From 60850f026ca49ba27cc798ff93d1961de8e727b9 Mon Sep 17 00:00:00 2001 From: luxick Date: Sat, 25 Jul 2026 19:36:41 +0200 Subject: [PATCH] Update nginx-scribe.luxick.de.conf --- deploy/nginx-scribe.luxick.de.conf | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/deploy/nginx-scribe.luxick.de.conf b/deploy/nginx-scribe.luxick.de.conf index 5bf9873..ce7fc1a 100644 --- a/deploy/nginx-scribe.luxick.de.conf +++ b/deploy/nginx-scribe.luxick.de.conf @@ -20,14 +20,25 @@ server { } server { - listen 443 ssl; - listen [::]:443 ssl; - http2 on; + # The `http2 on;` directive only exists from nginx 1.25.1; on older builds + # (Debian bookworm ships 1.22, Ubuntu 22.04 ships 1.18) it is an unknown + # directive and the config will not load. This form works everywhere, at the + # price of a deprecation warning on 1.25.1+. + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name scribe.luxick.de; ssl_certificate /etc/letsencrypt/live/scribe.luxick.de/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/scribe.luxick.de/privkey.pem; + # `certbot certonly` issues the certificate and stops there - unlike the nginx + # plugin it never writes an `options-ssl-nginx.conf` include, so the protocol + # and session settings have to live here. + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + root /var/www/brevyscribe; index index.html;