test: add proxy scale and concurrency coverage

[RentnerKev]

Summary

Validate correctness, recovery, and bounded resource behavior with larger configurations and
concurrent management operations. This is not a benchmark contest and does not authorize invented
performance targets.

Workloads

Select and document realistic sizes from observed runtime cost, including:

• many Proxy Hosts, domains, and Redirect Hosts
• certificates, trusted CAs, binding jobs, and Access Policies
• concurrent host/policy updates and enable/disable bursts
• rapid desired-state changes and reconciliation coalescing
• concurrent reads while mutations and runtime reloads occur
• CrowdSec allow/deny and configuration state if feat: integrate CrowdSec protection #64 ships
• Forward Auth policy combinations if feat: add Forward Auth access policies #65 ships
• importer preview/result processing at representative size if feat: add Nginx Proxy Manager importer #66 ships

The existing suggestion of roughly 100 Proxy Hosts is a starting scenario, not an unsupported
product guarantee.

Verify

• final desired revision wins and the active Caddy revision matches it
• no lost updates, duplicate application, or concurrent apply corruption
• generated Caddy JSON remains valid
• API/UI requests complete within bounded test time without deadlock or starvation
• restart and transient failure recovery converge correctly
• queues, memory, CPU, connections, and file descriptors remain bounded within the documented
  workload envelope
• Basic Auth, IP policies, certificates, HTTP/3, and shipped Beta integrations retain correct
  behavior

Acceptance criteria

• Automated deterministic scale and concurrency harness.
• Workload sizes and any limits are justified from measured evidence.
• Correctness assertions cover final revision, persisted state, runtime state, and traffic.
• Failures produce useful redacted diagnostics and clean up resources.
• Recovery after interruption/restart is tested.
• Shipped feat: integrate CrowdSec protection #64/feat: add Forward Auth access policies #65/feat: add Nginx Proxy Manager importer #66 behavior is included where relevant.
• No arbitrary throughput/latency claim is published without evidence.

Priority and sequencing

P1. Build on the current revision/reconciliation and smoke-test foundations. Keep this
correctness-at-scale work distinct from the long-duration soak in #69. Results gate #75.

[github-actions]

🔍 Similar issues found

This issue may overlap with existing reports. Please take a look at these related items.

Match	Issue	Status
Medium	#6 – [Bug]: test	CLOSED · COMPLETED

This is an automated suggestion. This issue has not been closed automatically.