Add BWH US DC1 proxy stack

2026-09-03 01:52:58 -07:00
parent a922793499
commit 108e5d8021
9 changed files with 316 additions and 0 deletions
@@ -0,0 +1,12 @@
+# DC1 TLS front door
+
+HAProxy inspects TCP SNI without terminating TLS:
+
+- `dc1-tls-676b11.opfo.xyz` -> sing-box Trojan on internal TCP 34795
+- `dc1-any-9a4fad.opfo.xyz` -> sing-box AnyTLS on internal TCP 40887
+- unmatched SNI -> Caddy fallback serving `dc1.opfo.xyz`
+
+HAProxy publishes host TCP 443. Hysteria2 owns host UDP 443. Caddy publishes
+host TCP 80 and receives HTTPS from HAProxy over the project network. Trojan
+and AnyTLS have no high-numbered host port. Both projects join the external
+`dc1-proxy` network.