package update

.gitea/workflows/build-publish.yml

@@ -15,130 +15,132 @@ jobs:
         include:
           - target: trixie
             image: debian:13
+            distro_dir: Trixie
             nexus_repo_secret: NEXUS_REPO_TRIXIE
+            nexus_user_secret: NEXUS_USER_TRIXIE
+            nexus_pass_secret: NEXUS_PASS_TRIXIE
           - target: raccoon
             image: ubuntu:26.04
+            distro_dir: Raccoon
             nexus_repo_secret: NEXUS_REPO_RACCOON
+            nexus_user_secret: NEXUS_USER_RACCOON
+            nexus_pass_secret: NEXUS_PASS_RACCOON
+
+    container:
+      image: ${{ matrix.image }}
 
     steps:
-      - name: Checkout source
+      - name: Bootstrap
+        run: |
+          apt-get update -qq
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            git ca-certificates nodejs
+
+      - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build nginx and assemble .deb inside ${{ matrix.image }}
+      - name: Build
         id: pkg
         env:
           TARGET: ${{ matrix.target }}
-          IMAGE:  ${{ matrix.image }}
+          DISTRO_DIR: ${{ matrix.distro_dir }}
         run: |
           set -euo pipefail
-          mkdir -p dist
-          sudo docker run --rm \
-            -v "$PWD:/repo" \
-            -w /repo \
-            -e TARGET="$TARGET" \
-            "$IMAGE" \
-            bash -euxc '
+          REPO_ROOT="$PWD"   # captured before any cd in the build script
           touch /.dockerenv
           bash build/${TARGET}.sh new
           bash build/${TARGET}.sh build
           bash build/${TARGET}.sh postfix
 
-              PKG_NAME="twiy"
-              NGINX_VER="$(nginx -v 2>&1 | awk -F/ "{print \$2}")"
+          NGINX_VER="$(nginx -v 2>&1 | awk -F/ '{print $2}')"
           VERSION="${NGINX_VER}-${GITHUB_RUN_NUMBER:-1}~${TARGET}"
           ARCH="amd64"
-              PKG_DIR="/opt/${PKG_NAME}_${VERSION}_${ARCH}"
-              DEB_DIR="${PKG_DIR}/DEBIAN"
-              mkdir -p "${PKG_DIR}/usr/sbin" "${PKG_DIR}/nginx" \
-                       "${PKG_DIR}/etc/systemd/system" "${PKG_DIR}/var/log/nginx" \
-                       "${PKG_DIR}/usr/lib" "${PKG_DIR}/usr/local/lib" \
-                       "${PKG_DIR}/hostdata/default/public_html" \
-                       "${PKG_DIR}/usr/nginx_lua" \
-                       "${PKG_DIR}/usr/local/nginx/client_body_temp" \
-                       "${PKG_DIR}/usr/local/nginx/proxy_temp" \
-                       "${PKG_DIR}/usr/local/nginx/fastcgi_temp" \
-                       "${PKG_DIR}/usr/local/nginx/uwsgi_temp" \
-                       "${PKG_DIR}/usr/local/nginx/scgi_temp"
 
-              cp /usr/sbin/nginx "${PKG_DIR}/usr/sbin/"
-              cp -R /nginx/* "${PKG_DIR}/nginx/" || true
-              cp /etc/systemd/system/nginx.service "${PKG_DIR}/etc/systemd/system/"
-              cp -R /hostdata/default "${PKG_DIR}/hostdata/" || true
-              cp -R /usr/nginx_lua "${PKG_DIR}/usr/" || true
-              for lib in $(ldd /usr/sbin/nginx | grep "=> /" | awk "{print \$3}"); do
-                cp "$lib" "${PKG_DIR}/usr/lib/" || true
+          assemble_deb() {
+              local pkg_name="$1" unit_src="$2" conflicts="$3"
+              local pkg_dir="/opt/${pkg_name}_${VERSION}_${ARCH}"
+              local deb_dir="${pkg_dir}/DEBIAN"
+
+              mkdir -p "${pkg_dir}/usr/sbin" \
+                       "${pkg_dir}/etc/systemd/system" \
+                       "${pkg_dir}/usr/lib" \
+                       "${pkg_dir}/usr/nginx_lua" \
+                       "${pkg_dir}/usr/share/twiy/defaults/nginx" \
+                       "${pkg_dir}/nginx/live" "${pkg_dir}/nginx/conf.d" \
+                       "${pkg_dir}/nginx/config" "${pkg_dir}/nginx/modsec" \
+                       "${pkg_dir}/nginx/modules"
+
+              cp /usr/sbin/nginx "${pkg_dir}/usr/sbin/"
+              # /nginx ships as an EMPTY, dpkg-owned skeleton (above): the dirs
+              # are tracked so upgrades from the old layout don't warn about
+              # "unable to delete old directory /nginx", but NO config file under
+              # it is tracked. The pristine configs go into a defaults stash;
+              # postinst places them into /nginx only when missing and never
+              # overwrites an admin-edited file (drops <file>.new instead).
+              # /hostdata is intentionally NOT packaged or seeded — postinst only
+              # ensures the directory exists and never removes it.
+              cp -R /nginx/. "${pkg_dir}/usr/share/twiy/defaults/nginx/" || true
+              cp "${unit_src}"  "${pkg_dir}/etc/systemd/system/nginx.service"
+              cp -R /usr/nginx_lua "${pkg_dir}/usr/" || true
+
+              for d in /usr/local/aws-lc /usr/local/LuaJIT /usr/local/modsecurity /usr/local/zlib-ng; do
+                  [ -d "$d" ] && cp -R "$d" "${pkg_dir}/usr/local/" || true
               done
-              # ---- DEBIAN/control --------------------------------------------
-              mkdir -p "${DEB_DIR}"
-              cat > "${DEB_DIR}/control" <<EOF
-              Package: ${PKG_NAME}
-              Version: ${VERSION}
-              Section: base
-              Priority: optional
-              Architecture: ${ARCH}
-              Depends: libjemalloc2
-              Maintainer: Julio <me@julio.al>
-              Description: Nginx L7 DDoS Protection (The-World-Is-Yours), built by RAWeb CI for ${TARGET}.
-              EOF
+              mkdir -p "${pkg_dir}/usr/local/lib"
+              cp -R /usr/local/lib/. "${pkg_dir}/usr/local/lib/" 2>/dev/null || true
 
-              # ---- DEBIAN/postinst -------------------------------------------
-              cat > "${DEB_DIR}/postinst" <<"EOFPOSTINST"
-              #!/bin/bash
-              # Idempotent: safe on first install, upgrade, and reinstall.
-              useradd -r -d /usr/local/nginx -s /bin/false nginx 2>/dev/null || true
-              install -d -o nginx -g nginx -m 0755 \
-                /usr/local/nginx \
-                /usr/local/nginx/client_body_temp \
-                /usr/local/nginx/proxy_temp \
-                /usr/local/nginx/fastcgi_temp \
-                /usr/local/nginx/uwsgi_temp \
-                /usr/local/nginx/scgi_temp \
-                /var/log/nginx
-              chown -R nginx:nginx /var/log/nginx /nginx /usr/local/nginx 2>/dev/null || true
-              systemctl daemon-reload 2>/dev/null || true
-              systemctl enable nginx.service 2>/dev/null || true
-              systemctl restart nginx.service 2>/dev/null || true
-              exit 0
-              EOFPOSTINST
-              chmod 755 "${DEB_DIR}/postinst"
+              for lib in $(ldd /usr/sbin/nginx | grep '=> /' | awk '{print $3}'); do
+                  case "$lib" in /usr/local/*) continue ;; esac
+                  cp "$lib" "${pkg_dir}/usr/lib/" || true
+              done
 
-              dpkg-deb --build "${PKG_DIR}"
-              cp "${PKG_DIR}.deb" /repo/dist/
+              mkdir -p "${deb_dir}"
+              printf 'Package: %s\nVersion: %s\nSection: base\nPriority: optional\nArchitecture: %s\nDepends: libjemalloc2, libsystemd0\nConflicts: %s\nReplaces: %s\nMaintainer: Julio <me@julio.al>\nDescription: Nginx L7 DDoS Protection (%s), built by RAWeb CI for %s.\n' \
+                  "${pkg_name}" "${VERSION}" "${ARCH}" "${conflicts}" "${conflicts}" "${pkg_name}" "${TARGET}" \
+                  > "${deb_dir}/control"
 
-              # Hand ownership back to the runner UID so the host job can read.
-              chown $(stat -c "%u:%g" /repo) /repo/dist/$(basename "${PKG_DIR}.deb")
+              # Shared maintainer scripts:
+              #   preinst  — backs up /nginx before an upgrade unpacks (so admin
+              #              configs survive the migration off dpkg tracking).
+              #   postinst — restores that backup, then seeds /nginx defaults
+              #              without overwriting any file already there.
+              cp "${REPO_ROOT}/build/deb/preinst"  "${deb_dir}/preinst"
+              cp "${REPO_ROOT}/build/deb/postinst" "${deb_dir}/postinst"
+              chmod 755 "${deb_dir}/preinst" "${deb_dir}/postinst"
 
-              # Stash version for the publish step.
-              echo "${PKG_NAME}_${VERSION}_${ARCH}.deb" > /repo/dist/${TARGET}.name
-              echo "${VERSION}"                          > /repo/dist/${TARGET}.version
-              echo "${PKG_NAME}"                         > /repo/dist/${TARGET}.pkg
-            '
+              dpkg-deb --build "${pkg_dir}"
+          }
+
+          assemble_deb "twiy"       "${REPO_ROOT}/static/${DISTRO_DIR}/nginx.service"       "twiy-raweb"
+          assemble_deb "twiy-raweb" "${REPO_ROOT}/static/${DISTRO_DIR}/nginx-raweb.service" "twiy"
+
+          DEB_TWIY="/opt/twiy_${VERSION}_${ARCH}.deb"
+          DEB_RAWEB="/opt/twiy-raweb_${VERSION}_${ARCH}.deb"
 
-          # Surface the artifact paths for the next step.
-          DEB_FILE="$PWD/dist/$(cat dist/${TARGET}.name)"
-          PKG_NAME="$(cat dist/${TARGET}.pkg)"
-          VERSION="$(cat dist/${TARGET}.version)"
           {
-            echo "deb_file=${DEB_FILE}"
+              echo "deb_twiy=${DEB_TWIY}"
+              echo "deb_raweb=${DEB_RAWEB}"
               echo "version=${VERSION}"
-            echo "pkg_name=${PKG_NAME}"
           } >> "$GITHUB_OUTPUT"
 
-          ls -la "${DEB_FILE}"
-          sha256sum "${DEB_FILE}"
-      - name: Publish to Nexus (${{ matrix.target }})
+          ls -la /opt/twiy*.deb
+          sha256sum /opt/twiy*.deb
+
+      - name: Publish
         env:
-          NEXUS_USER: ${{ secrets.NEXUS_USER }}
-          NEXUS_PASS: ${{ secrets.NEXUS_PASS }}
+          NEXUS_USER: ${{ secrets[matrix.nexus_user_secret] }}
+          NEXUS_PASS: ${{ secrets[matrix.nexus_pass_secret] }}
           NEXUS_URL:  ${{ secrets.NEXUS_URL }}
           NEXUS_REPO: ${{ secrets[matrix.nexus_repo_secret] }}
-          DEB_FILE:   ${{ steps.pkg.outputs.deb_file }}
-          PKG_NAME:   ${{ steps.pkg.outputs.pkg_name }}
+          DEB_TWIY:   ${{ steps.pkg.outputs.deb_twiy }}
+          DEB_RAWEB:  ${{ steps.pkg.outputs.deb_raweb }}
           TARGET:     ${{ matrix.target }}
         run: |
           set -euo pipefail
           umask 077
 
+          apt-get install -y -q --no-install-recommends curl python3 ca-certificates >/dev/null
+
           SECDIR="$(mktemp -d -p /dev/shm twiy-XXXXXXXX 2>/dev/null \
                     || mktemp -d -t twiy-XXXXXXXX)"
           chmod 700 "$SECDIR"
@@ -152,24 +154,34 @@ jobs:
           printf 'machine %s login %s password %s\n' \
                  "$NEXUS_HOST" "$NEXUS_USER" "$NEXUS_PASS" > "$SECDIR/netrc"
           unset NEXUS_USER NEXUS_PASS
-          OLD_ID="$(curl -fsS --netrc-file "$SECDIR/netrc" \
+
+          publish_one() {
+              local deb="$1" pkg_name="$2"
+
+              local old_id
+              old_id="$(curl -fsS --netrc-file "$SECDIR/netrc" \
                         "$NEXUS_URL/service/rest/v1/components?repository=$NEXUS_REPO" \
-                    | PKG_NAME="$PKG_NAME" python3 -c '
+                        | PKG_NAME="$pkg_name" python3 -c '
           import sys, json, os
           for c in json.load(sys.stdin).get("items", []):
               if c.get("name") == os.environ["PKG_NAME"]:
                   print(c["id"]); break
           ' || true)"
-          if [ -n "$OLD_ID" ]; then
+              if [ -n "$old_id" ]; then
                   curl -fsS -X DELETE --netrc-file "$SECDIR/netrc" \
-                 "$NEXUS_URL/service/rest/v1/components/$OLD_ID" -o /dev/null
+                       "$NEXUS_URL/service/rest/v1/components/$old_id" -o /dev/null
               fi
 
-          HTTP="$(curl -sS --netrc-file "$SECDIR/netrc" \
+              local http
+              http="$(curl -sS --netrc-file "$SECDIR/netrc" \
                       -o "$SECDIR/upload.body" -w '%{http_code}' \
-                  -X POST -F "apt.asset=@$DEB_FILE" \
+                      -X POST -F "apt.asset=@$deb" \
                       "$NEXUS_URL/service/rest/v1/components?repository=$NEXUS_REPO")"
-          case "$HTTP" in
-            201|204) echo "[$TARGET] uploaded $(basename "$DEB_FILE") to $NEXUS_URL/repository/$NEXUS_REPO/" ;;
-            *) echo "[$TARGET] upload failed (HTTP $HTTP)"; head -c 400 "$SECDIR/upload.body"; exit 1 ;;
+              case "$http" in
+                  201|204) echo "[$TARGET] uploaded $(basename "$deb")" ;;
+                  *) echo "[$TARGET] upload failed for $pkg_name (HTTP $http)"; cat "$SECDIR/upload.body"; exit 1 ;;
               esac
+          }
+
+          publish_one "$DEB_TWIY"  "twiy"
+          publish_one "$DEB_RAWEB" "twiy-raweb"

.gitignore

@@ -1,10 +1,22 @@
-.claude/
+.claude
 .codex
 .env
 .creds
 .workers
 .local
+.pi
+.gemini
+.cargo
+.claude.json
+.copilot
+.docker
+.grok
+.ollama
 Dockerfile
 docker-compose.yaml
 docker-compose.yml
 PENDING_*.md
+PATCH_*.md
+CLAUDE.md
+GEMINI.md
+AGENTS.md

README.md

@@ -3,7 +3,7 @@
 ![Simple](https://c.tenor.com/uYqsM9uIyuYAAAAC/simple-easy.gif)
 
 - [x] Debian 13 (trixie) and Ubuntu 26.04 LTS (raccoon) supported
-- [x] nginx 1.30.0
+- [x] nginx 1.31.1
 - [x] HTTP/3 (QUIC) via AWS-LC
 - [x] ModSecurity v3 (libmodsecurity)
 - [x] Naxsi
@@ -11,8 +11,6 @@
 - [x] Cookie-based challenge
 - [x] [Versions List](https://git.julio.al/theraw/The-World-Is-Yours/src/branch/master/version)
 
-## Easy install
-
 ### Debian 13 (trixie)
 ```bash
 sudo install -d /etc/apt/keyrings
@@ -29,10 +27,7 @@ echo "deb [signed-by=/etc/apt/keyrings/raweb.asc] https://apt.julio.al/repositor
 sudo apt update && sudo apt install twiy
 ```
 
-## Compile from source
-
-Pick the script that matches your OS — they're separate so apt package
-divergences (e.g. the t64 ABI transition on Ubuntu 24.04+) stay isolated.
+## Compile from source by yourself.
 
 ```bash
 apt-get -y install git && cd /root/ && git clone https://git.julio.al/theraw/The-World-Is-Yours.git && cd The-World-Is-Yours/

build/deb/postinst

@@ -0,0 +1,58 @@
+#!/bin/sh
+# postinst — shared by the twiy and twiy-raweb packages.
+#
+# Config files live under /nginx but are NOT tracked by dpkg. The package
+# ships an empty /nginx skeleton (so dpkg keeps the dirs across upgrades) plus
+# a pristine copy of every config under /usr/share/twiy/defaults/nginx. We
+# place configs from that stash here and NEVER overwrite a file that already
+# exists — our copy is dropped beside it as <file>.new instead (e.g.
+# nginx.conf.new). An upgrade therefore never changes an admin-edited config.
+#
+# /hostdata is left entirely to the admin: we only make sure the dir exists,
+# and we never touch or remove its contents.
+
+set -e
+
+useradd -r -s /bin/false nginx 2>/dev/null || true
+
+# Existing dirs are left exactly as they are (mkdir -p is a no-op then).
+mkdir -p /nginx /hostdata
+
+# Migration: older releases shipped /nginx/* as dpkg-tracked files, so the
+# upgrade unpack deletes them before this script runs. preinst stashed a copy
+# first — restore it now, without clobbering anything already present.
+if [ -d /var/backups/twiy-nginx ]; then
+    cp -an /var/backups/twiy-nginx/. /nginx/ 2>/dev/null || true
+    rm -rf /var/backups/twiy-nginx
+fi
+
+# Seed packaged defaults:
+#   - target absent          -> install it
+#   - target present, differs -> keep theirs, drop ours as <file>.new
+#   - target present, same    -> do nothing
+seed_tree() {
+    stash="$1"
+    target="$2"
+    [ -d "$stash" ] || return 0
+    find "$stash" -type f | while IFS= read -r src; do
+        rel=${src#$stash/}
+        dst="$target/$rel"
+        install -d "$(dirname "$dst")"
+        if [ -e "$dst" ]; then
+            cmp -s "$src" "$dst" || cp -p "$src" "$dst.new"
+        else
+            cp -p "$src" "$dst"
+        fi
+    done
+}
+seed_tree /usr/share/twiy/defaults/nginx /nginx
+
+install -d /nginx/conf.d /nginx/config
+install -d -o nginx -g nginx -m 0755 /var/log/nginx
+chown -R nginx:nginx /var/log/nginx /nginx 2>/dev/null || true
+
+systemctl daemon-reload  2>/dev/null || true
+systemctl enable  nginx.service 2>/dev/null || true
+systemctl restart nginx.service 2>/dev/null || true
+
+exit 0

build/deb/preinst

@@ -0,0 +1,18 @@
+#!/bin/sh
+# preinst — shared by the twiy and twiy-raweb packages.
+#
+# Older releases shipped /nginx as dpkg-tracked files. When upgrading from one
+# of those, dpkg deletes the old /nginx/* files during unpack (they are no
+# longer part of the package) BEFORE postinst runs. Stash a copy of the live
+# config tree first so postinst can restore any admin-edited config and it
+# survives the migration. Never touched on a fresh install.
+
+set -e
+
+if [ "$1" = upgrade ] && [ -d /nginx ]; then
+    rm -rf /var/backups/twiy-nginx
+    mkdir -p /var/backups
+    cp -a /nginx /var/backups/twiy-nginx
+fi
+
+exit 0

build/patches/nginx-1.31.1-dynamic-tls-records.patch

@@ -0,0 +1,220 @@
+diff -urN nginx-1.31.0-pristine2/src/event/ngx_event_openssl.c nginx-1.31.0-manual/src/event/ngx_event_openssl.c
+--- nginx-1.31.0-pristine2/src/event/ngx_event_openssl.c	2026-05-15 13:37:51.446080719 +0000
++++ nginx-1.31.0-manual/src/event/ngx_event_openssl.c	2026-05-15 13:38:11.254620535 +0000
+@@ -2115,6 +2115,7 @@
+ 
+     sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
+     sc->buffer_size = ssl->buffer_size;
++    sc->dyn_rec = ssl->dyn_rec;
+ 
+     sc->session_ctx = ssl->ctx;
+ 
+@@ -3086,6 +3087,41 @@
+ 
+     for ( ;; ) {
+ 
++        /* Dynamic record resizing:
++           We want the initial records to fit into one TCP segment
++           so we don't get TCP HoL blocking due to TCP Slow Start.
++           A connection always starts with small records, but after
++           a given amount of records sent, we make the records larger
++           to reduce header overhead.
++           After a connection has idled for a given timeout, begin
++           the process from the start. The actual parameters are
++           configurable. If dyn_rec_timeout is 0, we assume dyn_rec is off. */
++
++        if (c->ssl->dyn_rec.timeout > 0 ) {
++
++            if (ngx_current_msec - c->ssl->dyn_rec_last_write >
++                c->ssl->dyn_rec.timeout)
++            {
++                buf->end = buf->start + c->ssl->dyn_rec.size_lo;
++                c->ssl->dyn_rec_records_sent = 0;
++
++            } else {
++                if (c->ssl->dyn_rec_records_sent >
++                    c->ssl->dyn_rec.threshold * 2)
++                {
++                    buf->end = buf->start + c->ssl->buffer_size;
++
++                } else if (c->ssl->dyn_rec_records_sent >
++                           c->ssl->dyn_rec.threshold)
++                {
++                    buf->end = buf->start + c->ssl->dyn_rec.size_hi;
++
++                } else {
++                    buf->end = buf->start + c->ssl->dyn_rec.size_lo;
++                }
++            }
++        }
++
+         while (in && buf->last < buf->end && send < limit) {
+             if (in->buf->last_buf || in->buf->flush) {
+                 flush = 1;
+@@ -3225,6 +3261,9 @@
+ 
+     if (n > 0) {
+ 
++        c->ssl->dyn_rec_records_sent++;
++        c->ssl->dyn_rec_last_write = ngx_current_msec;
++
+         if (c->ssl->saved_read_handler) {
+ 
+             c->read->handler = c->ssl->saved_read_handler;
+diff -urN nginx-1.31.0-pristine2/src/event/ngx_event_openssl.h nginx-1.31.0-manual/src/event/ngx_event_openssl.h
+--- nginx-1.31.0-pristine2/src/event/ngx_event_openssl.h	2026-05-15 13:37:51.446142384 +0000
++++ nginx-1.31.0-manual/src/event/ngx_event_openssl.h	2026-05-15 13:38:11.246599371 +0000
+@@ -101,10 +101,19 @@
+ typedef struct ngx_ssl_ocsp_s   ngx_ssl_ocsp_t;
+ 
+ 
++typedef struct {
++    ngx_msec_t                  timeout;
++    ngx_uint_t                  threshold;
++    size_t                      size_lo;
++    size_t                      size_hi;
++} ngx_ssl_dyn_rec_t;
++
++
+ struct ngx_ssl_s {
+     SSL_CTX                    *ctx;
+     ngx_log_t                  *log;
+     size_t                      buffer_size;
++    ngx_ssl_dyn_rec_t           dyn_rec;
+ 
+     ngx_array_t                 certs;
+ 
+@@ -142,6 +151,10 @@
+     unsigned                    no_send_shutdown:1;
+     unsigned                    shutdown_without_free:1;
+     unsigned                    handshake_buffer_set:1;
++
++    ngx_ssl_dyn_rec_t           dyn_rec;
++    ngx_msec_t                  dyn_rec_last_write;
++    ngx_uint_t                  dyn_rec_records_sent;
+     unsigned                    session_timeout_set:1;
+     unsigned                    try_early_data:1;
+     unsigned                    in_early:1;
+diff -urN nginx-1.31.0-pristine2/src/http/modules/ngx_http_ssl_module.c nginx-1.31.0-manual/src/http/modules/ngx_http_ssl_module.c
+--- nginx-1.31.0-pristine2/src/http/modules/ngx_http_ssl_module.c	2026-05-15 13:37:51.444851287 +0000
++++ nginx-1.31.0-manual/src/http/modules/ngx_http_ssl_module.c	2026-05-15 13:38:11.254833775 +0000
+@@ -313,6 +313,41 @@
+       offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
+       NULL },
+ 
++    { ngx_string("ssl_dyn_rec_enable"),
++      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
++      ngx_conf_set_flag_slot,
++      NGX_HTTP_SRV_CONF_OFFSET,
++      offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_enable),
++      NULL },
++
++    { ngx_string("ssl_dyn_rec_timeout"),
++      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
++      ngx_conf_set_msec_slot,
++      NGX_HTTP_SRV_CONF_OFFSET,
++      offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_timeout),
++      NULL },
++
++    { ngx_string("ssl_dyn_rec_size_lo"),
++      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
++      ngx_conf_set_size_slot,
++      NGX_HTTP_SRV_CONF_OFFSET,
++      offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_size_lo),
++      NULL },
++
++    { ngx_string("ssl_dyn_rec_size_hi"),
++      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
++      ngx_conf_set_size_slot,
++      NGX_HTTP_SRV_CONF_OFFSET,
++      offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_size_hi),
++      NULL },
++
++    { ngx_string("ssl_dyn_rec_threshold"),
++      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
++      ngx_conf_set_num_slot,
++      NGX_HTTP_SRV_CONF_OFFSET,
++      offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_threshold),
++      NULL },
++
+       ngx_null_command
+ };
+ 
+@@ -668,6 +703,11 @@
+     sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR;
+     sscf->stapling = NGX_CONF_UNSET;
+     sscf->stapling_verify = NGX_CONF_UNSET;
++    sscf->dyn_rec_enable = NGX_CONF_UNSET;
++    sscf->dyn_rec_timeout = NGX_CONF_UNSET_MSEC;
++    sscf->dyn_rec_size_lo = NGX_CONF_UNSET_SIZE;
++    sscf->dyn_rec_size_hi = NGX_CONF_UNSET_SIZE;
++    sscf->dyn_rec_threshold = NGX_CONF_UNSET_UINT;
+ 
+     return sscf;
+ }
+@@ -739,6 +779,20 @@
+     ngx_conf_merge_str_value(conf->stapling_responder,
+                          prev->stapling_responder, "");
+ 
++    ngx_conf_merge_value(conf->dyn_rec_enable, prev->dyn_rec_enable, 0);
++    ngx_conf_merge_msec_value(conf->dyn_rec_timeout, prev->dyn_rec_timeout,
++                             1000);
++    /* Default sizes for the dynamic record sizes are defined to fit maximal
++       TLS + IPv6 overhead in a single TCP segment for lo and 3 segments for hi:
++       1369 = 1500 - 40 (IP) - 20 (TCP) - 10 (Time) - 61 (Max TLS overhead) */
++    ngx_conf_merge_size_value(conf->dyn_rec_size_lo, prev->dyn_rec_size_lo,
++                             1369);
++    /* 4229 = (1500 - 40 - 20 - 10) * 3  - 61 */
++    ngx_conf_merge_size_value(conf->dyn_rec_size_hi, prev->dyn_rec_size_hi,
++                             4229);
++    ngx_conf_merge_uint_value(conf->dyn_rec_threshold, prev->dyn_rec_threshold,
++                             40);
++
+     conf->ssl.log = cf->log;
+ 
+     if (conf->certificates) {
+@@ -962,6 +1016,28 @@
+         return NGX_CONF_ERROR;
+     }
+ 
++    if (conf->dyn_rec_enable) {
++        conf->ssl.dyn_rec.timeout = conf->dyn_rec_timeout;
++        conf->ssl.dyn_rec.threshold = conf->dyn_rec_threshold;
++
++        if (conf->buffer_size > conf->dyn_rec_size_lo) {
++            conf->ssl.dyn_rec.size_lo = conf->dyn_rec_size_lo;
++
++        } else {
++            conf->ssl.dyn_rec.size_lo = conf->buffer_size;
++        }
++
++        if (conf->buffer_size > conf->dyn_rec_size_hi) {
++            conf->ssl.dyn_rec.size_hi = conf->dyn_rec_size_hi;
++
++        } else {
++            conf->ssl.dyn_rec.size_hi = conf->buffer_size;
++        }
++
++    } else {
++        conf->ssl.dyn_rec.timeout = 0;
++    }
++
+     return NGX_CONF_OK;
+ }
+ 
+diff -urN nginx-1.31.0-pristine2/src/http/modules/ngx_http_ssl_module.h nginx-1.31.0-manual/src/http/modules/ngx_http_ssl_module.h
+--- nginx-1.31.0-pristine2/src/http/modules/ngx_http_ssl_module.h	2026-05-15 13:37:51.445106976 +0000
++++ nginx-1.31.0-manual/src/http/modules/ngx_http_ssl_module.h	2026-05-15 13:38:11.252995002 +0000
+@@ -66,6 +66,12 @@
+     ngx_flag_t                      stapling_verify;
+     ngx_str_t                       stapling_file;
+     ngx_str_t                       stapling_responder;
++
++    ngx_flag_t                      dyn_rec_enable;
++    ngx_msec_t                      dyn_rec_timeout;
++    size_t                          dyn_rec_size_lo;
++    size_t                          dyn_rec_size_hi;
++    ngx_uint_t                      dyn_rec_threshold;
+ } ngx_http_ssl_srv_conf_t;
+ 
+ 

build/patches/nginx-1.31.1-systemd-notify.patch

@@ -0,0 +1,70 @@
+Add sd_notify() integration to nginx master process so the systemd unit can
+use Type=notify. nginx mainline ships #if (NGX_HAVE_SYSTEMD) guards in nothing
+of its own — every distro carries its own patch. This is ours, kept minimal.
+
+Send:
+  READY=1     after workers + cache manager are spawned (master enters loop)
+  READY=1     again after a successful reconfigure
+  RELOADING=1 when reconfigure starts
+  STOPPING=1  in ngx_master_process_exit
+
+The build script provides -DNGX_HAVE_SYSTEMD and -lsystemd, so this patch
+doesn't touch auto/ configure scripts — only the source.
+
+--- a/src/os/unix/ngx_process_cycle.c
++++ b/src/os/unix/ngx_process_cycle.c
+@@ -12,6 +12,10 @@
+ #include <ngx_channel.h>
+
+
++#if (NGX_HAVE_SYSTEMD)
++#include <systemd/sd-daemon.h>
++#endif
++
+ static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n,
+     ngx_int_t type);
+ static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle,
+@@ -132,6 +136,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
+     sigio = 0;
+     live = 1;
+
++#if (NGX_HAVE_SYSTEMD)
++    sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
++#endif
++
+     for ( ;; ) {
+         if (delay) {
+             if (ngx_sigalrm) {
+@@ -211,6 +219,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
+         if (ngx_reconfigure) {
+             ngx_reconfigure = 0;
+
++#if (NGX_HAVE_SYSTEMD)
++            sd_notify(0, "RELOADING=1\nSTATUS=nginx is reloading\n");
++#endif
++
+             if (ngx_new_binary) {
+                 ngx_start_worker_processes(cycle, ccf->worker_processes,
+                                            NGX_PROCESS_RESPAWN);
+@@ -241,6 +253,10 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
+             live = 1;
+             ngx_signal_worker_processes(cycle,
+                                         ngx_signal_value(NGX_SHUTDOWN_SIGNAL));
++
++#if (NGX_HAVE_SYSTEMD)
++            sd_notify(0, "READY=1\nSTATUS=nginx is ready\n");
++#endif
+         }
+
+         if (ngx_restart) {
+@@ -655,6 +671,10 @@ static void
+ ngx_master_process_exit(ngx_cycle_t *cycle)
+ {
+     ngx_uint_t  i;
++
++#if (NGX_HAVE_SYSTEMD)
++    sd_notify(0, "STOPPING=1\nSTATUS=nginx is stopping\n");
++#endif
+
+     ngx_delete_pidfile(cycle);
+

build/raccoon.sh

@@ -1,5 +1,6 @@
 . ./version
 set -e
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 function reqs() {
     apt-get update -y; apt-get upgrade -y; apt-get dist-upgrade -y; apt-get autoremove -y
     DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get -y install tzdata dialog
@@ -7,9 +8,33 @@ function reqs() {
     apt-get -y install wget zip unzip build-essential libssl-dev curl nano git
     # apt-get -y install iptables ipset
     apt-get install libtool pkg-config make cmake automake autoconf golang-go ninja-build -y
-    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2-dev mercurial libpcre2-dev libc-ares-dev libre2-dev libzstd-dev libjemalloc2 -y
+    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2-dev mercurial libpcre2-dev libc-ares-dev libre2-dev libzstd-dev libjemalloc2 libsystemd-dev -y
     mkdir -p $LUA_SCRIPTS
 }
+function apply_patches() {
+    local nginx_src="/opt/nginx-${NGINX}"
+    local patch_dir="${SCRIPT_DIR}/patches"
+    [ -f "${nginx_src}/.patches_applied" ] && return 0
+
+    apply_one() {
+        local toggle="$1" file="$2"
+        if [ "$toggle" != "1" ]; then
+            echo "[patch] skip $file (toggle=$toggle)"; return 0
+        fi
+        if [ ! -f "${patch_dir}/${file}" ]; then
+            echo "[patch] MISSING ${patch_dir}/${file}"; return 1
+        fi
+        echo "[patch] applying ${file}"
+        ( cd "$nginx_src" && patch -p1 < "${patch_dir}/${file}" )
+    }
+
+    apply_one "${APPLY_PATCH_SYSTEMD_NOTIFY:-0}"      "nginx-${NGINX}-systemd-notify.patch"
+    apply_one "${APPLY_PATCH_DYNAMIC_TLS_RECORDS:-0}" "nginx-${NGINX}-dynamic-tls-records.patch"
+    apply_one "${APPLY_PATCH_HTTP2_HPACK_ENC:-0}"     "nginx-${NGINX}-http2-hpack-enc.patch"
+
+    touch "${nginx_src}/.patches_applied"
+}
+
 function clean_install() {
      mkdir -p /opt/mod
 
@@ -18,6 +43,7 @@ function clean_install() {
         cd /opt/ && wget https://nginx.org/download/nginx-${NGINX}.tar.gz
         tar xf nginx-${NGINX}.tar.gz && rm -Rf nginx-${NGINX}.tar.gz
     fi
+    apply_patches
 
     # START OF SYSTEM REQUIRED LIBS
     # ============================================================================================================
@@ -40,10 +66,23 @@ function clean_install() {
             ldconfig
     fi
 
-    # ZLIB
-    if [ ! -d /opt/mod/zlib ]; then
-        cd /opt/mod && wget http://zlib.net/current/zlib.tar.gz
-        cd /opt/mod && tar xf zlib.tar.gz; rm -Rf zlib.tar.gz; mv zlib-* zlib
+    # ZLIB (zlib-ng, --zlib-compat mode). Drop-in libz replacement with SIMD-
+    # accelerated DEFLATE. Installed to /usr/local/zlib-ng/. nginx links via
+    # -I/-L below (no more --with-zlib=PATH; nginx finds libz via -L+rpath).
+    if [ ! -d /opt/mod/zlib-ng-${SYSTEM_ZLIBNG} ]; then
+        cd /opt/mod && wget https://github.com/zlib-ng/zlib-ng/archive/refs/tags/${SYSTEM_ZLIBNG}.tar.gz
+        cd /opt/mod && tar xf ${SYSTEM_ZLIBNG}.tar.gz; rm -Rf ${SYSTEM_ZLIBNG}.tar.gz
+    fi
+    if [ ! -f /usr/local/zlib-ng/lib/libz.so ]; then
+        cd /opt/mod/zlib-ng-${SYSTEM_ZLIBNG} && \
+            cmake -GNinja -B build \
+                -DCMAKE_INSTALL_PREFIX=/usr/local/zlib-ng \
+                -DZLIB_COMPAT=ON \
+                -DBUILD_SHARED_LIBS=ON \
+                -DCMAKE_BUILD_TYPE=Release && \
+            cmake --build build -j`nproc` && \
+            cmake --install build && \
+            ldconfig
     fi
 
     # SYSTEM_LUAJIT
@@ -223,14 +262,18 @@ test_nginx() {
                                           --sbin-path=/usr/sbin/nginx                                             \
                                           --conf-path=/nginx/nginx.conf                                           \
                                           --modules-path=/nginx/modules                                           \
-                                          --pid-path=/var/run/nginx.pid                                           \
-                                          --lock-path=/var/run/nginx.lock                                         \
+                                          --pid-path=/run/nginx.pid                                           \
+                                          --lock-path=/run/nginx.lock                                               \
                                           --error-log-path=/var/log/nginx/error.log                               \
                                           --http-log-path=/var/log/nginx/access.log                               \
+                                          --http-client-body-temp-path=/run/nginx/temp/client_body                \
+                                          --http-proxy-temp-path=/run/nginx/temp/proxy                            \
+                                          --http-fastcgi-temp-path=/run/nginx/temp/fastcgi                        \
+                                          --http-uwsgi-temp-path=/run/nginx/temp/uwsgi                            \
+                                          --http-scgi-temp-path=/run/nginx/temp/scgi                              \
                                           --with-pcre                                                             \
                                           --with-pcre-jit                                                         \
                                           --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
-                                          --with-zlib=/opt/mod/zlib                                               \
                                           --with-threads                                                          \
                                           --with-file-aio                                                         \
                                           --with-http_ssl_module                                                  \
@@ -271,8 +314,8 @@ test_nginx() {
                                           --add-module=/opt/mod/ngx_brotli                                        \
                                           --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
                                           --add-module=/opt/mod/testcookie                                        \
-                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
-                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include -I/usr/local/zlib-ng/include -DNGX_HAVE_SYSTEMD" \
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib -L/usr/local/zlib-ng/lib -lz -Wl,-rpath,/usr/local/zlib-ng/lib -lsystemd"
                                           make clean
 }
 function build() {
@@ -282,14 +325,18 @@ function build() {
                                           --sbin-path=/usr/sbin/nginx                                             \
                                           --conf-path=/nginx/nginx.conf                                           \
                                           --modules-path=/nginx/modules                                           \
-                                          --pid-path=/var/run/nginx.pid                                           \
-                                          --lock-path=/var/run/nginx.lock                                         \
+                                          --pid-path=/run/nginx.pid                                           \
+                                          --lock-path=/run/nginx.lock                                               \
                                           --error-log-path=/var/log/nginx/error.log                               \
                                           --http-log-path=/var/log/nginx/access.log                               \
+                                          --http-client-body-temp-path=/run/nginx/temp/client_body                \
+                                          --http-proxy-temp-path=/run/nginx/temp/proxy                            \
+                                          --http-fastcgi-temp-path=/run/nginx/temp/fastcgi                        \
+                                          --http-uwsgi-temp-path=/run/nginx/temp/uwsgi                            \
+                                          --http-scgi-temp-path=/run/nginx/temp/scgi                              \
                                           --with-pcre                                                             \
                                           --with-pcre-jit                                                         \
                                           --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
-                                          --with-zlib=/opt/mod/zlib                                               \
                                           --with-threads                                                          \
                                           --with-file-aio                                                         \
                                           --with-http_ssl_module                                                  \
@@ -330,8 +377,8 @@ function build() {
                                           --add-module=/opt/mod/ngx_brotli                                        \
                                           --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
                                           --add-module=/opt/mod/testcookie                                        \
-                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
-                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include -I/usr/local/zlib-ng/include -DNGX_HAVE_SYSTEMD" \
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib -L/usr/local/zlib-ng/lib -lz -Wl,-rpath,/usr/local/zlib-ng/lib -lsystemd"
     # NOTE: kept as separate statements (not `make && make install && make clean`)
     # so `set -e` actually fires on a make failure. The && chain hides left-side
     # failures from set -e, which previously let half-built nginx ship.
@@ -355,14 +402,14 @@ function post_build() {
     curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/nginx/live/default > /nginx/live/default
     mkdir -p /hostdata/default/public_html/ && curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/index.html > /hostdata/default/public_html/index.html
     mkdir -p /hostdata/default/public_html/cdn/modsec && curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/modsec/aes.min.js > /hostdata/default/public_html/cdn/modsec/aes.min.js
+    SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+    install -m 0644 "${SRC_DIR}/static/Raccoon/nginx.service" /etc/systemd/system/nginx.service
     if [ -f "/run/.containerenv" ] || [ -f "/.dockerenv" ] || [ -f "/home/runner/.dockerenv" ]; then
         echo "Skipping systemctl commands on GitHub runner"
         mkdir -p /etc/systemd/system/
-        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Raccoon/nginx.service > /etc/systemd/system/nginx.service
     else
-        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Raccoon/nginx.service > /etc/systemd/system/nginx.service
         systemctl daemon-reload
-        systemctl start nginx.service
+        systemctl restart nginx.service
         systemctl enable nginx.service
     fi
 }

build/trixie.sh

@@ -1,5 +1,6 @@
 . ./version
 set -e
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 function reqs() {
     apt-get update -y; apt-get upgrade -y; apt-get dist-upgrade -y; apt-get autoremove -y
     DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get -y install tzdata dialog
@@ -7,9 +8,33 @@ function reqs() {
     apt-get -y install wget zip unzip build-essential libssl-dev curl nano git
     # apt-get -y install iptables ipset
     apt-get install libtool pkg-config make cmake automake autoconf golang-go ninja-build -y
-    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2 libxml2-dev mercurial libpcre2-dev libc-ares-dev libre2-dev libzstd-dev libjemalloc2 -y
+    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2 libxml2-dev mercurial libpcre2-dev libc-ares-dev libre2-dev libzstd-dev libjemalloc2 libsystemd-dev -y
     mkdir -p $LUA_SCRIPTS
 }
+function apply_patches() {
+    local nginx_src="/opt/nginx-${NGINX}"
+    local patch_dir="${SCRIPT_DIR}/patches"
+    [ -f "${nginx_src}/.patches_applied" ] && return 0
+
+    apply_one() {
+        local toggle="$1" file="$2"
+        if [ "$toggle" != "1" ]; then
+            echo "[patch] skip $file (toggle=$toggle)"; return 0
+        fi
+        if [ ! -f "${patch_dir}/${file}" ]; then
+            echo "[patch] MISSING ${patch_dir}/${file}"; return 1
+        fi
+        echo "[patch] applying ${file}"
+        ( cd "$nginx_src" && patch -p1 < "${patch_dir}/${file}" )
+    }
+
+    apply_one "${APPLY_PATCH_SYSTEMD_NOTIFY:-0}"      "nginx-${NGINX}-systemd-notify.patch"
+    apply_one "${APPLY_PATCH_DYNAMIC_TLS_RECORDS:-0}" "nginx-${NGINX}-dynamic-tls-records.patch"
+    apply_one "${APPLY_PATCH_HTTP2_HPACK_ENC:-0}"     "nginx-${NGINX}-http2-hpack-enc.patch"
+
+    touch "${nginx_src}/.patches_applied"
+}
+
 function clean_install() {
      mkdir -p /opt/mod
 
@@ -18,6 +43,7 @@ function clean_install() {
         cd /opt/ && wget https://nginx.org/download/nginx-${NGINX}.tar.gz
         tar xf nginx-${NGINX}.tar.gz && rm -Rf nginx-${NGINX}.tar.gz
     fi
+    apply_patches
 
     # START OF SYSTEM REQUIRED LIBS
     # ============================================================================================================
@@ -40,10 +66,23 @@ function clean_install() {
             ldconfig
     fi
 
-    # ZLIB
-    if [ ! -d /opt/mod/zlib ]; then
-        cd /opt/mod && wget http://zlib.net/current/zlib.tar.gz
-        cd /opt/mod && tar xf zlib.tar.gz; rm -Rf zlib.tar.gz; mv zlib-* zlib
+    # ZLIB (zlib-ng, --zlib-compat mode). Drop-in libz replacement with SIMD-
+    # accelerated DEFLATE. Installed to /usr/local/zlib-ng/. nginx links via
+    # -I/-L below (no more --with-zlib=PATH; nginx finds libz via -L+rpath).
+    if [ ! -d /opt/mod/zlib-ng-${SYSTEM_ZLIBNG} ]; then
+        cd /opt/mod && wget https://github.com/zlib-ng/zlib-ng/archive/refs/tags/${SYSTEM_ZLIBNG}.tar.gz
+        cd /opt/mod && tar xf ${SYSTEM_ZLIBNG}.tar.gz; rm -Rf ${SYSTEM_ZLIBNG}.tar.gz
+    fi
+    if [ ! -f /usr/local/zlib-ng/lib/libz.so ]; then
+        cd /opt/mod/zlib-ng-${SYSTEM_ZLIBNG} && \
+            cmake -GNinja -B build \
+                -DCMAKE_INSTALL_PREFIX=/usr/local/zlib-ng \
+                -DZLIB_COMPAT=ON \
+                -DBUILD_SHARED_LIBS=ON \
+                -DCMAKE_BUILD_TYPE=Release && \
+            cmake --build build -j`nproc` && \
+            cmake --install build && \
+            ldconfig
     fi
 
     # SYSTEM_LUAJIT
@@ -223,14 +262,18 @@ test_nginx() {
                                           --sbin-path=/usr/sbin/nginx                                             \
                                           --conf-path=/nginx/nginx.conf                                           \
                                           --modules-path=/nginx/modules                                           \
-                                          --pid-path=/var/run/nginx.pid                                           \
-                                          --lock-path=/var/run/nginx.lock                                         \
+                                          --pid-path=/run/nginx.pid                                           \
+                                          --lock-path=/run/nginx.lock                                               \
                                           --error-log-path=/var/log/nginx/error.log                               \
                                           --http-log-path=/var/log/nginx/access.log                               \
+                                          --http-client-body-temp-path=/run/nginx/temp/client_body                \
+                                          --http-proxy-temp-path=/run/nginx/temp/proxy                            \
+                                          --http-fastcgi-temp-path=/run/nginx/temp/fastcgi                        \
+                                          --http-uwsgi-temp-path=/run/nginx/temp/uwsgi                            \
+                                          --http-scgi-temp-path=/run/nginx/temp/scgi                              \
                                           --with-pcre                                                             \
                                           --with-pcre-jit                                                         \
                                           --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
-                                          --with-zlib=/opt/mod/zlib                                               \
                                           --with-threads                                                          \
                                           --with-file-aio                                                         \
                                           --with-http_ssl_module                                                  \
@@ -271,8 +314,8 @@ test_nginx() {
                                           --add-module=/opt/mod/ngx_brotli                                        \
                                           --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
                                           --add-module=/opt/mod/testcookie                                        \
-                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
-                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include -I/usr/local/zlib-ng/include -DNGX_HAVE_SYSTEMD" \
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib -L/usr/local/zlib-ng/lib -lz -Wl,-rpath,/usr/local/zlib-ng/lib -lsystemd"
                                           make clean
 }
 function build() {
@@ -282,14 +325,18 @@ function build() {
                                           --sbin-path=/usr/sbin/nginx                                             \
                                           --conf-path=/nginx/nginx.conf                                           \
                                           --modules-path=/nginx/modules                                           \
-                                          --pid-path=/var/run/nginx.pid                                           \
-                                          --lock-path=/var/run/nginx.lock                                         \
+                                          --pid-path=/run/nginx.pid                                           \
+                                          --lock-path=/run/nginx.lock                                               \
                                           --error-log-path=/var/log/nginx/error.log                               \
                                           --http-log-path=/var/log/nginx/access.log                               \
+                                          --http-client-body-temp-path=/run/nginx/temp/client_body                \
+                                          --http-proxy-temp-path=/run/nginx/temp/proxy                            \
+                                          --http-fastcgi-temp-path=/run/nginx/temp/fastcgi                        \
+                                          --http-uwsgi-temp-path=/run/nginx/temp/uwsgi                            \
+                                          --http-scgi-temp-path=/run/nginx/temp/scgi                              \
                                           --with-pcre                                                             \
                                           --with-pcre-jit                                                         \
                                           --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
-                                          --with-zlib=/opt/mod/zlib                                               \
                                           --with-threads                                                          \
                                           --with-file-aio                                                         \
                                           --with-http_ssl_module                                                  \
@@ -330,8 +377,8 @@ function build() {
                                           --add-module=/opt/mod/ngx_brotli                                        \
                                           --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
                                           --add-module=/opt/mod/testcookie                                        \
-                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
-                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include -I/usr/local/zlib-ng/include -DNGX_HAVE_SYSTEMD" \
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib -L/usr/local/zlib-ng/lib -lz -Wl,-rpath,/usr/local/zlib-ng/lib -lsystemd"
     # NOTE: kept as separate statements (not `make && make install && make clean`)
     # so `set -e` actually fires on a make failure. The && chain hides left-side
     # failures from set -e, which previously let half-built nginx ship.
@@ -355,14 +402,14 @@ function post_build() {
     curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/nginx/live/default > /nginx/live/default
     mkdir -p /hostdata/default/public_html/ && curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/index.html > /hostdata/default/public_html/index.html
     mkdir -p /hostdata/default/public_html/cdn/modsec && curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/modsec/aes.min.js > /hostdata/default/public_html/cdn/modsec/aes.min.js
+    SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+    install -m 0644 "${SRC_DIR}/static/Trixie/nginx.service" /etc/systemd/system/nginx.service
     if [ -f "/run/.containerenv" ] || [ -f "/.dockerenv" ] || [ -f "/home/runner/.dockerenv" ]; then
         echo "Skipping systemctl commands on GitHub runner"
         mkdir -p /etc/systemd/system/
-        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Trixie/nginx.service > /etc/systemd/system/nginx.service
     else
-        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Trixie/nginx.service > /etc/systemd/system/nginx.service
         systemctl daemon-reload
-        systemctl start nginx.service
+        systemctl restart nginx.service
         systemctl enable nginx.service
     fi
 }

static/Raccoon/nginx-raweb.service

@@ -0,0 +1,70 @@
+[Unit]
+Description=A high performance web server and a reverse proxy server (twiy)
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx.pid
+Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /run/nginx/temp /run/nginx/temp/client_body /run/nginx/temp/proxy /run/nginx/temp/fastcgi /run/nginx/temp/uwsgi /run/nginx/temp/scgi /var/log/nginx
+ExecStartPre=/usr/sbin/nginx -t
+ExecStart=/usr/sbin/nginx -c /nginx/nginx.conf
+ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /run/nginx.pid)"
+ExecStop=/bin/sh -c "/bin/kill -s QUIT $(/bin/cat /run/nginx.pid)"
+TimeoutStartSec=10
+LimitNOFILE=65535
+
+# === hardening: deny-everything by default, allowlist via bind mounts ===
+# TemporaryFileSystem=/ replaces the visible filesystem with an empty tmpfs.
+# Everything not bind-mounted below is invisible to nginx workers — even
+# read access. Compromise of a worker can no longer enumerate /etc/passwd,
+# /home/*, /var/lib/*, /root, /opt, etc.
+TemporaryFileSystem=/
+
+# Read-only: nginx binary, dynamic linker, all linked libs, system config,
+# CA bundles, Let's Encrypt certs (live/ + archive/ both under /etc).
+BindReadOnlyPaths=/usr
+BindReadOnlyPaths=/lib
+BindReadOnlyPaths=/lib64
+BindReadOnlyPaths=/bin
+BindReadOnlyPaths=/sbin
+BindReadOnlyPaths=/etc
+
+# Read-write: nginx runtime state.
+#   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
+#   /var/log/nginx     access.log, error.log
+#   /nginx             config dir (read-mostly but reload writes some state)
+BindPaths=/run
+BindPaths=/var/log/nginx
+BindPaths=/nginx
+BindPaths=/var/cache/nginx
+BindPaths=/srv
+BindPaths=/hostdata
+BindPaths=/raweb
+
+NoNewPrivileges=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+PrivateDevices=true
+PrivateTmp=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# NOTE deliberately OFF:
+#   MemoryDenyWriteExecute=true       breaks LuaJIT (JIT writable+executable pages)
+#   SystemCallFilter=~@resources      breaks nginx workers' prlimit64()
+# ProtectSystem and ProtectHome are redundant under TemporaryFileSystem=/.
+
+[Install]
+WantedBy=multi-user.target

static/Raccoon/nginx.service

@@ -6,51 +6,13 @@ Wants=network-online.target
 [Service]
 Type=forking
 PIDFile=/run/nginx.pid
-
-# jemalloc replaces glibc malloc — better fragmentation/perf under nginx's
-# alloc/free churn at scale. Package depends on libjemalloc2 so the .so is
-# guaranteed present. Removing this line falls back to glibc malloc cleanly.
 Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
-
-# Self-heal: nginx was compiled without --http-*-temp-path so it expects
-# these dirs under /usr/local/nginx; install -d is idempotent and fixes any
-# missing/wrong ownership on every restart.
-ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /usr/local/nginx /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/uwsgi_temp /usr/local/nginx/scgi_temp /var/log/nginx
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /run/nginx/temp /run/nginx/temp/client_body /run/nginx/temp/proxy /run/nginx/temp/fastcgi /run/nginx/temp/uwsgi /run/nginx/temp/scgi /var/log/nginx
 ExecStartPre=/usr/sbin/nginx -t
-ExecStart=/usr/sbin/nginx
-ExecReload=/usr/sbin/nginx -s reload
-ExecStop=/bin/kill -s QUIT $MAINPID
-
-# ---- systemd hardening (systemd 257+ on Debian 13 / Ubuntu 26.04) ----
-# Each line shrinks the worker's blast radius without affecting throughput.
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-ProtectClock=true
-ProtectHostname=true
-PrivateDevices=true
-PrivateTmp=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-LockPersonality=true
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged @resources @mount @debug @cpu-emulation @obsolete @raw-io @reboot @swap
-
-# Paths nginx legitimately writes to. ProtectSystem=strict makes everything
-# else read-only; these carve out the exceptions.
-ReadWritePaths=/var/log/nginx /usr/local/nginx /run /nginx /hostdata
-
-# NOTE on MemoryDenyWriteExecute: LuaJIT does runtime JIT compilation and
-# therefore needs writable+executable pages — enabling MDWE breaks Lua. Left
-# off intentionally.
-
+ExecStart=/usr/sbin/nginx -c /nginx/nginx.conf
+ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /run/nginx.pid)"
+ExecStop=/bin/sh -c "/bin/kill -s QUIT $(/bin/cat /run/nginx.pid)"
+TimeoutStartSec=10
 LimitNOFILE=65535
 
 [Install]

static/Trixie/nginx-raweb.service

@@ -0,0 +1,70 @@
+[Unit]
+Description=A high performance web server and a reverse proxy server (twiy)
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx.pid
+Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /run/nginx/temp /run/nginx/temp/client_body /run/nginx/temp/proxy /run/nginx/temp/fastcgi /run/nginx/temp/uwsgi /run/nginx/temp/scgi /var/log/nginx
+ExecStartPre=/usr/sbin/nginx -t
+ExecStart=/usr/sbin/nginx -c /nginx/nginx.conf
+ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /run/nginx.pid)"
+ExecStop=/bin/sh -c "/bin/kill -s QUIT $(/bin/cat /run/nginx.pid)"
+TimeoutStartSec=10
+LimitNOFILE=65535
+
+# === hardening: deny-everything by default, allowlist via bind mounts ===
+# TemporaryFileSystem=/ replaces the visible filesystem with an empty tmpfs.
+# Everything not bind-mounted below is invisible to nginx workers — even
+# read access. Compromise of a worker can no longer enumerate /etc/passwd,
+# /home/*, /var/lib/*, /root, /opt, etc.
+TemporaryFileSystem=/
+
+# Read-only: nginx binary, dynamic linker, all linked libs, system config,
+# CA bundles, Let's Encrypt certs (live/ + archive/ both under /etc).
+BindReadOnlyPaths=/usr
+BindReadOnlyPaths=/lib
+BindReadOnlyPaths=/lib64
+BindReadOnlyPaths=/bin
+BindReadOnlyPaths=/sbin
+BindReadOnlyPaths=/etc
+
+# Read-write: nginx runtime state.
+#   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
+#   /var/log/nginx     access.log, error.log
+#   /nginx             config dir (read-mostly but reload writes some state)
+BindPaths=/run
+BindPaths=/var/log/nginx
+BindPaths=/nginx
+BindPaths=/var/cache/nginx
+BindPaths=/srv
+BindPaths=/hostdata
+BindPaths=/raweb
+
+NoNewPrivileges=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+PrivateDevices=true
+PrivateTmp=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# NOTE deliberately OFF:
+#   MemoryDenyWriteExecute=true       breaks LuaJIT (JIT writable+executable pages)
+#   SystemCallFilter=~@resources      breaks nginx workers' prlimit64()
+# ProtectSystem and ProtectHome are redundant under TemporaryFileSystem=/.
+
+[Install]
+WantedBy=multi-user.target

static/Trixie/nginx.service

@@ -6,51 +6,13 @@ Wants=network-online.target
 [Service]
 Type=forking
 PIDFile=/run/nginx.pid
-
-# jemalloc replaces glibc malloc — better fragmentation/perf under nginx's
-# alloc/free churn at scale. Package depends on libjemalloc2 so the .so is
-# guaranteed present. Removing this line falls back to glibc malloc cleanly.
 Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
-
-# Self-heal: nginx was compiled without --http-*-temp-path so it expects
-# these dirs under /usr/local/nginx; install -d is idempotent and fixes any
-# missing/wrong ownership on every restart.
-ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /usr/local/nginx /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/uwsgi_temp /usr/local/nginx/scgi_temp /var/log/nginx
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /run/nginx/temp /run/nginx/temp/client_body /run/nginx/temp/proxy /run/nginx/temp/fastcgi /run/nginx/temp/uwsgi /run/nginx/temp/scgi /var/log/nginx
 ExecStartPre=/usr/sbin/nginx -t
-ExecStart=/usr/sbin/nginx
-ExecReload=/usr/sbin/nginx -s reload
-ExecStop=/bin/kill -s QUIT $MAINPID
-
-# ---- systemd hardening (systemd 257+ on Debian 13 / Ubuntu 26.04) ----
-# Each line shrinks the worker's blast radius without affecting throughput.
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-ProtectClock=true
-ProtectHostname=true
-PrivateDevices=true
-PrivateTmp=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-LockPersonality=true
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged @resources @mount @debug @cpu-emulation @obsolete @raw-io @reboot @swap
-
-# Paths nginx legitimately writes to. ProtectSystem=strict makes everything
-# else read-only; these carve out the exceptions.
-ReadWritePaths=/var/log/nginx /usr/local/nginx /run /nginx /hostdata
-
-# NOTE on MemoryDenyWriteExecute: LuaJIT does runtime JIT compilation and
-# therefore needs writable+executable pages — enabling MDWE breaks Lua. Left
-# off intentionally.
-
+ExecStart=/usr/sbin/nginx -c /nginx/nginx.conf
+ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /run/nginx.pid)"
+ExecStop=/bin/sh -c "/bin/kill -s QUIT $(/bin/cat /run/nginx.pid)"
+TimeoutStartSec=10
 LimitNOFILE=65535
 
 [Install]

static/nginx/nginx.conf

@@ -1,12 +1,5 @@
-# Suggestions? => https://github.com/theraw/The-World-Is-Yours/issues
-# Problems?    => https://github.com/theraw/The-World-Is-Yours/issues
-#
-# Tuned for shared hosting at 5,000+ vhost scale.
-# Per-vhost listen/ssl_certificate directives live in /nginx/live/* — this
-# file only contains the global event/http settings.
-
 user nginx;
-pid /var/run/nginx.pid;
+pid /run/nginx.pid;
 worker_processes auto;
 worker_cpu_affinity auto;
 worker_rlimit_nofile 65535;
@@ -28,7 +21,12 @@ http {
     # =================== END L7 =========================== #
 
     # ===================== LOGS =========================== #
-    log_format main 'DATE: $time_local FROM: $remote_addr  | STATUS: $status | TO: $request | CACHE: $upstream_cache_status | A: $http_user_agent';
+    map $upstream_cache_status $log_cache_status {
+        ""      "STATIC";
+        default $upstream_cache_status;
+    }
+    more_set_headers "X-Cache-Status: $log_cache_status";
+    log_format main 'DATE: $time_local FROM: $remote_addr  | STATUS: $status | TO: $request | CACHE: $log_cache_status | A: $http_user_agent';
     # =================== END LOGS ========================= #
 
     # ==================== GENERAL ========================= #
@@ -69,6 +67,15 @@ http {
     ssl_session_tickets            off;
     ssl_stapling                   on;
     ssl_stapling_verify            on;
+
+    # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
+    # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
+    # overhead once the connection is past head-of-line blocking.
+    ssl_dyn_rec_enable             on;
+    ssl_dyn_rec_size_lo            1369;
+    ssl_dyn_rec_size_hi            4229;
+    ssl_dyn_rec_threshold          40;
+    ssl_dyn_rec_timeout            1000;
     # ===================== END TLS ======================== #
     resolver                       1.1.1.1 1.0.0.1 valid=300s;
     resolver_timeout               5s;

version

@@ -1,4 +1,4 @@
-export NGINX="1.30.0"
+export NGINX="1.31.1"
 
 # Lua Path
 export LUA_SCRIPTS="/usr/nginx_lua"
@@ -58,3 +58,31 @@ export NGX_MOD_LUA_SRCACHE="0.33"
 # Zstandard compression module. Chrome 123+ and Firefox 126+ send
 # `Accept-Encoding: zstd`; older clients fall back to brotli/gzip.
 export NGX_MOD_ZSTD="0.1.1"
+
+# https://github.com/zlib-ng/zlib-ng/releases
+# Drop-in libz replacement with SIMD-accelerated DEFLATE. Built in --zlib-compat
+# mode, installed to /usr/local/zlib-ng/. ~2-3x faster gzip CPU vs stock zlib.
+export SYSTEM_ZLIBNG="2.3.3"
+
+# ---------------------------------------------------------------------------
+# Patches applied on top of upstream nginx source (committed at build/patches/).
+# 1 = apply, 0 = skip. Each patch's filename embeds the nginx version it was
+# authored against — bumping NGINX above means reviewing/refreshing every patch
+# in build/patches/.
+# ---------------------------------------------------------------------------
+# Required for Type=notify in the systemd unit. Mainline nginx has the
+# #if (NGX_HAVE_SYSTEMD) guards but no actual sd_notify call sites; every distro
+# carries their own patch. Without this, `Type=notify` times out at startup.
+export APPLY_PATCH_SYSTEMD_NOTIFY=1
+
+# Cloudflare's dynamic TLS records: ssl_dyn_rec_* directives. Varies TLS record
+# size based on connection state. -1 RTT TTFB on first byte, +reduced overhead
+# at steady state. Patch shipped at build/patches/.
+export APPLY_PATCH_DYNAMIC_TLS_RECORDS=1
+
+# Cloudflare's HPACK dynamic-table encoder: --with-http_v2_hpack_enc. Smaller
+# HTTP/2 response headers on the wire. Upstream patch is stale (last touched
+# 2017; nginx 1.31 has already absorbed parts of it upstream and the remaining
+# hunks reference internals that have drifted). Patch NOT yet shipped — would
+# need a full rebase. Keep toggle here for the day someone ports it.
+export APPLY_PATCH_HTTP2_HPACK_ENC=0