stream.conf

stream {
	server {
		listen xxx;
		ssl_certificate /etc/xxx/xxx.crt;
		ssl_certificate_key /etc/xxx/xxx/xxx.key;
		ssl_dhparam /etc/xxx/xxx/ssl-dhparams.pem;

		ssl_protocols TLSv1.3 TLSv1.2;
		ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
		ssl_prefer_server_ciphers off;
		ssl_session_timeout 10m;

		proxy_connect_timeout 1;
		proxy_timeout 3s;
		proxy_pass stream_xxx_backend;
	}
	upstream stream_xxx_backend {
		server localhost:xxx; 
	}
}