Harden haproxy config generation and input validation

- Factor common global/defaults/frontend config into emit_haproxy_preamble()
  and emit_evidence_backend() to eliminate duplication between single-domain
  and multi-domain setup functions
- Add sanitize_positive_integer() and sanitize_haproxy_timeout() validators;
  validate MAXCONN, TIMEOUT_CONNECT/CLIENT/SERVER, EVIDENCE_PORT at startup
- Fix renewal-daemon to log why HAProxy reload failed (missing PID file vs
  failed signal) instead of silently swallowing errors
- Move loop-scoped local declarations before the while loop in
  setup_haproxy_cfg_multi()
- Guard e2e test against wildcard DOMAIN input
- Wrap phala deploy in error check so test exits on deployment failure

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: h4x3rotab

custom-domain/dstack-ingress/scripts/functions.sh

@@ -71,6 +71,28 @@ sanitize_dns_label() {
     fi
 }
 
+sanitize_positive_integer() {
+    local candidate="$1"
+    local name="${2:-value}"
+    if [[ "$candidate" =~ ^[0-9]+$ ]] && (( candidate >= 1 )); then
+        echo "$candidate"
+    else
+        echo "Error: Invalid ${name}: $candidate (must be a positive integer)" >&2
+        return 1
+    fi
+}
+
+sanitize_haproxy_timeout() {
+    local candidate="$1"
+    local name="${2:-timeout}"
+    if [[ "$candidate" =~ ^[0-9]+(us|ms|s|m|h|d)?$ ]]; then
+        echo "$candidate"
+    else
+        echo "Error: Invalid ${name}: $candidate (e.g. 10s, 5m, 86400s)" >&2
+        return 1
+    fi
+}
+
 sanitize_proxy_timeout() {
     local candidate="$1"
     if [ -z "$candidate" ]; then

custom-domain/dstack-ingress/scripts/renewal-daemon.sh

@@ -25,8 +25,11 @@ while true; do
             build-combined-pems.sh || echo "Combined PEM build failed"
 
             # Graceful reload: send SIGUSR2 to haproxy master process
-            if ! kill -USR2 "$(cat /var/run/haproxy/haproxy.pid 2>/dev/null)" 2>/dev/null; then
-                echo "HAProxy reload failed" >&2
+            local pidfile="/var/run/haproxy/haproxy.pid"
+            if [ ! -f "$pidfile" ]; then
+                echo "HAProxy reload failed: PID file $pidfile not found" >&2
+            elif ! kill -USR2 "$(cat "$pidfile")"; then
+                echo "HAProxy reload failed: SIGUSR2 to PID $(cat "$pidfile") failed" >&2
             else
                 echo "Certificate renewed and HAProxy reloaded successfully"
             fi

custom-domain/dstack-ingress/scripts/tests/e2e-test.sh

@@ -36,6 +36,10 @@ BOOT_TIMEOUT="${BOOT_TIMEOUT:-300}"
 READY_TIMEOUT="${READY_TIMEOUT:-600}"
 
 # Derived domains for multi-protocol testing
+if [[ "$DOMAIN" == \** ]]; then
+    echo "Error: DOMAIN must not be a wildcard for e2e testing (got $DOMAIN)" >&2
+    exit 1
+fi
 GRPC_DOMAIN="grpc-${DOMAIN}"
 
 CVM_NAME="ingress-e2e-$(date +%s)"
@@ -147,7 +151,7 @@ DOMAINS_VAL="${DOMAIN},${GRPC_DOMAIN}"
 ROUTING_MAP_VAL="${DOMAIN}=whoami:80,${GRPC_DOMAIN}=grpcbin:9000"
 
 log "Deploying CVM: $CVM_NAME"
-phala deploy \
+if ! phala deploy \
     -c "$COMPOSE_FILE" \
     -n "$CVM_NAME" \
     -t "$INSTANCE_TYPE" \
@@ -157,7 +161,10 @@ phala deploy \
     -e "GATEWAY_DOMAIN=${GATEWAY_DOMAIN}" \
     -e "DOMAINS=${DOMAINS_VAL}" \
     -e "ROUTING_MAP=${ROUTING_MAP_VAL}" \
-    --wait
+    --wait; then
+    fail "CVM deployment failed"
+    exit 1
+fi
 
 log "CVM deployed, waiting for boot..."
 

custom-domain/dstack-ingress/scripts/tests/test_sanitizers.sh

@@ -55,6 +55,14 @@ assert_equal "$(sanitize_proxy_timeout 30s)" "30s" "sanitize_proxy_timeout accep
 assert_equal "$(sanitize_proxy_timeout 5m)" "5m" "sanitize_proxy_timeout accepts minutes suffix"
 assert_equal "$(sanitize_proxy_timeout 1h)" "1h" "sanitize_proxy_timeout accepts hours suffix"
 assert_equal "$(sanitize_proxy_timeout '')" "" "sanitize_proxy_timeout accepts empty value"
+assert_equal "$(sanitize_positive_integer 4096 MAXCONN)" "4096" "sanitize_positive_integer accepts 4096"
+assert_equal "$(sanitize_positive_integer 1 MAXCONN)" "1" "sanitize_positive_integer accepts 1"
+assert_equal "$(sanitize_haproxy_timeout 10s TIMEOUT_CONNECT)" "10s" "sanitize_haproxy_timeout accepts 10s"
+assert_equal "$(sanitize_haproxy_timeout 86400s TIMEOUT_CLIENT)" "86400s" "sanitize_haproxy_timeout accepts 86400s"
+assert_equal "$(sanitize_haproxy_timeout 5m TIMEOUT)" "5m" "sanitize_haproxy_timeout accepts 5m"
+assert_equal "$(sanitize_haproxy_timeout 500ms TIMEOUT)" "500ms" "sanitize_haproxy_timeout accepts 500ms"
+assert_equal "$(sanitize_haproxy_timeout 100us TIMEOUT)" "100us" "sanitize_haproxy_timeout accepts 100us"
+assert_equal "$(sanitize_haproxy_timeout 1d TIMEOUT)" "1d" "sanitize_haproxy_timeout accepts 1d"
 
 # Failing cases
 assert_fails "sanitize_port rejects non-numeric" sanitize_port abc
@@ -89,6 +97,9 @@ else
 fi
 
 assert_fails "sanitize_dns_label rejects invalid characters" sanitize_dns_label "bad*label"
+assert_fails "sanitize_positive_integer rejects zero" sanitize_positive_integer 0 MAXCONN
+assert_fails "sanitize_positive_integer rejects non-numeric" sanitize_positive_integer abc MAXCONN
+assert_fails "sanitize_haproxy_timeout rejects bare text" sanitize_haproxy_timeout abc TIMEOUT
 
 if [[ $failures -eq 0 ]]; then
     echo "All sanitizer tests passed"