stream {
    upstream rtmp {
        server 127.0.0.1:1935;
    }

    server {
        listen 1936 ssl;
        listen [::]:1936 ssl;

        ssl_certificate /var/lib/dehydrated/certs/${server_name}/fullchain.pem;
        ssl_certificate_key /var/lib/dehydrated/certs/${server_name}/privkey.pem;

        proxy_pass rtmp;
    }
}

rtmp {
    server {
        listen 127.0.0.1:1935;
        chunk_size 4096;

        application ${stream_key} {
            live on;
            record off;
            allow publish 127.0.0.1;  # for streaming through nginx
            allow play 127.0.0.1;     # for the pull from /live
        }

        application live {
            live on;
            record off;
            deny publish all;         # no need to publish on /live
            allow play all;           # playing allowed

            pull rtmp://127.0.0.1:1935/${stream_key};
        }
    }
}