OpenConnect VPN (ocserv) behind NPM

[jeffshead]

I haven't found any tutorials or example configurations specifically for NPM.

I want to mix streams and HTTP (layer 4 and 7) together all on ingress port 443. I've been told that NPM can do this with SNI. Is this true? Is it reliable or do I need to look at something else like HAProxy?

I have a VPS that has a single public IP address (45.45.45.45) and the following domains:

• vpn.example.com
• www,example.com

I have Let's Encrypt certs for both domains. Portainer and the NPM admin console are also behind NPM.

The server has the following backend services:

• OpenConnect VPN on port 4444
• Shadowsocks with v2ray uses location /shadow
• Apache web server on port 4443
• Portainer on port 127.0.0.1:9443:9443
• NPM admin console on port 127.0.0.1:81:81

I think traffic needs to default to OpenConnect in case SNI is missing in traffic.

I also have an access list in NPM to limit access to Portainer and the NPM admin console. I also have custom error pages for 404 and 403.

How do I get this working with NPM since there's no Advanced or custom tab for Streams?

Can someone please provide an example config (and how to implement) using the info that I provided?

Thank you!

[jeffshead]

I added more details.