feat: Raw TCP/UDP port exposure for non-HTTP workloads

[eliBenven]

Summary

Nexlayer currently routes all traffic through HTTP/HTTPS ingress. Many real-world workloads require raw TCP or UDP port forwarding without HTTP termination. Adding an exposePorts (or similar) field to the launchfile spec would unlock an entire category of deployments that are currently impossible on the platform.

Proposed API

application:
  name: my-game-server
  pods:
    - name: server
      image: my-game:latest
      servicePorts:
        - 8080        # existing HTTP behavior
      exposePorts:
        - port: 7777
          protocol: UDP
        - port: 27015
          protocol: UDP
        - port: 6379
          protocol: TCP

• servicePorts continues to work as today (HTTP ingress routing)
• exposePorts forwards raw TCP/UDP to the pod without HTTP termination
• Returns the external IP/hostname + port mapping in the deploy response

Use Cases

1. Game Server Hosting

Game servers (Minecraft, The Isle, Valheim, ARK, CS2, Rust) communicate over raw UDP. Clients connect via server-ip:port using game-native protocols — not HTTP. Without UDP exposure, no multiplayer game server can accept player connections on Nexlayer.

• The Isle: UDP 7777/7778 (game), UDP 27015 (Steam query)
• Minecraft: TCP 25565 (already deployed in stress test, but players can't connect)
• Valheim: UDP 2456-2458
• CS2/Rust: UDP 27015+

2. Direct Database Connections

Databases deployed on Nexlayer (Postgres, Redis, MongoDB) can only be accessed by other pods in the same deployment. External tools (pgAdmin, DataGrip, Redis CLI, application servers outside Nexlayer) cannot connect directly.

• PostgreSQL: TCP 5432
• Redis: TCP 6379
• MongoDB: TCP 27017

3. IoT / MQTT Brokers

IoT devices publish sensor data over MQTT (TCP 1883) or CoAP (UDP 5683). These protocols are not HTTP-based and can't go through an HTTP ingress.

4. VoIP / Media Servers

Real-time communication servers (Jitsi, Mumble, TeamSpeak) rely on UDP for low-latency audio/video. WebRTC TURN servers also need UDP exposure.

5. DNS / Authoritative Name Servers

Running a DNS server (e.g., CoreDNS, BIND) requires UDP 53 exposure.

Why This Matters

HTTP-only ingress positions Nexlayer exclusively for web apps. Adding raw port exposure opens the platform to game hosting, IoT, databases-as-a-service, and real-time communication — markets where API-driven provisioning (Nexlayer's strength) is a genuine differentiator vs. traditional providers.

References

• Stress test deployments (Minecraft, Postgres, Redis) confirmed the limitation: pods run but are unreachable externally over their native protocols
• Related: Slow-starting containers killed by liveness probe (Minecraft, heavy Java apps) #48 (slow-starting game servers killed by probes)

Migrated from #56