- nginx 1.30.0, ModSecurity v3.0.12, AWS-LC 1.72.0 (replaces
quictls/openssl 3.1.5-quic1; OpenSSL 3.1 is EOL upstream)
- AWS-LC build via cmake+ninja, installed to /usr/local/aws-lc;
nginx links via -I/-L and rpath
- lua-nginx-module: sed-broaden the existing OPENSSL_IS_BORINGSSL
guards to also recognise OPENSSL_IS_AWSLC (covers #ifdef,
#ifndef, #elif defined). without this the missing-API stubs
never fire on AWS-LC and the build breaks on
SSL_get1_supported_ciphers / SSL_export_keying_material_early
- lua-resty-core / lrucache: switched from `git clone master`
to wget tarball pinned via LUA_SCRIPTS_RESTYCORE/LRUCACHE.
master drifted to wanting ngx_lua 0.10.30 while the pin was
0.10.29 — silent CI breakage waiting to happen
- ModSec rewritten for v3 build flow (./build.sh && ./configure
--without-pcre --with-pcre2). v2's standalone.so isn't what
ModSecurity-nginx connector links against; it wants
libmodsecurity.so
- PCRE2: switched to /releases/download/ tarball (bundles the
sljit submodule needed for --with-pcre-jit); /archive/refs/tags/
is a raw snapshot and omits submodules
- LuaJIT version pin had a stray leading 'v' that produced
/tags/vv2.1-... → 404
- drop -L/lib/x86_64-linux-gnu -lpcre from --with-ld-opt;
PCRE1 is gone from debian 13
- drop libpcre3-dev from apt install for the same reason
- fix latent bug in build/run.sh build(): make && make install
&& make clean swallows make failures from set -e because of
&&-chain semantics. now separate statements
- static/nginx/nginx.conf rewrite for shared hosting at 5k+
vhosts: server_names_hash_max_size 32768, shared SSL session
cache 200m, OCSP stapling, open_file_cache, brotli+gzip
enabled in http{}, worker_cpu_affinity auto, max_headers 100,
keepalive_requests 10000. client_header_buffer_size dropped
from 2M to 4k (was a memory amplification surface)
- README: performance section comparing twiy vs vanilla nginx,
OpenResty, Apache; expected yield breakdown
root