Proxy Neo4j binary bolt protocol using nginx to add encryption and authentication

Question

It is possible to use nginx to proxy Neo4j's http protocol to add encryption and authentication:

server {
    server_name graph.example.org;

    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    include snippets/ssl-params.conf;

    location / {
            proxy_pass http://localhost:7471/;
            auth_basic "restricted";
            auth_basic_user_file /path/to/users;
    }
}

But I do not know how to proxy the bolt connection; a pseudo-configuration that contains all the necessary info:

server {
    server_name graph.example.org;

    listen 7687 ssl;
    listen [::]:7687 ssl;
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    include snippets/ssl-params.conf;

    <some ‘location’ directive> {
            <some-proxy-directive> localhost:7686;
                # dbms.connector.bolt.address=localhost:7686
            auth_basic "restricted";
            auth_basic_user_file /path/to/users;
    }
}

Given that location does not make sense in this context and that proxy_pass needs an http(s)-based url, this pseudo-configuration is probably not close to the wanted one.

In an answer to the the question “Is it possible to forward NON-http connecting request to some other port in nginx?”, the stream-core module is suggested. But it is not clear to me how I'd use it. Would the following work (I have not yet been able to test this):

stream {
    server {
        server_name graph.example.org;

        listen 7687 ssl;
        listen [::]:7687 ssl;
        ssl_certificate /path/to/fullchain.pem;
        ssl_certificate_key /path/to/privkey.pem;
        include snippets/ssl-params.conf;

        auth_basic "restricted";
        auth_basic_user_file /path/to/users;

        proxy_pass localhost:7686;
            # dbms.connector.bolt.address=localhost:7686
    }
}

Perhaps directive need to be modified or more directives need to be added to make this work?