diff --git a/nginx.tmpl b/nginx.tmpl
index 96c9036..5c8e535 100644
--- a/nginx.tmpl
+++ b/nginx.tmpl
@@ -255,11 +255,11 @@ server {
 	server_name _; # This is just an invalid value which will never trigger on a real hostname.
 	server_tokens off;
 	listen {{ $external_https_port }} ssl;
-  http2 on;
 	{{ if $enable_ipv6 }}
 	listen [::]:{{ $external_https_port }} ssl;
-  http2 on;
 	{{ end }}
+	http2 on;
+
 	{{ $access_log }}
 	include /etc/nginx/vhost.d/default;
 	location / {
@@ -365,15 +365,14 @@ server {
 	server_tokens {{ $server_tokens }};
 	{{ end }}
 	listen {{ $external_https_port }} ssl {{ $default_server }};
-  http2 on;
 {{ if eq $enable_socks "true" }}
 	listen unix:/etc/nginx/socks/{{ $host }}.{{ $external_https_port }}.sock  ssl {{ $default_server }};
-  http2 on;
 {{ end }}
 	{{ if $enable_ipv6 }}
 	listen [::]:{{ $external_https_port }} ssl {{ $default_server }};
-  http2 on;
 	{{ end }}
+	http2 on;
+
 	{{ $access_log }}
 
 	{{ template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}
@@ -494,15 +493,14 @@ server {
 	server_tokens {{ $server_tokens }};
 	{{ end }}
 	listen {{ $external_https_port }} ssl {{ $default_server }};
-  http2 on;
 {{ if eq $enable_socks "true" }}
 	listen unix:/etc/nginx/socks/{{ $host }}.{{ $external_https_port }}.sock  ssl {{ $default_server }};
-  http2 on;
 {{ end }}
 	{{ if $enable_ipv6 }}
 	listen [::]:{{ $external_https_port }} ssl {{ $default_server }};
-  http2 on;
 	{{ end }}
+	http2 on;
+
 	{{ $access_log }}
 	include /etc/nginx/vhost.d/default;
 	location / {