diff --git a/static/nginx/nginx.conf b/static/nginx/nginx.conf index 9c5c032..45bab65 100644 --- a/static/nginx/nginx.conf +++ b/static/nginx/nginx.conf @@ -77,17 +77,7 @@ http { # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch). # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS # overhead once the connection is past head-of-line blocking. - # INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size. The - # SSL buffer is allocated at ssl_buffer_size bytes, but the patch points - # buf->end at buf->start + size_hi -- a larger size_hi makes the copy loop - # memcpy response body past the end of that allocation and over adjacent - # nginx pools. Hit in production 2026-08-20: ssl_buffer_size 4k against - # size_hi 4229 overflowed by 133 bytes and crashed workers in unrelated - # code (ngx_http_v2_handle_frame, ngx_destroy_pool). The patch now clamps - # with ngx_min() so this is fail-safe, but exceeding it still silently caps - # records at ssl_buffer_size and wastes the ramp these values buy. - # ssl_buffer_size is NOT set here -- it lives in ssl.conf (outside this - # repo) and is settable per server block, so a single vhost can lower it. + # INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size. ssl_dyn_rec_enable on; ssl_dyn_rec_size_lo 1369; ssl_dyn_rec_size_hi 4229;