Migrate examples to tests_e2e directory structure

- Relocated all files and scripts from `examples` to `tests_e2e` for better organization. - Updated references and paths in configurations, scripts, and test files. - Adjusted `bump-version.sh` to handle the new `tests_e2e` structure. - Updated `.gitignore` to reflect path changes.
2026-02-12 17:05:04 -05:00 · 2026-02-12 17:05:04 -05:00 · d66c4f8595
commit d66c4f8595
parent b34d7822e4
51 changed files with 35 additions and 35 deletions
--- a/tests_e2e/swarm/README.md
+++ b/tests_e2e/swarm/README.md
@ -0,0 +1,67 @@
+# Docker Swarm Examples
+
+Self-contained examples for EasyHAProxy in Docker Swarm mode. **All documentation is in the YAML files as header comments.**
+
+## Quick Start
+
+1. Pick an example below
+2. Open the YAML file
+3. Read the header comments for complete instructions
+4. Run the commands step-by-step
+
+## Prerequisites
+
+All examples require:
+- Docker Swarm initialized (`docker swarm init`)
+- Overlay network created (`docker network create --driver overlay --attachable easyhaproxy`)
+- EasyHAProxy deployed (`docker stack deploy -c easyhaproxy.yml easyhaproxy`)
+
+See header comments in each file for detailed setup instructions.
+
+## Basic Examples
+
+| File | Description |
+|------|-------------|
+| [easyhaproxy.yml](easyhaproxy.yml) | EasyHAProxy service for Swarm with stats and certbot |
+| [services.yml](services.yml) | Basic services with SSL (embedded cert and file-based) |
+| [portainer.yml](portainer.yml) | Portainer management UI behind EasyHAProxy |
+
+## Plugin Examples
+
+| File | Description |
+|------|-------------|
+| [jwt-validator.yml](jwt-validator.yml) | JWT token validation for API protection |
+| [ip-whitelist.yml](ip-whitelist.yml) | IP whitelist for admin panels or sensitive services |
+| [cloudflare.yml](cloudflare.yml) | Restore real client IPs when behind Cloudflare CDN |
+| [plugins-combined.yml](plugins-combined.yml) | Multiple plugins combined for layered security |
+
+## Documentation Structure
+
+Each YAML file contains:
+- **WHAT THIS DEMONSTRATES** - Key features and concepts
+- **REQUIREMENTS** - Idempotent setup commands (safe to run multiple times)
+- **HOW TO START** - Command to deploy the stack
+- **HOW TO VERIFY IT'S WORKING** - Test commands with expected outputs
+- **CLEAN UP** - Commands to remove resources
+
+## Important: Service Labels
+
+In Swarm mode, labels must be under `deploy.labels`, NOT top-level `labels`:
+
+```yaml
+# ✅ CORRECT - Service labels
+deploy:
+  labels:
+    easyhaproxy.http.host: example.com
+
+# ❌ WRONG - Container labels (ignored in Swarm)
+labels:
+  easyhaproxy.http.host: example.com
+```
+
+## Additional Documentation
+
+- [Docker Swarm Guide](../../docs/swarm.md)
+- [Container Labels Reference](../../docs/container-labels.md)
+- [Using Plugins](../../docs/plugins/)
+- [ACME/Let's Encrypt](../../docs/acme.md)
--- a/tests_e2e/swarm/cloudflare.yml
+++ b/tests_e2e/swarm/cloudflare.yml
@ -0,0 +1,122 @@
+# ==============================================================================
+# EXAMPLE: Cloudflare IP Restoration (Swarm)
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - Restoring original visitor IPs when behind Cloudflare CDN
+# - Using Docker configs to manage Cloudflare IP lists
+# - Service discovery in Swarm mode with plugins
+# - Load balancing across multiple replicas
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Initialize Docker Swarm (if not already initialized)
+# docker swarm init
+#
+# # Create overlay network (idempotent)
+# docker network ls | grep -q easyhaproxy || docker network create --driver overlay --attachable easyhaproxy
+#
+# # Ensure EasyHAProxy is deployed
+# docker stack deploy -c easyhaproxy.yml easyhaproxy
+#
+# # Download Cloudflare IP ranges and create Docker config
+# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
+# echo "" >> cloudflare_ips.lst
+# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
+# docker config create cloudflare_ips cloudflare_ips.lst
+# rm cloudflare_ips.lst
+#
+# # Add to /etc/hosts for local testing (idempotent)
+# grep -q "myapp.example.com" /etc/hosts || echo "127.0.0.1 myapp.example.com" | sudo tee -a /etc/hosts
+# ```
+#
+# HOW TO START:
+# ```bash
+# docker stack deploy -c cloudflare.yml webapp
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Check stack is deployed
+# docker stack ls | grep webapp
+# # Expected: webapp stack listed
+#
+# # Check service is running
+# docker service ls | grep webapp_webapp
+# # Expected: webapp_webapp with 4/4 replicas
+#
+# # Test the application
+# curl -H "Host: myapp.example.com" http://localhost/
+# # Expected: 200 OK with "App Behind Cloudflare"
+#
+# # Check HAProxy config includes Cloudflare IPs
+# docker exec $(docker ps -q -f name=easyhaproxy_haproxy) cat /etc/haproxy/haproxy.cfg | grep -A 5 "cloudflare"
+# # Expected: ACL rules for Cloudflare IP ranges
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker stack rm webapp
+# # To also remove the Cloudflare IPs config:
+# # docker config rm cloudflare_ips
+# ```
+#
+# NOTE: This plugin is most useful when your site is actually behind Cloudflare CDN.
+# The plugin uses the CF-Connecting-IP header to restore the original visitor IP.
+#
+# ==============================================================================
+
+version: "3.7"
+
+services:
+  haproxy:
+    image: byjg/easy-haproxy:5.0.0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    configs:
+      - source: cloudflare_ips
+        target: /etc/haproxy/cloudflare_ips.lst
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+    environment:
+      EASYHAPROXY_DISCOVER: swarm
+      HAPROXY_USERNAME: admin
+      HAPROXY_PASSWORD: password
+      HAPROXY_STATS_PORT: 1936
+    ports:
+      - "80:80/tcp"
+      - "443:443/tcp"
+      - "1936:1936/tcp"
+    networks:
+      - easyhaproxy
+
+  # Web application behind Cloudflare
+  webapp:
+    image: byjg/static-httpserver
+    environment:
+      TITLE: "App Behind Cloudflare"
+    deploy:
+      replicas: 4
+      labels:
+        easyhaproxy.http.host: "myapp.example.com"
+        easyhaproxy.http.port: "80"
+        easyhaproxy.http.localport: "8080"
+
+        # Enable Cloudflare plugin
+        easyhaproxy.http.plugins: "cloudflare"
+
+        # Optional: Specify custom IP list path
+        # easyhaproxy.http.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
+    networks:
+      - easyhaproxy
+
+networks:
+  easyhaproxy:
+    external: true
+
+configs:
+  cloudflare_ips:
+    external: true
--- a/tests_e2e/swarm/easyhaproxy.yml
+++ b/tests_e2e/swarm/easyhaproxy.yml
@ -0,0 +1,87 @@
+# ==============================================================================
+# EXAMPLE: EasyHAProxy for Docker Swarm
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - EasyHAProxy running in Swarm mode with service discovery
+# - HAProxy stats interface
+# - Let's Encrypt/Certbot support
+# - Shared overlay network for services
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Initialize Docker Swarm (if not already initialized)
+# docker swarm init
+#
+# # Create overlay network (idempotent)
+# docker network ls | grep -q easyhaproxy || docker network create --driver overlay --attachable easyhaproxy
+#
+# # Edit this file and change:
+# # Line 18: EASYHAPROXY_CERTBOT_EMAIL to your email
+# ```
+#
+# HOW TO START:
+# ```bash
+# docker stack deploy -c easyhaproxy.yml easyhaproxy
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Check stack is deployed
+# docker stack ls
+# # Expected: easyhaproxy stack listed
+#
+# # Check service is running
+# docker service ls
+# # Expected: easyhaproxy_haproxy with 1/1 replicas
+#
+# # View HAProxy stats
+# # URL: http://localhost:1936
+# # Username: admin
+# # Password: password
+#
+# # Check logs
+# docker service logs -f easyhaproxy_haproxy
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker stack rm easyhaproxy
+# ```
+#
+# ==============================================================================
+
+
+services:
+  haproxy:
+    image: byjg/easy-haproxy:5.0.0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./certs:/certs/haproxy
+      - certs_certbot:/certs/certbot
+    deploy:
+      replicas: 1
+    environment:
+      EASYHAPROXY_DISCOVER: swarm
+      EASYHAPROXY_SSL_MODE: "loose"
+      EASYHAPROXY_CERTBOT_EMAIL: changeme@example.org
+      HAPROXY_CUSTOMERRORS: "true"
+      HAPROXY_USERNAME: admin
+      HAPROXY_PASSWORD: password
+      HAPROXY_STATS_PORT: 1936
+    ports:
+      - "80:80/tcp"
+      - "443:443/tcp"
+      - "1936:1936/tcp"
+    networks:
+      - easyhaproxy
+
+networks:
+  easyhaproxy:
+    external: true
+
+volumes:
+  certs_certbot:
+  #   external: true
+  # certs_haproxy:
+  #   external: true
--- a/tests_e2e/swarm/ip-whitelist.yml
+++ b/tests_e2e/swarm/ip-whitelist.yml
@ -0,0 +1,113 @@
+# ==============================================================================
+# EXAMPLE: IP Whitelist Plugin (Swarm)
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - Restricting access to specific IP addresses/networks
+# - IP-based access control for admin panels or sensitive services
+# - Returning custom status codes for blocked IPs
+# - Service discovery in Swarm mode with plugins
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Initialize Docker Swarm (if not already initialized)
+# docker swarm init
+#
+# # Create overlay network (idempotent)
+# docker network ls | grep -q easyhaproxy || docker network create --driver overlay --attachable easyhaproxy
+#
+# # Ensure EasyHAProxy is deployed
+# docker stack deploy -c easyhaproxy.yml easyhaproxy
+#
+# # Add to /etc/hosts for local testing (idempotent)
+# grep -q "admin.example.com" /etc/hosts || echo "127.0.0.1 admin.example.com" | sudo tee -a /etc/hosts
+#
+# # IMPORTANT: Edit this file (ip-whitelist.yml) line 64 to add your actual IP addresses!
+# # Get your current IP: curl ifconfig.me
+# ```
+#
+# HOW TO START:
+# ```bash
+# docker stack deploy -c ip-whitelist.yml admin
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Check stack is deployed
+# docker stack ls | grep admin
+# # Expected: admin stack listed
+#
+# # Check service is running
+# docker service ls | grep admin_admin
+# # Expected: admin_admin with 3/3 replicas
+#
+# # Test from allowed IP (assumes 127.0.0.1 or your IP is in the whitelist)
+# curl -H "Host: admin.example.com" http://localhost/
+# # Expected: 200 OK with "Admin Panel - IP Restricted"
+#
+# # Test from blocked IP (using a different IP via proxy or VPN)
+# # Expected: HTTP 403 Forbidden
+#
+# # View HAProxy stats to see IP whitelist rules
+# # URL: http://localhost:1936
+# # Username: admin
+# # Password: password
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker stack rm admin
+# ```
+#
+# ==============================================================================
+
+version: "3.7"
+
+services:
+  haproxy:
+    image: byjg/easy-haproxy:5.0.0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+    environment:
+      EASYHAPROXY_DISCOVER: swarm
+      HAPROXY_USERNAME: admin
+      HAPROXY_PASSWORD: password
+      HAPROXY_STATS_PORT: 1936
+    ports:
+      - "80:80/tcp"
+      - "1936:1936/tcp"
+    networks:
+      - easyhaproxy
+
+  # Admin panel with IP restrictions
+  admin:
+    image: byjg/static-httpserver
+    environment:
+      TITLE: "Admin Panel - IP Restricted"
+    deploy:
+      replicas: 3
+      labels:
+        easyhaproxy.http.host: "admin.example.com"
+        easyhaproxy.http.port: "80"
+        easyhaproxy.http.localport: "8080"
+
+        # Enable IP whitelist plugin
+        easyhaproxy.http.plugins: "ip_whitelist"
+
+        # Allow specific IPs and networks
+        # UPDATE THIS with your actual office/VPN IPs!
+        easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.0/24,10.0.0.0/8"
+
+        # Status code to return for blocked IPs
+        easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
+    networks:
+      - easyhaproxy
+
+networks:
+  easyhaproxy:
+    external: true
--- a/tests_e2e/swarm/jwt-validator.yml
+++ b/tests_e2e/swarm/jwt-validator.yml
@ -0,0 +1,132 @@
+# ==============================================================================
+# EXAMPLE: JWT Validator Plugin (Swarm)
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - JWT token validation for API authentication
+# - Using Docker configs to manage JWT public keys
+# - Validating issuer, audience, and expiration claims
+# - Service discovery in Swarm mode with plugins
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Initialize Docker Swarm (if not already initialized)
+# docker swarm init
+#
+# # Create overlay network (idempotent)
+# docker network ls | grep -q easyhaproxy || docker network create --driver overlay --attachable easyhaproxy
+#
+# # Ensure EasyHAProxy is deployed
+# docker stack deploy -c easyhaproxy.yml easyhaproxy
+#
+# # Generate JWT key pair (RS256 algorithm)
+# openssl genrsa -out jwt_private.pem 2048
+# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
+#
+# # Create Docker config with public key
+# docker config create jwt_api_pubkey jwt_pubkey.pem
+#
+# # Add to /etc/hosts for local testing (idempotent)
+# grep -q "api.example.com" /etc/hosts || echo "127.0.0.1 api.example.com" | sudo tee -a /etc/hosts
+# ```
+#
+# HOW TO START:
+# ```bash
+# docker stack deploy -c jwt-validator.yml api
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Check stack is deployed
+# docker stack ls | grep api
+# # Expected: api stack listed
+#
+# # Check service is running
+# docker service ls | grep api_api
+# # Expected: api_api with 5/5 replicas
+#
+# # Test without token (should fail)
+# curl -H "Host: api.example.com" http://localhost/
+# # Expected: HTTP 401 with "Missing Authorization HTTP header"
+#
+# # Generate test JWT at https://jwt.io with:
+# # - Algorithm: RS256
+# # - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
+# # - Use your jwt_private.pem content in "Verify Signature" section
+#
+# # Test with valid token (replace TOKEN with your JWT)
+# TOKEN="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
+# curl -H "Host: api.example.com" -H "Authorization: Bearer $TOKEN" http://localhost/
+# # Expected: 200 OK with "Protected API - JWT Required"
+#
+# # Test with invalid/expired token
+# curl -H "Host: api.example.com" -H "Authorization: Bearer invalid_token" http://localhost/
+# # Expected: HTTP 401 with error message
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker stack rm api
+# # To also remove the JWT public key config and generated keys:
+# # docker config rm jwt_api_pubkey
+# # rm jwt_private.pem jwt_pubkey.pem
+# ```
+#
+# ==============================================================================
+
+version: "3.7"
+
+services:
+  haproxy:
+    image: byjg/easy-haproxy:5.0.0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    configs:
+      - source: jwt_api_pubkey
+        target: /etc/haproxy/jwt_keys/api_pubkey.pem
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+    environment:
+      EASYHAPROXY_DISCOVER: swarm
+      HAPROXY_USERNAME: admin
+      HAPROXY_PASSWORD: password
+      HAPROXY_STATS_PORT: 1936
+    ports:
+      - "80:80/tcp"
+      - "1936:1936/tcp"
+    networks:
+      - easyhaproxy
+
+  # Protected API service
+  api:
+    image: byjg/static-httpserver
+    environment:
+      TITLE: "Protected API - JWT Required"
+    deploy:
+      replicas: 5
+      labels:
+        easyhaproxy.http.host: "api.example.com"
+        easyhaproxy.http.port: "80"
+        easyhaproxy.http.localport: "8080"
+
+        # Enable JWT validator plugin
+        easyhaproxy.http.plugins: "jwt_validator"
+
+        # JWT validator configuration
+        easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
+        easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
+        easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
+        easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    networks:
+      - easyhaproxy
+
+networks:
+  easyhaproxy:
+    external: true
+
+configs:
+  jwt_api_pubkey:
+    external: true
--- a/tests_e2e/swarm/plugins-combined.yml
+++ b/tests_e2e/swarm/plugins-combined.yml
@ -0,0 +1,200 @@
+# ==============================================================================
+# EXAMPLE: Multiple Plugins Combined (Swarm)
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - Using multiple plugins together for layered security
+# - Three different security profiles for different service types:
+#   * Public website: Cloudflare IP restoration + path blocking
+#   * Protected API: JWT authentication + path blocking
+#   * Admin panel: Strict IP whitelist
+# - Complex production-ready security configuration
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Initialize Docker Swarm (if not already initialized)
+# docker swarm init
+#
+# # Create overlay network (idempotent)
+# docker network ls | grep -q easyhaproxy || docker network create --driver overlay --attachable easyhaproxy
+#
+# # Ensure EasyHAProxy is deployed
+# docker stack deploy -c easyhaproxy.yml easyhaproxy
+#
+# # Generate JWT key pair (RS256 algorithm)
+# openssl genrsa -out jwt_private.pem 2048
+# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
+# docker config create jwt_api_pubkey jwt_pubkey.pem
+#
+# # Download Cloudflare IP ranges and create Docker config
+# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
+# echo "" >> cloudflare_ips.lst
+# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
+# docker config create cloudflare_ips cloudflare_ips.lst
+# rm cloudflare_ips.lst jwt_private.pem jwt_pubkey.pem
+#
+# # Add to /etc/hosts for local testing (idempotent)
+# grep -q "website.example.com" /etc/hosts || echo "127.0.0.1 website.example.com api.example.com admin.example.com" | sudo tee -a /etc/hosts
+#
+# # IMPORTANT: Edit this file (plugins-combined.yml) line 124 to add your actual IP!
+# ```
+#
+# HOW TO START:
+# ```bash
+# docker stack deploy -c plugins-combined.yml production
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Check stack is deployed
+# docker stack ls | grep production
+# # Expected: production stack listed
+#
+# # Check all services are running
+# docker service ls | grep production
+# # Expected: 3 services (website, api, admin) with all replicas running
+#
+# # Test public website (Cloudflare + deny_pages)
+# curl -H "Host: website.example.com" http://localhost/
+# # Expected: 200 OK with "Public Website"
+# curl -H "Host: website.example.com" http://localhost/admin
+# # Expected: HTTP 404 (blocked by deny_pages)
+#
+# # Test protected API (JWT + deny_pages)
+# curl -H "Host: api.example.com" http://localhost/
+# # Expected: HTTP 401 with "Missing Authorization HTTP header"
+#
+# # Generate JWT at https://jwt.io (see jwt-validator.yml for details)
+# TOKEN="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
+# curl -H "Host: api.example.com" -H "Authorization: Bearer $TOKEN" http://localhost/
+# # Expected: 200 OK with "Protected API"
+# curl -H "Host: api.example.com" -H "Authorization: Bearer $TOKEN" http://localhost/internal
+# # Expected: HTTP 403 (blocked by deny_pages)
+#
+# # Test admin panel (IP whitelist)
+# curl -H "Host: admin.example.com" http://localhost/
+# # Expected: 200 OK if your IP is whitelisted, 403 otherwise
+#
+# # View HAProxy stats to see all plugin configurations
+# # URL: http://localhost:1936
+# # Username: admin
+# # Password: password
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker stack rm production
+# # To also remove Docker configs:
+# # docker config rm cloudflare_ips jwt_api_pubkey
+# ```
+#
+# ==============================================================================
+
+version: "3.7"
+
+services:
+  haproxy:
+    image: byjg/easy-haproxy:5.0.0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    configs:
+      - source: cloudflare_ips
+        target: /etc/haproxy/cloudflare_ips.lst
+      - source: jwt_api_pubkey
+        target: /etc/haproxy/jwt_keys/api_pubkey.pem
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+    environment:
+      EASYHAPROXY_DISCOVER: swarm
+      EASYHAPROXY_SSL_MODE: "loose"
+      HAPROXY_CUSTOMERRORS: "true"
+      HAPROXY_USERNAME: admin
+      HAPROXY_PASSWORD: password
+      HAPROXY_STATS_PORT: 1936
+    ports:
+      - "80:80/tcp"
+      - "443:443/tcp"
+      - "1936:1936/tcp"
+    networks:
+      - easyhaproxy
+
+  # Public website with Cloudflare + path blocking
+  website:
+    image: byjg/static-httpserver
+    environment:
+      TITLE: "Public Website"
+    deploy:
+      replicas: 4
+      labels:
+        easyhaproxy.http.host: "website.example.com"
+        easyhaproxy.http.port: "80"
+        easyhaproxy.http.localport: "8080"
+
+        # Cloudflare IP restoration + block sensitive paths
+        easyhaproxy.http.plugins: "cloudflare,deny_pages"
+        easyhaproxy.http.plugin.deny_pages.paths: "/admin,/wp-admin,/wp-login.php,/.env,/config"
+        easyhaproxy.http.plugin.deny_pages.status_code: "404"
+    networks:
+      - easyhaproxy
+
+  # Protected API with JWT + path blocking
+  api:
+    image: byjg/static-httpserver
+    environment:
+      TITLE: "Protected API"
+    deploy:
+      replicas: 6
+      labels:
+        easyhaproxy.http.host: "api.example.com"
+        easyhaproxy.http.port: "80"
+        easyhaproxy.http.localport: "8080"
+
+        # JWT validation + block internal endpoints
+        easyhaproxy.http.plugins: "jwt_validator,deny_pages"
+
+        # JWT configuration
+        easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
+        easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
+        easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
+        easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+
+        # Block internal/debug paths
+        easyhaproxy.http.plugin.deny_pages.paths: "/internal,/debug,/metrics"
+        easyhaproxy.http.plugin.deny_pages.status_code: "403"
+    networks:
+      - easyhaproxy
+
+  # Admin panel with strict IP whitelist
+  admin:
+    image: byjg/static-httpserver
+    environment:
+      TITLE: "Admin Panel"
+    deploy:
+      replicas: 2
+      labels:
+        easyhaproxy.http.host: "admin.example.com"
+        easyhaproxy.http.port: "80"
+        easyhaproxy.http.localport: "8080"
+
+        # IP whitelist only (strictest security)
+        easyhaproxy.http.plugins: "ip_whitelist"
+
+        # Only allow office network
+        # UPDATE with your actual office/VPN IPs!
+        easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,10.0.0.0/8"
+        easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
+    networks:
+      - easyhaproxy
+
+networks:
+  easyhaproxy:
+    external: true
+
+configs:
+  cloudflare_ips:
+    external: true
+  jwt_api_pubkey:
+    external: true
--- a/tests_e2e/swarm/portainer.yml
+++ b/tests_e2e/swarm/portainer.yml
@ -0,0 +1,67 @@
+# ==============================================================================
+# EXAMPLE: Portainer Behind EasyHAProxy (Swarm)
+# ==============================================================================
+#
+# WHAT THIS DEMONSTRATES:
+# - Running Portainer management UI in Swarm mode
+# - Service discovery with EasyHAProxy
+# - Using persistent volumes for Portainer data
+#
+# REQUIREMENTS (run these first):
+# ```bash
+# # Ensure EasyHAProxy is deployed
+# docker stack deploy -c easyhaproxy.yml easyhaproxy
+#
+# # Add to /etc/hosts (idempotent)
+# grep -q "portainer.local" /etc/hosts || echo "127.0.0.1 portainer.local" | sudo tee -a /etc/hosts
+# ```
+#
+# HOW TO START:
+# ```bash
+# docker stack deploy -c portainer.yml portainer
+# ```
+#
+# HOW TO VERIFY IT'S WORKING:
+# ```bash
+# # Check service is running
+# docker service ls | grep portainer
+# # Expected: portainer_portainer with 1/1 replicas
+#
+# # Access Portainer
+# curl http://portainer.local
+# # Or open in browser: http://portainer.local
+# # First time: Create admin user
+# ```
+#
+# CLEAN UP:
+# ```bash
+# docker stack rm portainer
+# # To also remove data volume:
+# # docker volume rm portainer_portainer_data
+# ```
+#
+# ==============================================================================
+
+services:
+  portainer:
+    image: portainer/portainer-ce:latest
+    volumes:
+     - portainer_data:/data portainer
+     - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      replicas: 1
+      labels:
+        # easyhaproxy.http.redirect_ssl: true
+        # easyhaproxy.http.certbot: true
+        easyhaproxy.http.host: portainer.local
+        easyhaproxy.http.port: 80
+        easyhaproxy.http.localport: 9000
+
+volumes:
+  certs_certbot:
+    external: true
+  # certs_haproxy:
+  #   external: true
+  portainer_data:
+    # external: true
+
--- a/tests_e2e/swarm/services.yml
+++ b/tests_e2e/swarm/services.yml