nixos/nginx: clear clients Connection headers

nixos/doc/manual/from_md/release-notes/rl-2305.section.xml

@@ -702,6 +702,13 @@
           <literal>hipcc</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>services.nginx.recommendedProxySettings</literal> now
+          removes the <literal>Connection</literal> header preventing
+          clients from closing backend connections.
+        </para>
+      </listitem>
       <listitem>
         <para>
           Resilio sync secret keys can now be provided using a secrets

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -176,6 +176,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `hip` has been separated into `hip`, `hip-common` and `hipcc`.
 
+- `services.nginx.recommendedProxySettings` now removes the `Connection` header preventing clients from closing backend connections.
+
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
 
 - The `firewall` and `nat` module now has a nftables based implementation. Enable `networking.nftables` to use it.

nixos/modules/services/web-servers/nginx/default.nix

@@ -211,6 +211,8 @@ let
         proxy_send_timeout      ${cfg.proxyTimeout};
         proxy_read_timeout      ${cfg.proxyTimeout};
         proxy_http_version      1.1;
+        # don't let clients close the keep-alive connection to upstream
+        proxy_set_header        "Connection" "";
         include ${recommendedProxyConfig};
       ''}