Add BWH US DC1 proxy stack

2026-09-03 01:52:58 -07:00
parent a922793499
commit 108e5d8021
9 changed files with 316 additions and 0 deletions
@@ -0,0 +1,2 @@
+# HAProxy owns public TCP 443. Hysteria2 owns public UDP 443 separately.
+HAPROXY_PUBLIC_PORT=443
@@ -0,0 +1,12 @@
+# DC1 TLS front door
+
+HAProxy inspects TCP SNI without terminating TLS:
+
+- `dc1-tls-676b11.opfo.xyz` -> sing-box Trojan on internal TCP 34795
+- `dc1-any-9a4fad.opfo.xyz` -> sing-box AnyTLS on internal TCP 40887
+- unmatched SNI -> Caddy fallback serving `dc1.opfo.xyz`
+
+HAProxy publishes host TCP 443. Hysteria2 owns host UDP 443. Caddy publishes
+host TCP 80 and receives HTTPS from HAProxy over the project network. Trojan
+and AnyTLS have no high-numbered host port. Both projects join the external
+`dc1-proxy` network.
@@ -0,0 +1,22 @@
+{
+    email tnki.per@gmail.com
+    servers {
+        protocols h1 h2
+    }
+}
+
+dc1.opfo.xyz {
+    encode zstd gzip
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options DENY
+        Referrer-Policy no-referrer
+    }
+    respond <<HTML
+<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Service Status</title></head>
+<body><main><h1>Service online</h1><p>The requested service is available.</p></main></body>
+</html>
+HTML
+}
@@ -0,0 +1,44 @@
+services:
+  haproxy:
+    image: haproxy:3.4.4-alpine3.24
+    container_name: dc1-haproxy
+    restart: unless-stopped
+    ports:
+      - "${HAPROXY_PUBLIC_PORT:-443}:8443/tcp"
+    depends_on:
+      - decoy-caddy
+    networks:
+      - default
+      - proxy
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
+  decoy-caddy:
+    image: caddy:2.11.4
+    container_name: dc1-decoy-caddy
+    restart: unless-stopped
+    ports:
+      - "80:80/tcp"
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
+volumes:
+  caddy-data:
+  caddy-config:
+
+networks:
+  proxy:
+    external: true
+    name: dc1-proxy
@@ -0,0 +1,32 @@
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log global
+    mode tcp
+    option tcplog
+    timeout connect 5s
+    timeout client 24h
+    timeout server 24h
+
+frontend tls_443
+    bind 0.0.0.0:8443
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req.ssl_hello_type 1 }
+
+    acl sni_trojan req.ssl_sni -i dc1-tls-676b11.opfo.xyz
+    acl sni_anytls req.ssl_sni -i dc1-any-9a4fad.opfo.xyz
+
+    use_backend singbox_trojan if sni_trojan
+    use_backend singbox_anytls if sni_anytls
+    default_backend decoy_https
+
+backend singbox_trojan
+    server trojan dc1-sing-box:34795
+
+backend singbox_anytls
+    server anytls dc1-sing-box:40887
+
+backend decoy_https
+    server caddy decoy-caddy:443