# DC9 TLS front door

HAProxy inspects TCP SNI without terminating TLS:

- `dc9-tls-e2f48b.opfo.xyz` -> managed sing-box Trojan on host TCP 22591
- `sb-dd65a3.kais.cloud` -> managed sing-box AnyTLS on host TCP 43824
- `dc9.kais.cloud` -> the existing Arcane Agent Caddy on `arcane_default`
- unmatched SNI -> the dedicated Caddy fallback serving `dc9.opfo.xyz`

The first deployment uses host TCP 8444. Moving it to TCP 443 requires a staged
handoff from the existing Arcane Agent Caddy so the Direct HTTPS management path
remains reachable throughout the change.