Fix HAProxy unprivileged TLS listener

servers/bwh-hk-cmi/web/compose.yaml

@@ -3,7 +3,10 @@ services:
     image: haproxy:3.4.4-alpine3.24
     container_name: haproxy
     restart: unless-stopped
-    network_mode: host
+    ports:
+      - "443:8443/tcp"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     depends_on:
       - caddy
     volumes:
@@ -20,7 +23,6 @@ services:
     restart: unless-stopped
     ports:
       - "80:80"
-      - "127.0.0.1:8443:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - /opt/stacks/web/caddy/site:/srv

servers/bwh-hk-cmi/web/haproxy/haproxy.cfg

@@ -11,7 +11,7 @@ defaults
     timeout server 24h
 
 frontend tls_443
-    bind 0.0.0.0:443
+    bind 0.0.0.0:8443
     tcp-request inspect-delay 5s
     tcp-request content accept if { req.ssl_hello_type 1 }
 
@@ -23,10 +23,10 @@ frontend tls_443
     default_backend caddy_https
 
 backend singbox_anytls
-    server anytls 127.0.0.1:28443
+    server anytls host.docker.internal:28443
 
 backend singbox_trojan
-    server trojan 127.0.0.1:32700
+    server trojan host.docker.internal:32700
 
 backend caddy_https
-    server caddy 127.0.0.1:8443
+    server caddy caddy:443