nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead

[replete]

Main Issue:

web-1  | nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead

This deprecation warning can be fixed by moving http2 into a new directive like so:

server {
    listen 80 reuseport default_server;
    listen [::]:80 reuseport default_server;
    listen 443 ssl reuseport;
    listen [::]:443 ssl reuseport;

    http2 on;
	
	# ...

Secondary query:

Also can you please tell us how best to use these images with custom nginx configuration? This is my workaround for custom nginx configuration:

Currently, I copy the nginx config from the running container:
docker cp $(docker compose -f ../docker-compose.yml ps -q web):/etc/nginx ../nginx-dev-config

And then mount the files individually with volumes in my docker-compose.yml:

    volumes:
      # App
      - ./statamic:/var/www/html
      # Dev SSL keys (npm run devcerts in /statamic)
      - ./dev.crt:/etc/ssl/site/server.crt:ro
      - ./dev.key:/etc/ssl/site/server.key:ro
      # Nginx dev config
      - ./nginx-dev-config/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx-dev-config/sites-enabled/00-default.conf:/etc/nginx/sites-enabled/00-default.conf:ro
      - ./nginx-dev-config/fastcgi.conf:/etc/nginx/fast-cgi.conf:ro
      - ./nginx-dev-config/custom.d/common.conf:/etc/nginx/custom.d/common.conf:ro

But this generates these sed errors in the container:

web-1  | sed: can't move '/etc/nginx/sites-enabled/00-default.confgdAIiC' to '/etc/nginx/sites-enabled/00-default.conf': Resource busy
web-1  | sed: can't move '/etc/nginx/nginx.confBAdMAD' to '/etc/nginx/nginx.conf': Resource busy
web-1  | sed: can't move '/etc/nginx/nginx.confidBlHD' to '/etc/nginx/nginx.conf': Resource busy
web-1  | nginx version: nginx/1.26.1
web-1  | sed: can't move '/etc/nginx/custom.d/common.confIfHmAE' to '/etc/nginx/custom.d/common.conf': Resource busy
web-1  | nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/etc/ssl/site/server.crt"
web-1  | nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
web-1  | nginx: configuration file /etc/nginx/nginx.conf test is successful
web-1  | [12-Jul-2024 10:46:31] NOTICE: fpm is running, pid 381
web-1  | [12-Jul-2024 10:46:31] NOTICE: ready to handle connections
web-1  | nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/etc/ssl/site/server.crt"

This image is advertised as production ready, so could you help me understand how you would make custom nginx configurations, is it similar to this method? I would prefer to eliminate all warnings and errors from a production environment, you would expect to need custom nginx configuration in production.

Thank you once again for really excellent great work. Appreciate your last bugfix 🙌

[shinsenter]

Hi @replete

Thank you for reaching out.

Regarding the issue "http2 directive is deprecated", it is not urgent at the moment, and nginx can still function normally. Therefore, you can use it without too much concern.

I have no comments on the "sed: can't move. Resource busy" errors you are encountering. It is possible that the files on the host machine are locked by another application (or locked by the read-only mode), and during the nginx startup process, the container cannot update the necessary user and group to the *.conf files before starting nginx.

You can add your nginx configurations by mounting or copying your *.conf files into the /etc/nginx/custom.d/ directory of the container. The config files here will be loaded into the default nginx server.

php/src/php/with-nginx/rootfs/etc/nginx/sites-enabled/00-default.conf

Line 22 in 1476f50

include /etc/nginx/custom.d/*.conf;

Note: Since there are already some common configs in this directory, please avoid mounting or replacing an entire different directory into /etc/nginx/custom.d/.

[shinsenter]

By the way, these Docker images are created to be “ready for production,” not “immutable or non-customizable,” and I primarily focus on PHP. Web server software is added as a gateway to communicate with the underlying PHP handlers, enhancing request processing efficiency and reducing the load on PHP. Users can fully customize, and I am not responsible for any of their customizations.

[replete]

Thank you, I understand it's not urgent right now, but for a production environment I want to prevent potential issues in the future

The errors are because I have mounted the copied conf files as read only, so I can control the nginx configuration from source control outside of the container. Sed is complaining that some copy part of your docker image can't replace the files I've mounted, which is what I want.

I understand you are not responsible for customizations, and thank you for your advice so far. I just wanted to understand if my approach made sense.

My main context here is optimizing websites for performance, thanks again for your input.

Do you think you might enable http3 in the future with the ngx_http_v3_module?

[shinsenter]

Yes you can enable http3 yourself by extending these docker images using a Dockerfile.

[shinsenter]

Hi @replete

The warning is fixed, please pull and test to see if it works.

[replete]

Thank you for pushing this, I can confirm it's now working.

The /img/ statamic glide issue has come back with a vengeance in production though and now I'm getting 500 server errors. I'm guessing something else changed in the nginx config. Currently investigating

[shinsenter]

I will check it again tomorrow 😭

[replete]

I'll figure out what's going on and make a statamic repo that reproduces the issue. Nginx is fun!

[replete]

Thankfully this was not a regression, but something to do with Laravel and vite with SSL configured a certain way. So no problem with the image.

By the way, in my investigation, I noticed this change recently:

I thought this might be the cause, but it was not. Just an FYI in case this is accidental change.

Thanks for your help, have an amazing weekend