stream { map $ssl_preread_server_name $name { hostnames; .rainrain.xyz rainrainxyz; default proxy; } upstream rainrainxyz { server tailscale.rain.internal.simponic.xyz:443; } upstream proxy { server 127.0.0.1:4443; } server { listen 443; proxy_pass $name; proxy_protocol on; ssl_preread on; } }