infra-docker-configs/servers/bwh-us-dc9/frontdoor

DC9 TLS front door

HAProxy inspects TCP SNI without terminating TLS:

• dc9-tls-e2f48b.opfo.xyz -> managed sing-box Trojan on host TCP 22591
• sb-dd65a3.kais.cloud -> managed sing-box AnyTLS on host TCP 43824
• dc9.kais.cloud -> the existing Arcane Agent Caddy on arcane_default
• unmatched SNI -> the dedicated Caddy fallback serving dc9.opfo.xyz

The first deployment uses host TCP 8444. Moving it to TCP 443 requires a staged handoff from the existing Arcane Agent Caddy so the Direct HTTPS management path remains reachable throughout the change.