Add DC9 HAProxy TLS front door

2026-09-02 22:54:05 -07:00
parent 7ea4515b27
commit 787a1128c1
8 changed files with 142 additions and 72 deletions
@@ -0,0 +1,12 @@
+# DC9 TLS front door
+
+HAProxy inspects TCP SNI without terminating TLS:
+
+- `dc9-tls-e2f48b.opfo.xyz` -> managed sing-box Trojan on host TCP 22591
+- `sb-dd65a3.kais.cloud` -> managed sing-box AnyTLS on host TCP 43824
+- `dc9.kais.cloud` -> the existing Arcane Agent Caddy on `arcane_default`
+- unmatched SNI -> the dedicated Caddy fallback serving `dc9.opfo.xyz`
+
+The first deployment uses host TCP 8444. Moving it to TCP 443 requires a staged
+handoff from the existing Arcane Agent Caddy so the Direct HTTPS management path
+remains reachable throughout the change.