China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

Not currently, but it’s designed for it!

What you’re looking for is a TLS connection policy “matcher” module: JSON Config Structure - Caddy Documentation

These allow you to customize what kind of TLS configuration Caddy uses based on whatever matches the client’s TLS ClientHello. Part of that is the client’s (remote’s) IP address. We already have one such matcher for HTTP requests: Modules - Caddy Documentation

So, adding a remote IP module for TLS connections is easy breezy – we can copy or borrow the logic from the existing HTTP request matcher module. Then voila, you can serve one TLS ServerHello to some clients based on their IP address, and another ServerHello to all others.

However, this almost certainly won’t be exposed in the Caddyfile (anytime soon).

2 Likes