From 7ea4515b27f7b8221026a1655216b121ffea3992 Mon Sep 17 00:00:00 2001 From: Codex Date: Wed, 2 Sep 2026 22:22:01 -0700 Subject: [PATCH] Fix HAProxy unprivileged TLS listener --- servers/bwh-hk-cmi/web/compose.yaml | 6 ++++-- servers/bwh-hk-cmi/web/haproxy/haproxy.cfg | 8 ++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/servers/bwh-hk-cmi/web/compose.yaml b/servers/bwh-hk-cmi/web/compose.yaml index 4e11b5c..5683634 100644 --- a/servers/bwh-hk-cmi/web/compose.yaml +++ b/servers/bwh-hk-cmi/web/compose.yaml @@ -3,7 +3,10 @@ services: image: haproxy:3.4.4-alpine3.24 container_name: haproxy restart: unless-stopped - network_mode: host + ports: + - "443:8443/tcp" + extra_hosts: + - "host.docker.internal:host-gateway" depends_on: - caddy volumes: @@ -20,7 +23,6 @@ services: restart: unless-stopped ports: - "80:80" - - "127.0.0.1:8443:443" volumes: - ./Caddyfile:/etc/caddy/Caddyfile:ro - /opt/stacks/web/caddy/site:/srv diff --git a/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg b/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg index 292668e..b91a0a3 100644 --- a/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg +++ b/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg @@ -11,7 +11,7 @@ defaults timeout server 24h frontend tls_443 - bind 0.0.0.0:443 + bind 0.0.0.0:8443 tcp-request inspect-delay 5s tcp-request content accept if { req.ssl_hello_type 1 } @@ -23,10 +23,10 @@ frontend tls_443 default_backend caddy_https backend singbox_anytls - server anytls 127.0.0.1:28443 + server anytls host.docker.internal:28443 backend singbox_trojan - server trojan 127.0.0.1:32700 + server trojan host.docker.internal:32700 backend caddy_https - server caddy 127.0.0.1:8443 + server caddy caddy:443