Route TLS traffic by hostname — without decrypting.
SNI Router is a lightweight, HAProxy-based TLS/SNI passthrough router. It reads the SNI hostname from the TLS ClientHello and forwards the raw TCP stream to the matching backend — zero decryption, zero certificate management. Configured entirely via environment variables.
Why SNI Router?
TLS passthrough
Reads only the TLS ClientHello SNI field. The byte stream is forwarded untouched — backends manage their own certificates.
Multi-backend routing
Route traffic from a single public IP to multiple backends by hostname. Wildcard rules (*.example.com) are supported.
Environment-only config
No config file to maintain. All routes and options are set via environment variables or a Docker Compose block scalar.
Automatic priority sorting
Exact hostnames always win over wildcards, regardless of declaration order. The HAProxy config is generated and validated at startup.
TCP + HTTP routing
Route plain TCP connections by listen port and HTTP traffic with optional Let's Encrypt http-01 challenge forwarding.
PROXY protocol v2
Optionally prepend PROXY protocol v2 headers so backends recover the real client IP instead of the router address.