# Public :443 is stream ssl_preread (SNI). Unknown SNI must not fall through to HTTP.
# IM TLS is terminated here (gnet v2 has no native TLS), then PROXY+plaintext to 127.0.0.1:9000.
# HTTP TLS is terminated on 127.0.0.1:8443 (see http.conf).

stream {
    map $ssl_preread_server_name $backend {
        api.example.com  127.0.0.1:8443;
        im.example.com   127.0.0.1:9001;
        default          "";
    }

    server {
        listen 443 reuseport;
        ssl_preread on;
        proxy_connect_timeout 5s;
        proxy_timeout 3600s;
        proxy_pass $backend;
    }

    server {
        listen 127.0.0.1:9001 ssl;
        ssl_certificate     /etc/nginx/certs/im.example.com.crt;
        ssl_certificate_key /etc/nginx/certs/im.example.com.key;
        ssl_protocols       TLSv1.2 TLSv1.3;
        proxy_connect_timeout 5s;
        proxy_timeout 3600s;
        proxy_protocol on;
        proxy_pass 127.0.0.1:9000;
    }
}