Skip to content

Commit a652672

Browse files
PDowneyPDowney
authored
NGINX and HTTP3 Changes
1 parent b4f2eee commit a652672

7 files changed

Lines changed: 57 additions & 44 deletions

File tree

‎config/etc/nginx/admin/admin.localhost.conf‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,6 @@
55
# This is because we've self-signed an SSL certificate for this IP.
66
# You'll need to tell your browser to allow the invalid SSL cert.
77

8-
#Configuration note:
9-
# The listen parameters "deferred fastopen=256 reuseport" can only be enabled in a single vhost at a time.
10-
# They may result in some performance boost on a production site, but testing on your specific site is recommended.
11-
# If you'd like to test this, you'll need to remove it from this file and add it to /etc/nginx/sites-enabled/YOURDOMAIN.TLD.conf.
12-
138
server {
149
listen 80 deferred fastopen=256 reuseport;
1510
listen [::]:80 deferred fastopen=256 reuseport;
@@ -20,9 +15,15 @@ server {
2015
}
2116

2217
server {
23-
listen 443 ssl deferred fastopen=256 reuseport;
24-
listen [::]:443 ssl deferred fastopen=256 reuseport;
25-
server_name localhost;
18+
# HTTP2
19+
listen 443 default_server ssl reuseport fastopen=256 deferred;
20+
listen [::]:443 default_server ssl reuseport fastopen=256 deferred;
21+
22+
# HTTP3 / QUIC
23+
#listen 443 default_server quic reuseport;
24+
#listen [::]:443 default_server quic reuseport;
25+
26+
server_name _;
2627

2728
# SSL Certs
2829
ssl_verify_client optional_no_ca;
@@ -34,10 +35,10 @@ server {
3435
ssl_buffer_size 1369;
3536
ssl_protocols TLSv1.2 TLSv1.3;
3637
ssl_session_cache shared:SSL:5m;
37-
ssl_session_tickets off;
38+
ssl_session_tickets on;
3839
ssl_session_timeout 1h;
3940

40-
root /var/www/admin/enginescript;
41+
root /var/www/admin;
4142

4243
# Admin Control Panel Protection
4344
# Adds a second layer of password protection to any admin location page such as phpMyAdmin
@@ -52,14 +53,21 @@ server {
5253
fastcgi_cache off;
5354
set $skip_cache 1;
5455

55-
# EngineScript Control Panel - Default Location
56+
# Direct IP Access - Return 204 No Content
5657
location / {
57-
try_files $uri $uri/ /index.html =404;
58+
return 204;
59+
}
60+
61+
# EngineScript Control Panel - Admin Directory
62+
location /admin {
63+
alias /var/www/admin/enginescript;
64+
index index.html index.php;
65+
try_files $uri $uri/ /admin/index.html =404;
5866
}
5967

6068
# API Endpoints for EngineScript Control Panel
6169
location /api {
62-
rewrite ^/api/(.*)$ /api.php?endpoint=$1 last;
70+
rewrite ^/api/(.*)$ /enginescript/api.php?endpoint=$1 last;
6371
}
6472

6573
# Development and Debug

‎config/etc/nginx/globals/response-headers.conf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ add_header X-Robots-Tag "all" always;
55
add_header X-UA-Compatible "IE=Edge" always;
66

77
# HTTP3
8-
#add_header Alt-Svc 'h3=":$server_port"; ma=86400' always;
8+
#add_header Alt-Svc 'h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400' always;
9+
#add_header x-quic 'h3' always;
910

1011
# Cache Headers
1112
# If you've enabled Cloudflare caching software such as App for Cloudflare or Super Page Cache, this header is won't really function correctly as Cloudflare would cache the initial MISS header even though Nginx will have cached it internally for future requests.
@@ -34,3 +35,4 @@ add_header X-Frame-Options "SAMEORIGIN" always;
3435
# https://scotthelme.co.uk/introducing-the-reporting-api-nel-other-major-changes-to-report-uri/
3536
# https://docs.report-uri.com/setup/ect/
3637
# https://github.com/w3c/webappsec-feature-policy/blob/master/features.md#fn1
38+
# https://serverfault.com/questions/1153941/does-anyone-have-a-best-practices-guide-for-nginx-with-http3-quic/1172800#1172800

‎config/etc/nginx/nginx.conf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,6 @@ http {
8686
directio_alignment 512;
8787
etag on;
8888
http2 on;
89-
#http3 on; # HTTP3
9089
if_modified_since exact;
9190
ignore_invalid_headers on;
9291
keepalive_disable msie6;
@@ -113,8 +112,6 @@ http {
113112
proxy_read_timeout 90s;
114113
proxy_send_timeout 90s;
115114
proxy_temp_path /tmp/nginx_proxy;
116-
#quic_gso on; # HTTP3
117-
#quic_retry on; # HTTP3
118115
request_pool_size 32k;
119116
reset_timedout_connection on;
120117
sendfile on;
@@ -131,6 +128,13 @@ http {
131128
variables_hash_bucket_size SEDHBS;
132129
variables_hash_max_size 2048;
133130

131+
# HTTP3 - Experimental (Cloudflare does not support HTTP3 to origin)
132+
#http3 on;
133+
#http3_max_concurrent_streams 1024;
134+
#http3_stream_buffer_size 1024k;
135+
#quic_gso on;
136+
#quic_retry on;
137+
134138
# Dynamic TLS Record Resizing (Nginx Patch)
135139
ssl_dyn_rec_enable on;
136140
ssl_dyn_rec_size_hi 4229;
@@ -213,3 +217,5 @@ http {
213217
# https://github.com/roots/trellis/pull/1555 - Remove Cache-Control from fastcgi_ignore_headers
214218
# https://github.com/roots/trellis/pull/1513 - Add X-Cache-Enabled HTTP header for WordPress Site Health
215219
# https://github.com/roots/trellis/issues/1594 - Redirect loop on multiple sites with 1.25 (1.24)
220+
# https://serverfault.com/questions/1153941/does-anyone-have-a-best-practices-guide-for-nginx-with-http3-quic/1172800#1172800
221+
# https://http3check.net/

‎config/etc/nginx/sites-available/your-domain.conf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,14 @@
22
# Move this file to /etc/nginx/sites-available if you don't want the domain to be active within Nginx.
33

44
server {
5+
# HTTP2
56
listen 443 ssl;
67
listen [::]:443 ssl;
7-
#listen 443 quic reuseport; # HTTP3
8-
#listen [::]:443 quic reuseport; # HTTP3
8+
9+
# HTTP3 / QUIC
10+
#listen 443 quic reuseport;
11+
#listen [::]:443 quic reuseport;
12+
913
server_name YOURDOMAIN www.YOURDOMAIN;
1014

1115
# Logs

‎scripts/install/nginx/nginx-compile.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,9 @@ LD_OPT_FLAGS="-Wl,-z,relro -Wl,-z,now -Wl,-s -fPIC -flto=auto $LD_FLAG"
9696

9797
# Set OpenSSL test flag based on debug mode
9898
if [[ "${DEBUG_INSTALL}" == "1" ]]; then
99-
OPENSSL_TESTS_FLAG=""
99+
OPENSSL_TESTS_FLAG=""
100100
else
101-
OPENSSL_TESTS_FLAG="no-tests"
101+
OPENSSL_TESTS_FLAG="no-tests"
102102
fi
103103

104104
OPENSSL_OPT_FLAGS="enable-ec_nistp_64_gcc_128 enable-ktls no-deprecated no-psk no-srp no-ssl3-method no-tls1-method no-tls1_1-method no-weak-ssl-ciphers $OPENSSL_TESTS_FLAG"

‎scripts/install/nginx/nginx-tune.sh‎

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -106,30 +106,24 @@ if [[ "${NGINX_HASH_BUCKET}" = 128 ]];
106106
fi
107107

108108
# HTTP3
109-
if [[ "${INSTALL_HTTP3}" = 1 ]];
110-
then
111-
sed -i "s|#http3 on;|http3 on;|g" /etc/nginx/nginx.conf
112-
fi
113-
114-
if [[ "${INSTALL_HTTP3}" = 1 ]];
115-
then
116-
sed -i "s|#quic_bpf on|quic_bpf on|g" /etc/nginx/nginx.conf
117-
fi
118-
119-
if [[ "${INSTALL_HTTP3}" = 1 ]] && ethtool -k eth0 | grep "tx-gso-robust: on";
120-
then
121-
sed -i "s|#quic_gso on|quic_gso on|g" /etc/nginx/nginx.conf
109+
if [[ "${INSTALL_HTTP3}" = 1 ]]; then
110+
sed -i "s|#http3 on;|http3 on;|g" /etc/nginx/nginx.conf
111+
sed -i "s|#http3_max_concurrent_streams|http3_max_concurrent_streams|g" /etc/nginx/nginx.conf
112+
sed -i "s|#http3_stream_buffer_size|http3_stream_buffer_size|g" /etc/nginx/nginx.conf
113+
sed -i "s|#quic_bpf on|quic_bpf on|g" /etc/nginx/nginx.conf
114+
sed -i "s|#quic_retry on|quic_retry on|g" /etc/nginx/nginx.conf
115+
sed -i "s|#add_header Alt-Svc|add_header Alt-Svc|g" /etc/nginx/globals/response-headers.conf
116+
sed -i "s|#add_header x-quic|add_header x-quic|g" /etc/nginx/globals/response-headers.conf
117+
sed -i "s|#listen 443 quic|listen 443 quic|g" "/etc/nginx/globals/admin.localhost.conf"
118+
sed -i "s|#listen [::]:443 quic|listen [::]:443 quic|g" "/etc/nginx/globals/admin.localhost.conf"
122119
fi
123120

124-
if [[ "${INSTALL_HTTP3}" = 1 ]];
125-
then
126-
sed -i "s|#quic_retry on|quic_retry on|g" /etc/nginx/nginx.conf
121+
# HTTP3 - QUIC GSO (requires hardware support check)
122+
if [[ "${INSTALL_HTTP3}" = 1 ]] && ethtool -k eth0 | grep "tx-gso-robust: on"; then
123+
sed -i "s|#quic_gso on|quic_gso on|g" /etc/nginx/nginx.conf
127124
fi
128125

129-
if [[ "${INSTALL_HTTP3}" = 1 ]];
130-
then
131-
sed -i "s|#add_header Alt-Svc|add_header Alt-Svc|g" /etc/nginx/globals/response-headers.conf
132-
fi
133126

134127
# References:
135128
# https://www.cloudbees.com/blog/tuning-nginx
129+
# https://serverfault.com/questions/1153941/does-anyone-have-a-best-practices-guide-for-nginx-with-http3-quic/1172800#1172800

‎scripts/menu/enginescript-menu.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,8 @@ while true
2929
echo "==============================================================="
3030
echo ""
3131
echo "Admin Control Panels:"
32-
echo "PHPInfo - https://${IP_ADDRESS}/enginescript/phpinfo"
33-
echo "Adminer - https://${IP_ADDRESS}/enginescript/adminer"
34-
echo "phpMyAdmin - https://${IP_ADDRESS}/enginescript/phpmyadmin"
32+
echo "via IP: https://${IP_ADDRESS}/admin"
33+
echo "via Domain: https://admin.YOURDOMAIN.TLD"
3534
echo ""
3635
echo "Helpful Commands:"
3736
echo "es.config - Open the configuration file in Nano"

0 commit comments

Comments
 (0)