Setting up Nginx for HTTP/2 and HTTP/3 on Fedora

Modern web traffic has shifted heavily towards multiplexed, encrypted connections, and Australian operators running Fedora servers need to keep pace. Enabling HTTP/2 cuts latency by allowing many requests to share a single TLS connection, while HTTP/3 over QUIC removes head-of-line blocking and survives flaky handovers on mobile networks. For an admin in Sydney, Melbourne or Perth serving customers across the NBN, the practical difference shows up as faster page loads on congested links and fewer stalled connections during peak arvo browsing. Learn more about Isorc2015.org.

This walkthrough covers a clean Fedora build of Nginx with both protocols enabled, sensible TLS defaults, and the configuration tweaks that make a measurable difference in production. Whether you are hosting a small business on a VPS or running reverse proxies for a SaaS platform, the same steps apply, and the final config remains portable across RHEL-family distributions.

Preparing Fedora and installing build dependencies

Start with a current Fedora host and refresh the system before pulling in build tools. A short dnf cycle avoids surprises when the OpenSSL package arrives for QUIC support.

sudo dnf update -y
sudo dnf install -y gcc make pcre-devel zlib-devel openssl-devel git wget

Australian hosts behind the NBN often sit behind CGNAT, so plan firewall rules around the public IP of the cloud instance or data centre. If you are colocating in a Brisbane or Sydney facility, confirm that UDP 443 is open, since HTTP/3 needs QUIC traffic on that port. Forums on reliable distributed systems, such as the isorc2015 site, have published findings showing that loss recovery improves sharply when QUIC is allowed through.

Compiling Nginx with HTTP/2 and QUIC support

Fedora's stock nginx package ships with HTTP/2, but HTTP/3 requires a custom build because Nginx mainline needs a QUIC-compatible TLS library. Grab the source and a recent quictls OpenSSL fork.

wget https://nginx.org/download/nginx-1.27.4.tar.gz
git clone --depth 1 https://github.com/quictls/openssl
tar -xzf nginx-1.27.4.tar.gz && cd nginx-1.27.4
./configure \
  --prefix=/etc/nginx \
  --with-http_v2_module \
  --with-http_v3_module \
  --with-openssl=../openssl \
  --with-cc-opt='-Wno-error' \
  --with-ld-opt='-Wl,-rpath,/usr/local/lib'
make && sudo make install

Drop a systemd unit under /usr/lib/systemd/system/nginx.service so the binary behaves like a normal Fedora service. Local groups such as the Brisbane Systems Administrators community have long recommended pinning the OpenSSL path with rpath to avoid accidental linkage against the system OpenSSL after a dnf update.

Writing server blocks that speak both protocols

A dual-protocol server block looks like a standard HTTPS config, with two small additions: the http2 keyword on the listen line, and a parallel listen directive for UDP.

server {
    listen 443 ssl;
    http2 on;
    listen 443 quic reuseport;

    server_name example.com.au;
    add_header Alt-Svc 'h3=":443"; ma=86400';
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_early_data on;
}

The Alt-Svc header tells HTTP/2 clients that HTTP/3 is available, so do not omit it. If you are serving a .au domain, confirm that the certificate chains to a CA trusted by major browsers and that the OCSP responder is reachable from Australian IP ranges, since ACMA's local filtering infrastructure occasionally blocks stale endpoints.

Hardening TLS and managing certificates

TLS 1.3 is mandatory for HTTP/3, so disable anything older than TLS 1.2 and turn on session resumption plus OCSP stapling. The Australian Cyber Security Centre's Essential Eight framework treats certificate validity and strong ciphers as baseline controls, which lines up with the Nginx defaults.

Automate renewals with certbot or acme.sh. If your server sits behind an Optus or Telstra business link with strict egress rules, whitelist the ACME staging and production endpoints before the first renewal attempt. A cron job running twice daily gives plenty of headroom for transient network blips, helpful given the variable latency many Australian links see when peering with overseas CDNs.

Validating the configuration end to end

Before going live, run nginx -t to check syntax, then restart the service. Confirm the binary was actually built with HTTP/3 by looking for the QUIC build flag.

nginx -V 2>&1 | grep -o 'http_v3_module\|http_v2_module'
curl --http2 -I https://example.com.au
curl --http3-only -I https://example.com.au

If curl reports HTTP/3 negotiation failures, capture a packet trace with tcpdump on UDP 443 to confirm the QUIC handshake is reaching the listener. From a typical Aussie home on FttP or HFC NBN, the first request still falls back to HTTP/2 because the Alt-Svc header needs caching, but the second request should return h3.

Tuning caching, compression and connection reuse

HTTP/2 and HTTP/3 both reward aggressive caching, so enable proxy_cache, gzip and Brotli where the upstream supports it. Keep-alive settings matter more under these protocols because each connection carries many streams; the default of 75 seconds is usually fine, but adjust keepalive_requests to a few thousand for long-lived assets.

Compression ratio directly affects how much data flows over the link, and for users on the more distant NBN satellite tiers that translates to noticeable savings. A gzip_comp_level of 5 and Brotli quality of 4 keeps CPU usage sensible on a small Fedora VM while still delivering solid transfer reductions.

Monitoring in production

Keep an eye on the QUIC listen socket with ss -u -l 'sport = :443' and watch journalctl -u nginx for handshake errors after a rollout. A simple Grafana dashboard that splits requests by protocol makes regressions obvious, especially when a client base spans both NBN fibre and regional wireless.

Snippets from this guide fall under the site's copyright policy for reuse in your own runbooks. The most reliable signal that the rollout is healthy is a steady ratio of HTTP/3 requests climbing over the first week as repeat visitors receive the Alt-Svc header and upgrade. Once that curve flattens above sixty percent, the new transport is doing real work for the users behind it.