From f7e2d8dd033efaf933dd6885c56c649db54b1dc1 Mon Sep 17 00:00:00 2001
From: Barracuda Team <admin@omega8.cc>
Date: Thu, 19 May 2016 17:00:15 +0200
Subject: [PATCH] Nginx: Use HTTP/2 if detected as supported

Also, switch to wildcard listen directive (TLS SNI) on BOA(unfork).
---
 .../Config/Nginx/Ssl/vhost_ssl.tpl.php        | 30 +++++++++++++++++--
 .../Nginx/Ssl/vhost_ssl_disabled.tpl.php      | 21 ++++++++++++-
 2 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php b/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php
index 625bb15f..92b73eb2 100644
--- a/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php
+++ b/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php
@@ -1,10 +1,36 @@
 
 <?php if ($this->ssl_enabled && $this->ssl_key) : ?>
 
+<?php
+$satellite_mode = drush_get_option('satellite_mode');
+if (!$satellite_mode && $server->satellite_mode) {
+  $satellite_mode = $server->satellite_mode;
+}
+
+$nginx_has_http2 = drush_get_option('nginx_has_http2');
+if (!$nginx_has_http2 && $server->nginx_has_http2) {
+  $nginx_has_http2 = $server->nginx_has_http2;
+}
+
+if ($nginx_has_http2) {
+  $ssl_args = "ssl http2";
+}
+else {
+  $ssl_args = "ssl";
+}
+
+if ($satellite_mode == 'boa') {
+  $ssl_listen_ip = "*";
+}
+else {
+  $ssl_listen_ip = $ip_address;
+}
+?>
+
 <?php if ($this->redirection): ?>
 <?php foreach ($this->aliases as $alias_url): ?>
 server {
-  listen       <?php print "{$ip_address}:{$http_ssl_port}"; ?>;
+  listen       <?php print "{$ssl_listen_ip}:{$http_ssl_port} {$ssl_args}"; ?>;
 <?php
   // if we use redirections, we need to change the redirection
   // target to be the original site URL ($this->uri instead of
@@ -61,7 +87,7 @@ server {
   }
 ?>
   fastcgi_param db_port   <?php print urlencode($db_port); ?>;
-  listen        <?php print "{$ip_address}:{$http_ssl_port}"; ?>;
+  listen        <?php print "{$ssl_listen_ip}:{$http_ssl_port} {$ssl_args}"; ?>;
   server_name   <?php
     // this is the main vhost, so we need to put the redirection
     // target as the hostname (if it exists) and not the original URL
diff --git a/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php b/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php
index 1b2209a7..491598b4 100644
--- a/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php
+++ b/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php
@@ -6,10 +6,29 @@ $satellite_mode = drush_get_option('satellite_mode');
 if (!$satellite_mode && $server->satellite_mode) {
   $satellite_mode = $server->satellite_mode;
 }
+
+$nginx_has_http2 = drush_get_option('nginx_has_http2');
+if (!$nginx_has_http2 && $server->nginx_has_http2) {
+  $nginx_has_http2 = $server->nginx_has_http2;
+}
+
+if ($nginx_has_http2) {
+  $ssl_args = "ssl http2";
+}
+else {
+  $ssl_args = "ssl";
+}
+
+if ($satellite_mode == 'boa') {
+  $ssl_listen_ip = "*";
+}
+else {
+  $ssl_listen_ip = $ip_address;
+}
 ?>
 
 server {
-  listen       <?php print "{$ip_address}:{$http_ssl_port}"; ?>;
+  listen       <?php print "{$ssl_listen_ip}:{$http_ssl_port} {$ssl_args}"; ?>;
   server_name  <?php print $this->uri . ' ' . implode(' ', str_replace('/', '.', $this->aliases)); ?>;
 <?php if ($satellite_mode == 'boa'): ?>
   root         /var/www/nginx-default;
-- 
GitLab