{ ... }:
{
    services.nginx = {
        streamConfig = ''
            map $ssl_preread_server_name $target_backend {
                md.gvfr.de rupert;
                default localserv;
            }

            upstream rupert {
                server rupert.gvfr.de:443;
            }

            upstream localserv {
                server localhost:4431;
            }

            server {
                listen 443;

                # proxy_connect_timeout 1s;
                # proxy_timeout 3s;
                # resolver 1.1.1.1;

                proxy_pass $target_backend;
                ssl_preread on;
            }
        '';

        defaultSSLListenPort = 4431;
    };
}
