map $ssl_preread_server_name $netgescon_tls_backend {
    staging.netgescon.it 127.0.0.1:8443;
    default 192.168.0.157:443;
}

upstream netgescon_http {
    server 192.168.0.157:80;
}

server {
    listen 80;
    listen [::]:80;
    proxy_pass netgescon_http;
}

server {
    listen 443;
    listen [::]:443;
    proxy_pass $netgescon_tls_backend;
    ssl_preread on;
}