Reverse proxy doesn't work with HTTP/2

[jezen]

This concerns [at least] keter-2.1.2. It's possible this also affects keter-2.1.8, but I haven't managed to build that version yet, so I can't check.

---

I have a reverse proxy configuration which looks something like this.

  - type: reverse-proxy
    reversed-host: localhost
    reversed-port: 3000
    reversed-ssl: false
    reversing-host: sub.domain.com
    ssl:
      key: /etc/letsencrypt/live/domain.com/privkey.pem
      certificate: /etc/letsencrypt/live/domain.com/fullchain.pem

The server where this is running is sitting behind CloudFlare. Making requests to https://sub.domain.com in my web browser would see the following response.

505 HTTP Version Not Supported: unsupported protocol version

Downgrading the protocol at the CloudFlare level from HTTP/2 to HTTP/1.1 made this problem go away, and requests were then successfully proxied to the underlying web application running on port 3000.

[jappeace]

I suppose upgrading would help, there are changes in the reverse proxy library and keter should build against that:
https://hackage.haskell.org/package/http-reverse-proxy-0.6.1.0/changelog

if that don't work we'd need to find where this protocol is being rejected (and why).

[jezen]

Yeah, I think that's right. The first thing to do is a general patch party.