Add comprehensive plugin usage examples for Docker, Kubernetes, and Swarm

- Introduced multiple detailed plugin examples for Cloudflare IP restoration, IP whitelisting, JWT validation, and combined usage.
- Added configurations for `docker-compose`, `Kubernetes`, and `Swarm` showcasing individual and multi-plugin use cases.
- Included clear prerequisites, setup steps, and testing procedures for each example.
- Documented advanced scenarios like path blocking, custom IP lists, and JWT validation for production environments.

examples/kubernetes/plugins-combined.yml

@@ -0,0 +1,233 @@
+# Multiple Plugins Combined Example for Kubernetes
+#
+# This example demonstrates using multiple plugins together for enhanced security
+#
+# Prerequisites:
+# 1. EasyHAProxy installed in your cluster
+#
+# 2. Generate JWT keys and create ConfigMap:
+#    openssl genrsa -out jwt_private.pem 2048
+#    openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
+#    kubectl create configmap jwt-keys --from-file=api_pubkey.pem=jwt_pubkey.pem
+#
+# 3. Download Cloudflare IPs and create ConfigMap:
+#    curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
+#    curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
+#    kubectl create configmap cloudflare-ips \
+#      --from-file=cloudflare_ips.lst=cloudflare_ips.lst \
+#      -n easyhaproxy
+#
+# 4. Mount ConfigMaps in EasyHAProxy deployment
+#
+# 5. Apply this manifest:
+#    kubectl apply -f plugins-combined.yml
+#
+# This creates three services with different security profiles:
+# - Public website: Cloudflare + path blocking
+# - Protected API: JWT validation + path blocking
+# - Admin panel: Strict IP whitelist
+
+---
+# Public website service
+apiVersion: v1
+kind: Service
+metadata:
+  name: website-service
+  namespace: default
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app: website
+  type: ClusterIP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: website
+  namespace: default
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: website
+  template:
+    metadata:
+      labels:
+        app: website
+    spec:
+      containers:
+      - name: website
+        image: byjg/static-httpserver
+        env:
+        - name: TITLE
+          value: "Public Website"
+        resources:
+          requests:
+            cpu: '0.05'
+            memory: '32Mi'
+
+---
+# Public website ingress with Cloudflare + path blocking
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: easyhaproxy-ingress
+    # Cloudflare IP restoration + deny pages
+    easyhaproxy.plugins: "cloudflare,deny_pages"
+    easyhaproxy.plugin.deny_pages.paths: "/admin,/wp-admin,/wp-login.php,/.env,/config"
+    easyhaproxy.plugin.deny_pages.status_code: "404"
+  name: website-ingress
+  namespace: default
+spec:
+  rules:
+  - host: website.example.local
+    http:
+      paths:
+      - backend:
+          service:
+            name: website-service
+            port:
+              number: 8080
+        pathType: ImplementationSpecific
+
+---
+# API service
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-service
+  namespace: default
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app: api
+  type: ClusterIP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+  namespace: default
+spec:
+  replicas: 5
+  selector:
+    matchLabels:
+      app: api
+  template:
+    metadata:
+      labels:
+        app: api
+    spec:
+      containers:
+      - name: api
+        image: byjg/static-httpserver
+        env:
+        - name: TITLE
+          value: "Protected API"
+        resources:
+          requests:
+            cpu: '0.05'
+            memory: '32Mi'
+
+---
+# API ingress with JWT + path blocking
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: easyhaproxy-ingress
+    # JWT validation + block internal endpoints
+    easyhaproxy.plugins: "jwt_validator,deny_pages"
+    # JWT config
+    easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
+    easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
+    easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
+    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+    # Block internal paths
+    easyhaproxy.plugin.deny_pages.paths: "/internal,/debug,/metrics"
+    easyhaproxy.plugin.deny_pages.status_code: "403"
+  name: api-ingress
+  namespace: default
+spec:
+  rules:
+  - host: api.example.local
+    http:
+      paths:
+      - backend:
+          service:
+            name: api-service
+            port:
+              number: 8080
+        pathType: ImplementationSpecific
+
+---
+# Admin service
+apiVersion: v1
+kind: Service
+metadata:
+  name: admin-service
+  namespace: default
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app: admin
+  type: ClusterIP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: admin
+  namespace: default
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: admin
+  template:
+    metadata:
+      labels:
+        app: admin
+    spec:
+      containers:
+      - name: admin
+        image: byjg/static-httpserver
+        env:
+        - name: TITLE
+          value: "Admin Panel"
+        resources:
+          requests:
+            cpu: '0.05'
+            memory: '32Mi'
+
+---
+# Admin ingress with strict IP whitelist
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: easyhaproxy-ingress
+    # IP whitelist only (strictest security)
+    easyhaproxy.plugins: "ip_whitelist"
+    # UPDATE with your office/VPN IPs!
+    easyhaproxy.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,10.0.0.0/8"
+    easyhaproxy.plugin.ip_whitelist.status_code: "403"
+  name: admin-ingress
+  namespace: default
+spec:
+  rules:
+  - host: admin.example.local
+    http:
+      paths:
+      - backend:
+          service:
+            name: admin-service
+            port:
+              number: 8080
+        pathType: ImplementationSpecific