Flag to disable TLS handling by proxy

[ebariaux]

Allows to deploy HAProxy but terminate the TLS connections before entering the proxy container.

[Copilot]

Pull request overview

Adds support for deployments where TLS is terminated upstream of the proxy container (e.g., ALB/NLB/Ingress), so HAProxy can run with plain HTTP/TCP while still forwarding the expected X-Forwarded-* headers.

Changes:

• Add an edge-terminated HAProxy config that removes local TLS/cert usage and MQTT TLS handling.
• Introduce DISABLE_ACME to skip certbot initialization and renewal logic in entrypoint.sh.
• Document the new deployment mode and config selection in README.md, and ship the new config in the image.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
haproxy-edge-terminated-tls.cfg	New HAProxy config for plain HTTP + plain TCP MQTT when TLS is terminated upstream.
entrypoint.sh	Adds DISABLE_ACME gating for certbot/cron initialization and auto-renew behavior.
README.md	Documents DISABLE_ACME and provides setup steps for edge-terminated TLS.
Dockerfile	Copies the new HAProxy config into the image.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.