http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/https-tunnels
As with SSH tunneling, the initial connection is actually made to haproxy , which acts as a frontend balancer for this whole thing (and it's also used to balance our TCP OpenVPN instances). haproxy detects whether the session is RSA OpenVPN, ECC OpenVPN, or SSH, or HTTPS, and forwards it to it's respective backend. For HTTPS, haproxy sends the session to the server-side stunnel, which then forwards it back to haproxy (minus the HTTPS).