Weirdness with nginx.ssl.conf templates in mail

[andrewnewby]

I have a very weird one! My Letsencrypt wasn’t renewing for the mail domain. I noticed that the domains nginx.ssl.conf file had:

listen      172.104.227.123:443 ssl http2;

Yet my config file ( /usr/local/hestia/data/templates/mail/nginx/default.stpl ) , is:

	# bar
    listen      %ip%:%proxy_ssl_port% ssl; # something
    listen      [::]:%proxy_ssl_port% ssl;
	server_name %domain_idn% %alias_idn%;
	root        /var/lib/roundcube;
	index       index.php index.html index.htm;
	access_log  /var/log/nginx/domains/%domain%.log combined;
	error_log   /var/log/nginx/domains/%domain%.error.log error;

	#test

Yet this compiles to:

server {
	# bar
    listen      172.104.227.123:443 ssl http2; # something
    listen      [::]:443 ssl;
	server_name webmail.montferlandmarketing.nl mail.montferlandmarketing.nl;
	root        /var/lib/roundcube;
	index       index.php index.html index.htm;
	access_log  /var/log/nginx/domains/webmail.montferlandmarketing.nl.log combined;
	error_log   /var/log/nginx/domains/webmail.montferlandmarketing.nl.error.log error;

	#test

I don’t understand where its getting the http2 part from? Is it being added in? I’ve compared it to one of my other servers, and that correctly doesn’t have the http2 bit in - so why does this? The only difference with this one is that its apache + nginx, whereas the other one was nginx.

BTW the # comments are just so I could be sure it was building the template I thought it was

[eris]

What nginx version do you run ?

[andrewnewby]

On one that has the issue - its:

nginx/1.25.0

And one that’s ok, is:

nginx/1.25.2

Could that make a difference? The main .conf files all have the http2 removed (where it was ssl http2 , its now just ssl)

Cheers

Andy

[eris]

hestiacp/hestiacp/blob/main/install/deb/templates/mail/nginx/default.stpl

We already changed it

v-update-mail-templates replace them maybe we forgot them?

[andrewnewby]

Thats the weird part though… http2 doesn’t exist in the default.stpl file! Yet when I run

v-rebuild-mail-domain montferlandmart montferlandmarketing.nl

…it correctly rebuilds the template … with the exception of adding in http2 to the directive! I can see when doing a grep of hestia files, we have:

/usr/local/hestia/func/domain.sh

So maybe the nginx version is the issue, as I can see 1.25.1:

process_http2_directive() {
	if [ -e /etc/nginx/conf.d/http2-directive.conf ]; then
		while IFS= read -r old_param; do
			new_param="$(echo "$old_param" | sed 's/\shttp2//')"
			sed -i "s/$old_param/$new_param/" "$1"
		done < <(grep -E "listen.*(\bssl\b(\s|.+){1,}\bhttp2\b|\bhttp2\b(\s|.+){1,}\bssl\b).*;" "$1")
	else
		if version_ge "$(nginx -v 2>&1 | cut -d'/' -f2)" "1.25.1"; then
			echo "http2 on;" > /etc/nginx/conf.d/http2-directive.conf

			while IFS= read -r old_param; do
				new_param="$(echo "$old_param" | sed 's/\shttp2//')"
				sed -i "s/$old_param/$new_param/" "$1"
			done < <(grep -E "listen.*(\bssl\b(\s|.+){1,}\bhttp2\b|\bhttp2\b(\s|.+){1,}\bssl\b).*;" "$1")
		else
			listen_ssl="$(grep -E "listen.*\s\bssl\b(?:\s)*.*;" "$1")"
			listen_http2="$(grep -E "listen.*(\bssl\b(\s|.+){1,}\bhttp2\b|\bhttp2\b(\s|.+){1,}\bssl\b).*;" "$1")"

			if [ -n "$listen_ssl" ] && [ -z "$listen_http2" ]; then
				while IFS= read -r old_param; do
					new_param="$(echo "$old_param" | sed 's/\sssl/ ssl http2/')"
					sed -i "s/$old_param/$new_param/" "$1"
				done < <(grep -E "listen.*\s\bssl\b(?:\s)*.*;" "$1")
			fi
		fi
	fi
}

So maybe it just needs nginx updated? The weird thing is, that both servers are running Hestia v1.8.11 , so I’m not sure why the one with the issue is still on nginx 1.25.0 ?

[eris]

The new feature got introduced 1.25.1 or 2 so in that case upgrade to that version is fine …

[andrewnewby]

Ah ok. Doesn’t Hestia normally update nginx during the upgrade process? Or is that something I should do manually?

[eris]

We don’t update system packages except hestia-* (Hestia-php, hestia-nginx, and hestia)

So you need to do that your self

[andrewnewby]

Ah ok. I’ll do that later on in the week then. The client is meeting some people today, so won’t appreciate if the server is down for any reason =)

[istiak101]

@andrewnewby

echo "http2 on;" > /etc/nginx/conf.d/http2-directive.conf

It’s not in server block.

[andrewnewby]

Yup. The problem is that its on nginx 1.25.0, and that change was brought in on 1.25.1 (or 2). So what it seems to be doing, is when it creates the domain part, it adds in the http2 part via a sed. Upgrading nginx to the latest fixed it