stream {
    server {
    listen 443;
    ssl_preread on;
        proxy_pass $upstream;
    }

    map $ssl_preread_protocol $upstream {
    default shadowsocks;
    "TLSv1.1" https;
    "TLSv1.2" https;
    "TLSv1.3" https;
    }

    upstream shadowsocks {
        server 127.0.0.1:7890;
    }

    upstream https {
        server 127.0.0.1:8888;
    }
}