Quick Start

This guide walks you through the minimal setup to route TLS traffic from a single public IP to two backend machines.

Step 1 — Create the environment file

Copy the provided template and edit the values:

git clone https://github.com/circle-rd/sni-router.git
cd sni-router
cp .env.example .env
$EDITOR .env

Minimal required content for .env:

# At least one SNI rule
SNI_ROUTE_1=app1.example.com:192.168.1.10:443
SNI_ROUTE_2=app2.example.com:192.168.1.20:443

# Required — default backend when no SNI rule matches
SNI_DEFAULT=192.168.1.10:443

Step 2 — Start the container

docker compose up -d

SNI Router will:

1. Read all SNI_ROUTE_* and SNI_DEFAULT variables
2. Generate /usr/local/etc/haproxy/haproxy.cfg
3. Validate the config with haproxy -c -f
4. Start HAProxy

If the config is invalid (e.g. a malformed route variable), the container exits immediately with an error message.

Step 3 — Verify routing

Use openssl s_client to confirm that each hostname reaches the correct backend (the certificate returned must be the backend's own certificate, not from SNI Router):

# Should return app1's certificate
openssl s_client -connect <public-ip>:443 -servername app1.example.com </dev/null 2>&1 | grep "subject="

# Should return app2's certificate
openssl s_client -connect <public-ip>:443 -servername app2.example.com </dev/null 2>&1 | grep "subject="

# Should fall back to SNI_DEFAULT (app1)
openssl s_client -connect <public-ip>:443 -servername unknown.example.com </dev/null 2>&1 | grep "subject="

Step 4 — Check container health

docker compose ps
docker compose logs sni-router

A healthy container outputs the generated haproxy.cfg summary and then the HAProxy startup banner.

Next steps

• Environment variables reference — full list of all options
• Routing rules — SNI, TCP, and HTTP routing in depth
• Traefik integration — PROXY protocol setup with Traefik