Difficulty getting nginx and shadowsocks-libev with v2ray-plugin to work

I've setup a Google Cloud instance, firewall has port 3128 open. Using either Shadowrocket on iOS or Shadowsocks-NG on MacOS, I can't connect. I have nginx on port 3128 forwarding to port 10001 internally, and v2ray-plugin configured to 127.0.0.1:10001. On iOS, I am getting SSL errors unless I use "Direct" mode which seems to bypass my VM. For Proxy mode, I've tried with/without plugging the PAC and HTTP settings into Proxy Settings under my wifi connection. None of these work (SSL error). On MacOS, PAC does not seem to pass traffic to my server. Global (fills out HTTP, HTTPS, and SOCKS for me), no connection at all. I am using nload to see if traffic is going through the server, and it's not showing any activity.

Here are my configs:

/etc/nginx/sites-enabled/default:

server { root /var/www/html; index index.html index.htm index.nginx-debian.html; server_name MYSERVER.DOMAIN.COM; location / { proxy_redirect off; proxy_pass proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; }
listen [::]:3128 ssl ipv6only=on; # managed by Certbot
listen 3128 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/ # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/ # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

and /etc/shadowsocks-libev/config.json:

{
"server":"127.0.0.1",
"server_port":10001,
"password":"MYPASSWORD",
"timeout":300,
"method":"aes-256-gcm",
"plugin":"v2ray-plugin",
"plugin_opts":"server;tls;cert=/etc/letsencrypt/live/

Lastly, output of netstat -tulpn | grep LISTEN:

 tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN 1063/pihole-FTL
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 43630/nginx: master
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 907/lighttpd
tcp 0 0 127.0.0.1:10001 0.0.0.0:* LISTEN 43641/v2ray-plugin
tcp 0 0 127.0.0.1:35409 0.0.0.0:* LISTEN 43640/ss-server
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 1063/pihole-FTL
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 929/sshd: /usr/sbin
tcp 0 0 127.0.0.1:5335 0.0.0.0:* LISTEN 943/unbound
tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN 43630/nginx: master
tcp6 0 0 ::1:4711 :::* LISTEN 1063/pihole-FTL
tcp6 0 0 :::80 :::* LISTEN 43630/nginx: master
tcp6 0 0 :::8080 :::* LISTEN 907/lighttpd
tcp6 0 0 :::53 :::* LISTEN 1063/pihole-FTL
tcp6 0 0 :::22 :::* LISTEN 929/sshd: /usr/sbin
tcp6 0 0 :::3128 :::* LISTEN 43630/nginx: master

Thanks for any ideas, been stuck on this for days after trying various guides and combinations of configurations. I also tried working around nginx (briefly) without success - could not ping the port I moved Shadowsocks to.

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.