Environment Variables
Environment Variables
SNI Router is configured entirely via environment variables. The entrypoint.sh script reads these at container start, generates haproxy.cfg, validates it, and then starts HAProxy. If any required variable is missing or a value is malformed, the container exits with an error.
TLS / SNI routing
| Variable | Required | Default | Description |
|---|---|---|---|
SNI_LISTEN_PORT | No | 443 | Port HAProxy listens on for TLS/SNI traffic. |
SNI_ROUTE_N | At least one | — | TLS routing rule: hostname:backend_ip:backend_port. N must be consecutive integers starting at 1 (SNI_ROUTE_1, SNI_ROUTE_2, …). |
SNI_ROUTES | No | — | Multiline alternative to SNI_ROUTE_N. One hostname:ip:port per line; # comments and blank lines are ignored. Processed after SNI_ROUTE_N. Useful with Docker Compose block-scalar YAML (|). |
SNI_DEFAULT | Yes | — | Default backend when no SNI rule matches: ip:port. |
Wildcard hostnames are supported: *.example.com matches any subdomain. See Routing Rules for details on how exact and wildcard rules interact.
HTTP frontend
The HTTP frontend (port 80) allows SNI Router to forward Let's Encrypt http-01 ACME challenges to the correct backend and redirect all other plain HTTP requests to HTTPS.
| Variable | Required | Default | Description |
|---|---|---|---|
SNI_HTTP_REDIRECT | No | false | Enable the HTTP frontend. All unmatched requests are 301-redirected to HTTPS. Activated automatically if any HTTP_ROUTE_* variable is set. |
SNI_HTTP_PORT | No | 80 | Port for the HTTP frontend. |
HTTP_ROUTE_N | No | — | HTTP routing rule: hostname:backend_ip:backend_port. |
HTTP_ROUTES | No | — | Multiline alternative to HTTP_ROUTE_N (same format as SNI_ROUTES). |
Plain TCP routing
Each TCP_ROUTE_N creates an independent HAProxy frontend that forwards all traffic arriving on listen_port to the specified backend — no SNI inspection.
| Variable | Required | Default | Description |
|---|---|---|---|
TCP_ROUTE_N | No | — | TCP routing rule: listen_port:backend_ip:backend_port. Remember to expose listen_port in your ports: mapping. |
PROXY protocol
| Variable | Required | Default | Description |
|---|---|---|---|
PROXY_PROTOCOL | No | false | Send PROXY protocol v2 header to all backends (true/false). Backends must be configured to accept it. See Traefik integration. |
Health checks
By default every backend is TCP-checked every 2 seconds (inter 2s fall 3 rise 2). The variables below replace the plain TCP check with an HTTPS application-level check for individual backends.
| Variable | Required | Default | Description |
|---|---|---|---|
SNI_HEALTH_N | No | (TCP) | HTTPS health-check path for SNI_ROUTE_N (e.g. /health). HAProxy sends GET <path> over TLS (no cert verification) with Host: <hostname>. |
SNI_HEALTH_<norm> | No | (TCP) | HTTPS health-check path for an SNI_ROUTES entry. <norm> is the hostname with ., *, - replaced by _ (e.g. SNI_HEALTH_app1_example_com=/health). |
SNI_DEFAULT_HEALTH | No | (TCP) | HTTPS health-check path for the SNI_DEFAULT backend. |
TCP_HEALTH_N | No | (TCP) | HTTPS health-check path for TCP_ROUTE_N. |
See Health Checks for detailed examples.
HAProxy stats UI
| Variable | Required | Default | Description |
|---|---|---|---|
STATS_ENABLED | No | false | Enable the built-in HAProxy stats web dashboard. |
STATS_PORT | No | 8404 | Port for the stats UI. Access at http://<local-ip>:<STATS_PORT>/stats. |
STATS_PASSWORD | No | (none) | Password for the admin user. Leave empty to disable authentication. |
0.0.0.0 on a public host. In docker-compose.yml: "192.168.1.5:8404:8404" instead of "8404:8404".