# DC1 TLS front door

HAProxy inspects TCP SNI without terminating TLS:

- `dc1-tls-676b11.opfo.xyz` -> sing-box Trojan on internal TCP 34795
- `dc1-any-9a4fad.opfo.xyz` -> sing-box AnyTLS on internal TCP 40887
- unmatched SNI -> Caddy fallback serving `dc1.opfo.xyz`

HAProxy publishes host TCP 443. Hysteria2 owns host UDP 443. Caddy publishes
host TCP 80 and receives HTTPS from HAProxy over the project network. Trojan
and AnyTLS have no high-numbered host port. Both projects join the external
`dc1-proxy` network.