Docker environment variables
| Environment Variable | Description | Default |
|---|---|---|
| EASYHAPROXY_DISCOVER | How the services will be discovered to create haproxy.cfg: static, docker, swarm or kubernetes | required |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The prefix of the Docker/Swarm labels and Kubernetes annotations EasyHAProxy reads, e.g. myproxy for myproxy.http.host or myproxy.redirect_ssl. | easyhaproxy |
| EASYHAPROXY_BASE_PATH | (Optional) Base directory for all EasyHAProxy files. All paths (config, certs, plugins, www) are constructed relative to this base. | /etc/easyhaproxy |
| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: acme | empty |
| EASYHAPROXY_SSL_MODE | (Optional) strict supports only the most recent TLS version; default good SSL integration with recent browsers; loose supports all old SSL protocols for old browsers (not recommended). | default |
| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | INFO |
| HAPROXY_STATS_ENABLE | (Optional) Serve the statistics endpoint and the monitoring dashboard. Set to false to turn them off. | true |
| HAPROXY_USERNAME | (Optional) The HAProxy username for the statistics endpoint (used only when HAPROXY_PASSWORD is set). | admin |
| HAPROXY_PASSWORD | (Optional) The password for the statistics endpoint and dashboard. Without it they are served without a login. | empty |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. The dashboard uses this port + 10000. false also turns statistics off. | 1936 |
| HAPROXY_STATS_CORS_ORIGIN | Required for the monitoring dashboard to function. Set to the origin you use to open the dashboard (e.g. http://localhost:11936). The dashboard page calls the stats API from a different port, so the browser enforces CORS — without this header the dashboard shows no data. | empty |
| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | true |
Statistics and the monitoring dashboard are on by default. Without HAPROXY_PASSWORD they are served
without a login, and EasyHAProxy logs a warning at startup. Set a password, or HAPROXY_STATS_ENABLE=false
when the ports can be reached from outside.
When enabled, the real-time dashboard is available at http://<host>:<HAPROXY_STATS_PORT + 10000>/
(default http://<host>:11936/). See the Monitoring Dashboard guide for details.
For ACME/Certbot configuration (Let's Encrypt, ZeroSSL, etc.), see the ACME documentation for the complete list of EASYHAPROXY_CERTBOT_* variables.
Kubernetes
These variables apply only when EASYHAPROXY_DISCOVER=kubernetes. They control how EasyHAProxy updates Ingress resources with load-balancer IP information.
| Environment Variable | Description | Default |
|---|---|---|
| EASYHAPROXY_UPDATE_INGRESS_STATUS | Update Ingress resources with the load-balancer IP. Set to false to disable. | true |
| EASYHAPROXY_DEPLOYMENT_MODE | How to detect and report Ingress IPs: auto, daemonset, nodeport, or clusterip. auto inspects pod owner references and service type automatically. | auto |
| EASYHAPROXY_EXTERNAL_HOSTNAME | Hostname to report in Ingress status when using ClusterIP mode without a cloud LoadBalancer. | (none) |
| EASYHAPROXY_SERVICE_NAME | Name of the EasyHAProxy Service, in the pod's namespace. The Helm chart sets it. When empty, easyhaproxy and ingress-easyhaproxy are tried. | (none) |
| EASYHAPROXY_STATUS_UPDATE_INTERVAL | Seconds between Ingress status update cycles. | 30 |
EASYHAPROXY_DEPLOYMENT_MODE=auto is recommended. EasyHAProxy inspects its own pod owner references (DaemonSet vs Deployment) and Service type (NodePort vs ClusterIP) to determine the correct IP source. Override only if auto-detection gives wrong results.