What looked like a simple nginx config change turned into a tour through SSL library incompatibilities, pf firewall rules for a new protocol, and a multi-worker affinity problem that only shows up ...

What looks like a simple nginx config change turns out to involve SSL library compatibility, firewall rules for a new protocol, and a subtle multi-process routing problem that only surfaces under real traffic. This documents what it actually took to get HTTP/3 (QUIC) working on nginx 1.28 inside a FreeBSD 15.0 Bastille jail - serving the Mastodon instance at burningboard.net.