Systemd Patches + CVE Patch

2026-05-15 13:49:54 +00:00
parent e82f9f8009
commit 0b9651ca05
9 changed files with 435 additions and 34 deletions
@@ -1,5 +1,5 @@
 user nginx;
-pid /var/run/nginx.pid;
+pid /run/nginx.pid;
 worker_processes auto;
 worker_cpu_affinity auto;
 worker_rlimit_nofile 65535;
@@ -62,6 +62,15 @@ http {
    ssl_session_tickets            off;
    ssl_stapling                   on;
    ssl_stapling_verify            on;
+
+    # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
+    # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
+    # overhead once the connection is past head-of-line blocking.
+    ssl_dyn_rec_enable             on;
+    ssl_dyn_rec_size_lo            1369;
+    ssl_dyn_rec_size_hi            4229;
+    ssl_dyn_rec_threshold          40;
+    ssl_dyn_rec_timeout            1000;
    # ===================== END TLS ======================== #
    resolver                       1.1.1.1 1.0.0.1 valid=300s;
    resolver_timeout               5s;