Bind a second loopback-only stratum socket for TLS detection

ckpool exposes the serverurl[] index a client connected on as
client.server in its runtime JSON. By binding a second
loopback-only stratum socket and pointing stunnel at it, every TLS
miner arrives with server == 1 and the dashboard can render a
TLS pill cleanly — no source-IP heuristics.

Add TLS_INTERNAL_PORT=3437 to the entrypoint, render it into the
ckpool.conf.template's serverurl array (in the matching commit on
the KamadoPool repo), and update the stunnel config so TLS traffic
forwards to 127.0.0.1:${TLS_INTERNAL_PORT} instead of the public
plaintext port. Even when TLS is disabled the second bind is
harmless — nothing connects to it.

docker_entrypoint.sh

@@ -84,6 +84,15 @@ export BITCOIN_NOTIFY=false
 export ZMQ_BLOCK="tcp://${BITCOIN_RPC_HOST}:28332"
 export BLOCKPOLL_MS=100
 export UPDATE_INTERVAL_S=30
+
+# ckpool binds two stratum sockets — a public plaintext port and a
+# loopback-only port that stunnel forwards TLS traffic to. Clients
+# arriving via the second bind get client.server == 1 in the runtime
+# JSON, which lets the dashboard tag them with a TLS lock icon
+# without resorting to source-IP heuristics. Even when TLS is
+# disabled the second bind is harmless (nothing connects to it).
+export TLS_INTERNAL_PORT=3437
+
 mkdir -p "${LOGDIR}" "${SOCKET_DIR}" /etc/ckpool
 
 # Render ckpool.conf using the same sed approach as the upstream
@@ -102,6 +111,7 @@ sed \
     -e "s|\${BLOCKPOLL_MS}|${BLOCKPOLL_MS}|g" \
     -e "s|\${UPDATE_INTERVAL_S}|${UPDATE_INTERVAL_S}|g" \
     -e "s|\${STRATUM_PORT}|${STRATUM_PORT}|g" \
+    -e "s|\${TLS_INTERNAL_PORT}|${TLS_INTERNAL_PORT}|g" \
     -e "s|\${MINDIFF}|${MINDIFF}|g" \
     -e "s|\${STARTDIFF}|${STARTDIFF}|g" \
     -e "s|\${MAXDIFF}|${MAXDIFF}|g" \
@@ -257,7 +267,10 @@ options = NO_TLSv1_1
 
 [stratum]
 accept = 0.0.0.0:${TLS_PORT}
-connect = 127.0.0.1:${STRATUM_PORT}
+# Forward to ckpool's loopback-only TLS bind, not the public plaintext
+# port. ckpool tags traffic by serverurl index (server == 1 -> TLS),
+# which the dashboard reads to render a lock icon next to the client.
+connect = 127.0.0.1:${TLS_INTERNAL_PORT}
 cert = ${CERT}
 # No client-cert auth — stratum over TLS is opportunistic encryption;
 # the stratum protocol layer handles miner auth via username.