From b5e21daa9801d31bfe6b42757014097e821c5f91 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 19 Nov 2014 00:55:58 +0000
Subject: [PATCH] enable SPDY by installing nginx 1.6 from the nginx PPA

---
 conf/nginx-ssl.conf |  2 +-
 conf/nginx.conf     |  2 +-
 setup/system.sh     |  2 ++
 setup/web.sh        | 19 +++++++++++++++++--
 4 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/conf/nginx-ssl.conf b/conf/nginx-ssl.conf
index 8d1598cb..2e6d3d59 100644
--- a/conf/nginx-ssl.conf
+++ b/conf/nginx-ssl.conf
@@ -40,7 +40,7 @@ keepalive_timeout   70;
 
 # Buffer size of 1400 bytes fits in one MTU.
 # nginx 1.5.9+ ONLY
-#ssl_buffer_size 1400; 
+ssl_buffer_size 1400; 
 
 # SPDY header compression (0 for none, 9 for slow/heavy compression). Preferred is 6. 
 # 
diff --git a/conf/nginx.conf b/conf/nginx.conf
index 241bcebe..69d5467e 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -12,7 +12,7 @@ server {
 
 # The secure HTTPS server.
 server {
-	listen 443 ssl;
+	listen 443 ssl spdy;
 
 	server_name $HOSTNAME;
 
diff --git a/setup/system.sh b/setup/system.sh
index 5cbda2e2..20e4abd2 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -17,11 +17,13 @@ hide_output apt-get -y upgrade
 #	         when generating random numbers for private keys (e.g. during
 #	         ldns-keygen).
 # * unattended-upgrades: Apt tool to install security updates automatically.
+# * software-properties-common: Provides apt-add-repository.
 # * ntp: keeps the system time correct
 # * fail2ban: scans log files for repeated failed login attempts and blocks the remote IP at the firewall
 
 apt_install python3 python3-dev python3-pip \
 	wget curl \
+	software-properties-common \
 	haveged unattended-upgrades ntp fail2ban
 
 # Allow apt to install system updates automatically every day.
diff --git a/setup/web.sh b/setup/web.sh
index ec1ef0ac..752f8705 100755
--- a/setup/web.sh
+++ b/setup/web.sh
@@ -13,12 +13,27 @@ if [ -f /usr/sbin/apache2 ]; then
 	hide_output apt-get -y --purge autoremove
 fi
 
+# Ubuntu 14.04 comes with nginx 1.4.6, but we want 1.6.x to have SPDY support
+# which is the more modern best practice. We'll get nginx from the nginx PPA.
+# An update from stock nginx to the nginx ppa causes trouble, so we'll purge
+# first.
+if nginx -v 2>&1 | grep 1.4; then
+	apt-get purge -y nginx
+fi
+
+# Then add the PPA. Test first so we don't have to run apt-get update if the
+# PPA was already present.
+if [ ! -f /etc/apt/sources.list.d/nginx-stable-trusty.list ]; then
+	hide_output add-apt-repository -y ppa:nginx/stable
+	hide_output apt-get update
+fi
+
 # Install nginx and a PHP FastCGI daemon.
-#
-# Turn off nginx's default website.
 
 apt_install nginx php5-fpm
 
+# Turn off nginx's default website.
+
 rm -f /etc/nginx/sites-enabled/default
 
 # Copy in a nginx configuration file for common and best-practices