relayd.conf

# $OpenBSD: relayd.conf,v 1.5 2018/05/06 20:56:55 benno Exp $
#
# Macros
#
ext_ip1="203.0.113.4"
ext_ip2="2001:0db8::4"
app_port="31337"
table <app> { 10.0.0.4 }
table <defaulter> { 127.0.0.1, ::1 }

#
# Global Options
#
log connection errors

#
# Redirections
#
redirect "http" {
  listen on $ext_ip1 port http
  listen on $ext_ip2 port http

  forward to <defaulter> check tcp
}

#
# Relays
#
http protocol "https" {
  match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
  match request header append "X-Forwarded-By" \
    value "$SERVER_ADDR:$SERVER_PORT"
  match request header set "Connection" value "close"

  match request header "Host" value "app.*" forward to <app>

  tcp { sack, backlog 128 }

  tls ciphers "HIGH:!AES128:!kRSA:!aNULL" # default: "HIGH:!aNULL"
  tls ecdhe "P-384,P-256,X25519" # default: "X25519,P-256,P-384"

  tls keypair www.example.com
  tls keypair app.example.com
}

# a relay for each IP

relay "https" {
  listen on $ext_ip1 port https tls

  protocol "https"

  forward to <defaulter> check tcp
  forward to <app> port $app_port check tcp
}

relay "https2" {
  listen on $ext_ip2 port https tls

  protocol "https"

  forward to <defaulter> check tcp
  forward to <app> port $app_port check tcp
}