feat(BOUN-1002) fix nginx config to match v1.25.3

dfinity · Jan 12, 2024 · 8868cfa · 8868cfa
1 parent 5e42368
commit 8868cfa
Show file tree

Hide file tree

Showing 6 changed files with 22 additions and 20 deletions.
diff --git a/ic-os/boundary-guestos/rootfs/etc/certificate-syncer/domain-with-sw.tmpl b/ic-os/boundary-guestos/rootfs/etc/certificate-syncer/domain-with-sw.tmpl
@@ -1,6 +1,6 @@
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     server_name {name};
 

diff --git a/ic-os/boundary-guestos/rootfs/etc/certificate-syncer/domain-without-sw.tmpl b/ic-os/boundary-guestos/rootfs/etc/certificate-syncer/domain-without-sw.tmpl
@@ -1,6 +1,6 @@
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     server_name {name};
 

diff --git a/ic-os/boundary-guestos/rootfs/etc/nginx/conf.d/000-nginx-global.conf b/ic-os/boundary-guestos/rootfs/etc/nginx/conf.d/000-nginx-global.conf
@@ -141,8 +141,8 @@ root /var/www/html;
 
 # Any direct HTTPS access without correct domain name will default to returning a 404.
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2 ipv6only=on; # setting ipv6only=on once turns it on for all instances on that port
+    listen       443 ssl;
+    listen       [::]:443 ssl ipv6only=on; # setting ipv6only=on once turns it on for all instances on that port
 
     server_name  _;
 

diff --git a/ic-os/boundary-guestos/rootfs/etc/nginx/conf.d/001-rosetta-nginx.conf b/ic-os/boundary-guestos/rootfs/etc/nginx/conf.d/001-rosetta-nginx.conf
@@ -1,6 +1,6 @@
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     server_name .rosetta.dfinity.network;
     include "/run/ic-node/etc/nginx/conf.d/server_rosetta_domain.conf";

diff --git a/ic-os/boundary-guestos/rootfs/etc/nginx/conf.d/002-mainnet-nginx.conf b/ic-os/boundary-guestos/rootfs/etc/nginx/conf.d/002-mainnet-nginx.conf
@@ -4,8 +4,8 @@ include "/var/opt/nginx/ic/ic_upstreams.conf";
 include "/var/opt/nginx/domains.conf";
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     server_name .boundary.dfinity.network;
     server_name .mainnet.dfinity.network;
@@ -24,8 +24,8 @@ server {
 
 # API Domains ONLY
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     include "/run/ic-node/etc/nginx/conf.d/api_domain.conf";
     include "includes/error_pages.conf";
@@ -121,8 +121,8 @@ server {
 
 # System and Application Domains ONLY
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     include "/run/ic-node/etc/nginx/conf.d/server_domain.conf";
     include "includes/error_pages.conf";
@@ -257,8 +257,8 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     include "/run/ic-node/etc/nginx/conf.d/server_raw_domain.conf";
     include "includes/error_pages.conf";
@@ -305,8 +305,8 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     include "/run/ic-node/etc/nginx/conf.d/server_domain_escaped.conf";
     include "includes/error_pages.conf";
@@ -422,8 +422,8 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
 
     include "/run/ic-node/etc/nginx/conf.d/server_raw_domain_escaped.conf";
     include "includes/error_pages.conf";

diff --git a/ic-os/boundary-guestos/rootfs/etc/nginx/nginx.conf b/ic-os/boundary-guestos/rootfs/etc/nginx/nginx.conf
@@ -44,6 +44,8 @@ http {
     proxy_buffers 4 64k;
     proxy_busy_buffers_size 64k;
 
+    # HTTP2
+    http2 on;
     http2_max_concurrent_streams 100;
 
     # Increase hash sizes, needed for large denylist etc