infra-docker-configs/servers/bwh-us-dc1/frontdoor

DC1 TLS front door

HAProxy inspects TCP SNI without terminating TLS:

• dc1-tls-676b11.opfo.xyz -> sing-box Trojan on internal TCP 34795
• dc1-any-9a4fad.opfo.xyz -> sing-box AnyTLS on internal TCP 40887
• unmatched SNI -> Caddy fallback serving dc1.opfo.xyz

HAProxy publishes host TCP 443. Hysteria2 owns host UDP 443. Caddy publishes host TCP 80 and receives HTTPS from HAProxy over the project network. Trojan and AnyTLS have no high-numbered host port. Both projects join the external dc1-proxy network.