13 lines
520 B
Markdown
13 lines
520 B
Markdown
# DC1 TLS front door
|
|
|
|
HAProxy inspects TCP SNI without terminating TLS:
|
|
|
|
- `dc1-tls-676b11.opfo.xyz` -> sing-box Trojan on internal TCP 34795
|
|
- `dc1-any-9a4fad.opfo.xyz` -> sing-box AnyTLS on internal TCP 40887
|
|
- unmatched SNI -> Caddy fallback serving `dc1.opfo.xyz`
|
|
|
|
HAProxy publishes host TCP 443. Hysteria2 owns host UDP 443. Caddy publishes
|
|
host TCP 80 and receives HTTPS from HAProxy over the project network. Trojan
|
|
and AnyTLS have no high-numbered host port. Both projects join the external
|
|
`dc1-proxy` network.
|