Harden haproxy config generation and input validation

- Factor common global/defaults/frontend config into emit_haproxy_preamble()
  and emit_evidence_backend() to eliminate duplication between single-domain
  and multi-domain setup functions
- Add sanitize_positive_integer() and sanitize_haproxy_timeout() validators;
  validate MAXCONN, TIMEOUT_CONNECT/CLIENT/SERVER, EVIDENCE_PORT at startup
- Fix renewal-daemon to log why HAProxy reload failed (missing PID file vs
  failed signal) instead of silently swallowing errors
- Move loop-scoped local declarations before the while loop in
  setup_haproxy_cfg_multi()
- Guard e2e test against wildcard DOMAIN input
- Wrap phala deploy in error check so test exits on deployment failure

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: h4x3rotab

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -26,6 +26,21 @@ fi
 if ! TXT_PREFIX=$(sanitize_dns_label "$TXT_PREFIX"); then
     exit 1
 fi
+if ! MAXCONN=$(sanitize_positive_integer "$MAXCONN" "MAXCONN"); then
+    exit 1
+fi
+if ! TIMEOUT_CONNECT=$(sanitize_haproxy_timeout "$TIMEOUT_CONNECT" "TIMEOUT_CONNECT"); then
+    exit 1
+fi
+if ! TIMEOUT_CLIENT=$(sanitize_haproxy_timeout "$TIMEOUT_CLIENT" "TIMEOUT_CLIENT"); then
+    exit 1
+fi
+if ! TIMEOUT_SERVER=$(sanitize_haproxy_timeout "$TIMEOUT_SERVER" "TIMEOUT_SERVER"); then
+    exit 1
+fi
+if ! EVIDENCE_PORT=$(sanitize_positive_integer "$EVIDENCE_PORT" "EVIDENCE_PORT"); then
+    exit 1
+fi
 
 # Warn about deprecated L7 env vars
 for var in CLIENT_MAX_BODY_SIZE PROXY_READ_TIMEOUT PROXY_SEND_TIMEOUT PROXY_CONNECT_TIMEOUT; do
@@ -87,11 +102,11 @@ setup_certbot_env() {
 
 setup_py_env
 
-# Generate haproxy.cfg for single-domain mode (DOMAIN + TARGET_ENDPOINT)
-setup_haproxy_cfg() {
-    local target_hostport
-    target_hostport=$(parse_target_endpoint "$TARGET_ENDPOINT")
-
+# Emit common haproxy global/defaults/frontend preamble.
+# Both single-domain and multi-domain modes share this identical config.
+emit_haproxy_preamble() {
+    # "crt <dir>" loads all PEM files from the directory.
+    # ALPN is appended conditionally via ${ALPN:+ alpn ${ALPN}}.
     cat <<EOF >/etc/haproxy/haproxy.cfg
 global
     log stdout format raw local0
@@ -125,15 +140,10 @@ EOF
     use_backend be_evidence if is_evidence
 EVIDENCE_BLOCK
     fi
+}
 
-    cat <<EOF >>/etc/haproxy/haproxy.cfg
-
-    default_backend be_upstream
-
-backend be_upstream
-    server app1 ${target_hostport}
-EOF
-
+# Append the evidence backend block to haproxy.cfg
+emit_evidence_backend() {
     if [ "$EVIDENCE_SERVER" = "true" ]; then
         cat <<EOF >>/etc/haproxy/haproxy.cfg
 
@@ -145,41 +155,27 @@ EOF
     fi
 }
 
-# Generate haproxy.cfg for multi-domain mode (ROUTING_MAP)
-setup_haproxy_cfg_multi() {
-    cat <<EOF >/etc/haproxy/haproxy.cfg
-global
-    log stdout format raw local0
-    maxconn ${MAXCONN}
-    pidfile /var/run/haproxy/haproxy.pid
-    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
-    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
-    ssl-default-bind-curves secp384r1
+# Generate haproxy.cfg for single-domain mode (DOMAIN + TARGET_ENDPOINT)
+setup_haproxy_cfg() {
+    local target_hostport
+    target_hostport=$(parse_target_endpoint "$TARGET_ENDPOINT")
 
-defaults
-    log     global
-    mode    tcp
-    option  tcplog
-    timeout connect ${TIMEOUT_CONNECT}
-    timeout client  ${TIMEOUT_CLIENT}
-    timeout server  ${TIMEOUT_SERVER}
+    emit_haproxy_preamble
 
-frontend tls_in
-    bind :${PORT} ssl crt /etc/haproxy/certs/${ALPN:+ alpn ${ALPN}}
+    cat <<EOF >>/etc/haproxy/haproxy.cfg
+
+    default_backend be_upstream
+
+backend be_upstream
+    server app1 ${target_hostport}
 EOF
 
-    if [ "$EVIDENCE_SERVER" = "true" ]; then
-        cat <<'EVIDENCE_BLOCK' >>/etc/haproxy/haproxy.cfg
+    emit_evidence_backend
+}
 
-    # Route /evidences requests to local evidence HTTP server
-    tcp-request inspect-delay 5s
-    tcp-request content accept if WAIT_END
-    acl is_evidence payload(0,0) -m beg "GET /evidences"
-    acl is_evidence payload(0,0) -m beg "HEAD /evidences"
-    use_backend be_evidence if is_evidence
-EVIDENCE_BLOCK
-    fi
+# Generate haproxy.cfg for multi-domain mode (ROUTING_MAP)
+setup_haproxy_cfg_multi() {
+    emit_haproxy_preamble
 
     # Parse ROUTING_MAP and generate use_backend rules + backend sections
     # Support both newline-separated and comma-separated formats
@@ -189,12 +185,13 @@ EVIDENCE_BLOCK
     local backend_rules=""
     local backend_sections=""
     local first_be_name=""
+    local domain target be_name
 
     while IFS= read -r line; do
         [[ -n "$line" ]] || continue
         [[ "$line" == \#* ]] && continue
-        local domain="${line%%=*}"
-        local target="${line#*=}"
+        domain="${line%%=*}"
+        target="${line#*=}"
         domain=$(echo "$domain" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
         target=$(echo "$target" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
         [[ -n "$domain" && -n "$target" ]] || continue
@@ -203,7 +200,7 @@ EVIDENCE_BLOCK
         target=$(parse_target_endpoint "$target")
 
         # Generate safe backend name from domain
-        local be_name="be_$(echo "$domain" | sed 's/[^A-Za-z0-9]/_/g')"
+        be_name="be_$(echo "$domain" | sed 's/[^A-Za-z0-9]/_/g')"
 
         if [ -z "$first_be_name" ]; then
             first_be_name="$be_name"
@@ -227,15 +224,7 @@ backend ${be_name}
 
     echo "$backend_sections" >> /etc/haproxy/haproxy.cfg
 
-    if [ "$EVIDENCE_SERVER" = "true" ]; then
-        cat <<EOF >>/etc/haproxy/haproxy.cfg
-
-backend be_evidence
-    mode http
-    http-request replace-path /evidences(.*) \1
-    server evidence 127.0.0.1:${EVIDENCE_PORT}
-EOF
-    fi
+    emit_evidence_backend
 }
 
 set_alias_record() {

custom-domain/dstack-ingress/scripts/functions.sh

@@ -71,6 +71,28 @@ sanitize_dns_label() {
     fi
 }
 
+sanitize_positive_integer() {
+    local candidate="$1"
+    local name="${2:-value}"
+    if [[ "$candidate" =~ ^[0-9]+$ ]] && (( candidate >= 1 )); then
+        echo "$candidate"
+    else
+        echo "Error: Invalid ${name}: $candidate (must be a positive integer)" >&2
+        return 1
+    fi
+}
+
+sanitize_haproxy_timeout() {
+    local candidate="$1"
+    local name="${2:-timeout}"
+    if [[ "$candidate" =~ ^[0-9]+(us|ms|s|m|h|d)?$ ]]; then
+        echo "$candidate"
+    else
+        echo "Error: Invalid ${name}: $candidate (e.g. 10s, 5m, 86400s)" >&2
+        return 1
+    fi
+}
+
 sanitize_proxy_timeout() {
     local candidate="$1"
     if [ -z "$candidate" ]; then

custom-domain/dstack-ingress/scripts/renewal-daemon.sh

@@ -25,8 +25,11 @@ while true; do
             build-combined-pems.sh || echo "Combined PEM build failed"
 
             # Graceful reload: send SIGUSR2 to haproxy master process
-            if ! kill -USR2 "$(cat /var/run/haproxy/haproxy.pid 2>/dev/null)" 2>/dev/null; then
-                echo "HAProxy reload failed" >&2
+            local pidfile="/var/run/haproxy/haproxy.pid"
+            if [ ! -f "$pidfile" ]; then
+                echo "HAProxy reload failed: PID file $pidfile not found" >&2
+            elif ! kill -USR2 "$(cat "$pidfile")"; then
+                echo "HAProxy reload failed: SIGUSR2 to PID $(cat "$pidfile") failed" >&2
             else
                 echo "Certificate renewed and HAProxy reloaded successfully"
             fi

custom-domain/dstack-ingress/scripts/tests/e2e-test.sh

@@ -36,6 +36,10 @@ BOOT_TIMEOUT="${BOOT_TIMEOUT:-300}"
 READY_TIMEOUT="${READY_TIMEOUT:-600}"
 
 # Derived domains for multi-protocol testing
+if [[ "$DOMAIN" == \** ]]; then
+    echo "Error: DOMAIN must not be a wildcard for e2e testing (got $DOMAIN)" >&2
+    exit 1
+fi
 GRPC_DOMAIN="grpc-${DOMAIN}"
 
 CVM_NAME="ingress-e2e-$(date +%s)"
@@ -147,7 +151,7 @@ DOMAINS_VAL="${DOMAIN},${GRPC_DOMAIN}"
 ROUTING_MAP_VAL="${DOMAIN}=whoami:80,${GRPC_DOMAIN}=grpcbin:9000"
 
 log "Deploying CVM: $CVM_NAME"
-phala deploy \
+if ! phala deploy \
     -c "$COMPOSE_FILE" \
     -n "$CVM_NAME" \
     -t "$INSTANCE_TYPE" \
@@ -157,7 +161,10 @@ phala deploy \
     -e "GATEWAY_DOMAIN=${GATEWAY_DOMAIN}" \
     -e "DOMAINS=${DOMAINS_VAL}" \
     -e "ROUTING_MAP=${ROUTING_MAP_VAL}" \
-    --wait
+    --wait; then
+    fail "CVM deployment failed"
+    exit 1
+fi
 
 log "CVM deployed, waiting for boot..."
 

custom-domain/dstack-ingress/scripts/tests/test_sanitizers.sh

@@ -55,6 +55,14 @@ assert_equal "$(sanitize_proxy_timeout 30s)" "30s" "sanitize_proxy_timeout accep
 assert_equal "$(sanitize_proxy_timeout 5m)" "5m" "sanitize_proxy_timeout accepts minutes suffix"
 assert_equal "$(sanitize_proxy_timeout 1h)" "1h" "sanitize_proxy_timeout accepts hours suffix"
 assert_equal "$(sanitize_proxy_timeout '')" "" "sanitize_proxy_timeout accepts empty value"
+assert_equal "$(sanitize_positive_integer 4096 MAXCONN)" "4096" "sanitize_positive_integer accepts 4096"
+assert_equal "$(sanitize_positive_integer 1 MAXCONN)" "1" "sanitize_positive_integer accepts 1"
+assert_equal "$(sanitize_haproxy_timeout 10s TIMEOUT_CONNECT)" "10s" "sanitize_haproxy_timeout accepts 10s"
+assert_equal "$(sanitize_haproxy_timeout 86400s TIMEOUT_CLIENT)" "86400s" "sanitize_haproxy_timeout accepts 86400s"
+assert_equal "$(sanitize_haproxy_timeout 5m TIMEOUT)" "5m" "sanitize_haproxy_timeout accepts 5m"
+assert_equal "$(sanitize_haproxy_timeout 500ms TIMEOUT)" "500ms" "sanitize_haproxy_timeout accepts 500ms"
+assert_equal "$(sanitize_haproxy_timeout 100us TIMEOUT)" "100us" "sanitize_haproxy_timeout accepts 100us"
+assert_equal "$(sanitize_haproxy_timeout 1d TIMEOUT)" "1d" "sanitize_haproxy_timeout accepts 1d"
 
 # Failing cases
 assert_fails "sanitize_port rejects non-numeric" sanitize_port abc
@@ -89,6 +97,9 @@ else
 fi
 
 assert_fails "sanitize_dns_label rejects invalid characters" sanitize_dns_label "bad*label"
+assert_fails "sanitize_positive_integer rejects zero" sanitize_positive_integer 0 MAXCONN
+assert_fails "sanitize_positive_integer rejects non-numeric" sanitize_positive_integer abc MAXCONN
+assert_fails "sanitize_haproxy_timeout rejects bare text" sanitize_haproxy_timeout abc TIMEOUT
 
 if [[ $failures -eq 0 ]]; then
     echo "All sanitizer tests passed"