Paul Schneider
daf5949392
reuseport is legal only once per addr:port (443/udp). preprod and prod share the same IP today, so enabling it on preprod-Org clashed with prod-Org and made nginx refuse the config. QUIC_OPTS now resolves to " reuseport" only when APP_INSTALL_ENV=production AND the host is Org; preprod and the Api/Blogs vhosts get a plain `listen 443 quic;`. Also drop the stray space before `;` when QUIC_OPTS is empty by moving the separator into the QUIC_OPTS value (`listen 443 quic$QUIC_OPTS;`). Co-Authored-By: Claude Code <noreply@anthropic.com>
61 lines
No EOL
2.4 KiB
Nginx Configuration File
61 lines
No EOL
2.4 KiB
Nginx Configuration File
# Généré depuis contrib/template.vhost par `make generate-nginx` — NE PAS ÉDITER.
|
|
# Vhost $DOMAIN — backend $BACKEND_SCHEME://$HTTP_HOST:$BACKEND_PORT
|
|
#
|
|
# HTTP/3 (QUIC) termine au edge nginx (plan contrib/quic.md). Requiert un
|
|
# nginx compilé avec http_v3_module (≥ 1.25 ; `http3 on` ≥ 1.27.4) + UDP 443
|
|
# ouvert. Kestrel reste backend h1/h2 (mais configure aussi h3 côté logiciel,
|
|
# cf. template.appsettings-*.json — capacité, non joignable derrière nginx).
|
|
#
|
|
# Variables substituées par envsubst (allowlist) :
|
|
# DOMAIN BACKEND_SCHEME HTTP_HOST BACKEND_PORT QUIC_OPTS
|
|
# $QUIC_OPTS = "reuseport" sur un seul vhost (Org) ET en production
|
|
# uniquement ; vide en preprod et sur les autres hôtes. Règle : reuseport
|
|
# une seule fois par addr:port (443/udp) — or preprod et prod partagent la
|
|
# même IP, donc seule la prod (Org) l'active.
|
|
# Les variables nginx intrinsèques ($host, $scheme, $remote_addr, …) sont
|
|
# préservées (hors allowlist).
|
|
|
|
# Port 80 : redirection vers HTTPS. (Certbot/nginx-plugin gère les challenges
|
|
# ACME ; ne pas servir l'app en HTTP clair.)
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name $DOMAIN;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
# 1. TCP : HTTPS classique + HTTP/2
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
|
|
# 2. UDP : HTTP/3 (QUIC). reuseport sur UN seul vhost (Org via QUIC_OPTS).
|
|
listen 443 quic$QUIC_OPTS;
|
|
listen [::]:443 quic$QUIC_OPTS;
|
|
http3 on;
|
|
|
|
server_name $DOMAIN;
|
|
|
|
# 3. Certificats Let's Encrypt (Certbot).
|
|
ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem; # managed by Certbot
|
|
ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem; # managed by Certbot
|
|
# QUIC exige TLS 1.3. (TLS 1.2 conservable pour le fallback TCP :
|
|
# `ssl_protocols TLSv1.2 TLSv1.3;` — QUIC reste en 1.3.)
|
|
ssl_protocols TLSv1.3;
|
|
|
|
# 4. Annonce h3 au navigateur sur 443/udp. `always` = émis même en erreur.
|
|
add_header Alt-Svc 'h3=":443"; ma=86400' always;
|
|
|
|
location / {
|
|
proxy_pass $BACKEND_SCHEME://$HTTP_HOST:$BACKEND_PORT;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 100s;
|
|
proxy_buffering off;
|
|
}
|
|
include server-status.conf;
|
|
} |