From 435a519b04adbd699266c0c79337861fb46ed554 Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Mon, 15 Jun 2026 13:39:06 +1000
Subject: [PATCH] =?UTF-8?q?feat(haproxy):=20JSON=20tcplog=20=D1=81=20SNI?=
 =?UTF-8?q?=20capture=20=D0=BD=D0=B0=20fe=5Fhttps=5Fsni=20(0.7.6).?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 haproxy.cfg | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/haproxy.cfg b/haproxy.cfg
index d3834b2..fd54704 100644
--- a/haproxy.cfg
+++ b/haproxy.cfg
@@ -1,5 +1,5 @@
 # HAProxy — периметровый reverse-proxy для kalinamall.ru
-# Config version: 0.7.5
+# Config version: 0.7.6
 # Режим: TCP + SNI на 443 (TLS end-to-end, сертификаты на бэкендах)
 # HTTP на 80: zabbix.kalinamall.ru → 192.168.160.53 (allowlist zabbix-allowed)
 #
@@ -38,7 +38,11 @@ defaults
 frontend fe_https_sni
     bind *:443
     mode tcp
+    option tcplog
+    log-format '{"time":"%t","client":"%ci","port":%cp,"fe":"%f","be":"%b","srv":"%s","sni":%{+Q}[capture.req.hdr(0)],"bytes":%B,"term":"%tsc","tw":%Tw,"tc":%Tc,"tt":%Tt}'
+
     tcp-request inspect-delay 5s
+    tcp-request content capture req.ssl_sni len 128
     tcp-request content accept if { req_ssl_hello_type 1 }
 
     # SNI должен быть из списка (несколько acl с одним именем — логическое ИЛИ)