Enable quic and add CUSTOM kernel.

ansible/roles/jail_bastion/files/headers.include

@@ -10,3 +10,6 @@ add_header X-Content-Type-Options "nosniff" always;
 # Disallow the site to be rendered within a frame (clickjacking
 # protection)
 add_header X-Frame-Options "DENY" always;
+
+# Indicate that we are serving http3 on port 443
+add_header Alt-Svc 'h3=":443"; ma=864000';

ansible/roles/jail_bastion/files/nginx.conf

@@ -26,6 +26,8 @@ http {
     }
 
     server {
+        listen 443 quic reuseport;
+        listen [::]:443 quic reuseport;
         listen 443 ssl;
         listen [::]:443 ssl;
         http2  on;

ansible/roles/jail_bastion/files/proxy.include

@@ -5,3 +5,5 @@ proxy_set_header X-Forwarded-Proto $scheme;
 # Settings for keepalive module for upstreams
 proxy_http_version 1.1;
 proxy_set_header Connection "";
+# Requests sent with early data are subject to replay attacks so the application needs to protect against that by using the Early-Data header.
+# proxy_set_header Early-Data $ssl_early_data;