infra-docker-configs/servers/bwh-us-dc9/frontdoor/README.md

DC9 TLS front door

HAProxy inspects TCP SNI without terminating TLS:

• dc9-tls-e2f48b.opfo.xyz -> managed sing-box Trojan on host TCP 22591
• sb-dd65a3.kais.cloud -> managed sing-box AnyTLS on host TCP 43824
• dc9.kais.cloud -> the existing Arcane Agent Caddy on arcane_default
• unmatched SNI -> the dedicated Caddy fallback serving dc9.opfo.xyz

HAProxy publishes host TCP 443. The existing Arcane Agent Caddy remains attached to arcane_default without a host TCP 443 binding and receives dc9.kais.cloud traffic from HAProxy.