CF Proxy Protocol Gateway - Unified Linux Candidate Delivery (0.8.0-rc1)

Keep all files together. On the target server, enter this directory and verify:
  sha256sum -c SHA256SUMS

Fresh installation:
  sudo bash install.sh --check-only
  sudo bash install.sh

An existing CFPP installation follows the helper upgrade path automatically.
Its configuration, running gateway binary, and customer containers are retained.
Explicit package commands are also available:
  sudo bash cfppctl check
  sudo bash cfppctl upgrade
Save the printed backup and rollback command. Rule checks do not certify login.

Candidate scope: systemd-based Ubuntu, Debian, CentOS/RHEL family; Linux amd64.
Protocol: IPv4, TCP, Proxy Protocol v1 from trusted Cloudflare peers.
Backends: local listeners and compatible Docker bridge/host publishing. Bridge
subnets must be private and non-overlapping; Docker discovery uses a local socket.
IPv6, UDP/QUIC, PPv2, Kubernetes/CNI, alternate Docker nftables publishing, and
Windows are outside this candidate's supported network paths.

The topology planner selects host ingress interfaces, retains the default-route
source address as the shared listener, and allows global IPv4 addresses on all
selected interfaces. Use CFPP_INTERFACES=eth0,eth1 to select interfaces explicitly.
Unsupported or ambiguous topologies fail before gateway deployment. Trusted TCP
capture covers ports 1-65535 and the managed local-destination address set.

Fresh installs default to 32768 active connections. Set CFPP_MAX_CONNECTIONS to
an integer from 1 through 500000 before fresh installation, for example:
  sudo env CFPP_MAX_CONNECTIONS=65536 bash install.sh --check-only
  sudo env CFPP_MAX_CONNECTIONS=65536 bash install.sh
This is a resource guard, not a connection-performance guarantee. The bundled
capacity-500k.conf is a historical artifact; fresh installation generates its
service limit and capacity sysctls from the selected guard.

The background reconciler updates only CFPP-owned Docker routes under a shared
lock, after validating the installed configuration. It does not rediscover or
rewrite ingress addresses or replay the firewall automatically. After changing
ingress topology, use an explicitly reviewed migration. Use cfppctl status PORT
for diagnosis and cfppctl repair for explicit backed-up rule reapplication.

The installer does not replace customer-owned sets or chains such as long_cc,
short_cc, or short_cc2. Do not change trusted CIDRs merely to bypass a rejection.

Linux kernel integration, real Docker publishing, and upstream Cloudflare/client
login tests are required release evidence. A package checksum or script check
cannot establish those results. This candidate has no throughput guarantee.

CentOS 7 requires a working Vault/internal repository or runtime dependencies
installed in advance: iproute/iproute2, iptables, ipset, curl, kmod, Python 3,
and util-linux. Run check-only first; dependency installation may need a repository.
