'true'
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ secrets.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKER_REGISTRY_USER }}
+          password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+
       - name: Run tests
         run: |
           export PATH="$HOME/.local/bin:$PATH"

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: easyhaproxy
-Version: 6.1.1
+Version: 6.3.0
 Summary: HAProxy label based routing with service discovery for Docker, Swarm, and Kubernetes
 License: MIT License
         
@@ -54,9 +54,10 @@ tags: [docker, devops]
 
 [![Sponsor](https://img.shields.io/badge/Sponsor-%23ea4aaa?logo=githubsponsors&logoColor=white&labelColor=0d1117)](https://github.com/sponsors/byjg)
 [![Opensource ByJG](https://img.shields.io/badge/opensource-byjg-success.svg)](http://opensource.byjg.com)
+[![Install MCP Server](https://img.shields.io/badge/Install-MCP_Server-8A2BE2?logo=modelcontextprotocol&logoColor=white)](https://opensource.byjg.com/docs/ai/mcpserver-byjg-docs/)
 [![Build Status](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml)
 [![GitHub source](https://img.shields.io/badge/Github-source-informational?logo=github)](https://github.com/byjg/docker-easy-haproxy/)
-[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/opensource/licensing.html)
+[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/license/)
 [![GitHub release](https://img.shields.io/github/release/byjg/docker-easy-haproxy.svg)](https://github.com/byjg/docker-easy-haproxy/releases/)
 [![Helm Version](https://img.shields.io/badge/dynamic/yaml?color=blue&label=Helm&query=%24.entries.easyhaproxy%5B0%5D.version&url=http%3A%2F%2Fopensource.byjg.com%2Fhelm%2Findex.yaml)](https://opensource.byjg.com/helm)
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/byjg)](https://artifacthub.io/packages/search?repo=byjg)
@@ -112,7 +113,7 @@ EasyHAProxy is part of some projects:
 
 [![HAProxy Monitor](docs/dashboard_thumbnail.png)](docs/guides/dashboard.md)
 
-A real-time dashboard is available at `http://<host>:11936/` whenever `HAPROXY_PASSWORD` is set —
+A real-time dashboard is available at `http://<host>:11936/` (set `HAPROXY_PASSWORD` to require a login) —
 no extra containers, no Prometheus, no Grafana. See the [dashboard guide](docs/guides/dashboard.md).
 
 ## See EasyHAProxy in action

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/README.md

@@ -7,9 +7,10 @@ tags: [docker, devops]
 
 [![Sponsor](https://img.shields.io/badge/Sponsor-%23ea4aaa?logo=githubsponsors&logoColor=white&labelColor=0d1117)](https://github.com/sponsors/byjg)
 [![Opensource ByJG](https://img.shields.io/badge/opensource-byjg-success.svg)](http://opensource.byjg.com)
+[![Install MCP Server](https://img.shields.io/badge/Install-MCP_Server-8A2BE2?logo=modelcontextprotocol&logoColor=white)](https://opensource.byjg.com/docs/ai/mcpserver-byjg-docs/)
 [![Build Status](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/byjg/docker-easy-haproxy/actions/workflows/build.yml)
 [![GitHub source](https://img.shields.io/badge/Github-source-informational?logo=github)](https://github.com/byjg/docker-easy-haproxy/)
-[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/opensource/licensing.html)
+[![GitHub license](https://img.shields.io/github/license/byjg/docker-easy-haproxy.svg)](https://opensource.byjg.com/license/)
 [![GitHub release](https://img.shields.io/github/release/byjg/docker-easy-haproxy.svg)](https://github.com/byjg/docker-easy-haproxy/releases/)
 [![Helm Version](https://img.shields.io/badge/dynamic/yaml?color=blue&label=Helm&query=%24.entries.easyhaproxy%5B0%5D.version&url=http%3A%2F%2Fopensource.byjg.com%2Fhelm%2Findex.yaml)](https://opensource.byjg.com/helm)
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/byjg)](https://artifacthub.io/packages/search?repo=byjg)
@@ -65,7 +66,7 @@ EasyHAProxy is part of some projects:
 
 [![HAProxy Monitor](docs/dashboard_thumbnail.png)](docs/guides/dashboard.md)
 
-A real-time dashboard is available at `http://<host>:11936/` whenever `HAPROXY_PASSWORD` is set —
+A real-time dashboard is available at `http://<host>:11936/` (set `HAPROXY_PASSWORD` to require a login) —
 no extra containers, no Prometheus, no Grafana. See the [dashboard guide](docs/guides/dashboard.md).
 
 ## See EasyHAProxy in action

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/RELEASE.md

@@ -54,7 +54,7 @@ EasyHAProxy follows [Semantic Versioning](https://semver.org/):
   - **MINOR**: New features, plugin additions, backward-compatible changes
   - **PATCH**: Bug fixes, documentation updates, minor improvements
 
-**Current Version:** `6.1.1` (as of Chart.yaml)
+**Current Version:** `6.3.0` (as of Chart.yaml)
 
 ## Automated Release (Recommended)
 
@@ -329,6 +329,8 @@ helm show chart byjg/easyhaproxy
 
 | Version | Release Date | Type  | Highlights                                                                                                                            |
 |---------|--------------|-------|---------------------------------------------------------------------------------------------------------------------------------------|
+| 6.3.0   | 2026-10-21   | Minor | HAPROXY_STATS_ENABLE to turn stats/dashboard off, stats without a password documented with a startup warning, HAPROXY_STATS_PORT honored without a password, chart stats.enabled |
+| 6.2.0   | 2026-10-21   | Minor | Ingress status follows a cloud LoadBalancer address, EASYHAPROXY_SERVICE_NAME, Helm chart LoadBalancer Service and certbot persistence |
 | 6.1.1   | 2026-06-25   | Patch | Add pass_headers support to FastCGI plugin, fix flaky ACME e2e test timeout |
 | 6.1.0   | 2026-06-24   | Minor | FastCGI protocol support, certbot sidecar plugin, dependency updates |
 | 6.0.1   | 2026-02-23   | Patch | HAProxy dashboard, real-time monitoring dashboard with live traffic charts, ACME e2e test fixes |

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/deploy/docker/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   easyhaproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.3.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - certs_certbot:/etc/easyhaproxy/certs/certbot

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/deploy/kubernetes/easyhaproxy-clusterip.yml

@@ -6,10 +6,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: easyhaproxy/templates/clusterrole.yaml
@@ -19,10 +19,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
@@ -83,10 +83,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -105,10 +105,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
     {}
@@ -140,10 +140,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -164,7 +164,7 @@ spec:
         - name: easyhaproxy
           securityContext:
             {}
-          image: "byjg/easy-haproxy:6.1.1"
+          image: "byjg/easy-haproxy:6.3.0"
           imagePullPolicy: Always
           ports:
             - name: http
@@ -217,10 +217,10 @@ kind: IngressClass
 metadata:
   name: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   controller: byjg.com/easyhaproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/deploy/kubernetes/easyhaproxy-daemonset.yml

@@ -6,10 +6,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: easyhaproxy/templates/clusterrole.yaml
@@ -19,10 +19,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
@@ -83,10 +83,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -104,10 +104,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   selector:
@@ -136,7 +136,7 @@ spec:
         - name: easyhaproxy
           securityContext:
             {}
-          image: "byjg/easy-haproxy:6.1.1"
+          image: "byjg/easy-haproxy:6.3.0"
           imagePullPolicy: Always
           ports:
             - name: http
@@ -189,10 +189,10 @@ kind: IngressClass
 metadata:
   name: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   controller: byjg.com/easyhaproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/deploy/kubernetes/easyhaproxy-nodeport.yml

@@ -6,10 +6,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: easyhaproxy/templates/clusterrole.yaml
@@ -19,10 +19,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups:
@@ -83,10 +83,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -105,10 +105,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
     {}
@@ -140,10 +140,10 @@ metadata:
   name: ingress-easyhaproxy
   namespace: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -164,7 +164,7 @@ spec:
         - name: easyhaproxy
           securityContext:
             {}
-          image: "byjg/easy-haproxy:6.1.1"
+          image: "byjg/easy-haproxy:6.3.0"
           imagePullPolicy: Always
           ports:
             - name: http
@@ -217,10 +217,10 @@ kind: IngressClass
 metadata:
   name: easyhaproxy
   labels:
-    helm.sh/chart: easyhaproxy-2.0.4
+    helm.sh/chart: easyhaproxy-2.0.6
     app.kubernetes.io/name: easyhaproxy
     app.kubernetes.io/instance: ingress
-    app.kubernetes.io/version: "6.1.1"
+    app.kubernetes.io/version: "6.3.0"
     app.kubernetes.io/managed-by: Helm
 spec:
   controller: byjg.com/easyhaproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/getting-started/kubernetes.md

@@ -41,7 +41,7 @@ Exposes HAProxy on NodePort `31080` (HTTP), `31443` (HTTPS), and `31936` (stats)
 
 ```bash
 kubectl apply -f \
-    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-nodeport.yml
+    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.3.0/deploy/kubernetes/easyhaproxy-nodeport.yml
 ```
 
 ### ClusterIP (behind a LoadBalancer)
@@ -50,7 +50,7 @@ Cluster-internal only. Pair with an external cloud LoadBalancer or `kubectl port
 
 ```bash
 kubectl apply -f \
-    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-clusterip.yml
+    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.3.0/deploy/kubernetes/easyhaproxy-clusterip.yml
 ```
 
 ### DaemonSet (special cases — requires node label)
@@ -64,7 +64,7 @@ The node label must be reapplied after any node replacement. Failing to do so wi
 kubectl label nodes node-01 "easyhaproxy/node=master"
 
 kubectl apply -f \
-    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-daemonset.yml
+    https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.3.0/deploy/kubernetes/easyhaproxy-daemonset.yml
 ```
 
 If you need to configure environment variables (log levels, stats password, etc.), see the [environment variable reference](../reference/environment-variables.md).

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/getting-started/static.md

@@ -50,6 +50,7 @@ curl http://myapp.example.com
 
 ```yaml
 stats:
+  enabled: true       # Optional (default true); false turns stats and the dashboard off
   username: admin     # Optional (default "admin")
   password: password  # If omitted, stats are public with no password
   port: 1936          # Optional (default 1936)

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/getting-started/swarm.md

@@ -28,7 +28,7 @@ docker network create -d overlay --attachable easyhaproxy
 ```yaml
 services:
   haproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.3.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     deploy:

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/guides/acme.md

@@ -157,7 +157,7 @@ Here's a complete `docker-compose.yml` showing proper ACME configuration:
 ```yaml
 services:
   easyhaproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.3.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # REQUIRED: Persist Certbot certificates (ACME)

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/guides/dashboard.md

@@ -13,11 +13,11 @@ single page, with no extra software required.
 
 ## Enabling the dashboard
 
-Two environment variables are required:
+The dashboard is on by default (`HAPROXY_STATS_ENABLE=true`). Set these two variables:
 
 | Variable                    | Purpose                                                                                                                                       |
 |-----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
-| `HAPROXY_PASSWORD`          | Enables the stats endpoint and the dashboard.                                                                                                 |
+| `HAPROXY_PASSWORD`          | Requires a login for the stats endpoint and the dashboard. **Without it, both are served without a login.**                                   |
 | `HAPROXY_STATS_CORS_ORIGIN` | Allows the dashboard page to call the stats API. **Required** — without it the browser blocks the requests and the dashboard shows no data.   |
 
 The dashboard page is served from port `HAPROXY_STATS_PORT + 10000`, but it fetches data from
@@ -133,7 +133,8 @@ EasyHAProxy bundles a polished, self-contained dashboard that:
 
 | Variable | Description | Default |
 |---|---|---|
-| `HAPROXY_PASSWORD` | Enables stats **and** the dashboard. Required. | *empty* |
+| `HAPROXY_STATS_ENABLE` | Serve stats **and** the dashboard. `false` turns both off. | `true` |
+| `HAPROXY_PASSWORD` | Login password for stats and the dashboard. Without it they are served without a login. | *empty* |
 | `HAPROXY_USERNAME` | Username for the stats endpoint. | `admin` |
 | `HAPROXY_STATS_PORT` | Stats API port. Dashboard is served on this port **+ 10000**. | `1936` |
 | `HAPROXY_STATS_CORS_ORIGIN` | **Required for the dashboard.** Set to the exact origin you use to open the dashboard (e.g. `http://localhost:11936`). Without this the browser blocks stats API calls and the dashboard shows no data. | *empty* |

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/guides/helm.md

@@ -42,6 +42,28 @@ helm upgrade --install ingress byjg/easyhaproxy \
     --set service.type=ClusterIP
 ```
 
+```bash title="LoadBalancer (cloud providers)"
+helm upgrade --install ingress byjg/easyhaproxy \
+    --namespace easyhaproxy \
+    --set service.create=true \
+    --set service.type=LoadBalancer
+```
+
+On a cloud provider (DigitalOcean, AWS, GCP, Azure…), `LoadBalancer` asks the provider for an external load balancer in front of EasyHAProxy, and its address is written to your Ingress status. Use `service.annotations` for provider-specific load balancer settings.
+
+### 3) Persist ACME certificates
+
+If you use automatic certificates (`easyhaproxy.certbot` annotation), set the ACME e-mail and keep the issued certificates on a volume:
+
+```bash title="ACME with persisted certificates"
+helm upgrade --install ingress byjg/easyhaproxy \
+    --namespace easyhaproxy \
+    --set service.create=true \
+    --set service.type=LoadBalancer \
+    --set easyhaproxy.certbot.email=you@example.com \
+    --set persistence.certbot.enabled=true
+```
+
 See [Deployment Modes](../getting-started/kubernetes.md#deployment-modes) for a comparison of all three modes.
 
 For the complete list of configurable values, see the [Helm Values reference](../reference/helm.md).

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/guides/plugins.md

@@ -230,6 +230,8 @@ labels:
   easyhaproxy.http.plugins: cloudflare
 ```
 
+Using a Cloudflare Tunnel? See [Cloudflare Tunnel](../reference/plugins/cloudflare.md#cloudflare-tunnel).
+
 ### Multiple Plugins Together
 
 ```yaml

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/guides/ssl.md

@@ -83,7 +83,7 @@ docker cp single.pem easyhaproxy:/etc/easyhaproxy/certs/haproxy/example.com.pem
 ```yaml
 services:
   easyhaproxy:
-    image: byjg/easy-haproxy:6.1.1
+    image: byjg/easy-haproxy:6.3.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - certs_haproxy:/etc/easyhaproxy/certs/haproxy

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/reference/cli.md

@@ -38,13 +38,14 @@ Valid levels: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, `FATAL`
 
 | Flag                                 | Environment Variable        | Default      | Description                                 |
 |--------------------------------------|-----------------------------|--------------|---------------------------------------------|
-| `--haproxy-password PASSWORD`        | `HAPROXY_PASSWORD`          | *(disabled)* | Enable stats dashboard with this password   |
+| `--haproxy-stats-enable BOOL`        | `HAPROXY_STATS_ENABLE`      | `true`       | Serve the stats and dashboard               |
+| `--haproxy-password PASSWORD`        | `HAPROXY_PASSWORD`          | *(none)*     | Require this password for stats and dashboard |
 | `--haproxy-username USERNAME`        | `HAPROXY_USERNAME`          | `admin`      | Stats dashboard username                    |
 | `--haproxy-stats-port PORT`          | `HAPROXY_STATS_PORT`        | `1936`       | Stats dashboard port                        |
 | `--haproxy-stats-cors-origin ORIGIN` | `HAPROXY_STATS_CORS_ORIGIN` | *(none)*     | Allowed CORS origin for the stats dashboard |
 
 :::tip
-The stats dashboard is only enabled when `--haproxy-password` (or `HAPROXY_PASSWORD`) is set.
+Stats and the dashboard are on by default. Without `--haproxy-password` (or `HAPROXY_PASSWORD`) they are served without a login; turn them off with `--haproxy-stats-enable false`.
 :::
 
 ## ACME / Certbot (SSL certificates)
@@ -76,6 +77,7 @@ See the [plugins guide](../guides/plugins.md) for available plugins.
 | Flag                                       | Environment Variable                 | Default  | Description                                  |
 |--------------------------------------------|--------------------------------------|----------|----------------------------------------------|
 | `--update-ingress-status BOOL`             | `EASYHAPROXY_UPDATE_INGRESS_STATUS`  | `true`   | Update Ingress status with load-balancer IP  |
-| `--deployment-mode MODE`                   | `EASYHAPROXY_DEPLOYMENT_MODE`        | `auto`   | Deployment mode: `auto`, `single`, `cluster` |
+| `--deployment-mode MODE`                   | `EASYHAPROXY_DEPLOYMENT_MODE`        | `auto`   | Deployment mode: `auto`, `daemonset`, `nodeport`, `clusterip` |
 | `--external-hostname HOSTNAME`             | `EASYHAPROXY_EXTERNAL_HOSTNAME`      | *(none)* | External hostname reported in Ingress status |
+| `--service-name NAME`                      | `EASYHAPROXY_SERVICE_NAME`           | *(none)* | Name of the EasyHAProxy Service (set by the Helm chart) |
 | `--ingress-status-update-interval SECONDS` | `EASYHAPROXY_STATUS_UPDATE_INTERVAL` | `30`     | Interval to update Ingress status            |

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/reference/environment-variables.md

@@ -16,15 +16,17 @@ sidebar_label: "Environment Variables"
 | EASYHAPROXY_LOG_LEVEL     | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                | DEBUG              |
 | CERTBOT_LOG_LEVEL         | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | DEBUG              |
 | HAPROXY_LOG_LEVEL         | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | INFO               |
+| HAPROXY_STATS_ENABLE      | (Optional) Serve the statistics endpoint and the monitoring dashboard. Set to `false` to turn them off.                                                                                       | `true`             |
 | HAPROXY_USERNAME          | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set).                                                                                        | `admin`            |
-| HAPROXY_PASSWORD          | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined.                                                                                     | *empty*            |
-| HAPROXY_STATS_PORT        | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined.                                                         | `1936`             |
-| HAPROXY_STATS_CORS_ORIGIN | Required for the monitoring dashboard to function. Set to the origin you use to open the dashboard (e.g. `http://localhost:11936`). The dashboard page calls the stats API from a different port, so the browser enforces CORS — without this header the dashboard shows no data. Only applies when `HAPROXY_PASSWORD` is defined. | *empty*            |
+| HAPROXY_PASSWORD          | (Optional) The password for the statistics endpoint and dashboard. **Without it they are served without a login.**                                                                                     | *empty*            |
+| HAPROXY_STATS_PORT        | (Optional) The HAProxy port to the statistics. The dashboard uses this port + 10000. `false` also turns statistics off.                                                         | `1936`             |
+| HAPROXY_STATS_CORS_ORIGIN | Required for the monitoring dashboard to function. Set to the origin you use to open the dashboard (e.g. `http://localhost:11936`). The dashboard page calls the stats API from a different port, so the browser enforces CORS — without this header the dashboard shows no data. | *empty*            |
 | HAPROXY_CUSTOMERRORS      | (Optional) If HAProxy will use custom HTML errors. true/false.                                                                                                                                 | `false`            |
 
 :::tip HAProxy Stats & Dashboard
-Statistics are only configured when `HAPROXY_PASSWORD` is set. Without a password, neither the
-stats endpoint nor the monitoring dashboard is generated.
+Statistics and the monitoring dashboard are on by default. Without `HAPROXY_PASSWORD` they are served
+**without a login**, and EasyHAProxy logs a warning at startup. Set a password, or `HAPROXY_STATS_ENABLE=false`
+when the ports can be reached from outside.
 When enabled, the real-time dashboard is available at `http://<host>:<HAPROXY_STATS_PORT + 10000>/`
 (default `http://<host>:11936/`). See the [Monitoring Dashboard guide](../guides/dashboard.md) for details.
 :::
@@ -42,6 +44,7 @@ These variables apply only when `EASYHAPROXY_DISCOVER=kubernetes`. They control
 | EASYHAPROXY_UPDATE_INGRESS_STATUS  | Update Ingress resources with the load-balancer IP. Set to `false` to disable.                                                                              | `true`   |
 | EASYHAPROXY_DEPLOYMENT_MODE        | How to detect and report Ingress IPs: `auto`, `daemonset`, `nodeport`, or `clusterip`. `auto` inspects pod owner references and service type automatically. | `auto`   |
 | EASYHAPROXY_EXTERNAL_HOSTNAME      | Hostname to report in Ingress status when using ClusterIP mode without a cloud LoadBalancer.                                                                | *(none)* |
+| EASYHAPROXY_SERVICE_NAME           | Name of the EasyHAProxy Service, in the pod's namespace. The Helm chart sets it. When empty, `easyhaproxy` and `ingress-easyhaproxy` are tried. | *(none)* |
 | EASYHAPROXY_STATUS_UPDATE_INTERVAL | Seconds between Ingress status update cycles.                                                                                                               | `30`     |
 
 :::tip Deployment mode auto-detection

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/reference/helm.md

@@ -25,8 +25,8 @@ Controls whether EasyHAProxy runs as a **Deployment** (with a Service) or a **Da
 | Value                 | Description                                                                                 | Default     |
 |-----------------------|---------------------------------------------------------------------------------------------|-------------|
 | `replicaCount`        | Number of replicas (only used when `service.create: true`)                                  | `1`         |
-| `service.create`      | `true` → Deployment + Service (NodePort or ClusterIP). `false` → DaemonSet with host ports. | `false`     |
-| `service.type`        | Service type when `service.create: true`: `NodePort` or `ClusterIP`                         | `ClusterIP` |
+| `service.create`      | `true` → Deployment + Service (NodePort, ClusterIP or LoadBalancer). `false` → DaemonSet with host ports. | `false`     |
+| `service.type`        | Service type when `service.create: true`: `NodePort`, `ClusterIP` or `LoadBalancer`                       | `ClusterIP` |
 | `service.annotations` | Annotations to add to the Service resource                                                  | `{}`        |
 
 :::tip Recommended mode
@@ -48,7 +48,8 @@ Set `service.create: true` and `service.type: NodePort` for most setups. DaemonS
 | Value                              | Description                                         | Default    |
 |------------------------------------|-----------------------------------------------------|------------|
 | `easyhaproxy.stats.username`       | HAProxy stats username                                                              | `admin`    |
-| `easyhaproxy.stats.password`       | HAProxy stats password. **Required** to enable the stats endpoint and dashboard.   | `password` |
+| `easyhaproxy.stats.enabled`        | Serve the stats endpoint and dashboard. `false` also removes ports 1936/11936 from the pod and Service. | `true`     |
+| `easyhaproxy.stats.password`       | Login password for the stats endpoint and dashboard. Empty serves them without a login. | `password` |
 | `easyhaproxy.stats.corsOrigin`     | Allowed origin for stats API CORS (e.g. `http://node01:11936`). **Required** for the dashboard to load in a browser. | `""`       |
 | `easyhaproxy.refresh`              | Seconds between service discovery polls             | `"10"`     |
 | `easyhaproxy.customErrors`         | Enable custom HTML error pages                      | `"true"`   |
@@ -58,6 +59,24 @@ Set `service.create: true` and `service.type: NodePort` for most setups. DaemonS
 | `easyhaproxy.logLevel.haproxy`     | Log level for HAProxy                               | `DEBUG`    |
 | `easyhaproxy.certbot.email`        | Email address for Let's Encrypt / ACME registration | `""`       |
 
+## Certificate Persistence
+
+Keeps the ACME/Certbot certificates (`/etc/easyhaproxy/certs/certbot`) on a PersistentVolumeClaim, so a pod restart does not request them again and run into the CA rate limits. Recommended whenever `easyhaproxy.certbot.email` is set.
+
+| Value                                  | Description                                          | Default         |
+|----------------------------------------|------------------------------------------------------|-----------------|
+| `persistence.certbot.enabled`          | Mount a PVC at `/etc/easyhaproxy/certs/certbot`      | `false`         |
+| `persistence.certbot.existingClaim`    | Use this existing PVC instead of creating one        | `""`            |
+| `persistence.certbot.storageClass`     | Storage class of the created PVC. Empty = default.   | `""`            |
+| `persistence.certbot.accessMode`       | Access mode of the created PVC                       | `ReadWriteOnce` |
+| `persistence.certbot.size`             | Size of the created PVC                              | `1Gi`           |
+
+:::note
+With `service.create: true` and persistence enabled, the Deployment uses the `Recreate` strategy: a `ReadWriteOnce` volume cannot attach to the new pod while the old one still holds it. Expect a short gap during upgrades.
+
+The created PVC has `helm.sh/resource-policy: keep`, so `helm uninstall` leaves the certificates in place. Delete the PVC by hand to remove them.
+:::
+
 ## Ingress Status
 
 Controls how EasyHAProxy updates Kubernetes Ingress resources with load-balancer IPs.
@@ -94,7 +113,7 @@ kubectl label nodes node-01 "easyhaproxy/node=master"
 | `resources`          | CPU/memory requests and limits for the pod | `{}`    |
 | `nodeSelector`       | Node selector for pod scheduling           | `{}`    |
 | `tolerations`        | Tolerations for pod scheduling             | `[]`    |
-| `affinity`           | Affinity rules for pod scheduling          | `{}`    |
+| `affinity`           | Affinity rules for pod scheduling. In DaemonSet mode `nodeAffinity` comes from `masterNode`; other keys (e.g. `podAntiAffinity`) are kept. | `{}`    |
 | `podSecurityContext` | Pod-level security context                 | `{}`    |
 | `securityContext`    | Container-level security context           | `{}`    |
 

{easyhaproxy-6.1.1 → easyhaproxy-6.3.0}/docs/reference/other.md

@@ -30,7 +30,7 @@ These headers help backend applications:
 Some ports on the EasyHAProxy container and in the firewall are required to be open. However, you don't need to expose the other container ports because EasyHAProxy will handle that.
 
 - The ports `80` and `443`.
-- If you enable the HAProxy statistics, you must also expose the port defined in `HAPROXY_STATS_PORT` environment variable (default 1936). Statistics are only generated when you set `HAPROXY_PASSWORD`.
+- If you enable the HAProxy statistics, you must also expose the port defined in `HAPROXY_STATS_PORT` environment variable (default 1936). Statistics are on by default (`HAPROXY_STATS_ENABLE=false` turns them off) and need `HAPROXY_PASSWORD` to require a login.
 - Every port defined in `easyhaproxy.[definitions].port` also should be exposed.
 
 For example: