feat(ingress): opt-in PROXY protocol for the client address

[kingsleydon]

Why

The gateway relays TCP, so HAProxy sees every connection as coming from the gateway, and the backend sees it as coming from HAProxy. Apps behind dstack-ingress therefore can't rate-limit, log, or block by client address; all clients share one address.

The dstack gateway already supports the fix. With the app's port_policy set to {"port": 443, "pp": true} (Phala Cloud: the "Proxy protocol (pp)" switch), the gateway prepends a PROXY protocol header carrying the client's address. Gateway support landed in 87ce31cd and shipped in gateway 0.5.9. dstack-ingress is the missing hop: its public bind doesn't read the header, and its backends don't receive one.

What

Two opt-in switches, both defaulting to false. With both off, the generated config is unchanged.

• ACCEPT_PROXY_PROTOCOL=true adds accept-proxy to the public bind:

  • tls_peek in tls-alpn-01 mode;
  • tls_in in dns-01 mode.

  HAProxy then uses the header's address everywhere, including in logs. A connection without the header is refused, so the gateway's pp and this switch have to change in the same deployment.

• SEND_PROXY_PROTOCOL=true adds send-proxy-v2 to the app backends, for both TARGET_ENDPOINT and ROUTING_MAP. For connections accepted with accept-proxy, HAProxy advertises the client's address. The ACME responder and the evidence backend never get a header.

• In tls-alpn-01 mode the hop from tls_peek to the loopback TLS frontend already uses send-proxy-v2 / accept-proxy, so the client's address survives it unchanged.

• Both values are validated by a new sanitize_boolean; anything other than true or false stops startup.

• README: two env table rows and a "Client address (PROXY protocol)" section, covering the gateway side and the backend side (Caddy's proxy_protocol listener wrapper, nginx's proxy_protocol with set_real_ip_from).

Tests

• scripts/tests/test_proxy_protocol.sh <image> (new, in the style of test_x25519mlkem768.sh). It builds the config with the real haproxy-lib.sh helpers and runs HAProxy, checking that:

  • the default config has neither keyword;
  • with both switches on, a connection carrying a PROXY v2 header from 203.0.113.9 reaches the backend as 203.0.113.9;
  • a connection without a header is refused.

  All pass against 2.6 with this branch's scripts/ copied in.

• scripts/tests/test_sanitizers.sh now covers sanitize_boolean. All pass.

• shellcheck -x reports no new findings against main, and the new test is clean.

Not tested here: a real CVM behind a gateway (tier 3 in TESTING.md). We intend to run that on our deployment, which will be the first to enable pp.

🤖 Generated with Claude Code