dump

nixos/hosts/traefik/traefik.nix

@@ -50,14 +50,41 @@ in {
 
     staticConfigOptions = staticConfig;
 
-    dynamicConfigOptions.http = {
-      routers = allRouters;
-      services = allServices;
-      middlewares = middlewares;
+    dynamicConfigOptions = {
+      # HTTP configuration (your existing setup)
+      http = {
+        routers = allRouters;
+        services = allServices;
+        middlewares = middlewares;
+        serversTransports = {
+          insecureTransport = {
+            insecureSkipVerify = true;
+          };
+        };
+      };
 
-      serversTransports = {
-        insecureTransport = {
-          insecureSkipVerify = true;
+      tcp = {
+        routers = {
+          caddy-fallback = {
+            rule = "HostSNI(`*`)"; # Matches any SNI
+            service = "caddy-tls";
+            entryPoints = ["websecure"];
+            priority = 1; # Lowest priority - only if no HTTP router matches
+            tls = {
+              passthrough = true;
+            };
+          };
+        };
+        services = {
+          caddy-tls = {
+            loadBalancer = {
+              servers = [
+                {
+                  address = "sandbox.lab:443";
+                }
+              ];
+            };
+          };
         };
       };
     };