Merge remote-tracking branch 'upstream/master' into zope4py2

software/caddy-frontend/buildout.hash.cfg

@@ -22,7 +22,7 @@ md5sum = 5784bea3bd608913769ff9a8afcccb68
 
 [profile-caddy-frontend]
 filename = instance-apache-frontend.cfg.in
-md5sum = 02ce5d44d49982fda598e3086cfbca99
+md5sum = 1e912fb970401a4b7670b25ba8284a5b
 
 [profile-caddy-replicate]
 filename = instance-apache-replicate.cfg.in
@@ -38,7 +38,7 @@ md5sum = be54431846fe7f3cee65260eefc83d62
 
 [profile-caddy-frontend-configuration]
 _update_hash_filename_ = templates/Caddyfile.in
-md5sum = fdf46b1dee6ea6b91b9aa9e322a0530d
+md5sum = cb627dfce9ab7bc23fd98818d55876b7
 
 [template-not-found-html]
 _update_hash_filename_ = templates/notfound.html

software/caddy-frontend/instance-apache-frontend.cfg.in

@@ -413,6 +413,7 @@ extra-context =
     key not_found_file caddy-configuration:not-found-file
     key username monitor-instance-parameter:username
     key password monitor-htpasswd:passwd
+    key global_disable_http2 configuration:global-disable-http2
 # BBB: SlapOS Master non-zero knowledge BEGIN
     key apache_certificate apache-certificate:output
 # BBB: SlapOS Master non-zero knowledge END

software/caddy-frontend/templates/Caddyfile.in

@@ -3,7 +3,16 @@
 import {{ slave_configuration_directory }}/*.conf
 
 :{{ https_port }} {
-  tls {{ master_certificate }} {{ master_certificate }}
+  tls {{ master_certificate }} {{ master_certificate }} {
+{%- if global_disable_http2 %}
+    # Disallow HTTP2
+    alpn http/1.1
+{%- else %}
+    # Allow http2
+    alpn h2 http/1.1
+{%- endif %}
+
+  }
   bind {{ local_ipv4 }}
   status 404 /
   log / {{ access_log }} "{remote} - {>REMOTE_USER} [{when}] \"{method} {uri} {proto}\" {status} {size} \"{>Referer}\" \"{>User-Agent}\" {latency_ms}" {
@@ -29,7 +38,15 @@ import {{ slave_configuration_directory }}/*.conf
 
 # Access to server-status Caddy-style
 https://[{{ global_ipv6 }}]:{{ https_port }}/server-status, https://{{ local_ipv4 }}:{{ https_port }}/server-status {
-  tls {{ frontend_configuration['ip-access-certificate'] }} {{ frontend_configuration['ip-access-certificate'] }}
+  tls {{ frontend_configuration['ip-access-certificate'] }} {{ frontend_configuration['ip-access-certificate'] }} {
+{%- if global_disable_http2 %}
+    # Disallow HTTP2
+    alpn http/1.1
+{%- else %}
+    # Allow http2
+    alpn h2 http/1.1
+{%- endif %}
+  }
   bind {{ local_ipv4 }}
   basicauth "{{ username }}" {{ password | trim }} {
     "Server Status"