stream { map $ssl_preread_server_name $name { .rainrain.xyz rainrainxyz; default proxy; } upstream rainrainxyz { server tailscale.rain.internal.simponic.xyz:443; } upstream proxy { server 127.0.0.1:4443; } server { listen 443; proxy_pass $name; ssl_preread on; } }