GeezerVison

Replace nginx L7 reverse proxy with HAProxy in TCP mode. This eliminates
HTTP-level inspection so all protocols (HTTP, WebSocket, gRPC, arbitrary
TCP) work transparently after TLS termination.

Key changes:
- Dockerfile: nginx base -> haproxy:3.1-bookworm, master-worker mode
- entrypoint.sh: generate haproxy.cfg instead of nginx conf, support
  ROUTING_MAP env var for multi-domain SNI-based routing
- renewal-daemon.sh: graceful reload via SIGUSR2 instead of nginx -s reload
- New build-combined-pems.sh: concat fullchain+privkey for HAProxy PEM format
- functions.sh: sanitize_target_endpoint accepts bare host:port
- Evidence serving: payload inspection on port 443 (default, opt-out via
  EVIDENCE_SERVER=false) + shared /evidences volume for backend serving
- Configurable L4 tuning: MAXCONN, TIMEOUT_CONNECT/CLIENT/SERVER
- Drop L7-only env vars (CLIENT_MAX_BODY_SIZE, PROXY_*_TIMEOUT) with warnings

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Deploys dstack-ingress + nginx backend to a Phala CVM via phala CLI,
verifies TLS termination, TCP pass-through, evidence serving, and
HTTP/2 ALPN negotiation, then cleans up automatically.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Fixes discovered during Phala CVM deployment:
- Remove ALPN advertisement from haproxy bind (pure L4 proxy shouldn't
  promise application-layer protocols; caused HTTP/2 mismatch with
  HTTP/1.1 backends). ALPN now configurable via env var.
- Add http-request replace-path in evidence backend to strip /evidences
  prefix (Python http.server saw /evidences/evidences/)
- Fix e2e test: use --resolve for DNS, --http1.1 for curl, robust TLS
  version detection, grep IPs from dig output, echo y for delete prompt
- Update pinned-packages.txt for haproxy base image

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

- Add multi-domain test: whoami (HTTP/1.1) + grpcbin (gRPC/H2) backends
- Use ROUTING_MAP with SNI-based routing to test multi-backend support
- Add comma-separated ROUTING_MAP parsing (phala CLI -e flattens newlines)
- Test HTTP/2 against h2c-capable backend (grpcbin), not HTTP/1.1-only whoami
- Verify gRPC reflection, unary call, and SNI routing separation
- All 17 tests pass on live Phala CVM deployment

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

- Factor common global/defaults/frontend config into emit_haproxy_preamble()
  and emit_evidence_backend() to eliminate duplication between single-domain
  and multi-domain setup functions
- Add sanitize_positive_integer() and sanitize_haproxy_timeout() validators;
  validate MAXCONN, TIMEOUT_CONNECT/CLIENT/SERVER, EVIDENCE_PORT at startup
- Fix renewal-daemon to log why HAProxy reload failed (missing PID file vs
  failed signal) instead of silently swallowing errors
- Move loop-scoped local declarations before the while loop in
  setup_haproxy_cfg_multi()
- Guard e2e test against wildcard DOMAIN input
- Wrap phala deploy in error check so test exits on deployment failure

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Pin haproxy base image by digest for reproducible builds
- Add USER root comment explaining why (haproxy defaults to uid 99)
- Add sanitize_alpn() validator; ALPN is now validated at startup
- Require time suffix on haproxy timeouts (bare numbers are milliseconds
  in HAProxy which is almost never what users intend)
- Remove `local` usage outside function scope in renewal-daemon.sh
- Document ALPN env var in README

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Address PR review feedback:
- Add TODO comments for image digest pinning in compose files
- Use literal domains in multi-domain compose example (avoid env var injection)
- Sanitize ROUTING_MAP domain/target values against haproxy config injection
- Replace single-threaded http.server with ThreadingTCPServer for evidence serving

Co-Authored-By: Claude Opus 4.6 <[email protected]>

The evidence file server was using an inline Python ThreadingTCPServer,
which is hacky and not battle-tested for production use. Replace it with
mini-httpd (1.30), a proven static file server by Jef Poskanzer (author
of thttpd). At 123 KB installed, it is the smallest proper HTTP server
in Debian bookworm that handles concurrent connections (fork-per-request).

Co-Authored-By: Claude Opus 4.6 <[email protected]>