##
# HTTPS server
# - Send to ALPN responder port 4444 if protocol is acme-tls/1
# - Default to HTTPS backend port 4443
##

stream {
  map $ssl_preread_alpn_protocols $tls_port {
    ~\bacme-tls/1\b 4444;
    default 4443;
  }

  server {
    listen 443;
    listen [::]:443;
    proxy_pass 127.0.0.1:$tls_port;
    ssl_preread on;
  }
}