From 11ff3c491cef3994da43d3a5e56f0e3afcf882a1 Mon Sep 17 00:00:00 2001
From: Peixian Wang <peixian@users.noreply.github.com>
Date: Fri, 28 Mar 2025 09:55:17 -0400
Subject: [PATCH 01/19] Fix HPA Template & Add Media Proxy Ports (#368)

---
 charts/whatsapp-proxy-chart/Chart.yaml                |  2 +-
 charts/whatsapp-proxy-chart/templates/deployment.yaml | 10 ++++++++++
 charts/whatsapp-proxy-chart/templates/hpa.yaml        | 10 +++++++---
 charts/whatsapp-proxy-chart/templates/service.yaml    |  1 -
 4 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 2e1340c5..3dff6131 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.0
+version: 1.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index d0206772..a5222d1f 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -68,6 +68,16 @@ spec:
               containerPort: 5222
               protocol: TCP
             {{- end}}
+            {{- if .Values.service.media_port }}
+            - name: media
+              containerPort: 587
+              protocol: TCP
+            {{- end}}
+            {{- if .Values.service.media_proxy_port}}
+            - name: media-proxy
+              containerPort: 7777
+              protocol: TCP
+            {{- end}}
             {{- if .Values.service.stats_port }}
             - name: stats
               containerPort: 8199
diff --git a/charts/whatsapp-proxy-chart/templates/hpa.yaml b/charts/whatsapp-proxy-chart/templates/hpa.yaml
index e127efa1..49a41813 100644
--- a/charts/whatsapp-proxy-chart/templates/hpa.yaml
+++ b/charts/whatsapp-proxy-chart/templates/hpa.yaml
@@ -3,7 +3,7 @@
 # License found in the LICENSE file in the root directory
 # of this source tree.
 {{- if .Values.autoscaling.enabled }}
-apiVersion: autoscaling/v2beta1
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "whatsapp-proxy-chart.fullname" . }}
@@ -21,12 +21,16 @@ spec:
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
     {{- end }}
     {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
     {{- end }}
 {{- end }}
diff --git a/charts/whatsapp-proxy-chart/templates/service.yaml b/charts/whatsapp-proxy-chart/templates/service.yaml
index c4b154d9..6e4d69fe 100644
--- a/charts/whatsapp-proxy-chart/templates/service.yaml
+++ b/charts/whatsapp-proxy-chart/templates/service.yaml
@@ -64,7 +64,6 @@ spec:
       protocol: TCP
       name: media
     {{- end}}
-
     {{- if .Values.service.media_proxy_port }}
     - port: {{ .Values.service.media_proxy_port }}
       targetPort: 7777

From ccb8989bfa443933159d694fc7cf9ced368229f4 Mon Sep 17 00:00:00 2001
From: Peixian Wang <peixian@users.noreply.github.com>
Date: Tue, 15 Apr 2025 10:52:31 -0400
Subject: [PATCH 02/19] Fix jq healthcheck to account for nulls (#370)

---
 proxy/src/healthcheck.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/proxy/src/healthcheck.sh b/proxy/src/healthcheck.sh
index 0e651714..ca5b9eb0 100644
--- a/proxy/src/healthcheck.sh
+++ b/proxy/src/healthcheck.sh
@@ -11,7 +11,7 @@ curl -s -w 2 "http://127.0.0.1:8199/;csv" > /tmp/stats.txt || exit 1
 # Filter out the lines for *.whatsapp_net backend status
 # Select the "check_desc" field (Description of the check result)
 # and take all results that do NOT equal "Layer4 check passed" from HAProxy
-RESULT=$(tail -n +1 /tmp/stats.txt | jq -R 'split(",")' | jq -c '. | select(.[1] | contains("whatsapp_net"))' | jq --raw-output '.[65]| select(. | test("Layer4 check passed") | not)')
+RESULT=$(tail -n +1 /tmp/stats.txt | jq -R 'split(",")' | jq -c 'select(.[1] != null) | select(.[1] | contains("whatsapp_net"))' | jq --raw-output '.[65]| select(. | test("Layer4 check passed") | not)')
 
 # # CSV output header row:
 # # ["# pxname","svname","qcur","qmax","scur","smax","slim","stot","bin","bout","dreq","dresp","ereq","econ","eresp","wretr","wredis","status","weight","act","bck","chkfail","chkdown","lastchg","downtime","qlimit","pid","iid","sid","throttle","lbtot","tracked","type","rate","rate_lim","rate_max","check_status","check_code","check_duration","hrsp_1xx","hrsp_2xx","hrsp_3xx","hrsp_4xx","hrsp_5xx","hrsp_other","hanafail","req_rate","req_rate_max","req_tot","cli_abrt","srv_abrt","comp_in","comp_out","comp_byp","comp_rsp","lastsess","last_chk","last_agt","qtime","ctime","rtime","ttime","agent_status","agent_code","agent_duration","check_desc","agent_desc","check_rise","check_fall","check_health","agent_rise","agent_fall","agent_health","addr","cookie","mode","algo","conn_rate","conn_rate_max","conn_tot","intercepted","dcon","dses","wrew","connect","reuse","cache_lookups","cache_hits","srv_icur","src_ilim","qtime_max","ctime_max","rtime_max","ttime_max","eint","idle_conn_cur","safe_conn_cur","used_conn_cur","need_conn_est","uweight","agg_server_check_status","-","ssl_sess","ssl_reused_sess","ssl_failed_handshake","h2_headers_rcvd","h2_data_rcvd","h2_settings_rcvd","h2_rst_stream_rcvd","h2_goaway_rcvd","h2_detected_conn_protocol_errors","h2_detected_strm_protocol_errors","h2_rst_stream_resp","h2_goaway_resp","h2_open_connections","h2_backend_open_streams","h2_total_connections","h2_backend_total_streams",""]
@@ -24,4 +24,3 @@ then
 fi
 
 exit 0;
-

From cbad802166d9674a0095cd4062d4753fe232adaf Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Tue, 27 Jan 2026 13:18:06 -0800
Subject: [PATCH 03/19] provide advice for exposing proxy publicly (#459)

---
 README.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/README.md b/README.md
index 4f778205..c78dd222 100644
--- a/README.md
+++ b/README.md
@@ -113,6 +113,23 @@ on connections. If you have a network load balancer you can preserve the client
 2. 8443: Standard web traffic, encrypted (HTTPS) with PROXY protocol expected
 3. 8222: Jabber protocol traffic (WhatsApp default) with PROXY protocol expected
 
+## Adverse network conditions
+
+The proxy container exposes many ports for different functionality.
+When deploying the container to work around adverse network conditions,
+this flexibility may actually be undesirable,
+since a proxy instance may be uniquely identified by some of the non-standard ports.
+
+To provide basic functionality (messages and media),
+we recommend exposing only ports 443 and 587 on the proxy endpoint.
+
+This is required **only if exposing the proxy on a public IP address**,
+and not needed for users connecting to the proxy through a VPN or a private connection.
+
+> Note: When using the proxy enabled HTTPS port (8443),
+> make sure port 8443 is exposed publicly as port 443,
+> to ensure WhatsApp clients can connect to port 443.
+
 ## Certificate generation for SSL encrypted ports
 
 Ports 443 and 8443 are protected by a self-signed encryption certificate generated at container start time. There are some custom options should you wish to tweak the settings of the generated certificates

From 09adfd7cf717a4a373a0aa4c36ba94c5ef56fd54 Mon Sep 17 00:00:00 2001
From: Peixian Wang <peixian@users.noreply.github.com>
Date: Mon, 6 Apr 2026 15:07:36 -0400
Subject: [PATCH 04/19] Mount HAProxy config via ConfigMap instead of baking
 into image (#483)

---
 charts/whatsapp-proxy-chart/Chart.yaml        |  2 +-
 .../templates/configmap.yaml                  | 13 ++++
 .../templates/deployment.yaml                 | 14 +++-
 charts/whatsapp-proxy-chart/values.yaml       | 72 +++++++++++++++++++
 4 files changed, 98 insertions(+), 3 deletions(-)
 create mode 100644 charts/whatsapp-proxy-chart/templates/configmap.yaml

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 3dff6131..f8a20ac4 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.2.0
+version: 1.3.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/configmap.yaml b/charts/whatsapp-proxy-chart/templates/configmap.yaml
new file mode 100644
index 00000000..656fd431
--- /dev/null
+++ b/charts/whatsapp-proxy-chart/templates/configmap.yaml
@@ -0,0 +1,13 @@
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# License found in the LICENSE file in the root directory
+# of this source tree.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
+  labels:
+    {{- include "whatsapp-proxy-chart.labels" . | nindent 4 }}
+data:
+  haproxy.cfg: |
+    {{- .Values.haproxyConfig | nindent 4 }}
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index a5222d1f..d6c92d2d 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -17,10 +17,11 @@ spec:
       {{- include "whatsapp-proxy-chart.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
       annotations:
+        checksum/haproxy-config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
       labels:
         {{- include "whatsapp-proxy-chart.selectorLabels" . | nindent 8 }}
     spec:
@@ -94,6 +95,15 @@ spec:
           env:
             - name: "PUBLIC_IP"
               value: "{{ .Values.public_ip }}"
+          volumeMounts:
+            - name: haproxy-config
+              mountPath: /usr/local/etc/haproxy/haproxy.cfg
+              subPath: haproxy.cfg
+              readOnly: true
+      volumes:
+        - name: haproxy-config
+          configMap:
+            name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 52bab0c0..e9426b9f 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -102,3 +102,75 @@ nodeSelector: {}
 tolerations: []
 
 affinity: {}
+
+# HAProxy configuration file contents.
+# Edit this to customize proxy behavior without rebuilding the image.
+haproxyConfig: |
+  global
+    tune.bufsize 4096
+    maxconn 27500
+    spread-checks 5
+    ssl-server-verify none
+
+  defaults
+    mode tcp
+    timeout client-fin 1s
+    timeout server-fin 1s
+    timeout connect 5s
+    timeout client 200s
+    timeout server 200s
+    default-server inter 10s fastinter 1s downinter 3s error-limit 50
+
+  listen stats
+    bind :::8199
+    mode http
+    http-request use-service prometheus-exporter if { path /metrics }
+    stats uri /
+
+  frontend haproxy_v4_http
+    maxconn 27495
+    #PUBLIC_IP
+
+    bind ipv4@*:80
+    bind ipv4@*:8080 accept-proxy
+
+    default_backend wa_http
+
+  frontend haproxy_v4_https
+    maxconn 27495
+    #PUBLIC_IP
+
+    bind ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
+    bind ipv4@*:8443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem accept-proxy
+
+    default_backend wa
+
+  frontend haproxy_v4_xmpp
+    maxconn 27495
+    #PUBLIC_IP
+
+    bind ipv4@*:5222
+    bind ipv4@*:8222 accept-proxy
+
+    default_backend wa
+
+  frontend haproxy_v4_whatsapp_net
+    maxconn 27495
+    #PUBLIC_IP
+
+    bind ipv4@*:587
+    bind ipv4@*:7777
+
+    default_backend wa_whatsapp_net
+
+  backend wa_whatsapp_net
+    default-server check inter 60000 observe layer4
+    server whatsapp_net_443 whatsapp.net:443
+
+  backend wa
+    default-server check inter 60000 observe layer4 send-proxy
+    server g_whatsapp_net_5222 g.whatsapp.net:5222
+
+  backend wa_http
+    default-server check inter 60000 observe layer4 send-proxy
+    server g_whatsapp_net_80 g.whatsapp.net:80

From f850a922e4195a579962a73b5de9e522d9322acb Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Mon, 29 Jun 2026 15:54:24 -0700
Subject: [PATCH 05/19] Make HAProxy maxconn and config values templatable
 (v1.3.1) (#519)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 charts/whatsapp-proxy-chart/Chart.yaml        |   2 +-
 .../templates/configmap.yaml                  |   2 +-
 charts/whatsapp-proxy-chart/values.yaml       | 136 +++++++++++++-----
 3 files changed, 99 insertions(+), 41 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index f8a20ac4..998f604f 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.0
+version: 1.3.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/configmap.yaml b/charts/whatsapp-proxy-chart/templates/configmap.yaml
index 656fd431..10ca845b 100644
--- a/charts/whatsapp-proxy-chart/templates/configmap.yaml
+++ b/charts/whatsapp-proxy-chart/templates/configmap.yaml
@@ -10,4 +10,4 @@ metadata:
     {{- include "whatsapp-proxy-chart.labels" . | nindent 4 }}
 data:
   haproxy.cfg: |
-    {{- .Values.haproxyConfig | nindent 4 }}
+    {{- tpl .Values.haproxyConfig . | nindent 4 }}
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index e9426b9f..77318132 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -103,74 +103,132 @@ tolerations: []
 
 affinity: {}
 
-# HAProxy configuration file contents.
-# Edit this to customize proxy behavior without rebuilding the image.
+# HAProxy tunables. These are interpolated into haproxyConfig below via `tpl`,
+# so individual values (e.g. maxconn) can be overridden per-deployment without
+# replacing the entire config blob.
+haproxy:
+  global:
+    tuneBufsize: 4096
+    maxconn: 27500
+    spreadChecks: 5
+    sslServerVerify: none
+  defaults:
+    mode: tcp
+    timeoutClientFin: 1s
+    timeoutServerFin: 1s
+    timeoutConnect: 5s
+    timeoutClient: 200s
+    timeoutServer: 200s
+    defaultServer: inter 10s fastinter 1s downinter 3s error-limit 50
+  stats:
+    bind: ":::8199"
+    mode: http
+    metricsPath: /metrics
+    uri: /
+  frontends:
+    haproxyV4Http:
+      maxconn: 27495
+      directBind: ipv4@*:80
+      proxyBind: ipv4@*:8080 accept-proxy
+      defaultBackend: wa_http
+    haproxyV4Https:
+      maxconn: 27495
+      directBind: ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
+      proxyBind: ipv4@*:8443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem accept-proxy
+      defaultBackend: wa
+    haproxyV4Xmpp:
+      maxconn: 27495
+      directBind: ipv4@*:5222
+      proxyBind: ipv4@*:8222 accept-proxy
+      defaultBackend: wa
+    haproxyV4WhatsappNet:
+      maxconn: 27495
+      directBind: ipv4@*:587
+      proxyBind: ipv4@*:7777
+      defaultBackend: wa_whatsapp_net
+  backends:
+    waWhatsappNet:
+      defaultServer: check inter 60000 observe layer4
+      serverName: whatsapp_net_443
+      serverAddress: whatsapp.net:443
+    wa:
+      defaultServer: check inter 60000 observe layer4 send-proxy
+      serverName: g_whatsapp_net_5222
+      serverAddress: g.whatsapp.net:5222
+    waHttp:
+      defaultServer: check inter 60000 observe layer4 send-proxy
+      serverName: g_whatsapp_net_80
+      serverAddress: g.whatsapp.net:80
+
+# HAProxy configuration file contents, rendered through `tpl` so the values
+# under `haproxy:` above are interpolated. Edit haproxy.* values (or override
+# them per-deployment) to customize proxy behavior without rebuilding the image.
 haproxyConfig: |
   global
-    tune.bufsize 4096
-    maxconn 27500
-    spread-checks 5
-    ssl-server-verify none
+    tune.bufsize {{ .Values.haproxy.global.tuneBufsize }}
+    maxconn {{ .Values.haproxy.global.maxconn }}
+    spread-checks {{ .Values.haproxy.global.spreadChecks }}
+    ssl-server-verify {{ .Values.haproxy.global.sslServerVerify }}
 
   defaults
-    mode tcp
-    timeout client-fin 1s
-    timeout server-fin 1s
-    timeout connect 5s
-    timeout client 200s
-    timeout server 200s
-    default-server inter 10s fastinter 1s downinter 3s error-limit 50
+    mode {{ .Values.haproxy.defaults.mode }}
+    timeout client-fin {{ .Values.haproxy.defaults.timeoutClientFin }}
+    timeout server-fin {{ .Values.haproxy.defaults.timeoutServerFin }}
+    timeout connect {{ .Values.haproxy.defaults.timeoutConnect }}
+    timeout client {{ .Values.haproxy.defaults.timeoutClient }}
+    timeout server {{ .Values.haproxy.defaults.timeoutServer }}
+    default-server {{ .Values.haproxy.defaults.defaultServer }}
 
   listen stats
-    bind :::8199
-    mode http
-    http-request use-service prometheus-exporter if { path /metrics }
-    stats uri /
+    bind {{ .Values.haproxy.stats.bind }}
+    mode {{ .Values.haproxy.stats.mode }}
+    http-request use-service prometheus-exporter if { path {{ .Values.haproxy.stats.metricsPath }} }
+    stats uri {{ .Values.haproxy.stats.uri }}
 
   frontend haproxy_v4_http
-    maxconn 27495
+    maxconn {{ .Values.haproxy.frontends.haproxyV4Http.maxconn }}
     #PUBLIC_IP
 
-    bind ipv4@*:80
-    bind ipv4@*:8080 accept-proxy
+    bind {{ .Values.haproxy.frontends.haproxyV4Http.directBind }}
+    bind {{ .Values.haproxy.frontends.haproxyV4Http.proxyBind }}
 
-    default_backend wa_http
+    default_backend {{ .Values.haproxy.frontends.haproxyV4Http.defaultBackend }}
 
   frontend haproxy_v4_https
-    maxconn 27495
+    maxconn {{ .Values.haproxy.frontends.haproxyV4Https.maxconn }}
     #PUBLIC_IP
 
-    bind ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
-    bind ipv4@*:8443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem accept-proxy
+    bind {{ .Values.haproxy.frontends.haproxyV4Https.directBind }}
+    bind {{ .Values.haproxy.frontends.haproxyV4Https.proxyBind }}
 
-    default_backend wa
+    default_backend {{ .Values.haproxy.frontends.haproxyV4Https.defaultBackend }}
 
   frontend haproxy_v4_xmpp
-    maxconn 27495
+    maxconn {{ .Values.haproxy.frontends.haproxyV4Xmpp.maxconn }}
     #PUBLIC_IP
 
-    bind ipv4@*:5222
-    bind ipv4@*:8222 accept-proxy
+    bind {{ .Values.haproxy.frontends.haproxyV4Xmpp.directBind }}
+    bind {{ .Values.haproxy.frontends.haproxyV4Xmpp.proxyBind }}
 
-    default_backend wa
+    default_backend {{ .Values.haproxy.frontends.haproxyV4Xmpp.defaultBackend }}
 
   frontend haproxy_v4_whatsapp_net
-    maxconn 27495
+    maxconn {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.maxconn }}
     #PUBLIC_IP
 
-    bind ipv4@*:587
-    bind ipv4@*:7777
+    bind {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.directBind }}
+    bind {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.proxyBind }}
 
-    default_backend wa_whatsapp_net
+    default_backend {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.defaultBackend }}
 
   backend wa_whatsapp_net
-    default-server check inter 60000 observe layer4
-    server whatsapp_net_443 whatsapp.net:443
+    default-server {{ .Values.haproxy.backends.waWhatsappNet.defaultServer }}
+    server {{ .Values.haproxy.backends.waWhatsappNet.serverName }} {{ .Values.haproxy.backends.waWhatsappNet.serverAddress }}
 
   backend wa
-    default-server check inter 60000 observe layer4 send-proxy
-    server g_whatsapp_net_5222 g.whatsapp.net:5222
+    default-server {{ .Values.haproxy.backends.wa.defaultServer }}
+    server {{ .Values.haproxy.backends.wa.serverName }} {{ .Values.haproxy.backends.wa.serverAddress }}
 
   backend wa_http
-    default-server check inter 60000 observe layer4 send-proxy
-    server g_whatsapp_net_80 g.whatsapp.net:80
+    default-server {{ .Values.haproxy.backends.waHttp.defaultServer }}
+    server {{ .Values.haproxy.backends.waHttp.serverName }} {{ .Values.haproxy.backends.waHttp.serverAddress }}

From b3a0ed03b2ce9c01a271ae4b157ae9c212ef33f6 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:02:02 -0700
Subject: [PATCH 06/19] Add loadBalancerClass support to service template
 (#520)

---
 charts/whatsapp-proxy-chart/Chart.yaml             | 2 +-
 charts/whatsapp-proxy-chart/templates/service.yaml | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 998f604f..e34182ec 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.1
+version: 1.3.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/service.yaml b/charts/whatsapp-proxy-chart/templates/service.yaml
index 6e4d69fe..19bd15c2 100644
--- a/charts/whatsapp-proxy-chart/templates/service.yaml
+++ b/charts/whatsapp-proxy-chart/templates/service.yaml
@@ -15,6 +15,9 @@ metadata:
 
 spec:
   type: {{ .Values.service.type }}
+  {{- with .Values.service.loadBalancerClass }}
+  loadBalancerClass: {{ . | quote }}
+  {{- end }}
   ports:
     {{- if .Values.service.http_proxy_port }}
     - port: {{ .Values.service.http_proxy_port }}

From 140635a865a6cf1c5f036b38476302d1406b72ca Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Tue, 30 Jun 2026 09:54:36 -0700
Subject: [PATCH 07/19] Deliver HAProxy config via writable emptyDir so
 #PUBLIC_IP substitution works (v1.3.3) (#521)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 charts/whatsapp-proxy-chart/Chart.yaml        |  2 +-
 .../templates/deployment.yaml                 | 34 ++++++++++++++++---
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index e34182ec..0a16359e 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.2
+version: 1.3.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index d6c92d2d..57494e3f 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -32,6 +32,29 @@ spec:
       serviceAccountName: {{ include "whatsapp-proxy-chart.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+        # The container entrypoint substitutes #PUBLIC_IP -> `set-dst` in
+        # /usr/local/etc/haproxy/haproxy.cfg in place. A ConfigMap volume is
+        # always mounted read-only by the kubelet (the readOnly flag can't
+        # change that), which makes that in-place edit fail and leaves HAProxy
+        # advertising the pod's private IP. So seed a writable emptyDir with the
+        # image defaults (e.g. errors/) and overlay the ConfigMap haproxy.cfg.
+        - name: haproxy-config-init
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+              cp -a /usr/local/etc/haproxy/. /haproxy-runtime/
+              cp /haproxy-config-src/haproxy.cfg /haproxy-runtime/haproxy.cfg
+          volumeMounts:
+            - name: haproxy-config-src
+              mountPath: /haproxy-config-src
+              readOnly: true
+            - name: haproxy-config
+              mountPath: /haproxy-runtime
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -96,14 +119,17 @@ spec:
             - name: "PUBLIC_IP"
               value: "{{ .Values.public_ip }}"
           volumeMounts:
+            # Writable copy of the config dir (populated by the initContainer)
+            # so the entrypoint can edit haproxy.cfg in place, while keeping it
+            # at its canonical /usr/local/etc/haproxy/haproxy.cfg location.
             - name: haproxy-config
-              mountPath: /usr/local/etc/haproxy/haproxy.cfg
-              subPath: haproxy.cfg
-              readOnly: true
+              mountPath: /usr/local/etc/haproxy
       volumes:
-        - name: haproxy-config
+        - name: haproxy-config-src
           configMap:
             name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
+        - name: haproxy-config
+          emptyDir: {}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

From 0fb9d1da06210b81a396aeb111ac8af5a557f703 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Tue, 7 Jul 2026 16:54:39 -0700
Subject: [PATCH 08/19] Support extra volumes and volumeMounts in proxy
 deployment (v1.3.4) (#523)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 charts/whatsapp-proxy-chart/Chart.yaml                | 2 +-
 charts/whatsapp-proxy-chart/templates/deployment.yaml | 6 ++++++
 charts/whatsapp-proxy-chart/values.yaml               | 7 +++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 0a16359e..dd38f68e 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.3
+version: 1.3.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index 57494e3f..fa954022 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -124,12 +124,18 @@ spec:
             # at its canonical /usr/local/etc/haproxy/haproxy.cfg location.
             - name: haproxy-config
               mountPath: /usr/local/etc/haproxy
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
       volumes:
         - name: haproxy-config-src
           configMap:
             name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
         - name: haproxy-config
           emptyDir: {}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 77318132..96c7a590 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -103,6 +103,13 @@ tolerations: []
 
 affinity: {}
 
+# Extra volumes to attach to the pod, rendered as-is into the Deployment's
+# spec.template.spec.volumes
+extraVolumes: []
+
+# Extra volumeMounts for the HAProxy container.
+extraVolumeMounts: []
+
 # HAProxy tunables. These are interpolated into haproxyConfig below via `tpl`,
 # so individual values (e.g. maxconn) can be overridden per-deployment without
 # replacing the entire config blob.

From 7889b7df411ea7e6322f6cb3c9c7f739fa3a7578 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Tue, 7 Jul 2026 17:07:33 -0700
Subject: [PATCH 09/19] Fix HPA utilization calc by removing labels from test
 pod (#526)

---
 charts/whatsapp-proxy-chart/Chart.yaml                      | 2 +-
 .../templates/tests/test-connection.yaml                    | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index dd38f68e..403535e0 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.4
+version: 1.3.5
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/tests/test-connection.yaml b/charts/whatsapp-proxy-chart/templates/tests/test-connection.yaml
index c2f174ed..7c6d3e50 100644
--- a/charts/whatsapp-proxy-chart/templates/tests/test-connection.yaml
+++ b/charts/whatsapp-proxy-chart/templates/tests/test-connection.yaml
@@ -6,10 +6,12 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: "{{ include "whatsapp-proxy-chart.fullname" . }}-test-connection"
-  labels:
-    {{- include "whatsapp-proxy-chart.labels" . | nindent 4 }}
+  # Intentionally omit common/selector labels so this pod is not matched by the
+  # HPA's selector. This test pod has no resource requests, and including it
+  # would break the HPA's utilization calculation.
   annotations:
     "helm.sh/hook": test
+    "helm.sh/hook-delete-policy": hook-succeeded
 spec:
   containers:
     - name: wget

From ba3351fe9dbc3259aaa940706f37dcec64420218 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Thu, 9 Jul 2026 14:14:59 -0700
Subject: [PATCH 10/19] Add optional ServiceMonitor for HAProxy Prometheus
 metrics (v1.3.6) (#530)

---
 charts/whatsapp-proxy-chart/Chart.yaml        |  2 +-
 .../templates/servicemonitor.yaml             | 24 +++++++++++++++++++
 charts/whatsapp-proxy-chart/values.yaml       |  4 ++++
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 charts/whatsapp-proxy-chart/templates/servicemonitor.yaml

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 403535e0..10b2feda 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.5
+version: 1.3.6
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/servicemonitor.yaml b/charts/whatsapp-proxy-chart/templates/servicemonitor.yaml
new file mode 100644
index 00000000..8a85f1fb
--- /dev/null
+++ b/charts/whatsapp-proxy-chart/templates/servicemonitor.yaml
@@ -0,0 +1,24 @@
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# License found in the LICENSE file in the root directory
+# of this source tree.
+{{- if .Values.enableServiceMonitor }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "whatsapp-proxy-chart.fullname" . }}-servicemonitor
+  namespace: default
+  labels:
+    release: {{ .Values.prometheus.release }}
+spec:
+  endpoints:
+  - interval: 30s
+    path: /metrics
+    port: stats
+  namespaceSelector:
+    matchNames:
+    - default
+  selector:
+    matchLabels:
+      {{- include "whatsapp-proxy-chart.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 96c7a590..229fc286 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -110,6 +110,10 @@ extraVolumes: []
 # Extra volumeMounts for the HAProxy container.
 extraVolumeMounts: []
 
+enableServiceMonitor: false
+prometheus:
+  release: my-prometheus-release
+
 # HAProxy tunables. These are interpolated into haproxyConfig below via `tpl`,
 # so individual values (e.g. maxconn) can be overridden per-deployment without
 # replacing the entire config blob.

From cf014a3baab4e98f46ed8facd37c981ad28a68ed Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Fri, 10 Jul 2026 14:39:23 -0700
Subject: [PATCH 11/19] Add customMetrics support to HPA autoscaling (#531)

---
 charts/whatsapp-proxy-chart/Chart.yaml         | 2 +-
 charts/whatsapp-proxy-chart/templates/hpa.yaml | 3 +++
 charts/whatsapp-proxy-chart/values.yaml        | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 10b2feda..2b1ab0f8 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.6
+version: 1.3.7
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/hpa.yaml b/charts/whatsapp-proxy-chart/templates/hpa.yaml
index 49a41813..4f6f1fca 100644
--- a/charts/whatsapp-proxy-chart/templates/hpa.yaml
+++ b/charts/whatsapp-proxy-chart/templates/hpa.yaml
@@ -33,4 +33,7 @@ spec:
           type: Utilization
           averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
     {{- end }}
+    {{- with .Values.autoscaling.customMetrics }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 {{- end }}
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 229fc286..47d140c4 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -96,6 +96,7 @@ autoscaling:
   maxReplicas: 100
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
+  customMetrics: []
 
 nodeSelector: {}
 

From 913c81f038deac69f06ef8dba2f48b9bb864a600 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Fri, 10 Jul 2026 15:52:57 -0700
Subject: [PATCH 12/19] Consolidate wa backend servers and merge waHttp into wa
 (#532)

---
 charts/whatsapp-proxy-chart/Chart.yaml  |  2 +-
 charts/whatsapp-proxy-chart/values.yaml | 29 +++++++++++++++----------
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 2b1ab0f8..795c0d5a 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.7
+version: 1.3.8
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 47d140c4..31c18fa1 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -142,7 +142,7 @@ haproxy:
       maxconn: 27495
       directBind: ipv4@*:80
       proxyBind: ipv4@*:8080 accept-proxy
-      defaultBackend: wa_http
+      defaultBackend: wa
     haproxyV4Https:
       maxconn: 27495
       directBind: ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
@@ -165,12 +165,19 @@ haproxy:
       serverAddress: whatsapp.net:443
     wa:
       defaultServer: check inter 60000 observe layer4 send-proxy
-      serverName: g_whatsapp_net_5222
-      serverAddress: g.whatsapp.net:5222
-    waHttp:
-      defaultServer: check inter 60000 observe layer4 send-proxy
-      serverName: g_whatsapp_net_80
-      serverAddress: g.whatsapp.net:80
+      servers:
+        - name: g_whatsapp_net_5222
+          address: g.whatsapp.net:5222
+        - name: g_whatsapp_net_80
+          address: g.whatsapp.net:80
+        - name: g_whatsapp_net_443
+          address: g.whatsapp.net:443
+        - name: g_fallback_whatsapp_net_5222
+          address: g-fallback.whatsapp.net:5222
+        - name: g_fallback_whatsapp_net_80
+          address: g-fallback.whatsapp.net:80
+        - name: g_fallback_whatsapp_net_443
+          address: g-fallback.whatsapp.net:443
 
 # HAProxy configuration file contents, rendered through `tpl` so the values
 # under `haproxy:` above are interpolated. Edit haproxy.* values (or override
@@ -239,8 +246,6 @@ haproxyConfig: |
 
   backend wa
     default-server {{ .Values.haproxy.backends.wa.defaultServer }}
-    server {{ .Values.haproxy.backends.wa.serverName }} {{ .Values.haproxy.backends.wa.serverAddress }}
-
-  backend wa_http
-    default-server {{ .Values.haproxy.backends.waHttp.defaultServer }}
-    server {{ .Values.haproxy.backends.waHttp.serverName }} {{ .Values.haproxy.backends.waHttp.serverAddress }}
+    {{- range .Values.haproxy.backends.wa.servers }}
+    server {{ .name }} {{ .address }}
+    {{- end }}

From 8b06a45b7095ce4ed955db7c5820a18c94451696 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Tue, 21 Jul 2026 17:31:23 -0700
Subject: [PATCH 13/19] Support custom HAProxy frontend config and environment
 (#535)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 charts/whatsapp-proxy-chart/Chart.yaml        |  2 +-
 .../templates/deployment.yaml                 |  3 +++
 charts/whatsapp-proxy-chart/values.yaml       | 20 +++++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 795c0d5a..f4d3b68d 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.8
+version: 1.3.9
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index fa954022..e4852bd2 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -118,6 +118,9 @@ spec:
           env:
             - name: "PUBLIC_IP"
               value: "{{ .Values.public_ip }}"
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           volumeMounts:
             # Writable copy of the config dir (populated by the initContainer)
             # so the entrypoint can edit haproxy.cfg in place, while keeping it
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 31c18fa1..712f5479 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -111,6 +111,10 @@ extraVolumes: []
 # Extra volumeMounts for the HAProxy container.
 extraVolumeMounts: []
 
+# Extra environment variables for the HAProxy container. This can be used to
+# inject secrets with valueFrom.secretKeyRef without putting them in values.
+extraEnv: []
+
 enableServiceMonitor: false
 prometheus:
   release: my-prometheus-release
@@ -142,21 +146,25 @@ haproxy:
       maxconn: 27495
       directBind: ipv4@*:80
       proxyBind: ipv4@*:8080 accept-proxy
+      config: []
       defaultBackend: wa
     haproxyV4Https:
       maxconn: 27495
       directBind: ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
       proxyBind: ipv4@*:8443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem accept-proxy
+      config: []
       defaultBackend: wa
     haproxyV4Xmpp:
       maxconn: 27495
       directBind: ipv4@*:5222
       proxyBind: ipv4@*:8222 accept-proxy
+      config: []
       defaultBackend: wa
     haproxyV4WhatsappNet:
       maxconn: 27495
       directBind: ipv4@*:587
       proxyBind: ipv4@*:7777
+      config: []
       defaultBackend: wa_whatsapp_net
   backends:
     waWhatsappNet:
@@ -210,6 +218,9 @@ haproxyConfig: |
 
     bind {{ .Values.haproxy.frontends.haproxyV4Http.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4Http.proxyBind }}
+    {{- range .Values.haproxy.frontends.haproxyV4Http.config }}
+    {{ . }}
+    {{- end }}
 
     default_backend {{ .Values.haproxy.frontends.haproxyV4Http.defaultBackend }}
 
@@ -219,6 +230,9 @@ haproxyConfig: |
 
     bind {{ .Values.haproxy.frontends.haproxyV4Https.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4Https.proxyBind }}
+    {{- range .Values.haproxy.frontends.haproxyV4Https.config }}
+    {{ . }}
+    {{- end }}
 
     default_backend {{ .Values.haproxy.frontends.haproxyV4Https.defaultBackend }}
 
@@ -228,6 +242,9 @@ haproxyConfig: |
 
     bind {{ .Values.haproxy.frontends.haproxyV4Xmpp.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4Xmpp.proxyBind }}
+    {{- range .Values.haproxy.frontends.haproxyV4Xmpp.config }}
+    {{ . }}
+    {{- end }}
 
     default_backend {{ .Values.haproxy.frontends.haproxyV4Xmpp.defaultBackend }}
 
@@ -237,6 +254,9 @@ haproxyConfig: |
 
     bind {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.proxyBind }}
+    {{- range .Values.haproxy.frontends.haproxyV4WhatsappNet.config }}
+    {{ . }}
+    {{- end }}
 
     default_backend {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.defaultBackend }}
 

From 9b68605afd294d635dae2f10068dff0af0676d0a Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Wed, 22 Jul 2026 13:42:37 -0700
Subject: [PATCH 14/19] Avoid proxy rollouts on chart metadata changes (#538)

---
 charts/whatsapp-proxy-chart/Chart.yaml                | 2 +-
 charts/whatsapp-proxy-chart/templates/deployment.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index f4d3b68d..befd3ce6 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.9
+version: 1.3.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index e4852bd2..3a934472 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/haproxy-config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/haproxy-config: {{ tpl .Values.haproxyConfig . | sha256sum }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}

From daa9d09b03253f9d042a15a13cbd5073a1eb5d99 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:26:44 -0700
Subject: [PATCH 15/19] Send PROXY protocol v2 to backends by default (#539)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 charts/whatsapp-proxy-chart/Chart.yaml  | 2 +-
 charts/whatsapp-proxy-chart/values.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index befd3ce6..9eaed748 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.10
+version: 1.3.11
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 712f5479..0850c220 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -172,7 +172,7 @@ haproxy:
       serverName: whatsapp_net_443
       serverAddress: whatsapp.net:443
     wa:
-      defaultServer: check inter 60000 observe layer4 send-proxy
+      defaultServer: check inter 60000 observe layer4 send-proxy-v2
       servers:
         - name: g_whatsapp_net_5222
           address: g.whatsapp.net:5222

From b3b14fdd86d7412545ad5fe4fcb8502bf0437bc5 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Wed, 29 Jul 2026 12:01:47 -0700
Subject: [PATCH 16/19] Remove public IP rewriting from proxy image (#540)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 FAQ.md                               |  2 +-
 proxy/Dockerfile                     | 10 ++--
 proxy/ops/docker-compose.yml         |  2 -
 proxy/src/proxy_config.cfg           |  4 --
 proxy/src/set_public_ip_and_start.sh | 84 ----------------------------
 proxy/src/start.sh                   | 19 +++++++
 6 files changed, 25 insertions(+), 96 deletions(-)
 delete mode 100755 proxy/src/set_public_ip_and_start.sh
 create mode 100755 proxy/src/start.sh

diff --git a/FAQ.md b/FAQ.md
index cac9412f..30c2af96 100644
--- a/FAQ.md
+++ b/FAQ.md
@@ -10,7 +10,7 @@ git clone https://github.com/WhatsApp/proxy.git
 
 ## Common issues
 
-### (1) The container won't build on Windows with `set_public_ip_and_start.sh: Not found`
+### (1) The container won't build on Windows with `start.sh: Not found`
 
 This is likely a line encoding issue since the application is expecting unix-style line
 encoding (EOL not CRLF). This resolved in PR [72](https://github.com/WhatsApp/proxy/pull/72)
diff --git a/proxy/Dockerfile b/proxy/Dockerfile
index 288a45d9..da0d3561 100644
--- a/proxy/Dockerfile
+++ b/proxy/Dockerfile
@@ -22,9 +22,9 @@ RUN chmod +x /usr/local/bin/generate-certs.sh && \
     chown -R haproxy:haproxy /etc/haproxy/
 WORKDIR /
 
-# Copy the public-ip setting + sshd startup script
-COPY --chown=haproxy:haproxy src/set_public_ip_and_start.sh /usr/local/bin/set_public_ip_and_start.sh
-RUN chmod +x /usr/local/bin/set_public_ip_and_start.sh
+# Copy the startup script
+COPY --chown=haproxy:haproxy src/start.sh /usr/local/bin/start.sh
+RUN chmod +x /usr/local/bin/start.sh
 
 # Copy the HAProxy configuration
 COPY --chown=haproxy:haproxy src/proxy_config.cfg /usr/local/etc/haproxy/haproxy.cfg
@@ -54,5 +54,5 @@ EXPOSE 8199/tcp
 EXPOSE 587/tcp
 EXPOSE 7777/tcp
 
-# This is the startup command which also runs a background job to manage the WAPOX IPs
-CMD /usr/local/bin/set_public_ip_and_start.sh
+# Generate a runtime certificate and start HAProxy
+CMD ["/usr/local/bin/start.sh"]
diff --git a/proxy/ops/docker-compose.yml b/proxy/ops/docker-compose.yml
index 811636a3..7659283b 100644
--- a/proxy/ops/docker-compose.yml
+++ b/proxy/ops/docker-compose.yml
@@ -23,5 +23,3 @@ services:
       test: /usr/local/bin/healthcheck.sh
       interval: 10s
       start_period: 5s
-    environment:
-      - PUBLIC_IP=10.0.0.1
diff --git a/proxy/src/proxy_config.cfg b/proxy/src/proxy_config.cfg
index 889d9913..236b3451 100644
--- a/proxy/src/proxy_config.cfg
+++ b/proxy/src/proxy_config.cfg
@@ -55,7 +55,6 @@ listen stats
 # connections
 frontend haproxy_v4_http
   maxconn 27495
-  #PUBLIC_IP
 
   bind ipv4@*:80
   bind ipv4@*:8080 accept-proxy
@@ -64,7 +63,6 @@ frontend haproxy_v4_http
 
 frontend haproxy_v4_https
   maxconn 27495
-  #PUBLIC_IP
 
   bind ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
   bind ipv4@*:8443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem accept-proxy
@@ -73,7 +71,6 @@ frontend haproxy_v4_https
 
 frontend haproxy_v4_xmpp
   maxconn 27495
-  #PUBLIC_IP
 
   bind ipv4@*:5222
   bind ipv4@*:8222 accept-proxy
@@ -82,7 +79,6 @@ frontend haproxy_v4_xmpp
 
 frontend haproxy_v4_whatsapp_net
   maxconn 27495
-  #PUBLIC_IP
 
   bind ipv4@*:587
   bind ipv4@*:7777
diff --git a/proxy/src/set_public_ip_and_start.sh b/proxy/src/set_public_ip_and_start.sh
deleted file mode 100755
index 9ade79aa..00000000
--- a/proxy/src/set_public_ip_and_start.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/bin/bash
-# Copyright (c) Meta Platforms, Inc. and affiliates.
-#
-# License found in the LICENSE file in the root directory
-# of this source tree.
-
-## About:
-# This script replaces instances of #PUBLIC_IP in the HaProxy configuration files
-# with the real public ip. There's an order of priority here which is
-# 1. Environment variable
-# 2. AWS EC2 Metadata endpoint
-# 3. Third-party sources
-# If all fails, we'll just not set the destination IP address
-
-CONFIG_FILE="/usr/local/etc/haproxy/haproxy.cfg"
-
-## Custom function to use as curl wrapper
-# --silent: to reduce the nois eof response
-# --show-error: to show errors in the response
-# --fail: to fail on non-200 responses
-# --ipv4: to force ipv4 resolution
-# --max-time: to set a timeout
-function fetch() {
-  curl --silent --show-error --fail --ipv4 --max-time 2 "$@"
-}
-
-## PUBLIC_IP supplied from environment variable
-if [[ $PUBLIC_IP == '' ]]
-then
-    echo "[PROXYHOST] No public IP address was supplied as an environment variable."
-fi
-
-## PUBLIC_IP retrieved from AWS EC2 metadata endpoint
-if [[ $PUBLIC_IP == '' ]]
-then
-    # Attempt retrieval of the public ip from the meta-data instance
-    PUBLIC_IP=$(fetch http://169.254.169.254/latest/meta-data/public-ipv4)
-    if [[ $PUBLIC_IP == '' ]]
-    then
-        echo "[PROXYHOST] Failed to retrieve public ip address from AWS URI within 2s"
-    fi
-fi
-
-## PUBLIC_IP retrieved from third-party sources
-if [[ $PUBLIC_IP == '' ]]
-then
-    urls=(
-        'https://icanhazip.com/'
-        'https://ipinfo.io/ip'
-        'https://domains.google.com/checkip'
-    )
-
-    # Attempt retrieval of the public ip from the third-party sources
-    for url in "${urls[@]}"; do
-        PUBLIC_IP="$(fetch "${url}")" && break
-    done
-    if [[ $PUBLIC_IP == '' ]]
-    then
-        echo "[PROXYHOST] Failed to retrieve public ip address from third-party sources within 2s"
-    fi
-fi
-
-# Now if the public IP is available (test is for not-empty)
-# then replace the instances in all haproxy config lines
-if [[ -n "$PUBLIC_IP" ]]
-then
-    echo "[PROXYHOST] Public IP address ($PUBLIC_IP) in-place replacement occurring on $CONFIG_FILE"
-    # Replace all instances of #PUBLIC_IP with the
-    # haproxy configuration statement for the frontend which set's the destination
-    # ip to the public ip of the container (which is necessary to determine our IP's
-    # internally within WA)
-    sed -i "s/#PUBLIC\_IP/tcp-request connection set-dst ipv4($PUBLIC_IP)/g" $CONFIG_FILE
-fi
-
-# Setup a new, on-the-fly certificate for the HTTPS port (so this re-generates each restart)
-pushd /home/haproxy/certs
-/usr/local/bin/generate-certs.sh
-mv proxy.whatsapp.net.pem /etc/haproxy/ssl/proxy.whatsapp.net.pem
-chown haproxy:haproxy /etc/haproxy/ssl/proxy.whatsapp.net.pem
-popd
-
-# Start HAProxy
-haproxy -f "$CONFIG_FILE"
-
diff --git a/proxy/src/start.sh b/proxy/src/start.sh
new file mode 100755
index 00000000..30ad80b0
--- /dev/null
+++ b/proxy/src/start.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# License found in the LICENSE file in the root directory
+# of this source tree.
+
+set -e
+
+CONFIG_FILE="/usr/local/etc/haproxy/haproxy.cfg"
+
+# Generate a new certificate for the HTTPS port on each startup.
+pushd /home/haproxy/certs
+/usr/local/bin/generate-certs.sh
+mv proxy.whatsapp.net.pem /etc/haproxy/ssl/proxy.whatsapp.net.pem
+chown haproxy:haproxy /etc/haproxy/ssl/proxy.whatsapp.net.pem
+popd
+
+# Start HAProxy as the container's main process.
+exec haproxy -f "$CONFIG_FILE"

From 31f188827ac85eb49b5b3251dfe14475db55001f Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@users.noreply.github.com>
Date: Wed, 29 Jul 2026 13:38:10 -0700
Subject: [PATCH 17/19] Remove public IP rewriting from Helm chart (#541)

Co-authored-by: Brian Suh <bsuh@fb.com>
---
 charts/whatsapp-proxy-chart/Chart.yaml        |  2 +-
 .../templates/deployment.yaml                 | 40 +++----------------
 charts/whatsapp-proxy-chart/values.yaml       |  6 ---
 3 files changed, 7 insertions(+), 41 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/Chart.yaml b/charts/whatsapp-proxy-chart/Chart.yaml
index 9eaed748..ec849ec7 100644
--- a/charts/whatsapp-proxy-chart/Chart.yaml
+++ b/charts/whatsapp-proxy-chart/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.11
+version: 1.3.12
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index 3a934472..2bdec2c6 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -32,29 +32,6 @@ spec:
       serviceAccountName: {{ include "whatsapp-proxy-chart.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      initContainers:
-        # The container entrypoint substitutes #PUBLIC_IP -> `set-dst` in
-        # /usr/local/etc/haproxy/haproxy.cfg in place. A ConfigMap volume is
-        # always mounted read-only by the kubelet (the readOnly flag can't
-        # change that), which makes that in-place edit fail and leaves HAProxy
-        # advertising the pod's private IP. So seed a writable emptyDir with the
-        # image defaults (e.g. errors/) and overlay the ConfigMap haproxy.cfg.
-        - name: haproxy-config-init
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command:
-            - /bin/sh
-            - -c
-            - |
-              set -e
-              cp -a /usr/local/etc/haproxy/. /haproxy-runtime/
-              cp /haproxy-config-src/haproxy.cfg /haproxy-runtime/haproxy.cfg
-          volumeMounts:
-            - name: haproxy-config-src
-              mountPath: /haproxy-config-src
-              readOnly: true
-            - name: haproxy-config
-              mountPath: /haproxy-runtime
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -115,27 +92,22 @@ spec:
             periodSeconds: 30
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.extraEnv }}
           env:
-            - name: "PUBLIC_IP"
-              value: "{{ .Values.public_ip }}"
-            {{- with .Values.extraEnv }}
             {{- toYaml . | nindent 12 }}
-            {{- end }}
+          {{- end }}
           volumeMounts:
-            # Writable copy of the config dir (populated by the initContainer)
-            # so the entrypoint can edit haproxy.cfg in place, while keeping it
-            # at its canonical /usr/local/etc/haproxy/haproxy.cfg location.
             - name: haproxy-config
-              mountPath: /usr/local/etc/haproxy
+              mountPath: /usr/local/etc/haproxy/haproxy.cfg
+              subPath: haproxy.cfg
+              readOnly: true
             {{- with .Values.extraVolumeMounts }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
       volumes:
-        - name: haproxy-config-src
+        - name: haproxy-config
           configMap:
             name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
-        - name: haproxy-config
-          emptyDir: {}
         {{- with .Values.extraVolumes }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
diff --git a/charts/whatsapp-proxy-chart/values.yaml b/charts/whatsapp-proxy-chart/values.yaml
index 0850c220..0aeb635b 100644
--- a/charts/whatsapp-proxy-chart/values.yaml
+++ b/charts/whatsapp-proxy-chart/values.yaml
@@ -15,8 +15,6 @@ image:
   # Overrides the image tag whose default is the chart appVersion.
   tag: "latest"
 
-public_ip: "10.0.0.1"
-
 imagePullSecrets: {}
 nameOverride: ""
 fullnameOverride: ""
@@ -214,7 +212,6 @@ haproxyConfig: |
 
   frontend haproxy_v4_http
     maxconn {{ .Values.haproxy.frontends.haproxyV4Http.maxconn }}
-    #PUBLIC_IP
 
     bind {{ .Values.haproxy.frontends.haproxyV4Http.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4Http.proxyBind }}
@@ -226,7 +223,6 @@ haproxyConfig: |
 
   frontend haproxy_v4_https
     maxconn {{ .Values.haproxy.frontends.haproxyV4Https.maxconn }}
-    #PUBLIC_IP
 
     bind {{ .Values.haproxy.frontends.haproxyV4Https.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4Https.proxyBind }}
@@ -238,7 +234,6 @@ haproxyConfig: |
 
   frontend haproxy_v4_xmpp
     maxconn {{ .Values.haproxy.frontends.haproxyV4Xmpp.maxconn }}
-    #PUBLIC_IP
 
     bind {{ .Values.haproxy.frontends.haproxyV4Xmpp.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4Xmpp.proxyBind }}
@@ -250,7 +245,6 @@ haproxyConfig: |
 
   frontend haproxy_v4_whatsapp_net
     maxconn {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.maxconn }}
-    #PUBLIC_IP
 
     bind {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.directBind }}
     bind {{ .Values.haproxy.frontends.haproxyV4WhatsappNet.proxyBind }}

From c5bccb6d9e6167bfac789563f99fb02ee38ce2a2 Mon Sep 17 00:00:00 2001
From: Brian Suh <bsuh@fb.com>
Date: Wed, 29 Jul 2026 17:55:44 -0700
Subject: [PATCH 18/19] Declare all HAProxy container ports unconditionally

Summary:
- Always declare every port listened on by HAProxy in the container spec.
- Keep service port configuration limited to controlling Service exposure, since omitting a containerPort does not prevent the process from listening.

Test Plan:
- ==> Linting charts/whatsapp-proxy-chart

1 chart(s) linted, 0 chart(s) failed
- ---
# Source: whatsapp-proxy-chart/templates/serviceaccount.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: whatsapp-proxy
  labels:
    helm.sh/chart: whatsapp-proxy-chart-1.3.12
    app.kubernetes.io/name: whatsapp-proxy-chart
    app.kubernetes.io/instance: test
    app: test
    app.kubernetes.io/version: "1.16.0"
    app.kubernetes.io/managed-by: Helm
---
# Source: whatsapp-proxy-chart/templates/configmap.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-whatsapp-proxy-chart-haproxy
  labels:
    helm.sh/chart: whatsapp-proxy-chart-1.3.12
    app.kubernetes.io/name: whatsapp-proxy-chart
    app.kubernetes.io/instance: test
    app: test
    app.kubernetes.io/version: "1.16.0"
    app.kubernetes.io/managed-by: Helm
data:
  haproxy.cfg: |
    global
      tune.bufsize 4096
      maxconn 27500
      spread-checks 5
      ssl-server-verify none

    defaults
      mode tcp
      timeout client-fin 1s
      timeout server-fin 1s
      timeout connect 5s
      timeout client 200s
      timeout server 200s
      default-server inter 10s fastinter 1s downinter 3s error-limit 50

    listen stats
      bind :::8199
      mode http
      http-request use-service prometheus-exporter if { path /metrics }
      stats uri /

    frontend haproxy_v4_http
      maxconn 27495

      bind ipv4@*:80
      bind ipv4@*:8080 accept-proxy

      default_backend wa

    frontend haproxy_v4_https
      maxconn 27495

      bind ipv4@*:443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem
      bind ipv4@*:8443 ssl crt /etc/haproxy/ssl/proxy.whatsapp.net.pem accept-proxy

      default_backend wa

    frontend haproxy_v4_xmpp
      maxconn 27495

      bind ipv4@*:5222
      bind ipv4@*:8222 accept-proxy

      default_backend wa

    frontend haproxy_v4_whatsapp_net
      maxconn 27495

      bind ipv4@*:587
      bind ipv4@*:7777

      default_backend wa_whatsapp_net

    backend wa_whatsapp_net
      default-server check inter 60000 observe layer4
      server whatsapp_net_443 whatsapp.net:443

    backend wa
      default-server check inter 60000 observe layer4 send-proxy-v2
      server g_whatsapp_net_5222 g.whatsapp.net:5222
      server g_whatsapp_net_80 g.whatsapp.net:80
      server g_whatsapp_net_443 g.whatsapp.net:443
      server g_fallback_whatsapp_net_5222 g-fallback.whatsapp.net:5222
      server g_fallback_whatsapp_net_80 g-fallback.whatsapp.net:80
      server g_fallback_whatsapp_net_443 g-fallback.whatsapp.net:443
---
# Source: whatsapp-proxy-chart/templates/service.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
apiVersion: v1
kind: Service
metadata:
  name: test-whatsapp-proxy-chart
  labels:
    helm.sh/chart: whatsapp-proxy-chart-1.3.12
    app.kubernetes.io/name: whatsapp-proxy-chart
    app.kubernetes.io/instance: test
    app: test
    app.kubernetes.io/version: "1.16.0"
    app.kubernetes.io/managed-by: Helm
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb

spec:
  type: LoadBalancer
  ports:
    - port: 5222
      targetPort: 5222
      protocol: TCP
      name: jabber
    - port: 80
      targetPort: 80
      protocol: TCP
      name: http
    - port: 443
      targetPort: 443
      protocol: TCP
      name: https
    - port: 587
      targetPort: 587
      protocol: TCP
      name: media

  selector:
    app.kubernetes.io/name: whatsapp-proxy-chart
    app.kubernetes.io/instance: test
    app: test
---
# Source: whatsapp-proxy-chart/templates/deployment.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-whatsapp-proxy-chart
  labels:
    helm.sh/chart: whatsapp-proxy-chart-1.3.12
    app.kubernetes.io/name: whatsapp-proxy-chart
    app.kubernetes.io/instance: test
    app: test
    app.kubernetes.io/version: "1.16.0"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: whatsapp-proxy-chart
      app.kubernetes.io/instance: test
      app: test
  template:
    metadata:
      annotations:
        checksum/haproxy-config: 430df3ebfca341e61e0297d0ac17f0fff4524eec5fca23730a38270604186719
      labels:
        app.kubernetes.io/name: whatsapp-proxy-chart
        app.kubernetes.io/instance: test
        app: test
    spec:
      serviceAccountName: whatsapp-proxy
      securityContext:
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      containers:
        - name: whatsapp-proxy-chart
          securityContext:
            {}
          image: "facebook/whatsapp_proxy:latest"
          imagePullPolicy: IfNotPresent
          ports:
            - name: http-proxy
              containerPort: 8080
              protocol: TCP
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https-proxy
              containerPort: 8443
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
            - name: jabber-proxy
              containerPort: 8222
              protocol: TCP
            - name: jabber
              containerPort: 5222
              protocol: TCP
            - name: media
              containerPort: 587
              protocol: TCP
            - name: media-proxy
              containerPort: 7777
              protocol: TCP
            - name: stats
              containerPort: 8199
              protocol: TCP
          readinessProbe:
            exec:
              command:
              - /usr/local/bin/healthcheck.sh
            initialDelaySeconds: 30
            periodSeconds: 30
          resources:
            {}
          volumeMounts:
            - name: haproxy-config
              mountPath: /usr/local/etc/haproxy/haproxy.cfg
              subPath: haproxy.cfg
              readOnly: true
      volumes:
        - name: haproxy-config
          configMap:
            name: test-whatsapp-proxy-chart-haproxy
---
# Source: whatsapp-proxy-chart/templates/hpa.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
---
# Source: whatsapp-proxy-chart/templates/ingress.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
---
# Source: whatsapp-proxy-chart/templates/servicemonitor.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
---
# Source: whatsapp-proxy-chart/templates/tests/test-connection.yaml
# Copyright (c) Meta Platforms, Inc. and affiliates.
#
# License found in the LICENSE file in the root directory
# of this source tree.
apiVersion: v1
kind: Pod
metadata:
  name: "test-whatsapp-proxy-chart-test-connection"
  # Intentionally omit common/selector labels so this pod is not matched by the
  # HPA's selector. This test pod has no resource requests, and including it
  # would break the HPA's utilization calculation.
  annotations:
    "helm.sh/hook": test
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  containers:
    - name: wget
      image: busybox
      command: ['wget']
      args: ['test-whatsapp-proxy-chart:']
  restartPolicy: Never
---
 .../templates/deployment.yaml                  | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/charts/whatsapp-proxy-chart/templates/deployment.yaml b/charts/whatsapp-proxy-chart/templates/deployment.yaml
index 2bdec2c6..40f8f1b3 100644
--- a/charts/whatsapp-proxy-chart/templates/deployment.yaml
+++ b/charts/whatsapp-proxy-chart/templates/deployment.yaml
@@ -39,51 +39,33 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
-            {{- if .Values.service.http_proxy_port }}
             - name: http-proxy
               containerPort: 8080
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.http_port }}
             - name: http
               containerPort: 80
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.https_proxy_port }}
             - name: https-proxy
               containerPort: 8443
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.https_port }}
             - name: https
               containerPort: 443
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.jabber_proxy_port }}
             - name: jabber-proxy
               containerPort: 8222
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.jabber_port }}
             - name: jabber
               containerPort: 5222
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.media_port }}
             - name: media
               containerPort: 587
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.media_proxy_port}}
             - name: media-proxy
               containerPort: 7777
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.stats_port }}
             - name: stats
               containerPort: 8199
               protocol: TCP
-            {{- end}}
           readinessProbe:
             exec:
               command:

From 7d2494d71c541ef2a70f834d3ad89b44764ca474 Mon Sep 17 00:00:00 2001
From: jonokalender-coder <jonokalender@gmail.com>
Date: Sun, 30 Aug 2026 19:02:18 +0700
Subject: [PATCH 19/19] Rename ci.yml to ci.yml

---
 .github/workflows/{ci.yml => ci.ym} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{ci.yml => ci.ym} (100%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.ym
similarity index 100%
rename from .github/workflows/ci.yml
rename to .github/workflows/ci.ym