markmorado/pvemanager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

fix(nginx): drop two directives that only produced reload warnings

Browse Source 
`listen 443 ssl http2` has been deprecated since nginx 1.25.1 in favour of
a separate `http2 on;` directive, and Let's Encrypt no longer publishes an
OCSP responder URL in its certificates, so `ssl_stapling` had nothing to
staple. Both warned on every reload — noise that now matters more, since
nginx reloads itself every 6h to pick up renewed certificates.

Reloads are clean afterwards and HTTP/2 is still negotiated.
This commit is contained in:
Dilshod Rasulov
2026-08-11 20:38:03 +05:00
parent c6a32255df
commit 5f20b87824
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
nginx/conf.d/pvemanager.conf.template
View File

@@ -20,8 +20,9 @@ server {
# HTTPS # HTTPS
server { server {
listen 443 ssl http2; listen 443 ssl;
listen [::]:443 ssl http2; listen [::]:443 ssl;
http2 on;
server_name DOMAIN_NAME; server_name DOMAIN_NAME;
# SSL certificates # SSL certificates
@@ -34,8 +35,9 @@ server {
ssl_prefer_server_ciphers off; ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m; ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m; ssl_session_timeout 10m;
ssl_stapling on; # No OCSP stapling: Let's Encrypt no longer publishes an OCSP responder URL
ssl_stapling_verify on; # in its certificates, so ssl_stapling had nothing to staple and only
# produced a warning on every reload.
# Security headers # Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;