From 229553b5c381cfe2b99f033baf6dd89ddf158eab Mon Sep 17 00:00:00 2001 From: Kieran Klukas Date: Sat, 8 Aug 2026 20:34:32 -0400 Subject: [PATCH] caddy: open udp 443 so the advertised http/3 actually works Caddy sends alt-svc: h3=":443" on every response by default, but the firewall only opened tcp, so clients tried quic, got rejected and fell back. Costs a round trip on first connect for anyone who believed the header. --- machines/prattle/default.nix | 1 + machines/terebithia/default.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/machines/prattle/default.nix b/machines/prattle/default.nix index 9447014..b9dd21a 100644 --- a/machines/prattle/default.nix +++ b/machines/prattle/default.nix @@ -200,6 +200,7 @@ allowedUDPPorts = [ 137 138 # Samba NetBIOS + 443 # HTTP/3: caddy advertises h3 whether or not this is open ]; logRefusedConnections = false; rejectPackets = true; diff --git a/machines/terebithia/default.nix b/machines/terebithia/default.nix index 3598a69..3ba8c13 100644 --- a/machines/terebithia/default.nix +++ b/machines/terebithia/default.nix @@ -275,6 +275,7 @@ ]; allowedUDPPorts = [ 28869 # Minecraft voice chat + 443 # HTTP/3: caddy advertises h3 whether or not this is open ]; logRefusedConnections = false; rejectPackets = true; -- 2.51.2