bind HTTPS to ipv6 port in NGINX example configuration #2492
Conversation
| @@ -111,6 +111,7 @@ http { | |||
|
|
|||
| # These shouldn't need to be changed | |||
| listen 443 default_server; | |||
| listen [::]:443 default_server ipv6only=on; | |||
There was a problem hiding this comment.
Unless you are on a very old machine you should be able to just
listen [::]:443 ssl http2 default_server;
As sysctl net.ipv6.bindv6only defaults to 0 on linux (not sure about other platforms) and so binding to ipv6 will also bind to the ipv6-mapped ipv4 address.
Rolling HTTP2 requires nginx >= 1.9.5, isn't the example missing the ssl statement?
There was a problem hiding this comment.
I am on my Raspberry Pi 3 running a Debian Jessie derivate (OSMC) and that does not work.
invalid parameter "http2" in /etc/nginx/sites-enabled/default:44
Also I tested it without http2 and it does not bind to IPv4.
I verified net.ipv6.bindv6only = 0
There was a problem hiding this comment.
As per https://trac.nginx.org/nginx/ticket/345 we might need to set ipv6only=off then.
When running Jessie the necessary nginx version is only available in the backports I'm afraid.
There was a problem hiding this comment.
I would argue that the current solution is the same as the port handling of port 80 (see above that line in the same file).
Binding to v6 individually works on every version, so I do not really see a reason to change the PR.
There was a problem hiding this comment.
Just tested and confirmed working:
listen [::]:443 ssl default_server ipv6only=off;
I don't feel strongly about saving a single line.
We should however note that http2 can be enabled given a recent enough nginx version.
| @@ -110,7 +109,7 @@ http { | |||
|
|
|||
|
|
|||
| # These shouldn't need to be changed | |||
| listen 443 default_server; | |||
| listen [::]:443 default_server ipv6only=off; # if your nginx version is >= 1.9.5 you can also add the "http2" flag here | |||
There was a problem hiding this comment.
I'm still quite certain this will make 443 a plain http port. Are you sure leaving out the ssl flag here is correct?
There was a problem hiding this comment.
Right below is ssl on which does the trick. I have this config running and working on my machine
There was a problem hiding this comment.
So is this approved? Can you merge the changes please?
There was a problem hiding this comment.
Not a member, just a contributor.
lgtm
There was a problem hiding this comment.
Ah, I see. But I guess you can approve your review, can't you? :)
Description:
The nginx configuration does not bind port 443 with IPv6 (but does so for 80).
Another thing I could change is the fact that (in my setup), the
sites-available/hassfile must not include thehttp {... }wrapping. I was not sure whether that is specific to my setup (fresh nginx installation viaapt-get) so I did not change it yet.