XHTTP + Haproxy Is This Possible ?

[m0x61h0x64i]

Can we use proxy manager for forwarding and managing traffic while using XHTTP as config network?

I tried using path -m end / but that didnt work, only default backend works for it.

[shakibamoshiri]

Yes you can
no rule is needed for matching path, just match SNI in TCP request (L4) or host in HTTPS request (L7) and forward it to your backend in http mode
your backend should be xray xhttp, mode : auto, path: /what-ever-you-like without TLS

TLS is done by haproxy
xhttp is done by xray

---

some sample configurations can be found here
https://xtls.github.io/en/document/level-2/nginx_or_haproxy_tls_tunnel.html

[shakibamoshiri]

probably you should post/share your haproxy config, 200ms ping is huge and haproxy does not add that much overhead

[m0x61h0x64i]

HAProxy version 3.2.9-1ubuntu2.2 2026/06/19 - https://haproxy.org/
without using cdn
config file:

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 1000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http


frontend front18081
 bind *:18081
 mode http
 use_backend x if { hdr(host) -m end domain1.com }
 use_backend y if { hdr(host) -m end domain2.com }


backend x
 mode http
 server srv1 127.0.0.1:9166 check
 
backend y
 mode http
 server srv1 127.0.0.1:9212 check

[shakibamoshiri]

it is better to learn a bit about HaProxy, you are not doing it right
HaProxy terminates TLS at layer 4 or 7, yours is neither

it should be like this

   mode tcp
   # mode http # can be http as well
   bind IP:PORT ssl  crt /etc/haproxy/haproxy.pem alpn h3,h2,http/1.1
   
   # you can match based on Host if mode was http
   # you can match based on SNI if mode was TCP

[m0x61h0x64i]

Hi @shakibamoshiri thanks for your responses,

This works fine but I have to enable tls for client, Is there a way for http client to work correctly?

[shakibamoshiri]

no problem if you have other http/https applications
you route based on SNI for example a.example.com for your clients and b.example.com for xhttp backend
you need a wildcard cert *.example.com , so the same config but selective with SNI