# Additive examples only; this is NOT a standalone HAProxy configuration.
# Do not paste this whole file over the live config.
#
# 443 TLS passthrough example: insert in the existing mode tcp frontend bound
# to :443 after its existing TLS inspection rules and after explicit routes for
# other domains, but before any catch-all use_backend/default_backend. Replace
# CADDY_TLS_BACKEND_FROM_ACTIVE_CONFIG with the exact backend already used for
# krona-reverse-proxy. Do not create backend addresses based on guesses about
# Docker networks.
# If this frontend has no TLS ClientHello inspection, stop and reconcile its
# active routing design before adding these lines.
#
# tcp-request inspect-delay 5s   # add only if the frontend has no inspect delay
acl randomayzer_sni req.ssl_sni -i random.ochenstarik.ru
use_backend CADDY_TLS_BACKEND_FROM_ACTIVE_CONFIG if randomayzer_sni
# Keep existing explicit routes and the original default_backend unchanged.

# HTTP-01 example: only if inspection shows an existing mode http :80 frontend
# does not already route this host to Caddy. Put the host ACL and use_backend
# after existing explicit host routes and before any catch-all rule. This must
# use a distinct cleartext Caddy :80 backend, never the TLS :443 backend above.
# Caddy must receive the full, unchanged /.well-known/acme-challenge/<token>
# path on port 80; do not redirect, rewrite, or route it elsewhere in HAProxy.
#
# acl randomayzer_http01 path_beg /.well-known/acme-challenge/
# acl randomayzer_http_host hdr(host),field(1,:) -i random.ochenstarik.ru
# use_backend CADDY_HTTP_BACKEND_FROM_ACTIVE_CONFIG if randomayzer_http_host randomayzer_http01