Best Practices for HTTP/3 (QUIC) with Virtualmin LEMP on Debian 13 / NGINX 1.26.3

SYSTEM INFORMATION
OS type and version Debian Linux 13
Webmin version 2.653
Usermin version 2.552
Virtualmin version 8.1.0 GPL
Theme version 26.50.4
Nginx version 1.26.3
Package updates All installed packages are up to date

Hi Virtualmin Team,

We have recently deployed a fresh production server running Debian 13 (Trixie) with Virtualmin installed using the LEMP bundle.

The NGINX package is the standard Debian 13 package:

nginx 1.26.3-3+deb13u7

nginx -V confirms that this build includes native HTTP/3 support:

--with-http_v3_module

We have successfully enabled HTTP/2 and HTTP/3 (QUIC) on one of our Virtualmin-managed domains, and HTTP/3 has been verified with curl --http3.

Verified HTTP/3 Result

HTTP/3 200
server: nginx
date: Thu, 20 Aug 2026 14:51:08 GMT
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=86400

The server is also listening on UDP/443, and firewalld provides the http3 service:

http3
  ports: 443/udp

Current Implementation

We are deliberately avoiding modifications to Virtualmin’s internal NGINX module/template files because these may potentially be replaced during future Virtualmin updates.

Instead, we are currently applying the HTTP/3 configuration directly to individual VirtualHost configuration files.

Because multiple VirtualHosts share the same IP address and TCP/UDP port, we are using reuseport only on the primary/default VirtualHost.

Primary/default VirtualHost:

listen 192.0.2.1:443 ssl default_server;
listen 192.0.2.1:443 quic reuseport;
http2 on;

Additional VirtualHosts:

listen 192.0.2.1:443 ssl;
listen 192.0.2.1:443 quic;
http2 on;

add_header Alt-Svc 'h3=":443"; ma=86400' always;

We understand that http2 on the listen directive is deprecated in newer NGINX versions (1.25.1+), so we intend to use the standalone directive:

http2 on;

rather than:

listen 443 ssl http2;

Questions Before Production Rollout

We would appreciate your guidance on the following points.

1. VirtualHost regeneration / configuration overwrites

If a VirtualHost is modified through Virtualmin — for example, changing SSL settings, Website Options, PHP settings, or other domain configuration — can Virtualmin regenerate the NGINX VirtualHost and remove manually added directives such as:

listen ... quic;
add_header Alt-Svc ...;

If so, which Virtualmin operations are known to trigger regeneration?

2. Recommended Virtualmin integration

Is there currently a supported mechanism, template variable, or Server Template option for the LEMP stack that allows Virtualmin to generate:

listen ... quic;

and/or:

add_header Alt-Svc 'h3=":443"; ma=86400' always;

automatically for newly created VirtualHosts?

If there is no official mechanism yet, is adding native HTTP/3/QUIC support to the Virtualmin NGINX integration planned?

3. reuseport handling

For multiple VirtualHosts sharing the same IP:443, is the following architecture recommended and fully supported by Virtualmin?

# Primary/default server

listen IP:443 ssl default_server;
listen IP:443 quic reuseport;

# Additional VirtualHosts

listen IP:443 ssl;
listen IP:443 quic;

Or does Virtualmin have a preferred way of handling the QUIC listener across multiple domains?

4. Firewall integration

Our Debian 13 installation uses firewalld, and the http3 service already provides:

443/udp

Are there any Virtualmin-specific firewall considerations when enabling HTTP/3/QUIC on a LEMP server?

5. Backup / restore and migration

Are there any known Virtualmin backup/restore or domain migration considerations for manually configured QUIC/HTTP/3 directives?

Why We Are Asking

We would like to standardize HTTP/3 across multiple Virtualmin-hosted domains, but we want to avoid implementing it in a way that conflicts with Virtualmin’s configuration management.

Our preference is to use the existing Virtualmin-generated VirtualHost configuration and make only minimal per-domain additions until native HTTP/3 support is available in Virtualmin.

We would appreciate confirmation that this approach is compatible with the current Virtualmin LEMP implementation, as well as any recommendations for a more integrated solution.

If HTTP/3/QUIC support is already planned for a future Virtualmin release, information about the expected implementation or roadmap would also be appreciated.

Best regards,
Hamed

This matter was requested / talked about a few times already.
One topic with the latest answers / statements is from may 2026:

Thanks for pointing me to the May 2026 discussion. I had seen that thread, but I think there is an important difference with the setup I’m asking about.

I had also reviewed the previous Virtualmin discussions about Nginx and HTTP/3, including the 2024 discussion about Nginx HTTP/3 support. However, I could not find a previous case covering the current combination: a native Virtualmin LEMP installation using a distribution-provided Nginx package that already includes http_v3_module, without a custom Nginx build or a hybrid Apache/Nginx setup.

The May discussion is primarily about adding Nginx alongside Apache as a hybrid solution. My setup is different: this is a native Virtualmin LEMP installation, so Apache is not involved at all.

More importantly, the situation regarding the Nginx package has changed since the earlier discussions.

On my Debian 13 installation, the standard Debian package is:

nginx 1.26.3-3+deb13u7

and:

nginx -V

confirms:

--with-http_v3_module

So there is no third-party Nginx repository, custom build, or manually compiled Nginx involved.

I have already enabled HTTP/3 directly on a Virtualmin-managed VirtualHost and verified it successfully:

curl -I --http3 https://example.com/

HTTP/3 200
server: nginx
alt-svc: h3=":443"; ma=86400

This is why my question is slightly different from the previous discussions. I’m not asking whether HTTP/3 can be made to work with Virtualmin, or whether a hybrid Apache/Nginx architecture is desirable. It is already working with the native Virtualmin LEMP setup.

My main concern is Virtualmin configuration management:

  • Will Virtualmin regenerate/overwrite the manually added listen ... quic and Alt-Svc directives?
  • Is there currently a supported Virtualmin template mechanism for generating these directives?
  • Is native HTTP/3 support for the LEMP/Nginx integration planned now that Debian 13 provides Nginx with http_v3_module out of the box?

Therefore, I believe it would be worth revisiting native Nginx/LEMP support for HTTP/3, not just specifically for Debian 13, but more generally as other distributions begin shipping official Nginx packages with native HTTP/3 (http_v3_module) support. This is a different use case from the previously discussed Apache + Nginx hybrid approach.

What I meant with my post is, that there are already a few answers regarding that matter.

To your questions:

  1. I am not 100% sure, but I doubt it will be overwritten. So far I never had any uses with manually edited configs regarding services. If you added them via the webinterface from Webmin/Virtualmin, then I somewhat even more doubt it. But it is possible that it might get overwritten, it depends on what you do and how.
  2. Not sure about that, either @Ilia or @Joe will know that for sure (sorry for linking if thats not wished).
  3. If you mean, pre-activated during the setup … I don’t think that will happen since configurations like that are related to the users and their wishes. Even though I don’t really see a “real” downside to it. But that is also ob to the team. … if its already pre-shipped with the OS, then it is somewhat native available.

Thanks for clarifying — understood.

That is exactly why I wanted to bring the current LEMP setup to the attention of the Virtualmin developers. I have already reviewed the previous discussions and confirmed that HTTP/3 works successfully with the native Virtualmin LEMP stack on Debian 13 using the distribution-provided Nginx package.

The remaining questions are mainly about Virtualmin’s configuration management and long-term integration:

  • whether manually added QUIC/HTTP/3 directives are preserved across Virtualmin operations,

  • whether there is already a supported template/configuration mechanism for this,

  • and whether native HTTP/3 support for the Nginx/LEMP integration is planned.

So I’ll wait for Ilia/Joe’s input on those points. Thanks for pointing me back to the earlier discussions.

Alright, upcoming Virtualmin release will have support for HTTP/3 in case webserver supports it.

Thank you, Ilia. This is exactly the kind of native integration I was hoping for.

The per-domain QUIC listener handling, reuseport management, Alt-Svc support, and SSL lifecycle integration address the main concerns I had with maintaining these settings manually.

I’ll keep an eye on the PRs and test the implementation once it is available in a released version.

Thanks for taking this into consideration and for implementing it.