v1.31.2

.gitignore

@@ -20,3 +20,5 @@ PATCH_*.md
 CLAUDE.md
 GEMINI.md
 AGENTS.md
+docs
+docs/*

README.md

@@ -3,7 +3,7 @@
 ![Simple](https://c.tenor.com/uYqsM9uIyuYAAAAC/simple-easy.gif)
 
 - [x] Debian 13 (trixie) and Ubuntu 26.04 LTS (raccoon) supported
-- [x] nginx 1.31.1
+- [x] nginx 1.31.2
 - [x] HTTP/3 (QUIC) via AWS-LC
 - [x] ModSecurity v3 (libmodsecurity)
 - [x] Naxsi

build/patches/nginx-1.31.1-systemd-notify.patch

@@ -1,70 +0,0 @@
-Add sd_notify() integration to nginx master process so the systemd unit can
-use Type=notify. nginx mainline ships #if (NGX_HAVE_SYSTEMD) guards in nothing
-of its own — every distro carries its own patch. This is ours, kept minimal.
-
-Send:
-  READY=1     after workers + cache manager are spawned (master enters loop)
-  READY=1     again after a successful reconfigure
-  RELOADING=1 when reconfigure starts
-  STOPPING=1  in ngx_master_process_exit
-
-The build script provides -DNGX_HAVE_SYSTEMD and -lsystemd, so this patch
-doesn't touch auto/ configure scripts — only the source.
-
---- a/src/os/unix/ngx_process_cycle.c
-+++ b/src/os/unix/ngx_process_cycle.c
-@@ -12,6 +12,10 @@
- #include <ngx_channel.h>
-
-
-+#if (NGX_HAVE_SYSTEMD)
-+#include <systemd/sd-daemon.h>
-+#endif
-+
- static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n,
-     ngx_int_t type);
- static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle,
-@@ -132,6 +136,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
-     sigio = 0;
-     live = 1;
-
-+#if (NGX_HAVE_SYSTEMD)
-+    sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
-+#endif
-+
-     for ( ;; ) {
-         if (delay) {
-             if (ngx_sigalrm) {
-@@ -211,6 +219,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
-         if (ngx_reconfigure) {
-             ngx_reconfigure = 0;
-
-+#if (NGX_HAVE_SYSTEMD)
-+            sd_notify(0, "RELOADING=1\nSTATUS=nginx is reloading\n");
-+#endif
-+
-             if (ngx_new_binary) {
-                 ngx_start_worker_processes(cycle, ccf->worker_processes,
-                                            NGX_PROCESS_RESPAWN);
-@@ -241,6 +253,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
-             live = 1;
-             ngx_signal_worker_processes(cycle,
-                                         ngx_signal_value(NGX_SHUTDOWN_SIGNAL));
-+
-+#if (NGX_HAVE_SYSTEMD)
-+            sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
-+#endif
-         }
-
-         if (ngx_restart) {
-@@ -655,6 +671,10 @@ static void
- ngx_master_process_exit(ngx_cycle_t *cycle)
- {
-     ngx_uint_t  i;
-+
-+#if (NGX_HAVE_SYSTEMD)
-+    sd_notify(0, "STOPPING=1\nSTATUS=nginx is stopping\n");
-+#endif
-
-     ngx_delete_pidfile(cycle);
-

build/patches/nginx-1.31.2-systemd-notify.patch

@@ -0,0 +1,117 @@
+Add sd_notify() integration to nginx master process so the systemd unit can
+use Type=notify. nginx mainline ships #if (NGX_HAVE_SYSTEMD) guards in nothing
+of its own — every distro carries its own patch. This is ours, kept minimal.
+
+Send:
+  READY=1     after workers + cache manager are spawned (master enters loop)
+  RELOADING=1 when reconfigure starts
+  READY=1     again on every exit from a reconfigure, so the unit never gets
+              stuck in "reloading": after a successful reconfigure, after a
+              binary-upgrade respawn (ngx_new_binary), AND after a FAILED
+              reload (ngx_init_cycle() returns NULL on a bad config — nginx
+              keeps the old config running, so we must report ready again or
+              `systemctl reload` hangs until timeout and is marked failed).
+  STOPPING=1  in ngx_master_process_exit
+
+Workers and the cache manager unset NOTIFY_SOCKET in ngx_worker_process_init()
+so that only the master process can ever change the unit's state via sd_notify.
+
+The build script provides -DNGX_HAVE_SYSTEMD and -lsystemd, so this patch
+doesn't touch auto/ configure scripts — only the source.
+
+--- a/src/os/unix/ngx_process_cycle.c
++++ b/src/os/unix/ngx_process_cycle.c
+@@ -11,6 +11,10 @@
+ #include <ngx_channel.h>
+
+
++#if (NGX_HAVE_SYSTEMD)
++#include <systemd/sd-daemon.h>
++#endif
++
+ static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n,
+     ngx_int_t type);
+ static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle,
+@@ -136,6 +140,10 @@
+     sigio = 0;
+     live = 1;
+
++#if (NGX_HAVE_SYSTEMD)
++    sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
++#endif
++
+     for ( ;; ) {
+         if (delay) {
+             if (ngx_sigalrm) {
+@@ -211,12 +219,20 @@
+         if (ngx_reconfigure) {
+             ngx_reconfigure = 0;
+
++#if (NGX_HAVE_SYSTEMD)
++            sd_notify(0, "RELOADING=1\nSTATUS=nginx is reloading\n");
++#endif
++
+             if (ngx_new_binary) {
+                 ngx_start_worker_processes(cycle, ccf->worker_processes,
+                                            NGX_PROCESS_RESPAWN);
+                 ngx_start_cache_manager_processes(cycle, 0);
+                 ngx_noaccepting = 0;
+
++#if (NGX_HAVE_SYSTEMD)
++                sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
++#endif
++
+                 continue;
+             }
+
+@@ -225,6 +241,11 @@
+             cycle = ngx_init_cycle(cycle);
+             if (cycle == NULL) {
+                 cycle = (ngx_cycle_t *) ngx_cycle;
++
++#if (NGX_HAVE_SYSTEMD)
++                sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
++#endif
++
+                 continue;
+             }
+
+@@ -241,6 +262,10 @@
+             live = 1;
+             ngx_signal_worker_processes(cycle,
+                                         ngx_signal_value(NGX_SHUTDOWN_SIGNAL));
++
++#if (NGX_HAVE_SYSTEMD)
++            sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
++#endif
+         }
+
+         if (ngx_restart) {
+@@ -657,6 +682,10 @@
+ {
+     ngx_uint_t  i;
+
++#if (NGX_HAVE_SYSTEMD)
++    sd_notify(0, "STOPPING=1\nSTATUS=nginx is stopping\n");
++#endif
++
+     ngx_delete_pidfile(cycle);
+
+     ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exit");
+@@ -765,6 +794,16 @@
+         exit(2);
+     }
+
++#if (NGX_HAVE_SYSTEMD)
++    /*
++     * only the master process talks to systemd via sd_notify(); drop the
++     * inherited notification socket so workers and the cache manager cannot
++     * change the unit's state. Done after ngx_set_environment() so it applies
++     * to the final environ regardless of any "env" directives.
++     */
++    unsetenv("NOTIFY_SOCKET");
++#endif
++
+     ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
+
+     if (worker >= 0 && ccf->priority != 0) {

version

@@ -1,4 +1,4 @@
-export NGINX="1.31.1"
+export NGINX="1.31.2"
 
 # Lua Path
 export LUA_SCRIPTS="/usr/nginx_lua"