From 83e5ef0eb1f5847d7045c8873f0bfca487d8ab02 Mon Sep 17 00:00:00 2001
From: bitdeals <nobody@bitdeals.org>
Date: Thu, 3 Sep 2026 10:06:39 +0000
Subject: [PATCH] fix: drop the base image's FIPS preference, which closed TLS
 1.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The public door has been refusing every modern client since 2026-09-02,
with no commit behind it. `FROM bitnami/haproxy` carries no tag and the
scheduled build runs daily, so the image is rebuilt each morning on
whatever base is `:latest` that day. That morning's base arrived with
OpenSSL's FIPS provider preferred.

Photon OS reads the preference straight out of the environment:

    [alg_sect]
    default_properties = ?fips=$ENV::OPENSSL_FIPS

With "yes", every algorithm fetch prefers the FIPS provider, and that
provider cannot produce an X25519MLKEM768 key — ssl_generate_pkey_group
fails. HAProxy offers the group anyway: OpenSSL 3.5 lists it first and
haproxy.cfg sets no ssl-default-bind-curves, so the server picks a group
it cannot then use and answers a fatal illegal_parameter. Anything that
offers post-quantum key exchange — curl, browsers, httpx — is refused;
only a client asking for a classical group gets in. МС talks to ДС over
HTTPS, so no deal could be created through it either.

Nothing here needs FIPS, and the base image itself provides the switch.
The provider stays loaded; only the preference is dropped.

Verified by building this image on testnet2 and serving the live
certificate from it: curl 200 where it was a TLS connect error, group
X25519MLKEM768 negotiated, ECDHE-ECDSA-CHACHA20-POLY1305 still offered,
TLS 1.1 still refused.
---
 docker/Dockerfile | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index a189958..a8e4815 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,26 @@
 FROM bitnami/haproxy
 
+# The base is Photon OS, and its openssl.cnf reads this variable directly:
+#
+#     [alg_sect]
+#     default_properties = ?fips=$ENV::OPENSSL_FIPS
+#
+# The base image ships "yes", so every algorithm fetch prefers the FIPS
+# provider — and that provider cannot produce an X25519MLKEM768 key:
+# ssl_generate_pkey_group fails. HAProxy offers the group regardless, because
+# OpenSSL 3.5 lists it first and haproxy.cfg sets no `ssl-default-bind-curves`,
+# so it picks a group it then cannot use and answers a fatal illegal_parameter.
+# Every client that offers post-quantum key exchange — curl, browsers, anything
+# on OpenSSL 3.5 — is refused; only a client asking for a classical group gets
+# in. That is how this image closed the public door on 2026-09-02 with no commit
+# behind it: `FROM bitnami/haproxy` is untagged and the daily scheduled build
+# picks up whatever the base is that morning.
+#
+# Nothing here needs FIPS. Flipping the variable the base image itself provides
+# restores the door and the post-quantum exchange both; the FIPS provider stays
+# loaded, only the preference is dropped.
+ENV OPENSSL_FIPS=no
+
 # Copy config
 COPY ./docker/haproxy.cfg /bitnami/haproxy/conf/haproxy.cfg