AIUI, nginx doesn't terminate the SSL/TLS connection - it is just passed through as is. `ssl_preread on` extracts the server name from the Server Name Indication (SNI) send as part of the TLS handshake, which is unencrypted.

I just set up a similar system (Debian LXC permanently connected to a VPN, nginx proxying imgur.com and all its subdomains with the rest being dropped), and it works quite well. Setting DNS records for imgur.com and {api,i,s}.imgur.com seems to be sufficient to get the site and inline images working (not 100% if all are needed - I haven't fully tested it yet).