[nginx] IPv6 support?

[emilstahl]

Currently the nginx plugin adds:
listen 443 ssl; # managed by Certbot

It should add the following for IPv6 support:

listen 443 ssl; # managed by Certbot
listen [::]:443 ssl; # managed by Certbot

An option for HTTP 2 would be nice too, either by specifying --http2 flag or just check nginx for compatibility.;

listen 443 ssl http2;
listen [::]:443 ssl http2;

[bmw]

@emilstahl, thanks for making this issue. I created #3646 so we can track the issues of IPv6 and HTTP2 separately.

[kirelagin]

Actually, it is not entirely safe. In older versions of nginx the ipv6only was off by default, so having these two lines you propose at the same time would break the config.

I’d say that ipv6only=on should be added to the listen [::]:443 line, but, AFAIU, this option is Linux-only and I’m not sure how nginx will respond to it on other OSes.

[jkldgoefgkljefogeg]

ipv6only=on is the default. https://nginx.org/en/docs/http/ngx_http_core_module.html#listen
For a server config with listen [::]:80;, certbox does not generate listen [::]:443; At least user should be warned IPv6 SSL was not enabled.

For it breaks for some legacy version nginx_version check to skip ipv6 config is fine. Current implementation does not support IPv6 for nginx stable/mainline

[jplatte]

@bmw So what's the current state of this? You closed this issue in #5178, but then seem to have reverted your changes. Should this issue be re-opened?

[ohemorange]

@jplatte: We then unreverted the changes. The latest version of Certbot supports IPv6; see some caveats that we plan to fix in #5438.