newConn := func() *http2.Transport {
		if cfg.scheme == scheme.HTTPS {
			return &http2.Transport{
				TLSClientConfig: cfg.tlsConfig,
				DialTLS: func(network, addr string, tlsConfig *tls.Config) (net.Conn, error) {
					return hbone.TLSDialWithDialer(newDialer(cfg), network, addr, tlsConfig)
				},
			}
		}

		return &http2.Transport{

 *
 * ## Protocol vs Scheme
 *
 * Despite its name, [java.net.URL.getProtocol] returns the [scheme][java.net.URI.getScheme] (http,
 * https, etc.) of the URL, not the protocol (http/1.1, spdy/3.1, etc.). OkHttp uses the word
 * *protocol* to identify how HTTP messages are framed.
 *
 * [ietf_alpn]: http://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg
 */
enum class Protocol(private val protocol: String) {
  /**

// structure for RDS.
// HTTP servers have route name set to http.<portNumber>.
//
//	Multiple HTTP servers can exist on the same port and the code will combine all of them into
//	one single RDS payload for http.<portNumber>
//
// HTTPS servers with TLS termination (i.e. envoy decoding the content, and making outbound http calls to backends)

	// Method for the request. Valid only for HTTP
	Method string `protobuf:"bytes,9,opt,name=method,proto3" json:"method,omitempty"`
	// If true, requests will be sent using h2c prior knowledge
	Http2 bool `protobuf:"varint,7,opt,name=http2,proto3" json:"http2,omitempty"`
	// If true, requests will be sent using http3
	Http3 bool `protobuf:"varint,15,opt,name=http3,proto3" json:"http3,omitempty"`

  // NONE means requests should be forwarded as-is, without tunneling.
  NONE = 0;
  // HBONE means requests should be tunneled over HTTP.
  // This does not dictate HTTP/1.1 vs HTTP/2; ALPN should be used for that purpose.
  HBONE = 1;
  // Future options may include things like QUIC/HTTP3, etc.
}

// ApplicationProtocol specifies a workload  (application or gateway) can
// consume tunnel information.

		scheme := redirect.Scheme
		if scheme == "" {
			if isTLS {
				scheme = "https"
			} else {
				scheme = "http"
			}
		}
		// Do not put explicit :80 or :443 when its http/https
		if action.Redirect.PortRedirect == 80 && scheme == "http" {
			action.Redirect.PortRedirect = 0
		}
		if action.Redirect.PortRedirect == 443 && scheme == "https" {
			action.Redirect.PortRedirect = 0
		}
	}

	// Values are expected to be a CSV list, sorted by preference, of protocols supported.
	// Currently supported values:
	// * "http": indicates tunneling over HTTP over TCP. HTTP/2 vs HTTP/1.1 may be supported by ALPN negotiation.
	// Planned future values:
	// * "http3": indicates tunneling over HTTP over QUIC. This is distinct from "http", since we cannot do ALPN
	//   negotiation for QUIC vs TCP.

	TunnelProtocol_NONE TunnelProtocol = 0
	// HBONE means requests should be tunneled over HTTP.
	// This does not dictate HTTP/1.1 vs HTTP/2; ALPN should be used for that purpose.
	TunnelProtocol_HBONE TunnelProtocol = 1 // Future options may include things like QUIC/HTTP3, etc.
)

// Enum value maps for TunnelProtocol.
var (
	TunnelProtocol_name = map[int32]string{
		0: "NONE",

Обычной практикой является иметь **одну программу/HTTP-сервер** запущенную на сервере (машине, хосте и т.д.) и **ответственную за всю работу с HTTPS**:

* получение **зашифрованных HTTPS-запросов**
* отправка **расшифрованных HTTP запросов** в соответствующее HTTP-приложение, работающее на том же сервере (в нашем случае, это приложение **FastAPI**)
* получение **HTTP-ответа** от приложения

    * Die Inhalte sind **verschlüsselt**, auch wenn sie mit dem **HTTP-Protokoll** gesendet werden.