mirror of
https://github.com/ScuroNeko/mtg.git
synced 2026-08-31 11:54:01 +03:00
FILE / ScuroNeko/mtg
contrib/sni-router/haproxy.cfg
Исходный файл и его история в репозитории.
dolonet
0c1d001949
Turnkey deployment: HAProxy on :443 peeks at the TLS SNI and routes Telegram clients to mtg while forwarding everything else (including DPI probes) to a real Caddy web server with automatic HTTPS. This is the setup recommended in BEST_PRACTICES.md, packaged so that operators can clone and run it with minimal configuration. Refs: #458
48 lines
1.3 KiB
INI
48 lines
1.3 KiB
INI
# HAProxy SNI router — Layer 4 (TCP mode)
|
|
#
|
|
# Inspects the SNI in the TLS ClientHello and routes traffic:
|
|
# - SNI matching the mtg secret domain -> mtg (FakeTLS / MTProto)
|
|
# - Everything else -> real web backend (Caddy)
|
|
#
|
|
# Because routing happens before TLS termination, each backend sees the
|
|
# raw ClientHello and handles TLS itself. The real web backend therefore
|
|
# presents a genuine certificate to any probe or browser.
|
|
|
|
global
|
|
log stdout format raw local0 info
|
|
maxconn 4096
|
|
|
|
defaults
|
|
log global
|
|
mode tcp
|
|
option tcplog
|
|
timeout connect 5s
|
|
timeout client 60s
|
|
timeout server 60s
|
|
|
|
# --- HTTP :80 — redirect to HTTPS -------------------------------------------
|
|
|
|
frontend http
|
|
bind *:80
|
|
mode http
|
|
http-request redirect scheme https code 301
|
|
|
|
# --- TLS :443 — SNI-based routing -------------------------------------------
|
|
|
|
frontend tls
|
|
bind *:443
|
|
tcp-request inspect-delay 5s
|
|
tcp-request content accept if { req_ssl_hello_type 1 }
|
|
|
|
# Route Telegram clients to mtg.
|
|
# Replace "example.com" with the domain from your mtg secret.
|
|
use_backend mtg if { req_ssl_sni -i example.com }
|
|
|
|
default_backend web
|
|
|
|
backend mtg
|
|
server mtg mtg:3128
|
|
|
|
backend web
|
|
server web web:8443
|