dietpi-letsencrypt: update HTTP/2 syntax and add HTTP/3/QUIC

[JappeHallunken]

Nginx throws a warning at startup, because

"listen ... http2" directive is deprecated, use the "http2" directive instead

Changed from

listen [::]:443 ssl http2 ipv6only=on; # managed by Certbot
listen 443 ssl http2; # managed by Certbot

to

listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
http2 on;

[MichaIng]

This directive appeared with Nginx 1.25.1, hence is not available on Debian Bookworm and below yet. On Trixie, we might want to add the quic parameter instead. Weirdly there is a http3 directive, which is however enabled by default, but without QUIC it seems, and the http2 directive is still off by default. So inconsistent. So:

• Up to Bookworm: Keep things as they are
• From Trixie on: Replace http2 argument with quic, and add http2 directive instead.

[JappeHallunken]

I did a bit of testing and IDK if http3 is it worth yet.
For a working config we would need to add some more stuff:

# QUIC and HTTP/3 (UDP)
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;

    # HTTP/1.1 and HTTP/2 fallback (TCP)
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
# Advertise HTTP/3 availability to clients
    add_header Alt-Svc 'h3=":443"; ma=86400' always;

# optional:
# QUIC settings (http3 is on by default)
    quic_retry on;      # Address validation (DDoS protection)
    quic_gso on;        # Generic Segmentation Offload (performance)

see https://nginx-wiki.getpagespeed.com/config/http3/#full-production-configuration

But the biggest hurdle would be, that the user would need to forward port 443 on UDP too. I doubt anybody is aware of that except they really want QUIC for some specific reason.

[MichaIng]

Oh it needs a dedicated listen directive. Hmm, I mean it is the future, and looks like syntax will remain like this to split listen by port and UDP vs TCP. And it does not hurt to enable it even if ports are not forwarded, does it? For local access anyway, and we can add QUIC info to our docs.

[MichaIng]

Old vs new way is now applied depending on Debian version, and I split each of them into a separate sed resp. G_CONFIG_INJECT call, a way that existing directives are preserved.

It applies correctly on a manually prepared default config, the block looks like this:

        listen 80 default_server;
        listen [::]:80 default_server;

        listen 443 quic reuseport;
        listen [::]:443 quic reuseport;
        quic_retry on; # Address validation (DDoS protection)
        quic_gso on; # Generic Segmentation Offload (performance)
        add_header Alt-Svc 'h3=":443"; ma=86400' always; # Advertise HTTP/3 availability to clients
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

Syntax test only expectedly fails on either first of listen ... ssl or listen ... quic as I did not add a TLS certificate.

@JappeHallunken you escaped the Alt-Svc header to contain h3=\"\:443\" literally. I guess this is not needed when using single quotes around the header value, right?

[JappeHallunken]

@JappeHallunken you escaped the Alt-Svc header to contain h3=\"\:443\" literally. I guess this is not needed when using single quotes around the header value, right?

Yes, you’re right, only the single quotes need to be escaped.