# 443/TCP SNI 分流(ssl_preread)—— 逐字沿用现网,后端地址不变。
# host 网络下容器内的 127.0.0.1 即宿主 loopback,可直达各后端。
stream {
    map $ssl_preread_server_name $backend {
        www.cloudflare.com  127.0.0.1:10443;   # Marzban REALITY(线上代理)
        vpn.51yanmei.com    127.0.0.1:8443;    # Marzban 面板(本 nginx http)
        blog.51yanmei.com   127.0.0.1:8444;    # 博客(本 nginx http)
        jiu.51yanmei.com    127.0.0.1:8445;    # jiu(本 nginx http)
        default             127.0.0.1:10443;   # 兜底 → Marzban REALITY
    }

    server {
        listen 443;
        listen [::]:443;
        proxy_pass $backend;
        ssl_preread on;
        proxy_connect_timeout 10s;
        proxy_timeout 3600s;
    }
}