Replace inline Python http.server with mini-httpd

The evidence file server was using an inline Python ThreadingTCPServer,
which is hacky and not battle-tested for production use. Replace it with
mini-httpd (1.30), a proven static file server by Jef Poskanzer (author
of thttpd). At 123 KB installed, it is the smallest proper HTTP server
in Debian bookworm that handles concurrent connections (fork-per-request).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: h4x3rotab

custom-domain/dstack-ingress/Dockerfile

@@ -30,7 +30,8 @@ RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt
         python3.11-venv \
         curl \
         jq \
-        coreutils && \
+        coreutils \
+        mini-httpd && \
         rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
 
 RUN mkdir -p \

custom-domain/dstack-ingress/pinned-packages.txt

@@ -104,7 +104,9 @@ libzstd1:amd64=1.5.4+dfsg2-5
 login=1:4.13+dfsg1-1+deb12u1
 logsave=1.47.0-2
 mawk=1.3.4.20200120-3.1
+lsb-base=11.6
 media-types=10.0.0
+mini-httpd=1.30-3
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -404,16 +404,10 @@ elif [ -n "$DOMAIN" ] && [ -n "$TARGET_ENDPOINT" ]; then
     setup_haproxy_cfg
 fi
 
-# Start evidence HTTP server if enabled (threaded to avoid blocking on slow clients)
+# Start evidence HTTP server if enabled
 if [ "$EVIDENCE_SERVER" = "true" ]; then
-    python3 -c "
-import http.server, socketserver, os
-os.chdir('/evidences')
-handler = http.server.SimpleHTTPRequestHandler
-with socketserver.ThreadingTCPServer(('', ${EVIDENCE_PORT}), handler) as s:
-    s.serve_forever()
-" &
-    echo "Evidence server started on port ${EVIDENCE_PORT}"
+    mini_httpd -d /evidences -p "${EVIDENCE_PORT}" -D -l /dev/stderr &
+    echo "Evidence server started on port ${EVIDENCE_PORT} (mini_httpd)"
 fi
 
 renewal-daemon.sh &