diff --git a/docs/haproxy-install.md b/docs/haproxy-install.md
index 373fcca..3ea48b9 100644
--- a/docs/haproxy-install.md
+++ b/docs/haproxy-install.md
@@ -44,7 +44,7 @@ sudo haproxy -c -f /etc/haproxy/haproxy.cfg
 
    ```bash
    sudo cp ~/reverse-proxy/haproxy.cfg /etc/haproxy/haproxy.cfg
-   sudo cp ~/reverse-proxy/git-sac-allowed ~/reverse-proxy/1c-allowed ~/reverse-proxy/zabbix-allowed ~/reverse-proxy/syno-allowed ~/reverse-proxy/rds-allowed-static /etc/haproxy/
+   sudo cp ~/reverse-proxy/git-sac-allowed ~/reverse-proxy/1c-allowed ~/reverse-proxy/zabbix-allowed ~/reverse-proxy/syno-allowed ~/reverse-proxy/rds-allowed-static ~/reverse-proxy/stats-allowed /etc/haproxy/
    sudo install -m 0755 ~/reverse-proxy/scripts/haproxy-rds-allowed-deploy.sh ~/reverse-proxy/scripts/haproxy_ru_ipdeny_lib.sh /usr/local/bin/
    sudo /usr/local/bin/haproxy-rds-allowed-deploy.sh
    sudo cp ~/reverse-proxy/scripts/haproxy-rds-allowed.cron /etc/cron.d/haproxy-rds-allowed
diff --git a/haproxy.cfg b/haproxy.cfg
index fd54704..c5b6243 100644
--- a/haproxy.cfg
+++ b/haproxy.cfg
@@ -1,5 +1,5 @@
 # HAProxy — периметровый reverse-proxy для kalinamall.ru
-# Config version: 0.7.6
+# Config version: 0.7.7
 # Режим: TCP + SNI на 443 (TLS end-to-end, сертификаты на бэкендах)
 # HTTP на 80: zabbix.kalinamall.ru → 192.168.160.53 (allowlist zabbix-allowed)
 #
@@ -40,7 +40,6 @@ frontend fe_https_sni
     mode tcp
     option tcplog
     log-format '{"time":"%t","client":"%ci","port":%cp,"fe":"%f","be":"%b","srv":"%s","sni":%{+Q}[capture.req.hdr(0)],"bytes":%B,"term":"%tsc","tw":%Tw,"tc":%Tc,"tt":%Tt}'
-
     tcp-request inspect-delay 5s
     tcp-request content capture req.ssl_sni len 128
     tcp-request content accept if { req_ssl_hello_type 1 }
@@ -152,12 +151,18 @@ backend be_ksmg_smtp
     server ksmg 192.168.160.57:25 check
 
 # -----------------------------------------------------------------------------
-# Опционально: статистика (раскомментируйте и задайте пароль)
+# Статистика HAProxy — только LAN/admin (allowlist stats-allowed)
+# Пароль stats auth задаётся на сервере (/etc/haproxy/haproxy.cfg), не в GitHub.
 # -----------------------------------------------------------------------------
-# frontend fe_stats
-#     bind *:8404
-#     mode http
-#     stats enable
-#     stats uri /stats
-#     stats refresh 10s
-#     stats auth admin:CHANGEME
+
+frontend fe_stats
+    bind 192.168.160.117:8404
+    mode http
+    option httplog
+    acl src_stats_allowed src -f /etc/haproxy/stats-allowed
+    http-request deny deny_status 403 if !src_stats_allowed
+    stats enable
+    stats uri /stats
+    stats refresh 10s
+    stats auth admin:CHANGEME
+    # stats hide-version
diff --git a/stats-allowed b/stats-allowed
new file mode 100644
index 0000000..5376bc0
--- /dev/null
+++ b/stats-allowed
@@ -0,0 +1,5 @@
+# HAProxy stats (:8404) — src ACL для fe_stats
+192.168.128.0/17
+5.100.81.121
+109.109.217.150
+109.110.54.2