stream {
    limit_conn_zone $binary_remote_addr zone=perip:1m;
    limit_conn_log_level error;

    server {
        ...
        limit_conn perip 1;
    }
}

stream {
    server {
        ...
        allow 127.0.0.1;
        deny all;
    }
}

Upstreams with the "zone" directive are kept in shared memory,
with a consistent view of all worker processes.

Since Linux 2.6.17, epoll is able to report about peer half-closed connection
using special EPOLLRDHUP flag on a read event.