Install HAProxy

1.prepare ECS host and backups

ssh root@47.110.67.161 hostname
sudo ss -ltnp
sudo test -e /etc/haproxy || echo absent

Back up /etc/haproxy before installing. Keep the backup outside tracked source. The 72602 mail change also keeps the reverse-tunnel unit backup on the minipc.

2.install Ubuntu package

sudo apt-get install --no-install-recommends haproxy

Do not run upgrade, full-upgrade, or dist-upgrade. Ubuntu may start the package service during installation; stop it before replacing the default configuration and before the tunnel backends are ready.

3.configure TCP passthrough

/etc/haproxy/haproxy.cfg must use mode tcp, bind public IPv4 and IPv6 25, 465, 587, and 993, and send PROXY v2 to:

127.0.0.1:10225
127.0.0.1:10465
127.0.0.1:10587
127.0.0.1:10993

Do not terminate TLS or configure HTTP, relay, or authentication in HAProxy. Validate before starting it:

haproxy -c -f /etc/haproxy/haproxy.cfg

4.start after tunnel verification

# Confirm the four ECS loopback backends are sshd listeners first.
sudo ss -ltnp
sudo systemctl enable --now haproxy
sudo systemctl is-active haproxy
sudo systemctl is-enabled haproxy
sudo ss -ltnp

The public mail ports must belong to haproxy; only the four high ports on 127.0.0.1 may belong to the tunnel sshd.

5.rollback

sudo systemctl stop haproxy
# Restore the saved 10022 unit on 72602-minipc, daemon-reload, restart only 10022.

Do not restore an old HAProxy configuration or uninstall the package as part of this rollback. Preserve Mailu Secrets and PVCs.