Add HAProxy TLS routing for HK CMI

servers/bwh-hk-cmi/snell/entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Hong Kong CMI rollback-only Snell entrypoint.
+set -eu
+
+: "${PSK:?PSK is required}"
+: "${PORT:?PORT is required}"
+
+case "$PORT" in
+  *[!0-9]*|'') echo "PORT must be numeric" >&2; exit 1 ;;
+esac
+
+umask 077
+cat > /tmp/snell-server.conf <<EOF
+[snell-server]
+listen = :::${PORT}
+psk = ${PSK}
+EOF
+
+exec /usr/local/bin/snell-server -c /tmp/snell-server.conf