sni-router: switch HAProxy to host networking for real client IPs

Bridge ingress (Docker's docker-proxy userland forwarder, Podman's
slirp4netns/pasta) rewrites the source IP of inbound connections on a
published port to the bridge gateway address.  HAProxy then stamps that
gateway address into the PROXY v2 header it forwards to mtg and Caddy,
so neither backend ever sees a real client IP.

Move HAProxy into the host netns (network_mode: host) so it binds
:443/:80 directly with no NAT in the path.  mtg and Caddy stay on the
compose bridge and are published on 127.0.0.1 only; HAProxy reaches
them via host loopback and PROXY v2 carries the real client IP (v4 or
v6) end-to-end.

Also accept IPv6 clients explicitly on the HAProxy frontends — `bind
*:443` is IPv4-only and missed v6 clients on hosts where the previous
example happened to "work" only because of dual-stack quirks.

Add 127.0.0.0/8 to Caddy's PROXY allow-list to cover the new loopback
hop from HAProxy.  README gains a short subsection explaining the
host-mode choice and its trade-off (HAProxy occupies host :443/:80).

Diagnosed and tested by @bam80 on Fedora + Docker 29.  Fixes #498.

contrib/sni-router/Caddyfile

@@ -10,14 +10,16 @@
 	# to Caddy's access log.  The `tls` wrapper must follow so that TLS
 	# is terminated on the unwrapped connection.
 	#
-	# `allow` lists the networks permitted to send PROXY headers.  These
-	# ranges cover docker compose's default bridge networks; tighten
-	# them if you pin a specific subnet in docker-compose.yml.
+	# `allow` lists the networks permitted to send PROXY headers.
+	# 127.0.0.0/8 covers HAProxy reaching Caddy over host loopback (HAProxy
+	# runs in network_mode: host and connects to the published 127.0.0.1
+	# port).  The RFC1918 ranges cover mtg → Caddy on the compose bridge
+	# (fronting path; see "Fronting loop" in README.md).
 	servers :8443 {
 		listener_wrappers {
 			proxy_protocol {
 				timeout 5s
-				allow 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+				allow 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
 			}
 			tls
 		}

contrib/sni-router/README.md

@@ -63,6 +63,26 @@ must stay in sync:
 If you disable one, disable all four, otherwise the backend will fail
 to parse the connection.
 
+### Why HAProxy uses `network_mode: host`
+
+When a container is on a bridge network and a port is published with
+`ports: "443:443"`, the source IP of inbound connections is rewritten
+to the bridge gateway before HAProxy sees it — Docker's `docker-proxy`
+userland forwarder accepts on the host and re-opens the connection
+from the gateway; Podman's `slirp4netns` / `pasta` does the same in
+rootless mode.  The PROXY v2 header HAProxy then sends downstream
+carries that gateway address (e.g. `172.x.x.1`), not the real client.
+
+`network_mode: host` puts HAProxy in the host network namespace, so it
+binds `:443` / `:80` directly with no NAT in the path and observes the
+true source address of every connection.  mtg and Caddy stay on the
+compose bridge and are published only on `127.0.0.1` — HAProxy reaches
+them via host loopback, and the PROXY v2 header carries the real
+client IP (v4 or v6) end-to-end.
+
+Trade-off: HAProxy occupies the host's `:443` and `:80`.  Don't run
+anything else on those ports on the same host.
+
 ## Fronting loop (why `[domain-fronting]` is set explicitly)
 
 When mtg sees TLS that isn't valid Telegram (a probe or a browser

contrib/sni-router/docker-compose.yml

@@ -27,9 +27,16 @@ x-domain-env: &domain-env
 services:
   haproxy:
     image: haproxy:lts-alpine
-    ports:
-      - "443:443"
-      - "80:80"
+    # network_mode: host lets HAProxy see real client source IPs (v4 and v6)
+    # instead of the docker/podman bridge gateway.  Bridge ingress (docker-proxy
+    # userland forwarder, podman slirp4netns/pasta) rewrites the source address
+    # of inbound connections to the gateway; with host networking HAProxy binds
+    # in the host netns directly and the rewrite never happens.  See the
+    # "Real client IPs" section of README.md.
+    #
+    # Trade-off: HAProxy occupies host :443 and :80.  Don't run anything else
+    # on those ports.
+    network_mode: host
     volumes:
       - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro,Z
     environment:
@@ -38,16 +45,16 @@ services:
       - mtg
       - web
     restart: unless-stopped
-    sysctls:
-      - net.ipv4.ip_unprivileged_port_start=80
 
   mtg:
     # FIXME: :master until #480 lands in a tagged release; switch back to :2/:3 after release
     image: nineseconds/mtg:master
     volumes:
       - ./mtg-config.toml:/config/config.toml:ro,Z
-    expose:
-      - "3128"
+    # Published on host loopback only — HAProxy (host netns) reaches it via
+    # 127.0.0.1:3128.  Not exposed on any public interface.
+    ports:
+      - "127.0.0.1:3128:3128"
     restart: unless-stopped
     extra_hosts:
       - "host.containers.internal:host-gateway"
@@ -58,9 +65,10 @@ services:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro,Z
       - caddy_data:/data
       - ./www:/srv:ro,Z
-    expose:
-      - "80"
-      - "8443"
+    # Published on host loopback only — HAProxy reaches Caddy on 127.0.0.1.
+    ports:
+      - "127.0.0.1:8080:80"
+      - "127.0.0.1:8443:8443"
     environment:
       <<: *domain-env
     restart: unless-stopped

contrib/sni-router/haproxy.cfg

@@ -23,7 +23,11 @@ defaults
 # --- HTTP :80 — ACME challenges + redirect -----------------------------------
 
 frontend http
-    bind *:80
+    # Explicit v4 + v6 binds so IPv6 clients are accepted regardless of the
+    # host's IPV6_V6ONLY sysctl.  v6only on the v6 bind avoids the
+    # "address in use" overlap on dual-stack hosts.
+    bind 0.0.0.0:80
+    bind [::]:80 v6only
     mode http
 
     # Let Caddy answer ACME HTTP-01 challenges for Let's Encrypt.
@@ -35,7 +39,8 @@ frontend http
 # --- TLS :443 — SNI-based routing -------------------------------------------
 
 frontend tls
-    bind *:443
+    bind 0.0.0.0:443
+    bind [::]:443 v6only
     tcp-request inspect-delay 5s
     tcp-request content accept if { req_ssl_hello_type 1 }
 
@@ -46,18 +51,23 @@ frontend tls
 
     default_backend web
 
+# Backends reach mtg and web on host loopback — they publish to 127.0.0.1
+# (see docker-compose.yml), and HAProxy runs in the host netns
+# (network_mode: host).  PROXY v2 still carries the real client address
+# (v4 or v6) end-to-end, independent of the loopback transport.
+
 backend mtg
     # send-proxy-v2 prepends a PROXY protocol v2 header so mtg sees the
     # real client IP instead of HAProxy's.  mtg must have
     # `proxy-protocol-listener = true` in its config.
-    server mtg mtg:3128 send-proxy-v2
+    server mtg 127.0.0.1:3128 send-proxy-v2
 
 backend web
     # send-proxy-v2 prepends a PROXY protocol v2 header so Caddy logs the
     # real client IP instead of HAProxy's.  Caddy must enable the
     # proxy_protocol listener wrapper on :8443 (see Caddyfile).
-    server web web:8443 send-proxy-v2
+    server web 127.0.0.1:8443 send-proxy-v2
 
 backend web_acme
     mode http
-    server web web:80
+    server web 127.0.0.1:8080