How can I get Socket.io to work on Kubernetes when using nginx-ingress and cert-manager?

I have a deployment running inside my k8s cluster that uses Socket.io, but external WebSocket traffic doesn’t seem to be getting to it.

I’m using nginx ingress controller with cert-manager, which works fine for normal HTTPS traffic. With this setup, SSL termination is with nginx and the certificates live in the cluster.

I’ve seen in the docs and elsewhere that I need to switch the load balancer protocol to HTTP instead of TCP to get WebSockets to work. However, doing that breaks SSL for me. This is because the DigitalOcean load balancer has two options:

1. SSL Termination at the load balancer - this would require managing my domain and SSL certs through DigitalOcean and abandoning cert-manager which I don’t want to do
2. SSL Passthrough - this passes the encrypted data straight to the droplet, which is also not what I want to do (I think??)

Is there a way to continue to use nginx ingress controller and cert manager with WebSockets?