feat: configure sni tcp routes

docs/deployment.md

@@ -8,12 +8,22 @@
 
 ## Configuration
 
-Update `config/dynamic/tcp-services.yml` with the real backend addresses:
+Update `config/dynamic/tcp-services.yml` with the required SNI hostnames and backend addresses:
 
 ```yaml
-servers:
-  - address: "10.0.0.10:443"
-  - address: "10.0.0.11:443"
+tcp:
+  routers:
+    example:
+      rule: "HostSNI(`example.org`)"
+      service: example
+      tls:
+        passthrough: true
+
+  services:
+    example:
+      loadBalancer:
+        servers:
+          - address: "host.docker.internal:8443"
 ```
 
 If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.

docs/operations.md

@@ -54,4 +54,4 @@ For backends running on the Docker host, use `host.docker.internal:PORT` rather
 
 - TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
 - Backend certificates and renewal jobs must be monitored on each backend.
-- The default configuration routes all SNI names to the same backend pool. Use more specific `HostSNI(...)` rules if different names need different pools.
+- SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.

docs/testing.md

@@ -20,6 +20,14 @@ openssl s_client -connect LOAD_BALANCER_HOST:443 -servername EXPECTED_DNS_NAME
 
 The certificate shown by `openssl` should be the backend certificate, not a certificate stored by Traefik.
 
+For the included SNI example:
+
+```bash
+openssl s_client -connect LOAD_BALANCER_HOST:443 -servername lab.younerd.org
+openssl s_client -connect LOAD_BALANCER_HOST:443 -servername azionelab.org
+openssl s_client -connect LOAD_BALANCER_HOST:443 -servername www.azionelab.org
+```
+
 ## Test categories
 
 - Docker/Compose validation: `docker compose config`.