gzip is enabled by default

[mbelscher]

The module has gzip is enabled by default, when someone configures to uses HTTPS without modifying this parameter they are susceptible to www.breachattack.com.

It would be more appropriate and safer for the default to be undef and take the default of the nginx module which is "off" when not configured.

If someone wants to explicitly configure then it should be added.
This will avoid misconfiguration and opening users sites to the possible attack.

[wyardley]

I agree that, especially for SSL, it should default to off.