chore: update base image to HAProxy 3.2 LTS on Alpine 3.24

[oleksandr-nc]

HAProxy 3.1 is unmaintained since Q1 2026 and Docker Hub no longer rebuilds 3.1 images, so this moves the base image to the current LTS branch (3.2.22, supported until Q2 2030) on Alpine 3.24.

Alpine 3.24 ships Python 3.14, and the pinned pydantic 2.10.6 has no wheels for it, so pydantic moves to 2.13.4 (cp314 musl wheels for both amd64 and arm64). No code or config changes needed: haproxy -c is clean on 3.2.

Verified live besides CI: SPOA auth and routing, FRP tunnels, timeout semantics (client, server, tunnel including the 0 to 24d unlimited mapping), idle WebSocket survival, and a full app-skeleton-python deploy lifecycle through the new image.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3e1abcd9-69ea-4b16-b7dc-be26d3356517

📥 Commits

Reviewing files that changed from the base of the PR and between 5f3ef21 and 9a273ea.

📒 Files selected for processing (1)

• Dockerfile

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dockerfiles update HAProxy from 3.1.2 on Alpine 3.21 to 3.2.22 on Alpine 3.24. The main Dockerfile updates pydantic to 2.13.4 and pins haproxy-python-spoa to a specific commit.

Merge Risk: ⚪ Minimal · up to 9a273

This updates the container base image and Python dependency versions while preserving the documented runtime behavior; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: upgrading the HAProxy base image to the 3.2 LTS release on Alpine 3.24.
Description check	✅ Passed	The description directly explains the HAProxy, Alpine, and pydantic updates, their reasons, and the verification performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[oleksandr-nc]

The library fix is merged: cloud-py-api/haproxy-python-spoa#1. CI builds install the library from git master, so re-runs from now on include it. Re-running the deploy workflows several times to confirm the flake is gone.

[oleksandr-nc]

CI verified after the library fix (cloud-py-api/haproxy-python-spoa#1, merged): the Docker deploy workflow passed 3 consecutive attempts (the "NC In Host (Manual HaRP-Host network)" job that caught the SPOP regression included), and all four K8s deploy workflows passed 2 consecutive attempts. All 17 checks are green. From my side this is ready to merge.

[oleksandr-nc]

Upstream report for the mux side of this: haproxy/haproxy#3478 (verified affected: 3.2.0, 3.2.22, 3.3, 3.4 and 3.5-dev4; 3.1.2 clean). The library-side workaround from cloud-py-api/haproxy-python-spoa#1 keeps HaRP unaffected regardless of when upstream fixes it.