Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?
The ngx_stream_ssl_preread_module module is available as of Nginx 1.11.5 and seems to do just this.
It allows access to the SNI server name found in the client's ClientHello message via the $ssl_preread_server_name variable.
This information can be used to route a TCP ("stream") connection to a backend. The documentation for the module provides an example of how to do that.