If you want nginx to handle TLS of *.my2nddomain.xyz, then the backend of *.my2nddomain.xyz will be in TCP mode.
And you need to set SNI_FRONTEND to something like #176
If you want keeping HAPROXY to handle TLS, you need to change config of nginx to accept proxy protocol, which is really out of scope
[/quote]
Thanks a lot for your input. I'll play around with that and look at #176 as you pointed out.