Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for HTTP/3 #331

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

Add support for HTTP/3 #331

wants to merge 5 commits into from

Conversation

LeoColomb
Copy link
Member

@LeoColomb LeoColomb commented May 24, 2023

Initial configuration, based on https://nginx.org/en/docs/http/ngx_http_v3_module.html.

See also: https://nginx.org/en/docs/http/ngx_http_core_module.html#listen

  • Move HTTP version support into separate files (to be used at http{} level)
  • Correctly support all versions on the same port
  • Switch to modern syntax
  • Review backward support
  • Ensure upstream module is stable

@petecooper
Copy link
Contributor

Regarding >1 vhosts on the same Nginx instance, I'm using the config from this PR on multiple vhosts and it fails at the nginx -t stage with nginx: [emerg] duplicate listen options for [::]:443.

Is it possible (or viable) to spin up a second vhost instance in this repo to see if that triggers the error on CI, given the experimental implementation of HTTP/3 in Nginx 1.25.0?

@LeoColomb
Copy link
Member Author

Thanks for your comment @petecooper.

I'm using the config from this PR on multiple vhosts and it fails

That is definitely possible. This config is still at its very early stage, only tested with my custom build so far.
We have to figure out how to add h3 properly without breaking the current config, and this will be done once the Nginx support leaves its experimental status.

I guess for now the best option is to segregate h3 port from other protocols.
Or investigate the reason why reuseport is not respected.

Is it possible (or viable) to spin up a second vhost instance in this repo

Possible, always, but not realistic: this would imply importing the whole Nginx build workflow, which is way too far out of the scope.

@muuvmuuv
Copy link

muuvmuuv commented May 26, 2023

If anyone is interested, I once wrote this script to compile NGINX with H3 support, maybe it will help testing/debugging: https://gist.github.com/muuvmuuv/73b9008a393fd1b2c45d202ea11b6487

And, I don't have the issue with "duplicate listen".

www-server.conf
server {
  listen 443 http3 reuseport;
  listen 443 http2 ssl;

  root /etc/nginx/www;
  server_name localhost;
  index index.html;

  include /etc/nginx/h5bp/h5bp/tls/ssl_engine.conf;
  include /etc/nginx/custom.d/certificate_files.conf;
  include /etc/nginx/custom.d/ssl_policy.conf;

  include /etc/nginx/h5bp/h5bp/security/referrer-policy.conf;
  include /etc/nginx/h5bp/h5bp/security/x-content-type-options.conf;
  include /etc/nginx/h5bp/h5bp/security/x-frame-options.conf;
  include /etc/nginx/h5bp/h5bp/security/content-security-policy.conf;
  include /etc/nginx/h5bp/h5bp/security/strict-transport-security.conf;
  include /etc/nginx/h5bp/h5bp/security/permissions-policy.conf;
  include /etc/nginx/h5bp/h5bp/location/security_file_access.conf;

  location / {
    add_header Access-Control-Expose-Headers '*';
    add_header Access-Control-Allow-Origin '*';
    add_header Access-Control-Allow-Credentials 'true';
    add_header Access-Control-Allow-Methods '*';
    add_header Access-Control-Allow-Headers '*';
    add_header Alt-Svc 'h3=":$server_port"; ma=86400';
    add_header X-Protocol $server_protocol always;

    try_files $uri $uri/ 404=;
  }

  include /etc/nginx/policies/*.conf;
}

LeoColomb and others added 5 commits October 2, 2024 23:47
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pete Cooper <[email protected]>
Co-authored-by: Léo Colombaro <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants