nginx: enable http3

hosts/falkenstein/modules/nginx/default.nix

@@ -14,6 +14,7 @@
           extraConfig = ''
             access_log /var/log/nginx/${name}_access.log;
             error_log /var/log/nginx/${name}_error.log;
+            add_header Alt-Svc 'h3=":443"; ma=86400';
           '';
         })
       );

hosts/nuc/modules/nginx/default.nix

@@ -1,4 +1,4 @@
-{ lib, config, ... }:
+{ pkgs, lib, config, ... }:
 {
   # set default options for virtualHosts
   options = with lib; {
@@ -8,9 +8,13 @@
           # split up nginx access logs per vhost
           enableACME = true;
           forceSSL = true;
+          # enable http3 for all hosts
+          quic = true;
+          http3 = true;
           extraConfig = ''
             access_log /var/log/nginx/${name}_access.log;
             error_log /var/log/nginx/${name}_error.log;
+            add_header Alt-Svc 'h3=":443"; ma=86400';
           '';
         })
       );
@@ -18,13 +22,14 @@
   };
   config = {
     networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedUDPPorts = [ 443 ];
     services.nginx = {
       enable = true;
+      package = pkgs.nginxQuic;
       recommendedTlsSettings = true;
       recommendedProxySettings = true;
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
-      # virtualHosts = lib.genAttrs v (name: { extraConfig = " lohustuff goes ith ${name}"; });
     };
     security.acme = {
       acceptTerms = true;