fix(nginx-proxy): Fix http2 duplication and add SSL_STAPLING control

- Fix 'protocol options redefined' warning by placing http2 directive
  once per server block instead of after each listen directive
- Add SSL_STAPLING env var (default: on) to control OCSP stapling
- Set SSL_STAPLING=off to suppress 'ssl_stapling ignored' warnings
  for certificates without OCSP responder URLs
- Update README with SSL_STAPLING documentation

Author: mrrobot47

nginx-proxy/README.md

@@ -139,6 +139,7 @@ deny all;
 | `VIRTUAL_PROTO` | Protocol (`http`, `https`, `uwsgi`, `fastcgi`) | `http` |
 | `HTTPS_METHOD` | `redirect`, `noredirect`, `nohttps` | `redirect` |
 | `SSL_POLICY` | SSL/TLS policy | `Mozilla-Modern` |
+| `SSL_STAPLING` | Enable OCSP stapling (`on` or `off`) | `on` |
 | `HSTS` | HSTS header value | `max-age=31536000` |
 | `CERT_NAME` | Custom certificate name | auto-detected |
 | `NETWORK_ACCESS` | `external` or `internal` | `external` |

nginx-proxy/nginx.tmpl

@@ -289,11 +289,10 @@ server {
 server {
 	server_name _; # This is just an invalid value which will never trigger on a real hostname.
 	listen 443 ssl default_server;
-	http2 on;
 	{{ if $enable_ipv6 }}
 	listen [::]:443 ssl default_server;
-	http2 on;
 	{{ end }}
+	http2 on;
 
 	root /etc/nginx/html;
 
@@ -358,6 +357,9 @@ server {
 {{/* Get the HSTS defined by containers w/ the same vhost, falling back to "max-age=31536000" */}}
 {{ $hsts := or (first (groupByKeys $containers "Env.HSTS")) "max-age=31536000" }}
 
+{{/* Get the SSL_STAPLING defined by containers w/ the same vhost, falling back to "on" */}}
+{{ $ssl_stapling := or (first (groupByKeys $containers "Env.SSL_STAPLING")) "on" }}
+
 {{/* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
 {{ $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}
 
@@ -393,11 +395,10 @@ server {
 server {
 	server_name {{ $host }};
 	listen 443 ssl {{ $default_server }};
-	http2 on;
 	{{ if $enable_ipv6 }}
 	listen [::]:443 ssl {{ $default_server }};
-	http2 on;
 	{{ end }}
+	http2 on;
 
 	{{ if eq $network_tag "internal" }}
 	# Only allow traffic from internal clients
@@ -445,7 +446,7 @@ server {
 	ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
 	{{ end }}
 
-	{{ if (exists (printf "/etc/nginx/certs/%s.chain.pem" $cert)) }}
+	{{ if (and (eq $ssl_stapling "on") (exists (printf "/etc/nginx/certs/%s.chain.pem" $cert))) }}
 	ssl_stapling on;
 	ssl_stapling_verify on;
 	ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.pem" $cert }};
@@ -555,11 +556,10 @@ server {
 server {
 	server_name {{ $host }};
 	listen 443 ssl {{ $default_server }};
-	http2 on;
 	{{ if $enable_ipv6 }}
 	listen [::]:443 ssl {{ $default_server }};
-	http2 on;
 	{{ end }}
+	http2 on;
 	return 500;
 
 	ssl_certificate /etc/nginx/certs/default.crt;