stream.wikimedia.org was moved behind cache_misc in T134871. It was noted during this transition that most of the current clients are using unencrypted HTTP, and that our default/sample websocket client implementations tend to break on a 301 redirect rather than follow it, so this transition may be painful.
We should start with ensuring our own documentation uses https:// and/or wss:// URLs for the stream service as appropriate, and make some announcements to the community about the problem and a plea to update their URLs for secure access, and set a future date on which we'll make this service redirect to HTTPS with 301 like all of our other public, cache-terminated hostnames in wikimedia.org.