nginx 1.24, and a config I had not read since 2016

Upgrading forced a read of a configuration file that had been copied forward through three servers and four PHP versions.

# what was still in there
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;   # two of these are dead
ssl_ciphers 'ECDHE-RSA-AES256-SHA384:...';  # a 2016 list
fastcgi_param HTTPS on;                # unconditionally
client_max_body_size 2m;               # and uploads fail at 2m

# what it is now
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;         # let the client choose
# ciphers left at the default, which is better than my list

The cipher list is the line worth deleting rather than updating: a hand-maintained list from 2016 is worse than the default in every current version, and keeping one means owning a decision that changes faster than the file gets read. The fastcgi_param HTTPS on was the actively harmful one — it made the application generate https URLs on a plain-http health check endpoint and hid a redirect loop for a week.