When a trusted upstream sends "PROXY UNKNOWN\r\n", parseProxyProtocolHeader
returned the raw connection and discarded whatever followed the header in
the same read. The TLS ClientHello usually arrives in that same segment, so
it was lost, the SNI extraction failed on the truncated stream, and the
connection was dropped. The 5s parsing read deadline was also left set on
this path.
Wrap the connection so the remaining buffered bytes are replayed ahead of
the socket, and clear the read deadline, matching the other header
branches.
- Add reusable HTTP client with connection pooling for API requests
- Add sync.Pool for 32KB buffers used in connection piping
- Clear buffers before returning to pool to prevent data leakage
- Reduces GC pressure and improves throughput under load
breken