# traffic forwarding core configuration
stream {
  # Here is the SNI identification, mapping the domain name to a configuration name
  map $ssl_preread_server_name $backend_name {
    gost.example.com proxy_gost;
    default web;
  }

  # The subsequent virtual host configuration should listen to 44300 instead of 443
  upstream web {
    server 127.0.0.1:44300;
  }

  upstream proxy_gost {
    server 127.0.0.1:44301;
  }
  upstream gost {
    server 127.0.0.1:4430;
  }

  # listen to 443 and enable ssl_preread and proxy_protocol
  server {
    listen 443 reuseport;
    listen [::]:443 reuseport;
    proxy_pass $backend_name;
    proxy_protocol on;
    ssl_preread on;
  }

  # The server here is the middle layer used to unload the proxy protocol for gost
  # The original upstream gost configuration does not need to be changed
  server {
    listen 44301 proxy_protocol;
    proxy_pass gost;
  }
}

http {
  # ... unchanged
}

server {
  listen 44300 ssl http2 proxy_protocol;
  server_name web.example.com;
  ssl_certificate certs/web.example.com.cer;
  ssl_certificate_key certs/web.example.com.key;

  # Hide the IP of the forwarding layer and set remote_addr to the real client IP
  # Because of this traffic forwarding configuration, which is equivalent to opening another tcp link to this 44300 port at layer 4, the client IP becomes the local IP
  # So the proxy_protocol carries the original client ip, and then the following configuration changes the client ip to the real ip instead of the forwarding layer ip.
  # If you don't do this, the following ip restrictions won't work either.
  set_real_ip_from 172.17.0.0/24;
  set_real_ip_from 127.0.0.1;
  real_ip_header proxy_protocol;
  real_ip_recursive on;

  location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://127.0.0.1:10088;
  }

  access_log logs/web.example.com_access.log;
}