I'd like to use nginx to serve TLS and/or StartTLS connections only, the rest must be "proxy passed" without a modification to the backend.

Unfortunately I noticed https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290 topic, where Maxim Dounin mentioned that it is impossible. That was 10 years ago, probably now the situation is changed? Is there an option, which I can use to pass the AUTH command?

P.S. Side question, I'd like to use a hostname in Auth-Server header:

location = /mail/auth {
add_header Auth-Status OK;
add_header Auth-Server hostname;
add_header Auth-Port 8025;
return 204;
}

but nginx doesn't allow to do this. Is there an option or a workaround for this?