fix: wildcard cert lookup and evidence server latency in dstack-ingress

Two bugs fixed:

1. build-combined-pems.sh: wildcard domains (e.g. *.example.com) failed
   to find their Let's Encrypt certificates because the script looked for
   /etc/letsencrypt/live/*.example.com/ while certbot stores them under
   /etc/letsencrypt/live/example.com/. Fixed by using cert_dir_name() from
   functions.sh to strip the wildcard prefix.

2. entrypoint.sh: the HAProxy evidence-server routing used
   "tcp-request content accept if WAIT_END" which forces a full 5-second
   delay (the inspect-delay value) on EVERY new TLS connection before
   routing proceeds. Replaced with "tcp-request content accept if
   { req.len gt 0 }" so HAProxy accepts as soon as any application data
   arrives in the buffer. After SSL termination a complete TLS record is
   decrypted atomically, so the full HTTP request is available on first
   evaluation.

Bump version to 2.1.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: h4x3rotab

custom-domain/dstack-ingress/README.md

@@ -35,7 +35,7 @@ You can use a wildcard domain (e.g. `*.myapp.com`) to route all subdomains to a
 ```yaml
 services:
   dstack-ingress:
-    image: dstacktee/dstack-ingress:2.0@sha256:9fb13c42dceaba91d2e2e7de3a06700a2cf507f4335ae70f3f1db4574a5ad552
+    image: dstacktee/dstack-ingress:2.1
     ports:
       - "443:443"
     environment:
@@ -64,7 +64,7 @@ volumes:
 ```yaml
 services:
   dstack-ingress:
-    image: dstacktee/dstack-ingress:2.0@sha256:9fb13c42dceaba91d2e2e7de3a06700a2cf507f4335ae70f3f1db4574a5ad552
+    image: dstacktee/dstack-ingress:2.1
     ports:
       - "443:443"
     environment:
@@ -102,7 +102,7 @@ Use `ROUTING_MAP` to route different domains to different backends via SNI:
 ```yaml
 services:
   ingress:
-    image: dstacktee/dstack-ingress:2.0@sha256:9fb13c42dceaba91d2e2e7de3a06700a2cf507f4335ae70f3f1db4574a5ad552
+    image: dstacktee/dstack-ingress:2.1
     ports:
       - "443:443"
     environment:

custom-domain/dstack-ingress/docker-compose.multi.yaml

@@ -1,6 +1,6 @@
 services:
   ingress:
-    image: dstacktee/dstack-ingress:2.0@sha256:9fb13c42dceaba91d2e2e7de3a06700a2cf507f4335ae70f3f1db4574a5ad552
+    image: dstacktee/dstack-ingress:2.1
     ports:
       - "443:443"
     environment:

custom-domain/dstack-ingress/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   dstack-ingress:
-    image: dstacktee/dstack-ingress:2.0@sha256:9fb13c42dceaba91d2e2e7de3a06700a2cf507f4335ae70f3f1db4574a5ad552
+    image: dstacktee/dstack-ingress:2.1
     ports:
       - "443:443"
     environment:

custom-domain/dstack-ingress/scripts/build-combined-pems.sh

@@ -4,14 +4,16 @@
 
 set -e
 
+source /scripts/functions.sh
+
 CERT_DIR="/etc/haproxy/certs"
 mkdir -p "$CERT_DIR"
 
 all_domains=$(get-all-domains.sh)
 
 while IFS= read -r domain; do
     [[ -n "$domain" ]] || continue
-    le_dir="/etc/letsencrypt/live/${domain}"
+    le_dir="/etc/letsencrypt/live/$(cert_dir_name "$domain")"
     combined="${CERT_DIR}/${domain}.pem"
     if [ -f "${le_dir}/fullchain.pem" ] && [ -f "${le_dir}/privkey.pem" ]; then
         cat "${le_dir}/fullchain.pem" "${le_dir}/privkey.pem" > "$combined"

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -155,9 +155,13 @@ EOF
     if [ "$EVIDENCE_SERVER" = "true" ]; then
         cat <<'EVIDENCE_BLOCK' >>/etc/haproxy/haproxy.cfg
 
-    # Route /evidences requests to local evidence HTTP server
+    # Route /evidences requests to the local evidence HTTP server.
+    # inspect-delay sets the upper bound for buffering; the accept rule
+    # fires as soon as any application data is present in the buffer
+    # (after SSL termination a full TLS record is decrypted atomically,
+    # so the complete HTTP request is available on first evaluation).
     tcp-request inspect-delay 5s
-    tcp-request content accept if WAIT_END
+    tcp-request content accept if { req.len gt 0 }
     acl is_evidence payload(0,0) -m beg "GET /evidences"
     acl is_evidence payload(0,0) -m beg "HEAD /evidences"
     use_backend be_evidence if is_evidence