Switch to http2 directive in nginx configs

> 2024/06/02 11:05:53 \[warn\] 30324#30324: the "listen ... http2" directive is deprecated, use the "http2" directive instead

Fixes archlinux/infrastructure#589

roles/archive_web/templates/nginx.d.conf.j2

@@ -16,8 +16,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ archive_domain }};
 
     access_log   /var/log/nginx/{{ archive_domain }}/access.log reduced;

roles/archmanweb/templates/nginx.d.conf.j2

@@ -23,8 +23,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ archmanweb_domain }};
 
     access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log reduced;

roles/archweb/templates/ipxe.archlinux.org.j2

@@ -16,8 +16,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ domain['domain_name'] }};
 
     access_log   /var/log/nginx/{{ archweb_domain }}/access.log reduced;

roles/archweb/templates/maintenance-nginx.d.conf.j2

@@ -23,8 +23,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ domain }};
 
     access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
@@ -64,8 +65,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ service_domain }};
 
     access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;

roles/archweb/templates/nginx.d.conf.j2

@@ -50,8 +50,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ domain['domain'] }};
 
     access_log   /var/log/nginx/{{ archweb_domain }}/access.log reduced;
@@ -96,8 +97,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ archweb_domain }};
 
     access_log   /var/log/nginx/{{ archweb_domain }}/access.log reduced;

roles/archwiki/templates/nginx.d.conf.j2

@@ -31,8 +31,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ archwiki_domain }};
 
     access_log   /var/log/nginx/{{ archwiki_domain }}/access.log reduced;

roles/aurweb/templates/nginx.d.conf.j2

@@ -35,8 +35,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ aurweb_domain }};
 
     access_log   /var/log/nginx/{{ aurweb_domain }}/access.log main;

roles/dbscripts/templates/nginx.d.conf.j2

@@ -3,8 +3,9 @@ proxy_cache_path  /var/lib/nginx/cache levels=1:2 keys_zone=auth_cache:5m inacti
 server {
     listen       80;
     listen       [::]:80;
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ repos_domain }} {{repos_rsync_domain}};
     root         /srv/ftp;
 

roles/debuginfod/templates/nginx.d.conf.j2

@@ -16,8 +16,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ debuginfod_domain }};
 
     access_log   /var/log/nginx/{{ debuginfod_domain }}/access.log reduced;

roles/fluxbb/templates/nginx.conf.j2

@@ -23,8 +23,9 @@ limit_req_zone $binary_remote_addr zone=bbslimit:10m rate=10r/s;
 limit_req_status 429;
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2  on;
     server_name {{ fluxbb_domain }};
     root {{ fluxbb_dir }};
     index index.php;

roles/grafana/templates/nginx.d.conf.j2

@@ -25,8 +25,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ grafana_domain }};
 
     access_log   /var/log/nginx/{{ grafana_domain }}/access.log main;

roles/hedgedoc/templates/nginx.d.conf.j2

@@ -24,8 +24,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ hedgedoc_domain }};
 
     access_log   /var/log/nginx/{{ hedgedoc_domain }}/access.log main;

roles/keycloak/templates/nginx.d.conf.j2

@@ -16,8 +16,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ keycloak_domain }};
 
     access_log   /var/log/nginx/{{ keycloak_domain }}/access.log reduced;

roles/mailman/templates/nginx.d.conf.j2

@@ -35,8 +35,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ lists_domain }};
 
     access_log   /var/log/nginx/{{ lists_domain }}/access.log main;

roles/maintenance/templates/nginx-maintenance.conf.j2

@@ -19,8 +19,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ domain }};
 
     access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
@@ -60,8 +61,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ service_domain }};
 
     access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;

roles/matrix/templates/nginx.d.conf.j2

@@ -22,8 +22,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ matrix_domain }};
 
     access_log   /var/log/nginx/{{ matrix_domain }}/access.log reduced;

roles/mirrorsync/templates/nginx.d.conf.j2

 server {
     listen       80;
     listen       [::]:80;
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ item.value.mirror_domain }};
     root         {{ item.value.target }};
 

roles/mta_sts/templates/nginx.d.conf.j2

@@ -18,8 +18,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  mta-sts.{{ config.domains | join(' mta-sts.') }};
 
     access_log   /var/log/nginx/{{ domain }}/access.log reduced;

roles/ping/templates/nginx.d.conf.j2

@@ -2,8 +2,9 @@ server {
     # We don't redirect to HTTPS because a redirect is considered a captive portal.
     listen       80;
     listen       [::]:80;
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ ping_domain }};
 
     access_log   /var/log/nginx/{{ ping_domain }}/access.log reduced;

roles/public_html/templates/nginx.d.conf.j2

@@ -17,8 +17,9 @@ server {
 }
 
 server {
-    listen       443 ssl http2;
-    listen       [::]:443 ssl http2;
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    http2        on;
     server_name  {{ public_domain }} www.{{ public_domain }};
     root         /srv/public_html;