Is it possible to enable HTTP2 in an AIO apache reverse proxy configuration ?

[Zaphod-dev]

Hi,
My setup with AIO Nextcloud via an apache reverse proxy (same host) works as expected but all responses are in HTTP/1.1 mode, even if HTTP2 is requested, eg with "curl --http2". I've been trying hard to enable this protocol since I noticed a "performance" warning in the "memories" app that states that HTTP2 or 3 is recommended (sorry, snapshot below is in french...).
Am I wasting my time trying, because I'm hitting an inherent limitation of Apache reverse proxy setups that can't handle HTTP2 ?
Many thanks for any advice with this issue !

[szaimen]

Is it possible to enable HTTP2 in an AIO apache reverse proxy configuration ?

Hi, yes. Please compare with https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#apache. There http2 is enabled by default.

[Zaphod-dev]

Hi,
Thanks for the fast reply!
Indeed http2 is enabled in the example apache2 conf file, which I have duly integrated locally. Nonetheless, the HTTP2 protocol is turned down when accessing the hosted nextcloud AIO docker instance (see verbose curl test below). It seems that apache's default mod_proxy can't pass through HTTP2, it only passes HTTP1.1. There is an experimental mod_proxy_http2 that does just that, but it isn't available in stable debian https://httpd.apache.org/docs/2.4/fr/mod/mod_proxy_http2.html

curl -v -I --http2 -k https://my.nextcloud.domain
*   Trying 1.2.3.4:443...
* Connected to my.nextcloud.domain (1.2.3.4:) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=my.nextcloud.domain
*  start date: Oct 11 00:23:14 2024 GMT
*  expire date: Jan  9 00:23:13 2025 GMT
*  issuer: C=US; O=Let's Encrypt; CN=E5
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> HEAD / HTTP/1.1
> Host: my.nextcloud.domain
> User-Agent: curl/7.88.1
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 302 Found
HTTP/1.1 302 Found