diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..966230b
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,35 @@
+name: Smoke test
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - run: echo "CONTROL_PASSWORD=test-$(openssl rand -base64 12)" > .env
+      - run: docker compose up -d --build --scale tor=3
+      - name: Wait for Tor bootstrap
+        run: sleep 120
+      - name: Test proxy
+        run: |
+          result=$(curl --socks5-hostname 127.0.0.1:1080 -s --max-time 30 https://check.torproject.org/api/ip)
+          echo "check.torproject.org: $result"
+          echo "$result" | grep -q '"IsTor":[ ]*true' || { echo "FAIL: not Tor exit"; exit 1; }
+      - name: Test DNS leak
+        run: |
+          status=$(curl --socks5-hostname 127.0.0.1:1080 -s -o /dev/null -w "%{http_code}" --max-time 30 https://dnsleaktest.com)
+          echo "dnsleaktest.com: HTTP $status"
+          [ "$status" = "200" ] || { echo "FAIL: HTTP $status"; exit 1; }
+      - name: Show backends
+        run: |
+          docker compose exec discovery bash -c 'echo "show servers state tor_pool" | socat - tcp:haproxy:5555' | awk '!/^#/ && NF>0 {print $4, $5, "op="$6}' || true
+          docker compose logs discovery --since 10m | grep -c "Only servers in maintenance mode" | xargs -I{} echo "errors: {}"
+      - name: Logs on failure
+        if: failure()
+        run: |
+          docker compose logs --tail 50 discovery
+          docker compose logs --tail 20 haproxy
diff --git a/.gitignore b/.gitignore
index b1ef287..b072dbf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,4 +16,6 @@ tor_data/
 # Docker artifacts
 *.tar
 
-docs/plans
\ No newline at end of file
+docs/plans
+docs/resources
+docs/reports
\ No newline at end of file
diff --git a/config/haproxy/Dockerfile b/config/haproxy/Dockerfile
index 97efe45..529869b 100644
--- a/config/haproxy/Dockerfile
+++ b/config/haproxy/Dockerfile
@@ -1,6 +1,6 @@
 FROM haproxy:3.0-alpine@sha256:dee54db8b27cd6c21519ea4f0ba0604f3742e8e7369bc16fb5b69133dec3f47f
 
-COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
+COPY haproxy.cfg.template /usr/local/etc/haproxy/haproxy.cfg
 
 HEALTHCHECK --interval=15s --timeout=3s --retries=2 \
     CMD nc -z 127.0.0.1 1080 || exit 1
diff --git a/config/haproxy/haproxy.cfg.template b/config/haproxy/haproxy.cfg.template
index 2d2073b..8f9a946 100644
--- a/config/haproxy/haproxy.cfg.template
+++ b/config/haproxy/haproxy.cfg.template
@@ -1,12 +1,13 @@
 global
     maxconn 4096
-    log stdout format raw local0
+    log stdout format raw local0 info
     stats socket ipv4@0.0.0.0:5555 level admin
 
 defaults
     mode tcp
     log global
     option tcplog
+    log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %si:%sp %ac/%fc/%bc/%sc/%rc %sq/%bq"
     timeout connect 10s
     timeout client 120s
     timeout server 120s
@@ -27,4 +28,4 @@ listen stats
     mode http
     stats enable
     stats uri /stats
-    stats refresh 10s
+    stats refresh 1s