From 67c5180168a4d3e74be582050e625d30b98a54d2 Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Wed, 27 May 2026 07:36:31 +0200
Subject: [PATCH] fix(haproxy-stats): add stats socket to template + fix safeAt
 index-0 bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two root causes for Dashboard backends not showing:
1. haproxy.cfg.tpl had no stats socket directive → /run/haproxy/admin.sock
   never created → handler got "connection refused" → empty array returned.
   Fixed: added stats socket /run/haproxy/admin.sock mode 0660 level admin.
2. safeAt() used i<=0 instead of i<0 → pxname (column 0) always returned ""
   → all backend names were empty in the API response.
After upgrade: HAProxy reload (triggered by any domain/backend save, or
edgeguard-ctl render-config) will create the socket. v1.1.113.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                            | 2 +-
 cmd/edgeguard-api/main.go          | 2 +-
 cmd/edgeguard-ctl/main.go          | 2 +-
 cmd/edgeguard-scheduler/main.go    | 2 +-
 internal/handlers/haproxy_stats.go | 2 +-
 internal/haproxy/haproxy.cfg.tpl   | 3 +++
 6 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/VERSION b/VERSION
index 1b5cd17..d1887a0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.112
+1.1.113
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 96ac434..daefa4a 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.112"
+var version = "1.1.113"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 9ebbe5f..c8384b8 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.112"
+var version = "1.1.113"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index 8565a18..8da6e19 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.112"
+var version = "1.1.113"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/handlers/haproxy_stats.go b/internal/handlers/haproxy_stats.go
index bb954ec..4a043c7 100644
--- a/internal/handlers/haproxy_stats.go
+++ b/internal/handlers/haproxy_stats.go
@@ -135,7 +135,7 @@ func (h *HAProxyStatsHandler) Stats(c *gin.Context) {
 }
 
 func safeAt(fields []string, i int) string {
-	if i <= 0 || i >= len(fields) {
+	if i < 0 || i >= len(fields) {
 		return ""
 	}
 	return fields[i]
diff --git a/internal/haproxy/haproxy.cfg.tpl b/internal/haproxy/haproxy.cfg.tpl
index ddd1799..0dbb3f1 100644
--- a/internal/haproxy/haproxy.cfg.tpl
+++ b/internal/haproxy/haproxy.cfg.tpl
@@ -15,6 +15,9 @@ global
     # Ohne dieses Flag verweigert HAProxy `bind quic4@…` mit "this SSL
     # library does not support the QUIC protocol".
     limited-quic
+    # Runtime-API-Socket für edgeguard-api (show stat, show info, …).
+    # mode 0660 + group haproxy → edgeguard-user (in haproxy-group) kann lesen.
+    stats socket /run/haproxy/admin.sock mode 0660 level admin expose-fd listeners
 
 defaults
     log     global