diff --git a/examples/reverse-proxies/nginx/matrix.conf b/examples/reverse-proxies/nginx/matrix.conf index 366a8a8eb..0bb5bd96f 100644 --- a/examples/reverse-proxies/nginx/matrix.conf +++ b/examples/reverse-proxies/nginx/matrix.conf @@ -1,6 +1,14 @@ server { - listen 443 ssl http2; - listen [::]:443 ssl http2; + # TODO: once per IP and port you should add `reuseport`, if you don't have that in any other nginx config file, add it here by uncommenting the lines below and commenting the one after with `quic` but without `reuseport` + #listen 443 quic reuseport; + listen 443 quic; + listen 443 ssl; + # TODO: if you replaced the line above for port 443 and IPv4, you probably want to do the same for port 443 IPv6 by switching the two lines below + #listen [::]:443 quic reuseport; + listen [::]:443 quic; + listen [::]:443 ssl; + http2 on; + http3 on; # TODO: add/remove services and their subdomains if you use/don't use them # this example is using hosting something on the base domain and an element web client, so example.com and element.example.com are listed in addition to matrix.example.com @@ -24,6 +32,9 @@ server { # Nginx by default only allows file uploads up to 1M in size # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml client_max_body_size 50M; + + # required for browsers to direct them to quic port + add_header Alt-Svc 'h3=":443"; ma=86400'; } # TODO: adapt the path to your ssl certificate for the domains listed on server_name @@ -37,8 +48,16 @@ server { # settings for matrix federation server { # For the federation port - listen 8448 ssl http2 default_server; - listen [::]:8448 ssl http2 default_server; + # TODO: once per IP and port you should add `reuseport`, if you don't have that in any other nginx config file, add it here by uncommenting the lines below and commenting the one after with `quic` but without `reuseport` + #listen 8448 quic reuseport; + listen 8448 quic; + listen 8448 ssl default_server; + # TODO: if you replaced the line above for port 8448 and IPv4, you probably want to do the same for port 8448 IPv6 by switching the two lines below + #listen [::]:8448 quic reuseport; + listen [::]:8448 quic; + listen [::]:8448 ssl default_server; + http2 on; + http3 on; server_name matrix.example.com; @@ -54,6 +73,9 @@ server { # Nginx by default only allows file uploads up to 1M in size # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml client_max_body_size 50M; + + # required for browsers to direct them to quic port + add_header Alt-Svc 'h3=":8448"; ma=86400'; } # TODO: adapt the path to your ssl certificate for the domains listed on server_name ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot @@ -93,4 +115,4 @@ server { server_name element.example.com; listen 80; return 404; # managed by Certbot -} \ No newline at end of file +}