stream {
    map $ssl_preread_server_name $backend_name {
        trojan.example.com before_trojan;
        default web;
    }

    upstream before_trojan {
        server 127.0.0.1:7999;
    }

    upstream web {
        server 127.0.0.1:443;
    }

    upstream trojan {
        server 127.0.0.1:1501;
    }

    server {
        listen [public.ip]:443 reuseport;
        proxy_pass $backend_name;
        ssl_preread on;
        proxy_protocol on;
    }

    server {
        listen 127.0.0.1:7999 proxy_protocol;
        proxy_pass trojan;
    }
}

http {
    # ...

    server {
        listen 127.0.0.1:443 ssl http2 proxy_protocol; 

        set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;
        real_ip_recursive on;

        # ...
    }
}