From fd768828b7745f1c3a2639e778982bcb29872c88 Mon Sep 17 00:00:00 2001 From: theraw Date: Sat, 20 Jun 2026 13:07:00 +0000 Subject: [PATCH] v1.31.2 --- .gitignore | 2 + README.md | 2 +- .../patches/nginx-1.31.1-systemd-notify.patch | 70 ----------- ...=> nginx-1.31.2-dynamic-tls-records.patch} | 0 .../patches/nginx-1.31.2-systemd-notify.patch | 117 ++++++++++++++++++ version | 2 +- 6 files changed, 121 insertions(+), 72 deletions(-) delete mode 100644 build/patches/nginx-1.31.1-systemd-notify.patch rename build/patches/{nginx-1.31.1-dynamic-tls-records.patch => nginx-1.31.2-dynamic-tls-records.patch} (100%) create mode 100644 build/patches/nginx-1.31.2-systemd-notify.patch diff --git a/.gitignore b/.gitignore index c047988..723e7bd 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,5 @@ PATCH_*.md CLAUDE.md GEMINI.md AGENTS.md +docs +docs/* diff --git a/README.md b/README.md index b855fdf..222f747 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ ![Simple](https://c.tenor.com/uYqsM9uIyuYAAAAC/simple-easy.gif) - [x] Debian 13 (trixie) and Ubuntu 26.04 LTS (raccoon) supported -- [x] nginx 1.31.1 +- [x] nginx 1.31.2 - [x] HTTP/3 (QUIC) via AWS-LC - [x] ModSecurity v3 (libmodsecurity) - [x] Naxsi diff --git a/build/patches/nginx-1.31.1-systemd-notify.patch b/build/patches/nginx-1.31.1-systemd-notify.patch deleted file mode 100644 index 46be61b..0000000 --- a/build/patches/nginx-1.31.1-systemd-notify.patch +++ /dev/null @@ -1,70 +0,0 @@ -Add sd_notify() integration to nginx master process so the systemd unit can -use Type=notify. nginx mainline ships #if (NGX_HAVE_SYSTEMD) guards in nothing -of its own — every distro carries its own patch. This is ours, kept minimal. - -Send: - READY=1 after workers + cache manager are spawned (master enters loop) - READY=1 again after a successful reconfigure - RELOADING=1 when reconfigure starts - STOPPING=1 in ngx_master_process_exit - -The build script provides -DNGX_HAVE_SYSTEMD and -lsystemd, so this patch -doesn't touch auto/ configure scripts — only the source. - ---- a/src/os/unix/ngx_process_cycle.c -+++ b/src/os/unix/ngx_process_cycle.c -@@ -12,6 +12,10 @@ - #include - - -+#if (NGX_HAVE_SYSTEMD) -+#include -+#endif -+ - static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n, - ngx_int_t type); - static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle, -@@ -132,6 +136,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle) - sigio = 0; - live = 1; - -+#if (NGX_HAVE_SYSTEMD) -+ sd_notify(0, "READY=1\nSTATUS=nginx is ready\n"); -+#endif -+ - for ( ;; ) { - if (delay) { - if (ngx_sigalrm) { -@@ -211,6 +219,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle) - if (ngx_reconfigure) { - ngx_reconfigure = 0; - -+#if (NGX_HAVE_SYSTEMD) -+ sd_notify(0, "RELOADING=1\nSTATUS=nginx is reloading\n"); -+#endif -+ - if (ngx_new_binary) { - ngx_start_worker_processes(cycle, ccf->worker_processes, - NGX_PROCESS_RESPAWN); -@@ -241,6 +253,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle) - live = 1; - ngx_signal_worker_processes(cycle, - ngx_signal_value(NGX_SHUTDOWN_SIGNAL)); -+ -+#if (NGX_HAVE_SYSTEMD) -+ sd_notify(0, "READY=1\nSTATUS=nginx is ready\n"); -+#endif - } - - if (ngx_restart) { -@@ -655,6 +671,10 @@ static void - ngx_master_process_exit(ngx_cycle_t *cycle) - { - ngx_uint_t i; -+ -+#if (NGX_HAVE_SYSTEMD) -+ sd_notify(0, "STOPPING=1\nSTATUS=nginx is stopping\n"); -+#endif - - ngx_delete_pidfile(cycle); - diff --git a/build/patches/nginx-1.31.1-dynamic-tls-records.patch b/build/patches/nginx-1.31.2-dynamic-tls-records.patch similarity index 100% rename from build/patches/nginx-1.31.1-dynamic-tls-records.patch rename to build/patches/nginx-1.31.2-dynamic-tls-records.patch diff --git a/build/patches/nginx-1.31.2-systemd-notify.patch b/build/patches/nginx-1.31.2-systemd-notify.patch new file mode 100644 index 0000000..abeb00a --- /dev/null +++ b/build/patches/nginx-1.31.2-systemd-notify.patch @@ -0,0 +1,117 @@ +Add sd_notify() integration to nginx master process so the systemd unit can +use Type=notify. nginx mainline ships #if (NGX_HAVE_SYSTEMD) guards in nothing +of its own — every distro carries its own patch. This is ours, kept minimal. + +Send: + READY=1 after workers + cache manager are spawned (master enters loop) + RELOADING=1 when reconfigure starts + READY=1 again on every exit from a reconfigure, so the unit never gets + stuck in "reloading": after a successful reconfigure, after a + binary-upgrade respawn (ngx_new_binary), AND after a FAILED + reload (ngx_init_cycle() returns NULL on a bad config — nginx + keeps the old config running, so we must report ready again or + `systemctl reload` hangs until timeout and is marked failed). + STOPPING=1 in ngx_master_process_exit + +Workers and the cache manager unset NOTIFY_SOCKET in ngx_worker_process_init() +so that only the master process can ever change the unit's state via sd_notify. + +The build script provides -DNGX_HAVE_SYSTEMD and -lsystemd, so this patch +doesn't touch auto/ configure scripts — only the source. + +--- a/src/os/unix/ngx_process_cycle.c ++++ b/src/os/unix/ngx_process_cycle.c +@@ -11,6 +11,10 @@ + #include + + ++#if (NGX_HAVE_SYSTEMD) ++#include ++#endif ++ + static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n, + ngx_int_t type); + static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle, +@@ -136,6 +140,10 @@ + sigio = 0; + live = 1; + ++#if (NGX_HAVE_SYSTEMD) ++ sd_notify(0, "READY=1\nSTATUS=nginx is ready\n"); ++#endif ++ + for ( ;; ) { + if (delay) { + if (ngx_sigalrm) { +@@ -211,12 +219,20 @@ + if (ngx_reconfigure) { + ngx_reconfigure = 0; + ++#if (NGX_HAVE_SYSTEMD) ++ sd_notify(0, "RELOADING=1\nSTATUS=nginx is reloading\n"); ++#endif ++ + if (ngx_new_binary) { + ngx_start_worker_processes(cycle, ccf->worker_processes, + NGX_PROCESS_RESPAWN); + ngx_start_cache_manager_processes(cycle, 0); + ngx_noaccepting = 0; + ++#if (NGX_HAVE_SYSTEMD) ++ sd_notify(0, "READY=1\nSTATUS=nginx is ready\n"); ++#endif ++ + continue; + } + +@@ -225,6 +241,11 @@ + cycle = ngx_init_cycle(cycle); + if (cycle == NULL) { + cycle = (ngx_cycle_t *) ngx_cycle; ++ ++#if (NGX_HAVE_SYSTEMD) ++ sd_notify(0, "READY=1\nSTATUS=nginx is ready\n"); ++#endif ++ + continue; + } + +@@ -241,6 +262,10 @@ + live = 1; + ngx_signal_worker_processes(cycle, + ngx_signal_value(NGX_SHUTDOWN_SIGNAL)); ++ ++#if (NGX_HAVE_SYSTEMD) ++ sd_notify(0, "READY=1\nSTATUS=nginx is ready\n"); ++#endif + } + + if (ngx_restart) { +@@ -657,6 +682,10 @@ + { + ngx_uint_t i; + ++#if (NGX_HAVE_SYSTEMD) ++ sd_notify(0, "STOPPING=1\nSTATUS=nginx is stopping\n"); ++#endif ++ + ngx_delete_pidfile(cycle); + + ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exit"); +@@ -765,6 +794,16 @@ + exit(2); + } + ++#if (NGX_HAVE_SYSTEMD) ++ /* ++ * only the master process talks to systemd via sd_notify(); drop the ++ * inherited notification socket so workers and the cache manager cannot ++ * change the unit's state. Done after ngx_set_environment() so it applies ++ * to the final environ regardless of any "env" directives. ++ */ ++ unsetenv("NOTIFY_SOCKET"); ++#endif ++ + ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module); + + if (worker >= 0 && ccf->priority != 0) { diff --git a/version b/version index 3627775..6837d5a 100644 --- a/version +++ b/version @@ -1,4 +1,4 @@ -export NGINX="1.31.1" +export NGINX="1.31.2" # Lua Path export LUA_SCRIPTS="/usr/nginx_lua"