Repository navigation
Enable HTTP/2 on internal TLS listeners - #29
Merged
Merged
Conversation
TLS is terminated on the internal 444 listeners (port 443 is just an SNI-sniffing passthrough in the stream block), so http2 on; belongs there. OpenResty 1.31.1.1 is already compiled with --with-http_v2_module and ALPN/TLS 1.3 config is already in place, so this is the only directive needed to stop connections falling back to http/1.1 and queueing requests in batches of 6.
SanjeevLakhwani
force-pushed
the
feat/enable-http2
branch
2 times, most recently
from
September 22, 2026 15:24
e1dc435 to
66f27e6
Compare
SanjeevLakhwani
force-pushed
the
feat/enable-http2
branch
2 times, most recently
from
September 22, 2026 15:56
d460f92 to
8ddd330
Compare
v-rocheleau
reviewed
Sep 22, 2026
v-rocheleau
left a comment
v-rocheleau
left a comment
Contributor
There was a problem hiding this comment.
LGTM!
Some suggestions and a question.
Leaving the final approval to David since I'm a total NextJS noob 😅
SanjeevLakhwani
force-pushed
the
feat/enable-http2
branch
2 times, most recently
from
September 23, 2026 14:52
cf340dd to
5e56ac5
Compare
davidlougheed
requested changes
Sep 23, 2026
SanjeevLakhwani
force-pushed
the
feat/enable-http2
branch
from
September 23, 2026 15:31
5e56ac5 to
dbc276f
Compare
HTTP/2 lets the browser fire dozens of _next/static chunk requests on one connection instead of trickling them through 6 HTTP/1.1 connections, which tripped the perip limit_req (rate=10r/s, burst=30) in proxy.conf and caused a wave of 503s / ChunkLoadErrors on initial page load for Bento Public (confirmed via bentov2_public_errors.log: "limiting requests ... by zone perip"). Split proxy.conf's non-rate-limit directives into proxy_common.conf and proxy /_next/static/, /public/ (plus Next.js dev-mode /__nextjs_ helpers) through a separate, looser static_perip zone (75r/s, burst=200) so page-load bursts pass while dynamic/API traffic through location / keeps the existing limits.
SanjeevLakhwani
force-pushed
the
feat/enable-http2
branch
from
September 23, 2026 18:43
dbc276f to
86242ff
Compare
davidlougheed
approved these changes
Sep 23, 2026
davidlougheed
left a comment
davidlougheed
left a comment
Member
There was a problem hiding this comment.
lgtm, faster on my laptop
v-rocheleau
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
http2 on;to public, protal, and the domain-redirect server blocks. (OpenResty 1.31.1.1 is already compiled with--with-http_v2_moduleand ALPN/TLS 1.3 config was already in place)_next/static/chunk requests over a single connection instead of trickling them through HTTP/1.1's 6-connection cap, which blew past thelimit_req zone=perip burst=30;rate limit inproxy.confand caused a wave of 503s /ChunkLoadErrors on initial page load. Fixed by splittingproxy.conf's reverse-proxy directives into a sharedproxy_common.conf, and adding a/_next/static/,/__nextjs_and/public/location that proxies throughproxy_common.confwith a separate, looser rate limit (static_perip, 75r/s, burst=200), while dynamic/API traffic throughlocation /keeps the existing protection unchanged.