stream {
    map $ssl_preread_server_name $backend {
        www.cloudflare.com      xray;
        drive-jp.salmonstill.cn nas;      # NAS 入口（TLS 透传到 NAS）
        default                 npm;
    }
    upstream xray {
        server 127.0.0.1:9443;
    }
    upstream nas {
        server 127.0.0.1:38653;
    }
    upstream npm {
        server 127.0.0.1:8443;
    }
    server {
        listen 443 reuseport;
        listen [::]:443 reuseport;
        ssl_preread on;
        proxy_pass $backend;
    }
}