# Spark IM + shared HTTPS on :443 (ssl_preread).
# sparkim.wyrs365.com → IM TLS terminator → PROXY plaintext to gnet :9090
# default SNI → existing HTTP sites on 127.0.0.1:8443 (proxy_protocol restores RealIP)

map $ssl_preread_server_name $spark_sni_backend {
    sparkim.wyrs365.com  127.0.0.1:19001;
    default              127.0.0.1:8443;
}

server {
    listen 443 reuseport;
    listen [::]:443 reuseport ipv6only=on;
    ssl_preread on;
    proxy_connect_timeout 5s;
    proxy_timeout 3600s;
    proxy_protocol on;
    proxy_pass $spark_sni_backend;
}

server {
    listen 127.0.0.1:19001 ssl proxy_protocol;
    ssl_certificate     /etc/letsencrypt/live/sparkim.wyrs365.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sparkim.wyrs365.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    proxy_connect_timeout 5s;
    proxy_timeout 3600s;
    proxy_protocol on;
    proxy_pass 127.0.0.1:9090;
}