Merge pull request #88 from Dstack-TEE/vk/d9b5-dstack-ingress-2

dstack-ingress 2.0: nginx → haproxy L4 TCP proxy

Author: kvinwang

custom-domain/dstack-ingress/Dockerfile

@@ -1,4 +1,8 @@
-FROM nginx@sha256:b6653fca400812e81569f9be762ae315db685bc30b12ddcdc8616c63a227d3ca
+FROM haproxy@sha256:49a0a0d6f0b8b7e59c233b06eefab1564f2c8d64f673554d368fd7d2ab4b2c2d
+
+# haproxy image runs as non-root (uid 99) by default; we need root for
+# certbot, DNS management, and writing to /etc/haproxy/certs.
+USER root
 
 RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt,ro \
     set -e; \
@@ -26,15 +30,17 @@ RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt
         python3.11-venv \
         curl \
         jq \
-        coreutils && \
+        coreutils \
+        mini-httpd && \
         rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
 
 RUN mkdir -p \
     /etc/letsencrypt \
     /var/www/certbot \
-    /usr/share/nginx/html \
-    /etc/nginx/conf.d \
-    /var/log/nginx
+    /etc/haproxy/certs \
+    /var/run/haproxy \
+    /var/lib/haproxy \
+    /evidences
 
 # Install scripts with deterministic permissions via bind mount
 RUN --mount=type=bind,source=scripts,target=/tmp/scripts,ro \
@@ -62,4 +68,4 @@ ENV PYTHONUNBUFFERED=1
 COPY --chmod=666 .GIT_REV /etc/
 
 ENTRYPOINT ["/scripts/entrypoint.sh"]
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["haproxy", "-W", "-f", "/etc/haproxy/haproxy.cfg"]