stream {
    map $ssl_preread_server_name $backend {
        api.example.com  127.0.0.1:8443;
        im.example.com   127.0.0.1:9001;
        default          "";
    }

    server {
        listen 443 reuseport;
        ssl_preread on;
        proxy_connect_timeout 5s;
        proxy_timeout 3600s;
        proxy_pass $backend;
    }

    # Add PROXY protocol only on the IM hop so Gin/HTTP is unaffected.
    server {
        listen 127.0.0.1:9001;
        proxy_protocol on;
        proxy_connect_timeout 5s;
        proxy_timeout 3600s;
        proxy_pass 127.0.0.1:9000;
    }
}