Migrate examples to tests_e2e directory structure

- Relocated all files and scripts from `examples` to `tests_e2e` for better organization.
- Updated references and paths in configurations, scripts, and test files.
- Adjusted `bump-version.sh` to handle the new `tests_e2e` structure.
- Updated `.gitignore` to reflect path changes.

tests_e2e/static/README.md

@@ -0,0 +1,97 @@
+# Static Configuration Example
+
+Self-contained example for EasyHAProxy using static YAML configuration. **All documentation is in the docker-compose file as header comments.**
+
+## Quick Start
+
+1. Open [docker-compose.yml](docker-compose.yml)
+2. Read the header comments for complete instructions
+3. Choose a configuration scenario from `conf/` directory
+4. Run the commands step-by-step
+
+## What is Static Mode?
+
+Static mode uses explicit YAML configuration files instead of dynamic service discovery. This is useful for:
+- **Non-containerized backends** - VMs, bare metal servers, external APIs
+- **Fixed infrastructure** - When your backend IPs/ports don't change
+- **Explicit routing control** - Precise control over HAProxy configuration
+
+## Configuration Files
+
+All scenarios use `/etc/haproxy/static/config.yml` mounted from `./conf/config.yml`.
+
+Choose one of these pre-made configurations:
+
+| Configuration File         | Description                                     |
+|----------------------------|-------------------------------------------------|
+| `config-basic.yml`         | Simple HTTP→HTTPS redirect with SSL termination |
+| `config-certbot.yml`       | Let's Encrypt SSL (requires public domain)      |
+| `config-deny-pages.yml`    | Block specific paths (e.g., `/admin`, `/.env`)  |
+| `config-jwt-validator.yml` | JWT token validation for API authentication     |
+
+## Prerequisites
+
+- SSL certificates generated (`./tests_e2e/generate-keys.sh`)
+- `/etc/hosts` entry for `host1.local`
+- Backend container running on port 8080
+
+See header comments in [docker-compose.yml](docker-compose.yml) for detailed setup.
+
+## Documentation Structure
+
+The docker-compose.yml file contains:
+- **WHAT THIS DEMONSTRATES** - Key features and concepts
+- **REQUIREMENTS** - Idempotent setup commands (safe to run multiple times)
+- **HOW TO START** - Commands to start backend and EasyHAProxy
+- **HOW TO VERIFY IT'S WORKING** - Test commands with expected outputs
+- **CLEAN UP** - Commands to stop and remove resources
+
+## Example Workflow
+
+```bash
+# 1. Generate certificates
+cd ../.. && ./tests_e2e/generate-keys.sh && cd tests_e2e/static
+
+# 2. Choose a configuration
+cp conf/config-basic.yml conf/config.yml
+
+# 3. Start backend
+docker run -d --name container -p 8080:8080 byjg/static-httpserver
+
+# 4. Start EasyHAProxy
+docker compose up -d
+
+# 5. Test
+curl -k https://host1.local/
+
+# 6. Clean up
+docker compose down
+docker stop container && docker rm container
+```
+
+## Configuration File Reference
+
+Basic structure of `config.yml`:
+
+```yaml
+stats:
+  username: admin
+  password: password
+  port: 1936
+
+easymapping:
+  - port: 443
+    ssl: true
+    hosts:
+      host1.local:
+        containers:
+          - container:8080  # Can also be IP:PORT for external backends
+```
+
+See `conf/` directory for complete examples.
+
+## Additional Documentation
+
+- [Static Configuration Guide](../../docs/static.md)
+- [Using Plugins](../../docs/plugins/)
+- [Environment Variables](../../docs/environment-variable.md)

tests_e2e/static/conf/config-basic.yml

@@ -0,0 +1,31 @@
+# Basic Static Configuration Example
+#
+# This is a minimal configuration without plugins
+# Demonstrates basic HTTP to HTTPS redirect and SSL setup
+#
+# To use:
+# 1. Update the container name and ports to match your setup
+# 2. Place SSL certificate at /certs/haproxy/host1.local.pem
+# 3. Mount this config: -v ./conf/config-basic.yml:/etc/haproxy/static/config.yml
+
+stats:
+  username: admin
+  password: password
+  port: 1936         # Optional (default 1936)
+
+customerrors: true   # Optional (default false)
+
+easymapping:
+  # HTTP - Redirect to HTTPS
+  - port: 80
+    redirect:
+      host1.local: https://host1.local
+      www.host1.local: https://host1.local
+
+  # HTTPS - Serve application
+  - port: 443
+    ssl: true
+    hosts:
+      host1.local:
+        containers:
+          - container:8080

tests_e2e/static/conf/config-certbot.yml

@@ -0,0 +1,88 @@
+# Certbot/Let's Encrypt Configuration Example
+#
+# Demonstrates:
+# - Automatic SSL certificate generation with Let's Encrypt
+# - HTTP to HTTPS redirect
+# - Certificate renewal
+#
+# Prerequisites:
+# 1. Public IP address with ports 80 and 443 accessible
+# 2. DNS records pointing to your server:
+#    example.com -> your-server-ip
+#    www.example.com -> your-server-ip
+#
+# 3. Set environment variable:
+#    EASYHAPROXY_CERTBOT_EMAIL=your-email@example.com
+#
+# 4. Mount this config:
+#    -v ./conf/config-certbot.yml:/etc/haproxy/static/config.yml
+#
+# 5. Persist certificates:
+#    -v ./certs/certbot:/certs/certbot
+#
+# How it works:
+# - EasyHAProxy requests certificates from Let's Encrypt via HTTP-01 challenge
+# - Certificates are stored in /certs/certbot/
+# - Certificates auto-renew when needed
+#
+# Note: Let's Encrypt has rate limits. Use staging environment for testing:
+#       EASYHAPROXY_CERTBOT_AUTOCONFIG=staging
+
+stats:
+  username: admin
+  password: password
+  port: 1936
+
+customerrors: true
+
+easymapping:
+  # HTTP Port 80
+  # Required for ACME HTTP-01 challenge and redirect
+  - port: 80
+    hosts:
+      # Domain with certbot enabled
+      example.com:
+        containers:
+          - webapp:8080
+        # Enable certbot for this domain
+        certbot: true
+        # Redirect HTTP to HTTPS after cert is issued
+        redirect_ssl: true
+
+      # Additional domain with certbot
+      app.example.com:
+        containers:
+          - app:3000
+        certbot: true
+        redirect_ssl: true
+
+      # Domain without certbot (uses custom certificate)
+      custom.example.com:
+        containers:
+          - custom-app:8080
+        # No certbot - expects certificate at /certs/haproxy/custom.example.com.pem
+
+  # HTTPS Port 443
+  # Serves HTTPS traffic with auto-generated certificates
+  - port: 443
+    ssl: true
+    hosts:
+      example.com:
+        containers:
+          - webapp:8080
+        # Certificate path (auto-generated by certbot)
+        # /certs/certbot/example.com/fullchain.pem
+
+      app.example.com:
+        containers:
+          - app:3000
+
+      # Custom certificate example
+      custom.example.com:
+        containers:
+          - custom-app:8080
+        # Place your certificate at:
+        # /certs/haproxy/custom.example.com.pem
+
+# Multiple domains with different backends
+# Certbot will request separate certificates for each domain

tests_e2e/static/conf/config-deny-pages.yml

@@ -0,0 +1,78 @@
+# Deny Pages Plugin Configuration Example
+#
+# Demonstrates:
+# - Global plugin configuration (applies to all domains)
+# - Per-domain plugin override (custom settings per host)
+#
+# To use:
+# 1. Update container names and ports
+# 2. Mount this config: -v ./conf/config-deny-pages.yml:/etc/haproxy/static/config.yml
+# 3. Test blocked paths:
+#    curl http://host1.local/admin        # Should return 404
+#    curl http://host2.local/wp-admin     # Should return 403 (different config)
+
+stats:
+  username: admin
+  password: password
+  port: 1936
+
+customerrors: true
+
+# Global plugin configuration
+# This applies to ALL domains unless overridden
+plugins:
+  enabled:
+    - deny_pages
+
+  config:
+    deny_pages:
+      # Global default: block common admin paths with 404
+      paths:
+        - /admin
+        - /.env
+        - /config
+      status_code: 404  # Hide existence of these paths
+
+easymapping:
+  - port: 80
+    hosts:
+      # Domain 1: Uses global deny_pages configuration
+      host1.local:
+        containers:
+          - webapp1:8080
+        # No plugins specified = uses global configuration
+
+      # Domain 2: WordPress site with custom blocked paths
+      host2.local:
+        containers:
+          - wordpress:80
+        # Override global plugin configuration for this domain
+        plugins:
+          - deny_pages
+        plugin_config:
+          deny_pages:
+            paths:
+              - /wp-admin
+              - /wp-login.php
+              - /xmlrpc.php
+              - /wp-config.php
+            status_code: 403  # Return forbidden instead of 404
+
+      # Domain 3: Public site with stricter blocking
+      host3.local:
+        containers:
+          - publicsite:3000
+        plugins:
+          - deny_pages
+        plugin_config:
+          deny_pages:
+            paths:
+              - /admin
+              - /administrator
+              - /manager
+              - /phpmyadmin
+              - /.git
+              - /.env
+              - /config
+              - /backup
+            status_code: 404

tests_e2e/static/conf/config-jwt-validator.yml

@@ -0,0 +1,86 @@
+# JWT Validator Plugin Configuration Example
+#
+# Demonstrates:
+# - JWT token validation for API protection
+# - Different JWT configurations per domain
+# - Optional issuer/audience validation
+#
+# Prerequisites:
+# 1. Generate RSA key pair:
+#    openssl genrsa -out jwt_private.pem 2048
+#    openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
+#
+# 2. Mount public keys:
+#    -v ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+#    -v ./jwt_pubkey2.pem:/etc/haproxy/jwt_keys/admin_pubkey.pem:ro
+#
+# 3. Mount this config:
+#    -v ./conf/config-jwt-validator.yml:/etc/haproxy/static/config.yml
+#
+# 4. Test:
+#    # Without token - should fail
+#    curl http://api.local/users
+#    # Response: Missing Authorization HTTP header
+#
+#    # With valid token - should succeed
+#    curl -H "Authorization: Bearer eyJhbGc..." http://api.local/users
+
+stats:
+  username: admin
+  password: password
+  port: 1936
+
+customerrors: true
+
+easymapping:
+  - port: 80
+    hosts:
+      # Public API with full JWT validation
+      api.local:
+        containers:
+          - api-server:8080
+        plugins:
+          - jwt_validator
+        plugin_config:
+          jwt_validator:
+            algorithm: RS256
+            issuer: https://auth.example.com/
+            audience: https://api.example.com
+            pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+
+      # Internal API - validate signature only (no issuer/audience check)
+      internal-api.local:
+        containers:
+          - internal-api:3000
+        plugins:
+          - jwt_validator
+        plugin_config:
+          jwt_validator:
+            algorithm: RS256
+            # No issuer/audience = skip those validations
+            pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+
+      # Admin API - different issuer and key
+      admin-api.local:
+        containers:
+          - admin-api:4000
+        plugins:
+          - jwt_validator
+          - deny_pages  # Also block internal paths
+        plugin_config:
+          jwt_validator:
+            algorithm: RS256
+            issuer: https://admin-auth.example.com/
+            audience: https://admin.example.com
+            pubkey_path: /etc/haproxy/jwt_keys/admin_pubkey.pem
+          deny_pages:
+            paths:
+              - /internal
+              - /debug
+            status_code: 403
+
+      # Public website - no JWT required
+      website.local:
+        containers:
+          - website:8080
+        # No plugins = public access

tests_e2e/static/docker-compose.yml

@@ -0,0 +1,76 @@
+# ==============================================================================
+# EXAMPLE: Static Configuration Mode
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - EasyHAProxy using static YAML configuration (no service discovery)
+# - Useful for non-containerized backends, VMs, or bare metal servers
+# - Configuration via /etc/haproxy/static/config.yml
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Generate SSL certificates
+# cd ../.. && ./tests_e2e/generate-keys.sh && cd tests_e2e/static
+#
+# # Add to /etc/hosts (idempotent)
+# grep -q "host1.local" /etc/hosts || echo "127.0.0.1 host1.local" | sudo tee -a /etc/hosts
+#
+# # Copy a configuration file (choose one):
+# cp conf/config-basic.yml conf/config.yml              # Basic HTTP→HTTPS redirect
+# # OR
+# cp conf/config-certbot.yml conf/config.yml            # Let's Encrypt (requires public domain)
+# # OR
+# cp conf/config-deny-pages.yml conf/config.yml         # Block specific paths
+# # OR
+# cp conf/config-jwt-validator.yml conf/config.yml      # JWT authentication
+# ```
+#
+# HOW TO START:
+# ```bash
+# # Start backend container
+# docker run -d --name container -p 8080:8080 byjg/static-httpserver
+#
+# # Start EasyHAProxy
+# docker compose up -d
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Test HTTPS
+# curl -k -H "Host: host1.local" https://127.0.0.1/
+# # Expected: 200 OK with "Hello from Static HTTP Server!"
+#
+# # Test HTTP redirect (if using basic config)
+# curl -I -H "Host: host1.local" http://127.0.0.1
+# # Expected: HTTP/1.1 301 Moved Permanently
+#
+# # View HAProxy stats
+# # URL: http://localhost:1936
+# # Username: admin
+# # Password: password
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker compose down
+# docker stop container && docker rm container
+# ```
+#
+# ==============================================================================
+
+services:
+  haproxy:
+    image: byjg/easy-haproxy:5.0.0
+    volumes:
+      - ./conf/:/etc/haproxy/static/
+      - ./host1.local.pem:/certs/haproxy/host1.local.pem
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      EASYHAPROXY_DISCOVER: static
+    ports:
+      - "80:80/tcp"
+      - "443:443/tcp"
+      - "1936:1936/tcp"
+
+  container:
+    image: byjg/static-httpserver