stream { map $ssl_preread_protocol $upstream_3000 { "" 127.0.0.1:3001; # HTTP clair default 127.0.0.1:3443; # TLS -> HTTPS } server { listen 3000; proxy_pass $upstream_3000; ssl_preread on; } }