stream {
  map $ssl_preread_server_name $name {
    .rainrain.xyz  rainrainxyz;
    default proxy;
  }

  upstream rainrainxyz {
    server tailscale.rain.internal.simponic.xyz:443;
  }
  upstream proxy {
    server 127.0.0.1:4443;
  }

  server {
    listen 443;
    proxy_pass $name;
    ssl_preread on;
  }
}