nginx configuration for tls-alpn-01

issue.sh

# using https://github.com/Neilpang/acme.sh
acme.sh --issue -d your.domain.1 --alpn --tlsport 30443

stream.conf

stream {
  map $ssl_preread_alpn_protocols $is_acme {
    ~\bacme-tls/1\b 1;
    default 0;
  }

  map $ssl_preread_server_name $name_valid {
    your.domain.1 1;
    your.domain.2 1;
    default 0;
  }

  map $is_acme$name_valid $backend {
    00 unwrap;
    01 nginx-https;
    10 unwrap;
    11 unwrap;
    default unwrap;
  }

  map $is_acme$name_valid $unwrap_backend {
    10 acme;
    11 acme;
    default hide;
  }

  upstream unwrap {
    server unix:/tmp/nginx-stream-proxy.sock;
  }

  upstream acme {
    server 127.0.0.1:30443;
  }

  upstream nginx-https {
    server unix:/tmp/nginx-https.sock;
  }

  upstream hide {
    server www.xuexi.cn:443;    # do not serve default cert if sni name unknown
  }

  server {
    listen 443;
    ssl_preread on;
    proxy_protocol on;
    proxy_pass $backend;
  }

  server {
    # unwrap proxy protocol
    listen unix:/tmp/nginx-stream-proxy.sock proxy_protocol;
    ssl_preread on;
    proxy_protocol off;
    proxy_pass $unwrap_backend;
  }
}

your.domain.1.conf

server {
  server_name your.domain.1;
  listen listen unix:/tmp/nginx-https.sock ssl proxy_protocol;
  
  set_real_ip_from unix:;
  real_ip_header proxy_protocol;
  
  # ssl and other configurations
  ...
}