https://aaronyang0628.github.io/docs/csp/72602/tunnel/wireguard-web/index.htmlWireGuard Web Tunnel 公网 Web 入口固定由 ECS HAProxy 持有，HAProxy 通过 WireGuard 访问 72602-minipc 的 ingress-nginx NodePort。TLS 仍由 ingress-nginx 和 cert-manager 管理；ECS 不复制证书，不启用 PROXY protocol，也不终止 TLS。 Internet TCP 80/443 -> ECS HAProxy -> primary: WireGuard 10.77.0.1 <-> 10.77.0.2 over UDP 51820 -> minipc TCP 32080/32443 -> ingress-nginx -> backup: ECS-loopback SSH Web path 127.0.0.1:18080/18443 -> minipc TCP 32080/32443 -> ingress-nginx The WireGuard and SSH Web paths are alternative HAProxy backends, not a serial chain. The SSH Web fallback is an independent ECS-loopback service; its host-local unit and credentials are kept in private host state/ ops-private, not reproduced in this repository.Hugoen