feat: add HAProxy dual-domain routing with separate IPv4 headers

docker-compose.yml

@@ -5,6 +5,7 @@ services:
       - "443:443"
     volumes:
       - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+      - ./haproxy/ipv4_domain.lst:/usr/local/etc/haproxy/ipv4_domain.lst:ro
       - ${CERT_PATH:-./haproxy/certs}:/etc/haproxy/certs:ro
       - ${IPV4_CERT_PATH:-./haproxy/certs-ipv4}:/etc/haproxy/certs-ipv4:ro
     depends_on:

haproxy/haproxy.cfg

@@ -19,7 +19,7 @@ defaults
     timeout http-keep-alive 5s
 
 frontend https_in
-    bind *:443 ssl crt /etc/haproxy/certs/origin.pem alpn h2,http/1.1 strict-sni
+    bind *:443 ssl crt /etc/haproxy/certs/origin.pem crt /etc/haproxy/certs-ipv4/origin.pem alpn h2,http/1.1 strict-sni
 
     # Gzip compression
     compression algo gzip
@@ -28,11 +28,17 @@ frontend https_in
     # Access to port 443 is already restricted to Cloudflare IPs at the UFW level
     # Therefore, all requests reaching HAProxy come from Cloudflare; no additional ACL validation is required.
 
-    # HAProxy's own forwardfor is not enabled; real IP is set explicitly below via CF-Connecting-IP
+    # Identify IPv4-only domain traffic by Host header
+    acl is_ipv4_domain hdr(host) -f /usr/local/etc/haproxy/ipv4_domain.lst
 
-    # Overwrite standard headers directly with the real IP forcibly added by Cloudflare
-    http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)]
-    http-request set-header X-Real-IP      %[req.hdr(CF-Connecting-IP)]
+    # HAProxy's own forwardfor is not enabled; real IP is set explicitly below via CF-Connecting-IP
+    # Main domain: standard headers
+    http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)] if !is_ipv4_domain
+    http-request set-header X-Real-IP      %[req.hdr(CF-Connecting-IP)] if !is_ipv4_domain
+    # IPv4-only domain: separate header to prevent confusion with the main domain
+    http-request set-header X-IPv4-Client-IP %[req.hdr(CF-Connecting-IP)] if is_ipv4_domain
+    http-request del-header X-Forwarded-For if is_ipv4_domain
+    http-request del-header X-Real-IP       if is_ipv4_domain
 
     # Rate limiting: tiered based on global request rate
     # Track per-IP request rate (per minute)

haproxy/ipv4_domain.lst

@@ -0,0 +1,2 @@
+# IPv4-only domain name for dual-stack detection
+# Add the domain (e.g., noipv6.org) on a new line below