HTTP/3 & QUIC Server Config Generator

# NGINX 1.25+ HTTP/3 (QUIC) Configuration for api.example.com
server {
    # Listen on standard TCP 443 with HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # Listen on UDP 443 for HTTP/3 QUIC with reuseport
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;

    server_name api.example.com;

    # SSL / TLS 1.3 Configuration (QUIC strictly requires TLS 1.3)
    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

    # Advertise HTTP/3 Alt-Svc header to clients
    add_header Alt-Svc 'h3=":443"; ma=86400' always;

    # QUIC Specific Parameters
    quic_retry on;
    quic_gso on;
    # TLS 1.3 0-RTT Early Data (Replay protection warning)
    ssl_early_data on;
    proxy_set_header Early-Data $ssl_early_data;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# /etc/sysctl.d/60-quic.conf
# Kernel buffer optimizations for high-throughput UDP QUIC packets
net.core.rmem_max = 7500000
net.core.wmem_max = 7500000
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr