title: HAProxy reverse proxy SNI wildcard
body: <p>I need some help with my HAProxy config. I am currently using HAProxy 1.5 to access geoblocked websites by reverse proxying them through altered DNS entries.
  (<a href="https://github.com/trick77/tunlr-style-dns-unblocking" rel="noreferrer">https://github.com/trick77/tunlr-style-dns-unblocking</a>).</p>
  
  <p>Now I stumbled upon a problem as I have to proxy many subdomains of one server (lets say abc.xyz.com, def.xyz.com, ...).
  Is it possible to create a wildcard for my config by using something like *.xyz.com and that actually works with SNI and all subdomains of this domain?</p>
  
  <p>Thank you very much in advance!</p>
  
  <pre><code>global
    daemon
    maxconn 200
    user haproxy
    group haproxy
    stats socket /var/run/haproxy.sock mode 0600 level admin
    log /dev/log  local0 debug
    pidfile /var/run/haproxy.pid
    spread-checks 5
  
  defaults
    maxconn 195
    log global
    mode http
    option httplog
    option abortonclose
    option http-server-close
    option persist
    option accept-invalid-http-response
  
    timeout connect 20s
    timeout server 120s
    timeout client 120s
    timeout check 10s
    retries 3
  
  # catchall ------------------------------------------------------------------------
  
  frontend f_catchall
    mode http
    bind *:80
    log global
    option httplog
    option accept-invalid-http-request
  
    capture request  header Host len 50
    capture request  header User-Agent len 150
  
    #--- xyz.com
    use_backend b_catchall     if { hdr(host) -i abc.xyz.com }
  
  
    default_backend b_deadend
  
  backend b_catchall
    log global
    mode http
    option httplog
    option http-server-close
  
    #--- xyz.com
    use-server abc.xyz.com                    if { hdr(host) -i abc.xyz.com }
    server abc.xyz.com abc.xyz.com:80 check inter 10s fastinter 2s downinter 2s fall 1800
  
  frontend f_catchall_sni
    bind *:443
    mode tcp
    log global
    option tcplog
    no option http-server-close
  
    tcp-request inspect-delay 5s
    tcp-request content accept               if { req_ssl_hello_type 1 }
  
    #--- abc
    use_backend b_catchall_sni               if { req_ssl_sni -i abc.xyz.com }
  
    default_backend b_deadend_sni
  
  backend b_catchall_sni
    log global
    option tcplog
    mode tcp
    no option http-server-close
    no option accept-invalid-http-response
  
    #---xyz.com
    use-server abc.xyz.com                    if { req_ssl_sni -i abc.xyz.com }
    server abc.xyz.com abc.xyz.com:443 check inter 10s fastinter 2s downinter 2s fall 1800
  
  # deadend ------------------------------------------------------------------------
  
  backend b_deadend
    mode http
    log global
    option httplog
  
  backend b_deadend_sni
    mode tcp
    log global
    option tcplog
    no option accept-invalid-http-response
    no option http-server-close
  </code></pre>