See https://trac.nginx.org/nginx/ticket/810.

What's the best way to make sure we put 'ssl_stapling on' in the first server block? Do we edit existing configs that are included into nginx.conf? Or do we add a dummy server block that's earliest in the nginx.conf file?

Note this is on a per-port basis, so e.g. if a config has listeners for :443 and :9443, we need to have ssl_stapling on in the first server block for each of those ports.

cc @diracdeltas