dolonet
1f8f063ec3
Warn about SNI/IP mismatch at mtg run startup
The SNI-DNS validation that exists in 'mtg doctor' is now also run at
proxy startup. If the secret hostname does not resolve to the server's
public IP, a warning is logged so that operators notice the
misconfiguration before DPI silently blocks the proxy.
The check is best-effort: if the public IP cannot be detected or the
hostname cannot be resolved, a brief warning is emitted and the proxy
starts normally.
Refs: #444, #458