gw(deploy): expose inbound_pp_enabled and port_attrs_fetch tunables

Thread the new gateway config knobs through the dstack-app deployment:

- .env / .app_env gains `INBOUND_PP_ENABLED` (default false). Set to
  true only when the gateway runs behind a PP-aware L4 LB; otherwise
  every connection would be rejected because the parser would try to
  read a PP header that isn't there.

- docker-compose.yaml forwards the new env vars plus the retry/backoff
  knobs for the background port_attrs fetcher and the pp_header read
  timeout.

- entrypoint.sh writes the corresponding fields into gateway.toml,
  including the new [core.proxy.port_attrs_fetch] section.

Defaults match the in-repo gateway.toml so existing deployments
continue to work without any .env changes.

Author: kvinwang

gateway/dstack-app/builder/entrypoint.sh

@@ -111,6 +111,7 @@ localhost_enabled = false
 app_address_ns_compat = true
 workers = ${PROXY_WORKERS:-32}
 max_connections_per_app = ${MAX_CONNECTIONS_PER_APP:-0}
+inbound_pp_enabled = ${INBOUND_PP_ENABLED:-false}
 
 [core.proxy.timeouts]
 connect = "${TIMEOUT_CONNECT:-5s}"
@@ -122,6 +123,13 @@ idle = "${TIMEOUT_IDLE:-10m}"
 write = "${TIMEOUT_WRITE:-5s}"
 shutdown = "${TIMEOUT_SHUTDOWN:-5s}"
 total = "${TIMEOUT_TOTAL:-5h}"
+pp_header = "${TIMEOUT_PP_HEADER:-5s}"
+
+[core.proxy.port_attrs_fetch]
+timeout = "${PORT_ATTRS_FETCH_TIMEOUT:-10s}"
+max_retries = ${PORT_ATTRS_FETCH_MAX_RETRIES:-5}
+backoff_initial = "${PORT_ATTRS_FETCH_BACKOFF_INITIAL:-1s}"
+backoff_max = "${PORT_ATTRS_FETCH_BACKOFF_MAX:-30s}"
 
 [core.recycle]
 enabled = true

gateway/dstack-app/deploy-to-vmm.sh

@@ -94,6 +94,13 @@ WG_ADDR=0.0.0.0:9202
 # The token used to launch the App
 APP_LAUNCH_TOKEN=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
 
+# PROXY protocol: read v1/v2 header from inbound connections (e.g. when this
+# gateway sits behind a PP-aware L4 LB such as Cloudflare Spectrum or haproxy
+# with send-proxy). Set to "true" only if the upstream LB is configured to
+# send PROXY headers; otherwise leave disabled or every connection will be
+# rejected.
+# INBOUND_PP_ENABLED=false
+
 EOF
   echo "Please edit the .env file and set the required variables, then run this script again."
   exit 1
@@ -175,6 +182,7 @@ APP_LAUNCH_TOKEN=$APP_LAUNCH_TOKEN
 RPC_DOMAIN=$RPC_DOMAIN
 NODE_ID=$NODE_ID
 PROXY_LISTEN_PORT=$PROXY_LISTEN_PORT
+INBOUND_PP_ENABLED=${INBOUND_PP_ENABLED:-false}
 EOF
 
 if [ -n "$APP_COMPOSE_FILE" ]; then

gateway/dstack-app/docker-compose.yaml

@@ -41,6 +41,12 @@ services:
       - TIMEOUT_TOTAL=${TIMEOUT_TOTAL:-5h}
       - ADMIN_LISTEN_ADDR=${ADMIN_LISTEN_ADDR:-0.0.0.0}
       - ADMIN_LISTEN_PORT=${ADMIN_LISTEN_PORT:-8001}
+      - INBOUND_PP_ENABLED=${INBOUND_PP_ENABLED:-false}
+      - TIMEOUT_PP_HEADER=${TIMEOUT_PP_HEADER:-5s}
+      - PORT_ATTRS_FETCH_TIMEOUT=${PORT_ATTRS_FETCH_TIMEOUT:-10s}
+      - PORT_ATTRS_FETCH_MAX_RETRIES=${PORT_ATTRS_FETCH_MAX_RETRIES:-5}
+      - PORT_ATTRS_FETCH_BACKOFF_INITIAL=${PORT_ATTRS_FETCH_BACKOFF_INITIAL:-1s}
+      - PORT_ATTRS_FETCH_BACKOFF_MAX=${PORT_ATTRS_FETCH_BACKOFF_MAX:-30s}
     restart: always
 
 volumes: