Add DC9 HAProxy TLS front door

2026-09-02 22:54:05 -07:00
parent 7ea4515b27
commit 787a1128c1
8 changed files with 142 additions and 72 deletions
@@ -0,0 +1,3 @@
+# Stage on 8444 first. Change to 443 only after the Arcane Agent Caddy is
+# reachable through its temporary management port and host TCP 443 is free.
+HAPROXY_PUBLIC_PORT=8444
@@ -0,0 +1,12 @@
+# DC9 TLS front door
+
+HAProxy inspects TCP SNI without terminating TLS:
+
+- `dc9-tls-e2f48b.opfo.xyz` -> managed sing-box Trojan on host TCP 22591
+- `sb-dd65a3.kais.cloud` -> managed sing-box AnyTLS on host TCP 43824
+- `dc9.kais.cloud` -> the existing Arcane Agent Caddy on `arcane_default`
+- unmatched SNI -> the dedicated Caddy fallback serving `dc9.opfo.xyz`
+
+The first deployment uses host TCP 8444. Moving it to TCP 443 requires a staged
+handoff from the existing Arcane Agent Caddy so the Direct HTTPS management path
+remains reachable throughout the change.
@@ -0,0 +1,21 @@
+{
+    servers {
+        protocols h1 h2
+    }
+}
+
+dc9.opfo.xyz {
+    encode zstd gzip
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options DENY
+        Referrer-Policy no-referrer
+    }
+    respond <<HTML 200
+<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Service Status</title></head>
+<body><main><h1>Service online</h1><p>The requested service is available.</p></main></body>
+</html>
+HTML
+}
@@ -0,0 +1,44 @@
+services:
+  haproxy:
+    image: haproxy:3.4.4-alpine3.24
+    container_name: dc9-haproxy
+    restart: unless-stopped
+    ports:
+      - "${HAPROXY_PUBLIC_PORT:-8444}:8443/tcp"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    depends_on:
+      - decoy-caddy
+    networks:
+      - default
+      - arcane
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
+  decoy-caddy:
+    image: caddy:2.11.4
+    container_name: dc9-decoy-caddy
+    restart: unless-stopped
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
+networks:
+  arcane:
+    external: true
+    name: arcane_default
+
+volumes:
+  caddy-data:
+  caddy-config:
@@ -0,0 +1,37 @@
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log global
+    mode tcp
+    option tcplog
+    timeout connect 5s
+    timeout client 24h
+    timeout server 24h
+
+frontend tls_443
+    bind 0.0.0.0:8443
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req.ssl_hello_type 1 }
+
+    acl sni_trojan req.ssl_sni -i dc9-tls-e2f48b.opfo.xyz
+    acl sni_anytls req.ssl_sni -i sb-dd65a3.kais.cloud
+    acl sni_arcane req.ssl_sni -i dc9.kais.cloud
+
+    use_backend singbox_trojan if sni_trojan
+    use_backend singbox_anytls if sni_anytls
+    use_backend arcane_agent if sni_arcane
+    default_backend decoy_https
+
+backend singbox_trojan
+    server trojan host.docker.internal:22591
+
+backend singbox_anytls
+    server anytls host.docker.internal:43824
+
+backend arcane_agent
+    server arcane arcane-agent-caddy:443
+
+backend decoy_https
+    server caddy decoy-caddy:443