Systemd Patches + CVE Patch

static/Raccoon/nginx.service

@@ -4,14 +4,14 @@ After=syslog.target network-online.target remote-fs.target nss-lookup.target
 Wants=network-online.target
 
 [Service]
-Type=forking
+Type=notify
+NotifyAccess=main
 PIDFile=/run/nginx.pid
 Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
 ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /usr/local/nginx /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/uwsgi_temp /usr/local/nginx/scgi_temp /var/log/nginx
 ExecStartPre=/usr/sbin/nginx -t
 ExecStart=/usr/sbin/nginx
 ExecReload=/usr/sbin/nginx -s reload
-ExecStop=/bin/kill -s QUIT $MAINPID
 LimitNOFILE=65535
 
 [Install]

static/Trixie/nginx.service

@@ -4,14 +4,14 @@ After=syslog.target network-online.target remote-fs.target nss-lookup.target
 Wants=network-online.target
 
 [Service]
-Type=forking
+Type=notify
+NotifyAccess=main
 PIDFile=/run/nginx.pid
 Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
 ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /usr/local/nginx /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/uwsgi_temp /usr/local/nginx/scgi_temp /var/log/nginx
 ExecStartPre=/usr/sbin/nginx -t
 ExecStart=/usr/sbin/nginx
 ExecReload=/usr/sbin/nginx -s reload
-ExecStop=/bin/kill -s QUIT $MAINPID
 LimitNOFILE=65535
 
 [Install]

static/nginx/nginx.conf

@@ -1,5 +1,5 @@
 user nginx;
-pid /var/run/nginx.pid;
+pid /run/nginx.pid;
 worker_processes auto;
 worker_cpu_affinity auto;
 worker_rlimit_nofile 65535;
@@ -62,6 +62,15 @@ http {
     ssl_session_tickets            off;
     ssl_stapling                   on;
     ssl_stapling_verify            on;
+
+    # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
+    # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
+    # overhead once the connection is past head-of-line blocking.
+    ssl_dyn_rec_enable             on;
+    ssl_dyn_rec_size_lo            1369;
+    ssl_dyn_rec_size_hi            4229;
+    ssl_dyn_rec_threshold          40;
+    ssl_dyn_rec_timeout            1000;
     # ===================== END TLS ======================== #
     resolver                       1.1.1.1 1.0.0.1 valid=300s;
     resolver_timeout               5s;