fix(nginx-proxy): Fix http2 duplication and add SSL_STAPLING control #299
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Fix 'protocol options redefined' warning by placing http2 directive once per server block instead of after each listen directive - Add SSL_STAPLING env var (default: on) to control OCSP stapling - Set SSL_STAPLING=off to suppress 'ssl_stapling ignored' warnings for certificates without OCSP responder URLs - Update README with SSL_STAPLING documentation
There was a problem hiding this comment.
Pull request overview
This PR fixes nginx warning logs by correcting the placement of the http2 directive and adding optional control for SSL stapling via environment variable.
Changes:
- Moved
http2 on;directive outside oflistenblocks to prevent duplication warnings in nginx 1.25.1+ - Added
SSL_STAPLINGenvironment variable to allow disabling OCSP stapling for certificates without OCSP support - Updated documentation to include the new
SSL_STAPLINGvariable
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| nginx-proxy/nginx.tmpl | Relocated http2 on; to server-level (3 locations) and added conditional SSL stapling based on SSL_STAPLING environment variable |
| nginx-proxy/README.md | Added documentation for the new SSL_STAPLING environment variable |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes recurring Nginx warning logs related to duplicate
http2directives and improves handling of SSL stapling for certificates without OCSP support.Fixes
http2warnings: Resolvesnginx: [warn] protocol options redefinedby ensuringhttp2 on;appears only once per server block (moved outsidelistendirectives).ssl_staplingwarnings: Resolvesnginx: [warn] "ssl_stapling" ignoredfor certificates lacking OCSP responders.Changes
http2 on;to a valid location for modern Nginx (1.25.1+), preventing duplication across IPv4/IPv6 listen blocks.SSL_STAPLINGenvironment variable.SSL_STAPLINGenvironment variable.Configuration
New Environment Variable:
SSL_STAPLING: Controls OCSP stapling. Default ison.SSL_STAPLING=offto disable stapling and silence warnings for self-signed certs or certs without OCSP.