Containarium

PROXY protocol v2 — real client IP propagation

This release adds optional PROXY protocol v2 support across the sentinel and daemon so containers behind TLS-passthrough hops can finally see the real client IP via `X-Forwarded-For`. Off by default; opt in with `--proxy-protocol` on both sides.

What's in it

• #105 — Sentinel: `WriteProxyV2` encoder; `--proxy-protocol` flag; header injected in the SNI router before raw-TCP forwarding. Real-Caddy e2e gated by `proxyproto_real_caddy` build tag.
• #106 — Daemon srv0: `--proxy-protocol` and `--proxy-protocol-trusted` flags; `ProxyManager.EnableProxyProtocol` installs a `[proxy_protocol, tls]` listener_wrapper chain + trusted_proxies, atomically via `/load` so other server fields are preserved.
• #107 — Daemon caddy-l4: pattern B wrapping (`[proxy_protocol, subroute]` outer route) so SNI passthrough routes (e.g. gRPC) keep working under PROXY. Lifecycle is wrapping-aware — `RouteSyncJob`'s CRUD doesn't undo the wrapping.
• #108 — Architecture documentation at `docs/PROXY-PROTOCOL.md`.

Recommended rollout

1. Deploy daemon first with `--proxy-protocol --proxy-protocol-trusted=`. Wrappers pass through non-PROXY traffic gracefully.
2. Verify HTTPS keeps working.
3. Restart sentinel with `--proxy-protocol`.
4. Verify the destination container's access log now shows the real client IP in `X-Forwarded-For`.

See `docs/PROXY-PROTOCOL.md` for the trust model, deploy state matrix, and rollback path.