feat(configgen): Phase 2 Config-Generator + nginx → HAProxy-only Pivot

Architektur-Pivot: nginx fällt komplett weg. HAProxy 2.8+ übernimmt
TLS-Termination, L7-Routing per Host-Header und LB. ACME-Webroot
und Management-UI werden von edgeguard-api ausgeliefert (Phase 3
implementiert die zugehörigen Handler); HAProxy proxied
/.well-known/acme-challenge/* und Management-FQDN-Traffic an
127.0.0.1:9443. Eine Distro-Abhängigkeit weniger, ein Renderer
weniger, sauberere Trennung.

Renderer (alle mit Embed-Templates + Tests):
* internal/configgen/  — atomic write + systemctl reload helpers
* internal/haproxy/    — :80 + :443, ACME-ACL, Host-Header-Routing,
                         Stats-Frontend, api_backend Fallback
* internal/firewall/   — default-deny input, stateful baseline,
                         SSH-Rate-Limit, :80/:443 accept,
                         Cluster-Peer-Set für mTLS :8443,
                         Custom-Rules aus PG
* internal/{squid,wireguard,unbound}/ — Stubs (ErrNotImplemented)

Orchestrator + CLI:
* internal/services/configorch/  — fester Reihenfolge-Run, Stubs
                                   sind soft-skip statt fatal
* cmd/edgeguard-ctl render-config [--no-reload] [--only=svc1,svc2]

Packaging:
* postinst: /etc/edgeguard/nginx raus, /var/lib/edgeguard/acme rein,
  self-signed _default.pem via openssl req (damit HAProxy startet
  bevor certbot etwas issuet hat)
* control: Depends nginx raus, openssl rein
* edgeguard-ui: dependency auf nginx weg, "Served by edgeguard-api
  gin StaticFS"

Live-Smoke: render-config gegen lokale PG schreibt /etc/edgeguard/
haproxy/haproxy.cfg + nftables.d/ruleset.nft korrekt; CRUD-Test aus
Phase 2 läuft weiter unverändert.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/haproxy/haproxy.go

@@ -0,0 +1,137 @@
+// Package haproxy renders /etc/edgeguard/haproxy/haproxy.cfg from
+// the relational state in PG. v1 is the full ingress: HAProxy
+// terminates TLS on :443, redirects :80 → :443 (except ACME), routes
+// by Host header to user backends, and falls through to edgeguard-api
+// for management UI + ACME webroot.
+package haproxy
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"path/filepath"
+	"text/template"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/backends"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/routingrules"
+)
+
+//go:embed haproxy.cfg.tpl
+var cfgTpl string
+
+var tpl = template.Must(template.New("haproxy").Parse(cfgTpl))
+
+type Generator struct {
+	Pool         *pgxpool.Pool
+	DomainsRepo  *domains.Repo
+	BackendsRepo *backends.Repo
+	RoutingRepo  *routingrules.Repo
+
+	OutputPath string
+	SkipReload bool
+}
+
+func New(pool *pgxpool.Pool) *Generator {
+	return &Generator{
+		Pool:         pool,
+		DomainsRepo:  domains.New(pool),
+		BackendsRepo: backends.New(pool),
+		RoutingRepo:  routingrules.New(pool),
+	}
+}
+
+func (g *Generator) Name() string { return "haproxy" }
+
+func (g *Generator) Render(ctx context.Context) error {
+	view, err := g.loadView(ctx)
+	if err != nil {
+		return fmt.Errorf("haproxy: load state: %w", err)
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		return fmt.Errorf("haproxy: render template: %w", err)
+	}
+	out := g.OutputPath
+	if out == "" {
+		out = filepath.Join(configgen.EtcEdgeguard, "haproxy", "haproxy.cfg")
+	}
+	if err := configgen.AtomicWrite(out, buf.Bytes(), 0o644); err != nil {
+		return fmt.Errorf("haproxy: write: %w", err)
+	}
+	if g.SkipReload {
+		return nil
+	}
+	if err := configgen.ReloadService("haproxy"); err != nil {
+		return fmt.Errorf("haproxy: reload: %w", err)
+	}
+	return nil
+}
+
+// View is what the template consumes. Routes per domain are pre-
+// joined here so the template can stay declarative.
+type View struct {
+	Domains  []DomainView
+	Backends []models.Backend
+}
+
+type DomainView struct {
+	models.Domain
+	Routes []RouteView
+}
+
+type RouteView struct {
+	PathPrefix string
+	BackendID  int64
+}
+
+func (g *Generator) loadView(ctx context.Context) (*View, error) {
+	doms, err := g.DomainsRepo.List(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("list domains: %w", err)
+	}
+	bes, err := g.BackendsRepo.List(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("list backends: %w", err)
+	}
+	rules, err := g.RoutingRepo.List(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("list routing rules: %w", err)
+	}
+
+	rulesByDomain := map[int64][]RouteView{}
+	for _, r := range rules {
+		if !r.Active {
+			continue
+		}
+		rulesByDomain[r.DomainID] = append(rulesByDomain[r.DomainID], RouteView{
+			PathPrefix: r.PathPrefix,
+			BackendID:  r.BackendID,
+		})
+	}
+
+	activeBackends := make([]models.Backend, 0, len(bes))
+	for _, b := range bes {
+		if b.Active {
+			activeBackends = append(activeBackends, b)
+		}
+	}
+
+	domViews := make([]DomainView, 0, len(doms))
+	for _, d := range doms {
+		if !d.Active {
+			continue
+		}
+		domViews = append(domViews, DomainView{
+			Domain: d,
+			Routes: rulesByDomain[d.ID],
+		})
+	}
+
+	return &View{Domains: domViews, Backends: activeBackends}, nil
+}