Hardened HAProxy 3.0 reverse-proxy edge for Debian 13 DMZ — ACME/Cloudflare DNS-01, Tailscale mgmt, nftables; adopts the acidnetworks base/hardening collections.
