Ubuntu 26.04

- nginx 1.30.0, ModSecurity v3.0.12, AWS-LC 1.72.0 (replaces
  quictls/openssl 3.1.5-quic1; OpenSSL 3.1 is EOL upstream)
- AWS-LC build via cmake+ninja, installed to /usr/local/aws-lc;
  nginx links via -I/-L and rpath
- lua-nginx-module: sed-broaden the existing OPENSSL_IS_BORINGSSL
  guards to also recognise OPENSSL_IS_AWSLC (covers #ifdef,
  #ifndef, #elif defined). without this the missing-API stubs
  never fire on AWS-LC and the build breaks on
  SSL_get1_supported_ciphers / SSL_export_keying_material_early
- lua-resty-core / lrucache: switched from `git clone master`
  to wget tarball pinned via LUA_SCRIPTS_RESTYCORE/LRUCACHE.
  master drifted to wanting ngx_lua 0.10.30 while the pin was
  0.10.29 — silent CI breakage waiting to happen
- ModSec rewritten for v3 build flow (./build.sh && ./configure
  --without-pcre --with-pcre2). v2's standalone.so isn't what
  ModSecurity-nginx connector links against; it wants
  libmodsecurity.so
- PCRE2: switched to /releases/download/ tarball (bundles the
  sljit submodule needed for --with-pcre-jit); /archive/refs/tags/
  is a raw snapshot and omits submodules
- LuaJIT version pin had a stray leading 'v' that produced
  /tags/vv2.1-... → 404
- drop -L/lib/x86_64-linux-gnu -lpcre from --with-ld-opt;
  PCRE1 is gone from debian 13
- drop libpcre3-dev from apt install for the same reason
- fix latent bug in build/run.sh build(): make && make install
  && make clean swallows make failures from set -e because of
  &&-chain semantics. now separate statements
- static/nginx/nginx.conf rewrite for shared hosting at 5k+
  vhosts: server_names_hash_max_size 32768, shared SSL session
  cache 200m, OCSP stapling, open_file_cache, brotli+gzip
  enabled in http{}, worker_cpu_affinity auto, max_headers 100,
  keepalive_requests 10000. client_header_buffer_size dropped
  from 2M to 4k (was a memory amplification surface)
- README: performance section comparing twiy vs vanilla nginx,
  OpenResty, Apache; expected yield breakdown

.gitea/workflows/build-publish.yml

@@ -0,0 +1,175 @@
+name: build-and-publish
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [trixie, raccoon]
+        include:
+          - target: trixie
+            image: debian:13
+            nexus_repo_secret: NEXUS_REPO_TRIXIE
+          - target: raccoon
+            image: ubuntu:26.04
+            nexus_repo_secret: NEXUS_REPO_RACCOON
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Build nginx and assemble .deb inside ${{ matrix.image }}
+        id: pkg
+        env:
+          TARGET: ${{ matrix.target }}
+          IMAGE:  ${{ matrix.image }}
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          sudo docker run --rm \
+            -v "$PWD:/repo" \
+            -w /repo \
+            -e TARGET="$TARGET" \
+            "$IMAGE" \
+            bash -euxc '
+              touch /.dockerenv
+              bash build/${TARGET}.sh new
+              bash build/${TARGET}.sh build
+              bash build/${TARGET}.sh postfix
+
+              PKG_NAME="twiy"
+              NGINX_VER="$(nginx -v 2>&1 | awk -F/ "{print \$2}")"
+              VERSION="${NGINX_VER}-${GITHUB_RUN_NUMBER:-1}~${TARGET}"
+              ARCH="amd64"
+              PKG_DIR="/opt/${PKG_NAME}_${VERSION}_${ARCH}"
+              DEB_DIR="${PKG_DIR}/DEBIAN"
+              mkdir -p "${PKG_DIR}/usr/sbin" "${PKG_DIR}/nginx" \
+                       "${PKG_DIR}/etc/systemd/system" "${PKG_DIR}/var/log/nginx" \
+                       "${PKG_DIR}/usr/lib" "${PKG_DIR}/usr/local/lib" \
+                       "${PKG_DIR}/hostdata/default/public_html" \
+                       "${PKG_DIR}/usr/nginx_lua" \
+                       "${PKG_DIR}/usr/local/nginx/client_body_temp" \
+                       "${PKG_DIR}/usr/local/nginx/proxy_temp" \
+                       "${PKG_DIR}/usr/local/nginx/fastcgi_temp" \
+                       "${PKG_DIR}/usr/local/nginx/uwsgi_temp" \
+                       "${PKG_DIR}/usr/local/nginx/scgi_temp"
+
+              cp /usr/sbin/nginx "${PKG_DIR}/usr/sbin/"
+              cp -R /nginx/* "${PKG_DIR}/nginx/" || true
+              cp /etc/systemd/system/nginx.service "${PKG_DIR}/etc/systemd/system/"
+              cp -R /hostdata/default "${PKG_DIR}/hostdata/" || true
+              cp -R /usr/nginx_lua "${PKG_DIR}/usr/" || true
+              for lib in $(ldd /usr/sbin/nginx | grep "=> /" | awk "{print \$3}"); do
+                cp "$lib" "${PKG_DIR}/usr/lib/" || true
+              done
+              # ---- DEBIAN/control --------------------------------------------
+              mkdir -p "${DEB_DIR}"
+              cat > "${DEB_DIR}/control" <<EOF
+              Package: ${PKG_NAME}
+              Version: ${VERSION}
+              Section: base
+              Priority: optional
+              Architecture: ${ARCH}
+              Depends: libjemalloc2
+              Maintainer: Julio <me@julio.al>
+              Description: Nginx L7 DDoS Protection (The-World-Is-Yours), built by RAWeb CI for ${TARGET}.
+              EOF
+
+              # ---- DEBIAN/postinst -------------------------------------------
+              cat > "${DEB_DIR}/postinst" <<"EOFPOSTINST"
+              #!/bin/bash
+              # Idempotent: safe on first install, upgrade, and reinstall.
+              useradd -r -d /usr/local/nginx -s /bin/false nginx 2>/dev/null || true
+              install -d -o nginx -g nginx -m 0755 \
+                /usr/local/nginx \
+                /usr/local/nginx/client_body_temp \
+                /usr/local/nginx/proxy_temp \
+                /usr/local/nginx/fastcgi_temp \
+                /usr/local/nginx/uwsgi_temp \
+                /usr/local/nginx/scgi_temp \
+                /var/log/nginx
+              chown -R nginx:nginx /var/log/nginx /nginx /usr/local/nginx 2>/dev/null || true
+              systemctl daemon-reload 2>/dev/null || true
+              systemctl enable nginx.service 2>/dev/null || true
+              systemctl restart nginx.service 2>/dev/null || true
+              exit 0
+              EOFPOSTINST
+              chmod 755 "${DEB_DIR}/postinst"
+
+              dpkg-deb --build "${PKG_DIR}"
+              cp "${PKG_DIR}.deb" /repo/dist/
+
+              # Hand ownership back to the runner UID so the host job can read.
+              chown $(stat -c "%u:%g" /repo) /repo/dist/$(basename "${PKG_DIR}.deb")
+
+              # Stash version for the publish step.
+              echo "${PKG_NAME}_${VERSION}_${ARCH}.deb" > /repo/dist/${TARGET}.name
+              echo "${VERSION}"                          > /repo/dist/${TARGET}.version
+              echo "${PKG_NAME}"                         > /repo/dist/${TARGET}.pkg
+            '
+
+          # Surface the artifact paths for the next step.
+          DEB_FILE="$PWD/dist/$(cat dist/${TARGET}.name)"
+          PKG_NAME="$(cat dist/${TARGET}.pkg)"
+          VERSION="$(cat dist/${TARGET}.version)"
+          {
+            echo "deb_file=${DEB_FILE}"
+            echo "version=${VERSION}"
+            echo "pkg_name=${PKG_NAME}"
+          } >> "$GITHUB_OUTPUT"
+
+          ls -la "${DEB_FILE}"
+          sha256sum "${DEB_FILE}"
+      - name: Publish to Nexus (${{ matrix.target }})
+        env:
+          NEXUS_USER: ${{ secrets.NEXUS_USER }}
+          NEXUS_PASS: ${{ secrets.NEXUS_PASS }}
+          NEXUS_URL:  ${{ secrets.NEXUS_URL }}
+          NEXUS_REPO: ${{ secrets[matrix.nexus_repo_secret] }}
+          DEB_FILE:   ${{ steps.pkg.outputs.deb_file }}
+          PKG_NAME:   ${{ steps.pkg.outputs.pkg_name }}
+          TARGET:     ${{ matrix.target }}
+        run: |
+          set -euo pipefail
+          umask 077
+
+          SECDIR="$(mktemp -d -p /dev/shm twiy-XXXXXXXX 2>/dev/null \
+                    || mktemp -d -t twiy-XXXXXXXX)"
+          chmod 700 "$SECDIR"
+          cleanup() {
+            find "$SECDIR" -type f -exec shred -uz {} + 2>/dev/null || true
+            rm -rf "$SECDIR"
+          }
+          trap cleanup EXIT INT TERM HUP
+
+          NEXUS_HOST="$(printf '%s' "$NEXUS_URL" | awk -F/ '{print $3}')"
+          printf 'machine %s login %s password %s\n' \
+                 "$NEXUS_HOST" "$NEXUS_USER" "$NEXUS_PASS" > "$SECDIR/netrc"
+          unset NEXUS_USER NEXUS_PASS
+          OLD_ID="$(curl -fsS --netrc-file "$SECDIR/netrc" \
+                    "$NEXUS_URL/service/rest/v1/components?repository=$NEXUS_REPO" \
+                    | PKG_NAME="$PKG_NAME" python3 -c '
+          import sys, json, os
+          for c in json.load(sys.stdin).get("items", []):
+              if c.get("name") == os.environ["PKG_NAME"]:
+                  print(c["id"]); break
+          ' || true)"
+          if [ -n "$OLD_ID" ]; then
+            curl -fsS -X DELETE --netrc-file "$SECDIR/netrc" \
+                 "$NEXUS_URL/service/rest/v1/components/$OLD_ID" -o /dev/null
+          fi
+
+          HTTP="$(curl -sS --netrc-file "$SECDIR/netrc" \
+                  -o "$SECDIR/upload.body" -w '%{http_code}' \
+                  -X POST -F "apt.asset=@$DEB_FILE" \
+                  "$NEXUS_URL/service/rest/v1/components?repository=$NEXUS_REPO")"
+          case "$HTTP" in
+            201|204) echo "[$TARGET] uploaded $(basename "$DEB_FILE") to $NEXUS_URL/repository/$NEXUS_REPO/" ;;
+            *) echo "[$TARGET] upload failed (HTTP $HTTP)"; head -c 400 "$SECDIR/upload.body"; exit 1 ;;
+          esac

.github/workflows/main.yml

@@ -1,106 +0,0 @@
-name: Build and Publish NGINX
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  build:
-    runs-on: ubuntu-22.04
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-      
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get -y install git dpkg-dev
-
-    - name: Clone the repository
-      run: |
-        cd $HOME
-        git clone https://github.com/theraw/The-World-Is-Yours.git
-        cd The-World-Is-Yours/
-
-    - name: Build NGINX
-      run: |
-        touch $HOME/.dockerenv
-        cd $HOME/The-World-Is-Yours/
-        sudo bash build/run.sh new
-        sudo bash build/run.sh build
-        sudo bash build/run.sh postfix
-
-    - name: Build .deb Package
-      id: build_deb
-      run: |
-        cd $HOME/The-World-Is-Yours/
-        sudo bash -c 'function create_deb() {
-            PKG_NAME="twiy"
-            VERSION=$(nginx -v 2>&1 | awk -F"/" "{print \$2}")
-            ARCH="amd64"
-            PKG_DIR="/opt/${PKG_NAME}_${VERSION}_${ARCH}"
-            DEB_DIR="${PKG_DIR}/DEBIAN"
-            mkdir -p ${PKG_DIR}/usr/sbin
-            mkdir -p ${PKG_DIR}/usr/local/nginx
-            mkdir -p ${PKG_DIR}/nginx
-            mkdir -p ${PKG_DIR}/etc/systemd/system
-            mkdir -p ${PKG_DIR}/var/log/nginx
-            mkdir -p ${PKG_DIR}/nginx/conf.d
-            mkdir -p ${PKG_DIR}/nginx/live
-            mkdir -p ${PKG_DIR}/nginx/modsec
-            mkdir -p ${PKG_DIR}/usr/lib
-            mkdir -p ${PKG_DIR}/usr/local/lib
-            mkdir -p ${PKG_DIR}/hostdata/default/public_html
-            mkdir -p ${PKG_DIR}/usr/nginx_lua
-            cp /usr/sbin/nginx ${PKG_DIR}/usr/sbin/
-            cp -R /nginx/* ${PKG_DIR}/nginx/
-            cp /etc/systemd/system/nginx.service ${PKG_DIR}/etc/systemd/system/
-            cp -R /hostdata/default ${PKG_DIR}/hostdata/
-            cp -R /usr/nginx_lua ${PKG_DIR}/usr/
-            for lib in $(ldd /usr/sbin/nginx | grep "=> /" | awk "{print \$3}"); do
-                cp "$lib" "${PKG_DIR}/usr/lib/"
-            done
-            for module in /opt/mod/*; do
-                if [ -f "$module" ]; then
-                    for lib in $(ldd "$module" | grep "=> /" | awk "{print \$3}"); do
-                        cp "$lib" "${PKG_DIR}/usr/lib/"
-                    done
-                fi
-            done
-            mkdir -p ${DEB_DIR}
-            echo "Package: ${PKG_NAME}" > ${DEB_DIR}/control
-            echo "Version: ${VERSION}" >> ${DEB_DIR}/control
-            echo "Section: base" >> ${DEB_DIR}/control
-            echo "Priority: optional" >> ${DEB_DIR}/control
-            echo "Architecture: ${ARCH}" >> ${DEB_DIR}/control
-            echo "Maintainer: Julio <me@julio.al>" >> ${DEB_DIR}/control
-            echo "Description: Nginx L7 DDoS Protection! And many more features github.com/theraw/The-World-Is-Yours" >> ${DEB_DIR}/control
-            echo "#!/bin/bash" > ${DEB_DIR}/postinst
-            echo "useradd -r -d /usr/local/nginx -s /bin/false nginx || true" >> ${DEB_DIR}/postinst
-            chmod 755 ${DEB_DIR}/postinst
-            chmod -R 0755 ${DEB_DIR}
-            dpkg-deb --build ${PKG_DIR}
-            mv ${PKG_DIR}.deb /opt/${PKG_NAME}_${VERSION}_${ARCH}.deb
-            echo "Debian package created at /opt/${PKG_NAME}_${VERSION}_${ARCH}.deb"
-            echo "::set-output name=VERSION::${VERSION}"
-        }; create_deb'
-
-    - name: Create Git Tag
-      run: |
-        VERSION=${{ steps.build_deb.outputs.VERSION }}
-        git config user.name "theraw"
-        git config user.email "me@julio.al"
-        git tag v$VERSION
-        git push origin v$VERSION
-
-    - name: Upload .deb Package as Release Asset
-      uses: softprops/action-gh-release@v2
-      with:
-        files: /opt/*.deb
-        tag_name: v${{ steps.build_deb.outputs.version }}
-      env:
-        GITHUB_TOKEN: ${{ secrets.REPO_TOKEN }}

.gitignore

@@ -1,25 +1,10 @@
-/.phpunit.cache
+.claude/
-/node_modules
+.codex
-/public/build
-/public/hot
-/public/storage
-/storage/*.key
-/storage/pail
-/vendor
 .env
-.env.backup
+.creds
-.env.production
+.workers
-.phpactor.json
+.local
-.phpunit.result.cache
+Dockerfile
-Homestead.json
+docker-compose.yaml
-Homestead.yaml
+docker-compose.yml
-npm-debug.log
+PENDING_*.md
-yarn-error.log
-/auth.json
-/.fleet
-/.idea
-/.nova
-/.vscode
-/.zed
-/.cache
-.cache

README.md

@@ -2,74 +2,69 @@
 
 ![Simple](https://c.tenor.com/uYqsM9uIyuYAAAAC/simple-easy.gif)
 
-- [x] **Support Ubuntu 22.04**
+- [x] Debian 13 (trixie) and Ubuntu 26.04 LTS (raccoon) supported
-- [x] **Latest Nginx 1.26.0**
+- [x] nginx 1.30.0
-- [x] **HTTP/3**
+- [x] HTTP/3 (QUIC) via AWS-LC
-- [x] **Admin Panel** : Optional *(Not installed by default)*
+- [x] ModSecurity v3 (libmodsecurity)
-     - [X] **Home Page** *(Nginx stats/graph via nginx stub stats)*
+- [x] Naxsi
-     - [X] **Vhosts Page** *(Create, Delete, Edit)*
+- [x] Lua (LuaJIT 2.1)
-     - [X] **IP Management** *(add, edit, delete)* *selectable on vhost creation*
+- [x] Cookie-based challenge
-     - [X] **Ports Management** *(add, edit, delete)* *selectable on vhost creation*
+- [x] [Versions List](https://git.julio.al/theraw/The-World-Is-Yours/src/branch/master/version)
-     - [ ] **Nginx Settings Page** *(Only change existing nginx.conf values)*
-     - [ ] **Log Reporting Page** (Not set yet, might be all in one page or seperated pages for access logs, modsec logs)
-     - [x] **Php Selector** (a.k.a creation of dedicated fpm pool) *selectable on vhost creation*
-     - [ ] **One click App installer** *(WordPress)*
-- [x] ModSecurity Support *(Ngx Mod)*
-- [x] Naxsi Support *(Ngx Mod)*
-- [x] Lua Support.
-     - [X] **AutoSSL** *(Lua Mod)*
-     - [ ] **Rate Limit** *(Lua Mod)*
-     - [ ] **Captcha**  *(Lua Mod)*
-- [x] Cookie Based Challenge *(Ngx Mod)*
-- [x] [Versions List](https://github.com/theraw/The-World-Is-Yours/blob/master/version)
 
-# Installation methods.
+## Easy install
 
-- 1 : **Repository (Easy)**
+### Debian 13 (trixie)
-     ```bash
-     # Add repository and update system.
-     echo '' > /etc/apt/sources.list.d/the-world-is-yours.list
-     apt-get update; apt-get upgrade -y
-     
-     # Install nginx.
-     apt-get install raweb -y
-
-     # Install admin panel.
-     apt-get install raweb-admin -y
-     ```
-- 2 : **Manual .deb (Med)**
-     ```bash
-     Download them from : https://github.com/theraw/The-World-Is-Yours/releases
-     ```
-- 3 : **Compile from source (Hard)**
-     ```bash
-     apt-get -y install git && cd /root/ && git clone https://github.com/theraw/The-World-Is-Yours.git && cd The-World-Is-Yours/
-
-     bash build/run.sh new
-     bash build/run.sh build
-     bash build/run.sh postfix
-     ```
-     - 3.1 : **Compiling from source with changed versions**
-          ```bash
-          # assuming you completed step 3.
-          # update "version" file then run again
-          bash build/run.sh new
-          bash build/run.sh build
-          ```
-          
-
-
-## CLI Info
 ```bash
-bash build/run.sh new     => Download all modules + nginx that are missing from /opt/. (If you make version changes to 'version' file then simply rerun this to download again)
+sudo install -d /etc/apt/keyrings
-bash build/run.sh build   => This is going to simply compile nginx nothing else. (You can run this as many times as you need, its not going to replace configs)
+sudo curl -fsSL https://apt.julio.al/repository/public/keys/raweb.asc -o /etc/apt/keyrings/raweb.asc
-bash build/run.sh postfix => This will redownload /nginx/nginx.conf everytime you run it. (Suggested to run only once when you install nginx via my repo for first time)
+echo "deb [signed-by=/etc/apt/keyrings/raweb.asc] https://apt.julio.al/repository/raweb-trixie trixie main" | sudo tee /etc/apt/sources.list.d/raweb.list
+sudo apt update && sudo apt install twiy
 ```
 
+### Ubuntu 26.04 LTS (raccoon)
+```bash
+sudo install -d /etc/apt/keyrings
+sudo curl -fsSL https://apt.julio.al/repository/public/keys/raweb.asc -o /etc/apt/keyrings/raweb.asc
+echo "deb [signed-by=/etc/apt/keyrings/raweb.asc] https://apt.julio.al/repository/raweb-raccoon raccoon main" | sudo tee /etc/apt/sources.list.d/raweb.list
+sudo apt update && sudo apt install twiy
+```
 
-## Nginx Structure.
+## Compile from source
+
+Pick the script that matches your OS — they're separate so apt package
+divergences (e.g. the t64 ABI transition on Ubuntu 24.04+) stay isolated.
 
 ```bash
+apt-get -y install git && cd /root/ && git clone https://git.julio.al/theraw/The-World-Is-Yours.git && cd The-World-Is-Yours/
+
+# Debian 13
+bash build/trixie.sh new
+bash build/trixie.sh build
+bash build/trixie.sh postfix
+
+# Ubuntu 26.04 LTS
+bash build/raccoon.sh new
+bash build/raccoon.sh build
+bash build/raccoon.sh postfix
+```
+
+To try a different upstream version, edit `version` and re-run `new` then `build`.
+
+## CLI Info
+```
+bash build/<distro>.sh new     => Download all modules + nginx that are missing from /opt/.
+                                  (Re-run after changing the `version` file to fetch new versions.)
+bash build/<distro>.sh build   => Compile nginx. Re-runnable; will not touch your configs.
+bash build/<distro>.sh postfix => Drop the default /nginx/nginx.conf, vhost, and systemd unit
+                                  into place. Run once on first install; re-running overwrites
+                                  /nginx/nginx.conf.
+```
+where `<distro>` is `trixie` or `raccoon`.
+
+
+## Nginx info.
+
+```
 => Nginx Folder     = /nginx/
 => --conf-path      = /nginx/nginx.conf
 => --pid-path       = /var/run/nginx.pid 
@@ -79,26 +74,24 @@ bash build/run.sh postfix => This will redownload /nginx/nginx.conf everytime yo
 => --error-log-path = /var/log/nginx/error.log
 
 LUA RESTY CORE SCRIPTS = /usr/nginx_lua
-
-# Admin Panel Info
-=> Folder           = /nginx/admin/public_html 
 ```
 
 ## How to install lua scripts 
+```
+. /root/The-World-Is-Yours/version
+cd /opt/mod/; git clone https://github.com/openresty/lua-resty-lrucache.git
+cd /opt/mod/lua-resty-lrucache; make install PREFIX=${LUA_SCRIPTS}
+nginx -s reload
+```
 
-- Method 1
+## Performance
-  ```bash
+
-  . /root/The-World-Is-Yours/version
+### vs. vanilla nginx (same version, default config)
-  cd /opt/mod/; git clone https://github.com/openresty/lua-resty-lrucache.git
+
-  cd /opt/mod/lua-resty-lrucache; make install PREFIX=${LUA_SCRIPTS}
+| Area | Twiy | Vanilla nginx | Why |
-  nginx -s reload
+|---|---|---|---|
-  ```
+| TLS handshake throughput | **+5–15%** | baseline | AWS-LC's tuned AES/ChaCha asm vs OpenSSL |
-- Method 2
+| WAF, Lua, HTTP/3 | included | not included | needs custom build |
-  ```bash
-  # At first when you use this method you may get errors for missing lua scripts, you can install them with "luarocks".
-  apt-get install luarocks
-  luarocks install lua-resty-lrucache
-  ```
 
 # Support options.
 

build/raccoon.sh

@@ -6,8 +6,8 @@ function reqs() {
     # apt-get purge nftables firewalld ufw -y; apt-get autoremove -y
     apt-get -y install wget zip unzip build-essential libssl-dev curl nano git
     # apt-get -y install iptables ipset
-    apt-get install libtool pkg-config make cmake automake autoconf -y
+    apt-get install libtool pkg-config make cmake automake autoconf golang-go ninja-build -y
-    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2 libxml2-dev libpcre3-dev mercurial libpcre2-dev libc-ares-dev libre2-dev -y
+    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2-dev mercurial libpcre2-dev libc-ares-dev libre2-dev libzstd-dev libjemalloc2 -y
     mkdir -p $LUA_SCRIPTS
 }
 function clean_install() {
@@ -21,10 +21,23 @@ function clean_install() {
 
     # START OF SYSTEM REQUIRED LIBS
     # ============================================================================================================
-    # OPENSSL
+    # AWS-LC — TLS+QUIC backend. Replaces quictls/openssl. Built standalone
-    if [ ! -d /opt/mod/openssl-opernssl-${SYSTEM_OPENSSL} ]; then
+    # (cmake+ninja) and installed to /usr/local/aws-lc/. nginx 1.29.2+ links
-        cd /opt/mod; wget https://github.com/quictls/openssl/archive/refs/tags/opernssl-${SYSTEM_OPENSSL}.tar.gz
+    # against it via -I/-L; we no longer pass --with-openssl=PATH because we
-        cd /opt/mod && tar xf opernssl-${SYSTEM_OPENSSL}.tar.gz; rm -Rf opernssl-${SYSTEM_OPENSSL}.tar.gz
+    # don't want nginx's configure to rebuild OpenSSL itself.
+    if [ ! -d /opt/mod/aws-lc-${SYSTEM_AWSLC} ]; then
+        cd /opt/mod && wget https://github.com/aws/aws-lc/archive/refs/tags/v${SYSTEM_AWSLC}.tar.gz
+        cd /opt/mod && tar xf v${SYSTEM_AWSLC}.tar.gz; rm -Rf v${SYSTEM_AWSLC}.tar.gz
+    fi
+    if [ ! -f /usr/local/aws-lc/lib/libssl.so ]; then
+        cd /opt/mod/aws-lc-${SYSTEM_AWSLC} && \
+            cmake -GNinja -B build \
+                -DCMAKE_INSTALL_PREFIX=/usr/local/aws-lc \
+                -DBUILD_SHARED_LIBS=1 \
+                -DCMAKE_BUILD_TYPE=Release && \
+            cmake --build build -j`nproc` && \
+            cmake --install build && \
+            ldconfig
     fi
 
     # ZLIB
@@ -43,20 +56,22 @@ function clean_install() {
         fi
     fi
 
-    # SYSTEM_MODSECURITY
+    # SYSTEM_MODSECURITY (v3 — libmodsecurity, what ModSecurity-nginx connector needs)
     if [ ! -d /opt/mod/modsecurity-v${SYSTEM_MODSECURITY} ]; then
         cd /opt/mod && wget https://github.com/SpiderLabs/ModSecurity/releases/download/v${SYSTEM_MODSECURITY}/modsecurity-v${SYSTEM_MODSECURITY}.tar.gz
         cd /opt/mod && tar xf modsecurity-v${SYSTEM_MODSECURITY}.tar.gz; rm -Rf modsecurity-v${SYSTEM_MODSECURITY}.tar.gz
-        if [ ! -d /usr/local/modsecurity ]; then
-            cd /opt/mod/modsecurity-v${SYSTEM_MODSECURITY} && ./configure && make -j`nproc` && make install
     fi
+    if [ ! -f /usr/local/modsecurity/lib/libmodsecurity.so ]; then
+        cd /opt/mod/modsecurity-v${SYSTEM_MODSECURITY} && ./build.sh && ./configure --without-pcre --with-pcre2 && make -j`nproc` && make install
     fi
 
     # SYSTEM_PCRE
-    if [ ! -d /opt/mod/pcre2-pcre2-${SYSTEM_PCRE} ]; then
+    # Use the official release tarball (bundles the sljit submodule needed for
-        cd /opt/mod && wget https://github.com/PCRE2Project/pcre2/archive/refs/tags/pcre2-${SYSTEM_PCRE}.tar.gz
+    # JIT). The /archive/refs/tags/ tarball from GitHub is a raw source snapshot
+    # that omits submodules and breaks `--with-pcre-jit`.
+    if [ ! -d /opt/mod/pcre2-${SYSTEM_PCRE} ]; then
+        cd /opt/mod && wget https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${SYSTEM_PCRE}/pcre2-${SYSTEM_PCRE}.tar.gz
         cd /opt/mod && tar xf pcre2-${SYSTEM_PCRE}.tar.gz; rm -Rf pcre2-${SYSTEM_PCRE}.tar.gz
-        cd /opt/mod/pcre2-pcre2-${SYSTEM_PCRE} && ./autogen.sh
     fi
 
     # LibInjection
@@ -75,18 +90,36 @@ function clean_install() {
         cd /opt/mod/; wget https://github.com/openresty/lua-nginx-module/archive/refs/tags/v${NGX_MOD_LUA}.tar.gz
         cd /opt/mod/; tar xf v${NGX_MOD_LUA}.tar.gz; rm -Rf v${NGX_MOD_LUA}.tar.gz
         sed -i 's/cookies/cookie/g' /opt/mod/lua-nginx-module-${NGX_MOD_LUA}/src/ngx_http_lua_headers_in.c
+        # AWS-LC compatibility: lua-nginx-module already has guards around APIs
+        # missing from BoringSSL (SSL_get1_supported_ciphers, SSL_export_keying_
+        # material_early, etc.). AWS-LC has the same API limitations but defines
+        # OPENSSL_IS_AWSLC instead of OPENSSL_IS_BORINGSSL, so the guards never
+        # fire. Broaden every form (#if, #ifdef, #ifndef, #elif) to recognise
+        # both macros. Order matters: the bare `defined()` substitution runs
+        # first so the later #ifdef/#ifndef substitutions don't double-rewrite.
+        sed -i \
+            -e 's@defined(OPENSSL_IS_BORINGSSL)@(defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC))@g' \
+            -e 's@#ifdef OPENSSL_IS_BORINGSSL@#if (defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC))@g' \
+            -e 's@#ifndef OPENSSL_IS_BORINGSSL@#if !(defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC))@g' \
+            /opt/mod/lua-nginx-module-${NGX_MOD_LUA}/src/*.c
     fi
 
-    # NGX_LUA_CORE
+    # NGX_LUA_CORE — must stay in lockstep with NGX_MOD_LUA. lua-resty-core
-    if [ ! -d /opt/mod/lua-resty-core ]; then
+    # does a strict-equality check on ngx.config.ngx_lua_version at startup,
-        cd /opt/mod/; git clone https://github.com/openresty/lua-resty-core.git
+    # so an upstream bump on master silently breaks the build. Pinning via
-        cd /opt/mod/lua-resty-core; make install PREFIX=${LUA_SCRIPTS}
+    # the tagged tarball (dir name embeds the version) means changing
+    # LUA_SCRIPTS_RESTYCORE in `version` invalidates the cache automatically.
+    if [ ! -d /opt/mod/lua-resty-core-${LUA_SCRIPTS_RESTYCORE} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/lua-resty-core/archive/refs/tags/v${LUA_SCRIPTS_RESTYCORE}.tar.gz
+        cd /opt/mod/; tar xf v${LUA_SCRIPTS_RESTYCORE}.tar.gz; rm -Rf v${LUA_SCRIPTS_RESTYCORE}.tar.gz
+        cd /opt/mod/lua-resty-core-${LUA_SCRIPTS_RESTYCORE} && make install PREFIX=${LUA_SCRIPTS}
     fi
 
-    # NGX_LUA_LRUCACHE
+    # NGX_LUA_LRUCACHE — same pattern, pinned to LUA_SCRIPTS_LRUCACHE.
-    if [ ! -d /opt/mod/lua-resty-lrucache ]; then
+    if [ ! -d /opt/mod/lua-resty-lrucache-${LUA_SCRIPTS_LRUCACHE} ]; then
-        cd /opt/mod/; git clone https://github.com/openresty/lua-resty-lrucache.git
+        cd /opt/mod/; wget https://github.com/openresty/lua-resty-lrucache/archive/refs/tags/v${LUA_SCRIPTS_LRUCACHE}.tar.gz
-        cd /opt/mod/lua-resty-lrucache; make install PREFIX=${LUA_SCRIPTS}
+        cd /opt/mod/; tar xf v${LUA_SCRIPTS_LRUCACHE}.tar.gz; rm -Rf v${LUA_SCRIPTS_LRUCACHE}.tar.gz
+        cd /opt/mod/lua-resty-lrucache-${LUA_SCRIPTS_LRUCACHE} && make install PREFIX=${LUA_SCRIPTS}
     fi
 
     # NGX_MOD_LUA_MYSQL
@@ -171,6 +204,14 @@ function clean_install() {
         cd /opt/mod/; git clone --recurse-submodules https://github.com/wargio/naxsi.git naxsi
     fi
 
+    # NGX_MOD_ZSTD — Zstandard compression module from tokers. Pinned via
+    # NGX_MOD_ZSTD; tarball pattern (dir name embeds version → cache invalidates
+    # automatically when the pin moves).
+    if [ ! -d /opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD} ]; then
+        cd /opt/mod/; wget https://github.com/tokers/zstd-nginx-module/archive/refs/tags/${NGX_MOD_ZSTD}.tar.gz
+        cd /opt/mod/; tar xf ${NGX_MOD_ZSTD}.tar.gz; rm -Rf ${NGX_MOD_ZSTD}.tar.gz
+    fi
+
     # END OF NGINX MODULES
     # ============================================================================================================
 }
@@ -186,11 +227,9 @@ test_nginx() {
                                           --lock-path=/var/run/nginx.lock                                         \
                                           --error-log-path=/var/log/nginx/error.log                               \
                                           --http-log-path=/var/log/nginx/access.log                               \
-                                          --with-openssl=/opt/mod/openssl-opernssl-${SYSTEM_OPENSSL}              \
-                                          --with-openssl-opt=enable-tls1_3                                        \
                                           --with-pcre                                                             \
                                           --with-pcre-jit                                                         \
-                                          --with-pcre=/opt/mod/pcre2-pcre2-${SYSTEM_PCRE}                         \
+                                          --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
                                           --with-zlib=/opt/mod/zlib                                               \
                                           --with-threads                                                          \
                                           --with-file-aio                                                         \
@@ -230,9 +269,10 @@ test_nginx() {
                                           --add-module=/opt/mod/srcache-nginx-module-${NGX_MOD_LUA_SRCACHE}       \
                                           --add-module=/opt/mod/redis2-nginx-module                               \
                                           --add-module=/opt/mod/ngx_brotli                                        \
+                                          --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
                                           --add-module=/opt/mod/testcookie                                        \
-                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" \
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
-                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/lib/x86_64-linux-gnu -lpcre"
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
                                           make clean
 }
 function build() {
@@ -246,11 +286,9 @@ function build() {
                                           --lock-path=/var/run/nginx.lock                                         \
                                           --error-log-path=/var/log/nginx/error.log                               \
                                           --http-log-path=/var/log/nginx/access.log                               \
-                                          --with-openssl=/opt/mod/openssl-opernssl-${SYSTEM_OPENSSL}              \
-                                          --with-openssl-opt=enable-tls1_3                                        \
                                           --with-pcre                                                             \
                                           --with-pcre-jit                                                         \
-                                          --with-pcre=/opt/mod/pcre2-pcre2-${SYSTEM_PCRE}                         \
+                                          --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
                                           --with-zlib=/opt/mod/zlib                                               \
                                           --with-threads                                                          \
                                           --with-file-aio                                                         \
@@ -290,10 +328,16 @@ function build() {
                                           --add-module=/opt/mod/srcache-nginx-module-${NGX_MOD_LUA_SRCACHE}       \
                                           --add-module=/opt/mod/redis2-nginx-module                               \
                                           --add-module=/opt/mod/ngx_brotli                                        \
+                                          --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
                                           --add-module=/opt/mod/testcookie                                        \
-                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" \
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
-                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/lib/x86_64-linux-gnu -lpcre"
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
-                                          make -j`nproc` && make install && make clean
+    # NOTE: kept as separate statements (not `make && make install && make clean`)
+    # so `set -e` actually fires on a make failure. The && chain hides left-side
+    # failures from set -e, which previously let half-built nginx ship.
+    cd /opt/nginx-${NGINX} && make -j`nproc`
+    cd /opt/nginx-${NGINX} && make install
+    cd /opt/nginx-${NGINX} && make clean
     unset NGINX
 }
 function post_build() {
@@ -314,9 +358,9 @@ function post_build() {
     if [ -f "/run/.containerenv" ] || [ -f "/.dockerenv" ] || [ -f "/home/runner/.dockerenv" ]; then
         echo "Skipping systemctl commands on GitHub runner"
         mkdir -p /etc/systemd/system/
-        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Jammy/nginx.service > /etc/systemd/system/nginx.service
+        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Raccoon/nginx.service > /etc/systemd/system/nginx.service
     else
-        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Jammy/nginx.service > /etc/systemd/system/nginx.service
+        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Raccoon/nginx.service > /etc/systemd/system/nginx.service
         systemctl daemon-reload
         systemctl start nginx.service
         systemctl enable nginx.service

build/trixie.sh

@@ -0,0 +1,395 @@
+. ./version
+set -e
+function reqs() {
+    apt-get update -y; apt-get upgrade -y; apt-get dist-upgrade -y; apt-get autoremove -y
+    DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get -y install tzdata dialog
+    # apt-get purge nftables firewalld ufw -y; apt-get autoremove -y
+    apt-get -y install wget zip unzip build-essential libssl-dev curl nano git
+    # apt-get -y install iptables ipset
+    apt-get install libtool pkg-config make cmake automake autoconf golang-go ninja-build -y
+    apt-get install libyajl-dev ssdeep zlib1g-dev libxslt1-dev libgd-dev libgeoip-dev liblmdb-dev libfuzzy-dev libmaxminddb-dev liblua5.1-dev libcurl4-openssl-dev libxml2 libxml2-dev mercurial libpcre2-dev libc-ares-dev libre2-dev libzstd-dev libjemalloc2 -y
+    mkdir -p $LUA_SCRIPTS
+}
+function clean_install() {
+     mkdir -p /opt/mod
+
+    # Nginx
+    if [ ! -d /opt/nginx-${NGINX} ]; then
+        cd /opt/ && wget https://nginx.org/download/nginx-${NGINX}.tar.gz
+        tar xf nginx-${NGINX}.tar.gz && rm -Rf nginx-${NGINX}.tar.gz
+    fi
+
+    # START OF SYSTEM REQUIRED LIBS
+    # ============================================================================================================
+    # AWS-LC — TLS+QUIC backend. Replaces quictls/openssl. Built standalone
+    # (cmake+ninja) and installed to /usr/local/aws-lc/. nginx 1.29.2+ links
+    # against it via -I/-L; we no longer pass --with-openssl=PATH because we
+    # don't want nginx's configure to rebuild OpenSSL itself.
+    if [ ! -d /opt/mod/aws-lc-${SYSTEM_AWSLC} ]; then
+        cd /opt/mod && wget https://github.com/aws/aws-lc/archive/refs/tags/v${SYSTEM_AWSLC}.tar.gz
+        cd /opt/mod && tar xf v${SYSTEM_AWSLC}.tar.gz; rm -Rf v${SYSTEM_AWSLC}.tar.gz
+    fi
+    if [ ! -f /usr/local/aws-lc/lib/libssl.so ]; then
+        cd /opt/mod/aws-lc-${SYSTEM_AWSLC} && \
+            cmake -GNinja -B build \
+                -DCMAKE_INSTALL_PREFIX=/usr/local/aws-lc \
+                -DBUILD_SHARED_LIBS=1 \
+                -DCMAKE_BUILD_TYPE=Release && \
+            cmake --build build -j`nproc` && \
+            cmake --install build && \
+            ldconfig
+    fi
+
+    # ZLIB
+    if [ ! -d /opt/mod/zlib ]; then
+        cd /opt/mod && wget http://zlib.net/current/zlib.tar.gz
+        cd /opt/mod && tar xf zlib.tar.gz; rm -Rf zlib.tar.gz; mv zlib-* zlib
+    fi
+
+    # SYSTEM_LUAJIT
+    if [ ! -d /opt/mod/luajit2-${SYSTEM_LUAJIT} ]; then
+        cd /opt/mod && wget https://github.com/openresty/luajit2/archive/refs/tags/v${SYSTEM_LUAJIT}.tar.gz
+        cd /opt/mod && tar xf v${SYSTEM_LUAJIT}.tar.gz && rm -Rf v${SYSTEM_LUAJIT}.tar.gz
+        if [ ! -d /usr/local/LuaJIT/include/luajit-2.1 ]; then
+            cd /opt/mod/luajit2-${SYSTEM_LUAJIT}/ && make clean && make install PREFIX=/usr/local/LuaJIT && ldconfig
+#            apt-get -y install liblua5.1-0-dev; apt-get -y install luarocks; luarocks install lua-resty-core
+        fi
+    fi
+
+    # SYSTEM_MODSECURITY (v3 — libmodsecurity, what ModSecurity-nginx connector needs)
+    if [ ! -d /opt/mod/modsecurity-v${SYSTEM_MODSECURITY} ]; then
+        cd /opt/mod && wget https://github.com/SpiderLabs/ModSecurity/releases/download/v${SYSTEM_MODSECURITY}/modsecurity-v${SYSTEM_MODSECURITY}.tar.gz
+        cd /opt/mod && tar xf modsecurity-v${SYSTEM_MODSECURITY}.tar.gz; rm -Rf modsecurity-v${SYSTEM_MODSECURITY}.tar.gz
+    fi
+    if [ ! -f /usr/local/modsecurity/lib/libmodsecurity.so ]; then
+        cd /opt/mod/modsecurity-v${SYSTEM_MODSECURITY} && ./build.sh && ./configure --without-pcre --with-pcre2 && make -j`nproc` && make install
+    fi
+
+    # SYSTEM_PCRE
+    # Use the official release tarball (bundles the sljit submodule needed for
+    # JIT). The /archive/refs/tags/ tarball from GitHub is a raw source snapshot
+    # that omits submodules and breaks `--with-pcre-jit`.
+    if [ ! -d /opt/mod/pcre2-${SYSTEM_PCRE} ]; then
+        cd /opt/mod && wget https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${SYSTEM_PCRE}/pcre2-${SYSTEM_PCRE}.tar.gz
+        cd /opt/mod && tar xf pcre2-${SYSTEM_PCRE}.tar.gz; rm -Rf pcre2-${SYSTEM_PCRE}.tar.gz
+    fi
+
+    # LibInjection
+    if [ ! -d /opt/mod/libinjection ]; then
+        cd /opt/mod && git clone https://github.com/libinjection/libinjection.git
+        cd /opt/mod/libinjection && ./autogen.sh && ./configure && make -j`nproc` && make install
+    fi
+    # END OF SYSTEM REQUIRED LIBS
+    # ============================================================================================================
+
+
+    # START OF NGINX MODULES
+    # ============================================================================================================
+    # NGX_MOD_LUA
+    if [ ! -d /opt/mod/lua-nginx-module-${NGX_MOD_LUA} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/lua-nginx-module/archive/refs/tags/v${NGX_MOD_LUA}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_LUA}.tar.gz; rm -Rf v${NGX_MOD_LUA}.tar.gz
+        sed -i 's/cookies/cookie/g' /opt/mod/lua-nginx-module-${NGX_MOD_LUA}/src/ngx_http_lua_headers_in.c
+        # AWS-LC compatibility: lua-nginx-module already has guards around APIs
+        # missing from BoringSSL (SSL_get1_supported_ciphers, SSL_export_keying_
+        # material_early, etc.). AWS-LC has the same API limitations but defines
+        # OPENSSL_IS_AWSLC instead of OPENSSL_IS_BORINGSSL, so the guards never
+        # fire. Broaden every form (#if, #ifdef, #ifndef, #elif) to recognise
+        # both macros. Order matters: the bare `defined()` substitution runs
+        # first so the later #ifdef/#ifndef substitutions don't double-rewrite.
+        sed -i \
+            -e 's@defined(OPENSSL_IS_BORINGSSL)@(defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC))@g' \
+            -e 's@#ifdef OPENSSL_IS_BORINGSSL@#if (defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC))@g' \
+            -e 's@#ifndef OPENSSL_IS_BORINGSSL@#if !(defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC))@g' \
+            /opt/mod/lua-nginx-module-${NGX_MOD_LUA}/src/*.c
+    fi
+
+    # NGX_LUA_CORE — must stay in lockstep with NGX_MOD_LUA. lua-resty-core
+    # does a strict-equality check on ngx.config.ngx_lua_version at startup,
+    # so an upstream bump on master silently breaks the build. Pinning via
+    # the tagged tarball (dir name embeds the version) means changing
+    # LUA_SCRIPTS_RESTYCORE in `version` invalidates the cache automatically.
+    if [ ! -d /opt/mod/lua-resty-core-${LUA_SCRIPTS_RESTYCORE} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/lua-resty-core/archive/refs/tags/v${LUA_SCRIPTS_RESTYCORE}.tar.gz
+        cd /opt/mod/; tar xf v${LUA_SCRIPTS_RESTYCORE}.tar.gz; rm -Rf v${LUA_SCRIPTS_RESTYCORE}.tar.gz
+        cd /opt/mod/lua-resty-core-${LUA_SCRIPTS_RESTYCORE} && make install PREFIX=${LUA_SCRIPTS}
+    fi
+
+    # NGX_LUA_LRUCACHE — same pattern, pinned to LUA_SCRIPTS_LRUCACHE.
+    if [ ! -d /opt/mod/lua-resty-lrucache-${LUA_SCRIPTS_LRUCACHE} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/lua-resty-lrucache/archive/refs/tags/v${LUA_SCRIPTS_LRUCACHE}.tar.gz
+        cd /opt/mod/; tar xf v${LUA_SCRIPTS_LRUCACHE}.tar.gz; rm -Rf v${LUA_SCRIPTS_LRUCACHE}.tar.gz
+        cd /opt/mod/lua-resty-lrucache-${LUA_SCRIPTS_LRUCACHE} && make install PREFIX=${LUA_SCRIPTS}
+    fi
+
+    # NGX_MOD_LUA_MYSQL
+    if [ ! -d /opt/mod/lua-resty-mysql-${NGX_MOD_LUA_MYSQL} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/lua-resty-mysql/archive/refs/tags/v${NGX_MOD_LUA_MYSQL}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_LUA_MYSQL}.tar.gz; rm -Rf v${NGX_MOD_LUA_MYSQL}.tar.gz
+        cd /opt/mod/lua-resty-mysql-${NGX_MOD_LUA_MYSQL} && make install PREFIX=${LUA_SCRIPTS}
+    fi
+
+    # NGX_MOD_LUA_SRCACHE
+    if [ ! -d /opt/mod/srcache-nginx-module-${NGX_MOD_LUA_SRCACHE} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/srcache-nginx-module/archive/refs/tags/v${NGX_MOD_LUA_SRCACHE}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_LUA_SRCACHE}.tar.gz; rm -Rf v${NGX_MOD_LUA_SRCACHE}.tar.gz
+    fi
+
+    # NGX_MOD_LUA_REDIS2
+    if [ ! -d /opt/mod/redis2-nginx-module ]; then
+        cd /opt/mod/; git clone --recursive https://github.com/openresty/redis2-nginx-module.git
+    fi
+
+    # NGX_MOD_LUA_LOCK 0.09
+    if [ ! -d /opt/mod/lua-resty-lock-${NGX_MOD_LUA_LOCK} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/lua-resty-lock/archive/refs/tags/v${NGX_MOD_LUA_LOCK}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_LUA_LOCK}.tar.gz; rm -Rf v${NGX_MOD_LUA_LOCK}.tar.gz
+        cd /opt/mod/lua-resty-lock-${NGX_MOD_LUA_LOCK} && make install PREFIX=${LUA_SCRIPTS}
+    fi
+
+    # NGX_MOD_LUA_CACHE
+    if [ ! -d /opt/mod/lua-resty-cache ]; then
+        cd /opt/mod/; git clone --branch feature-srcache --recursive https://github.com/lloydzhou/lua-resty-cache
+        cd /opt/mod/lua-resty-cache && make install PREFIX=${LUA_SCRIPTS}
+    fi
+
+    # NGX_MOD_DEVELKIT
+    if [ ! -d /opt/mod/ngx_devel_kit-${NGX_MOD_DEVELKIT} ]; then
+        cd /opt/mod/; wget https://github.com/vision5/ngx_devel_kit/archive/refs/tags/v${NGX_MOD_DEVELKIT}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_DEVELKIT}.tar.gz; rm -Rf v${NGX_MOD_DEVELKIT}.tar.gz
+    fi
+
+    # NGX_MOD_GEOIP2
+    if [ ! -d /opt/mod/ngx_http_geoip2_module-${NGX_MOD_GEOIP2} ]; then
+        cd /opt/mod/; wget https://github.com/leev/ngx_http_geoip2_module/archive/refs/tags/${NGX_MOD_GEOIP2}.tar.gz
+        cd /opt/mod/; tar xf ${NGX_MOD_GEOIP2}.tar.gz; rm -Rf ${NGX_MOD_GEOIP2}.tar.gz
+    fi
+
+    # NGX_MOD_MODSECURITY
+    if [ ! -d /opt/mod/ModSecurity-nginx-${NGX_MOD_MODSECURITY} ]; then
+        cd /opt/mod/; wget https://github.com/SpiderLabs/ModSecurity-nginx/archive/refs/tags/v${NGX_MOD_MODSECURITY}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_MODSECURITY}.tar.gz; rm -Rf v${NGX_MOD_MODSECURITY}.tar.gz
+    fi
+
+    # NGX_MOD_HTTPFLV
+    if [ ! -d /opt/mod/nginx-http-flv-module-${NGX_MOD_HTTPFLV} ]; then
+        cd /opt/mod/; wget https://github.com/winshining/nginx-http-flv-module/archive/refs/tags/v${NGX_MOD_HTTPFLV}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_HTTPFLV}.tar.gz; rm -Rf v${NGX_MOD_HTTPFLV}.tar.gz
+    fi
+
+    # NGX_MOD_HEADERS_MORE
+    if [ ! -d /opt/mod/headers-more-nginx-module-${NGX_MOD_HEADERS_MORE} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v${NGX_MOD_HEADERS_MORE}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_HEADERS_MORE}.tar.gz; rm -Rf v${NGX_MOD_HEADERS_MORE}.tar.gz
+    fi
+
+    # NGX_MOD_SETMISC
+    if [ ! -d /opt/mod/set-misc-nginx-module-${NGX_MOD_SETMISC} ]; then
+        cd /opt/mod/; wget https://github.com/openresty/set-misc-nginx-module/archive/refs/tags/v${NGX_MOD_SETMISC}.tar.gz
+        cd /opt/mod/; tar xf v${NGX_MOD_SETMISC}.tar.gz; rm -Rf v${NGX_MOD_SETMISC}.tar.gz
+    fi
+
+    # Testcookie
+    if [ ! -d /opt/mod/testcookie ]; then
+        cd /opt/mod/; git clone https://github.com/kyprizel/testcookie-nginx-module.git testcookie
+    fi
+
+    # Brotli
+    if [ ! -d /opt/mod/ngx_brotli ]; then
+        cd /opt/mod/; git clone https://github.com/google/ngx_brotli.git ngx_brotli; cd /opt/mod/ngx_brotli && git submodule update --init
+    fi
+
+    # Naxsi
+    if [ ! -d /opt/mod/naxsi ]; then
+        cd /opt/mod/; git clone --recurse-submodules https://github.com/wargio/naxsi.git naxsi
+    fi
+
+    # NGX_MOD_ZSTD — Zstandard compression module from tokers. Pinned via
+    # NGX_MOD_ZSTD; tarball pattern (dir name embeds version → cache invalidates
+    # automatically when the pin moves).
+    if [ ! -d /opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD} ]; then
+        cd /opt/mod/; wget https://github.com/tokers/zstd-nginx-module/archive/refs/tags/${NGX_MOD_ZSTD}.tar.gz
+        cd /opt/mod/; tar xf ${NGX_MOD_ZSTD}.tar.gz; rm -Rf ${NGX_MOD_ZSTD}.tar.gz
+    fi
+
+    # END OF NGINX MODULES
+    # ============================================================================================================
+}
+
+test_nginx() {
+    cd /opt/nginx-${NGINX} && LUAJIT_LIB="/usr/local/LuaJIT/lib" LUAJIT_INC="/usr/local/LuaJIT/include/luajit-2.1/" CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --with-compat \
+                                          --user=nginx                                                            \
+                                          --group=nginx                                                           \
+                                          --sbin-path=/usr/sbin/nginx                                             \
+                                          --conf-path=/nginx/nginx.conf                                           \
+                                          --modules-path=/nginx/modules                                           \
+                                          --pid-path=/var/run/nginx.pid                                           \
+                                          --lock-path=/var/run/nginx.lock                                         \
+                                          --error-log-path=/var/log/nginx/error.log                               \
+                                          --http-log-path=/var/log/nginx/access.log                               \
+                                          --with-pcre                                                             \
+                                          --with-pcre-jit                                                         \
+                                          --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
+                                          --with-zlib=/opt/mod/zlib                                               \
+                                          --with-threads                                                          \
+                                          --with-file-aio                                                         \
+                                          --with-http_ssl_module                                                  \
+                                          --with-http_v2_module                                                   \
+                                          --with-http_v3_module                                                   \
+                                          --with-http_realip_module                                               \
+                                          --with-http_addition_module                                             \
+                                          --with-http_xslt_module                                                 \
+                                          --with-http_image_filter_module                                         \
+                                          --with-http_geoip_module                                                \
+                                          --with-http_sub_module                                                  \
+                                          --with-http_dav_module                                                  \
+                                          --with-http_flv_module                                                  \
+                                          --with-http_mp4_module                                                  \
+                                          --with-http_gunzip_module                                               \
+                                          --with-http_gzip_static_module                                          \
+                                          --with-http_auth_request_module                                         \
+                                          --with-http_random_index_module                                         \
+                                          --with-http_secure_link_module                                          \
+                                          --with-http_slice_module                                                \
+                                          --with-http_stub_status_module                                          \
+                                          --with-mail                                                             \
+                                          --with-mail_ssl_module                                                  \
+                                          --with-stream                                                           \
+                                          --with-stream_ssl_module                                                \
+                                          --with-stream_realip_module                                             \
+                                          --with-stream_geoip_module                                              \
+                                          --add-module=/opt/mod/ngx_devel_kit-${NGX_MOD_DEVELKIT}                 \
+                                          --add-module=/opt/mod/set-misc-nginx-module-${NGX_MOD_SETMISC}          \
+                                          --add-module=/opt/mod/ngx_http_geoip2_module-${NGX_MOD_GEOIP2}          \
+                                          --add-module=/opt/mod/headers-more-nginx-module-${NGX_MOD_HEADERS_MORE} \
+                                          --add-module=/opt/mod/lua-nginx-module-${NGX_MOD_LUA}                   \
+                                          --add-module=/opt/mod/ModSecurity-nginx-${NGX_MOD_MODSECURITY}          \
+                                          --add-module=/opt/mod/naxsi/naxsi_src                                   \
+                                          --add-module=/opt/mod/nginx-http-flv-module-${NGX_MOD_HTTPFLV}          \
+                                          --add-module=/opt/mod/srcache-nginx-module-${NGX_MOD_LUA_SRCACHE}       \
+                                          --add-module=/opt/mod/redis2-nginx-module                               \
+                                          --add-module=/opt/mod/ngx_brotli                                        \
+                                          --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
+                                          --add-module=/opt/mod/testcookie                                        \
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
+                                          make clean
+}
+function build() {
+    cd /opt/nginx-${NGINX} && LUAJIT_LIB="/usr/local/LuaJIT/lib" LUAJIT_INC="/usr/local/LuaJIT/include/luajit-2.1/" CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --with-compat \
+                                          --user=nginx                                                            \
+                                          --group=nginx                                                           \
+                                          --sbin-path=/usr/sbin/nginx                                             \
+                                          --conf-path=/nginx/nginx.conf                                           \
+                                          --modules-path=/nginx/modules                                           \
+                                          --pid-path=/var/run/nginx.pid                                           \
+                                          --lock-path=/var/run/nginx.lock                                         \
+                                          --error-log-path=/var/log/nginx/error.log                               \
+                                          --http-log-path=/var/log/nginx/access.log                               \
+                                          --with-pcre                                                             \
+                                          --with-pcre-jit                                                         \
+                                          --with-pcre=/opt/mod/pcre2-${SYSTEM_PCRE}                         \
+                                          --with-zlib=/opt/mod/zlib                                               \
+                                          --with-threads                                                          \
+                                          --with-file-aio                                                         \
+                                          --with-http_ssl_module                                                  \
+                                          --with-http_v2_module                                                   \
+                                          --with-http_v3_module                                                   \
+                                          --with-http_realip_module                                               \
+                                          --with-http_addition_module                                             \
+                                          --with-http_xslt_module                                                 \
+                                          --with-http_image_filter_module                                         \
+                                          --with-http_geoip_module                                                \
+                                          --with-http_sub_module                                                  \
+                                          --with-http_dav_module                                                  \
+                                          --with-http_flv_module                                                  \
+                                          --with-http_mp4_module                                                  \
+                                          --with-http_gunzip_module                                               \
+                                          --with-http_gzip_static_module                                          \
+                                          --with-http_auth_request_module                                         \
+                                          --with-http_random_index_module                                         \
+                                          --with-http_secure_link_module                                          \
+                                          --with-http_slice_module                                                \
+                                          --with-http_stub_status_module                                          \
+                                          --with-mail                                                             \
+                                          --with-mail_ssl_module                                                  \
+                                          --with-stream                                                           \
+                                          --with-stream_ssl_module                                                \
+                                          --with-stream_realip_module                                             \
+                                          --with-stream_geoip_module                                              \
+                                          --add-module=/opt/mod/ngx_devel_kit-${NGX_MOD_DEVELKIT}                 \
+                                          --add-module=/opt/mod/set-misc-nginx-module-${NGX_MOD_SETMISC}          \
+                                          --add-module=/opt/mod/ngx_http_geoip2_module-${NGX_MOD_GEOIP2}          \
+                                          --add-module=/opt/mod/headers-more-nginx-module-${NGX_MOD_HEADERS_MORE} \
+                                          --add-module=/opt/mod/ModSecurity-nginx-${NGX_MOD_MODSECURITY}          \
+                                          --add-module=/opt/mod/lua-nginx-module-${NGX_MOD_LUA}                   \
+                                          --add-module=/opt/mod/naxsi/naxsi_src                                   \
+                                          --add-module=/opt/mod/nginx-http-flv-module-${NGX_MOD_HTTPFLV}          \
+                                          --add-module=/opt/mod/srcache-nginx-module-${NGX_MOD_LUA_SRCACHE}       \
+                                          --add-module=/opt/mod/redis2-nginx-module                               \
+                                          --add-module=/opt/mod/ngx_brotli                                        \
+                                          --add-module=/opt/mod/zstd-nginx-module-${NGX_MOD_ZSTD}                  \
+                                          --add-module=/opt/mod/testcookie                                        \
+                                          --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I/usr/local/aws-lc/include" \
+                                          --with-ld-opt="-Wl,-rpath,/usr/local/LuaJIT/lib -Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L/opt/mod/pcre2-${SYSTEM_PCRE}/.libs -lpcre2-8 -L/usr/local/aws-lc/lib -lssl -lcrypto -Wl,-rpath,/usr/local/aws-lc/lib"
+    # NOTE: kept as separate statements (not `make && make install && make clean`)
+    # so `set -e` actually fires on a make failure. The && chain hides left-side
+    # failures from set -e, which previously let half-built nginx ship.
+    cd /opt/nginx-${NGINX} && make -j`nproc`
+    cd /opt/nginx-${NGINX} && make install
+    cd /opt/nginx-${NGINX} && make clean
+    unset NGINX
+}
+function post_build() {
+    useradd nginx; unset NGINX; rm -rf /nginx/*.default;
+    mkdir -p /nginx/live
+    mkdir -p /nginx/conf.d
+    mkdir -p /nginx/config
+    mkdir -p /var/log/nginx
+    mkdir -p /nginx/modsec; curl -s https://raw.githubusercontent.com/nbs-system/naxsi/master/naxsi_config/naxsi_core.rules > /nginx/modsec/naxi.core
+    curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/modsec/l7.conf > /nginx/modsec/l7.conf
+    curl -s https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended > /nginx/modsec/modsecurity.conf
+    curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/modsec/tester.conf > /nginx/modsec/tester.conf
+    curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/modsec/unicode.mapping > /nginx/modsec/unicode.mapping
+    curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/nginx/nginx.conf > /nginx/nginx.conf
+    curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/nginx/live/default > /nginx/live/default
+    mkdir -p /hostdata/default/public_html/ && curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/index.html > /hostdata/default/public_html/index.html
+    mkdir -p /hostdata/default/public_html/cdn/modsec && curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/modsec/aes.min.js > /hostdata/default/public_html/cdn/modsec/aes.min.js
+    if [ -f "/run/.containerenv" ] || [ -f "/.dockerenv" ] || [ -f "/home/runner/.dockerenv" ]; then
+        echo "Skipping systemctl commands on GitHub runner"
+        mkdir -p /etc/systemd/system/
+        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Trixie/nginx.service > /etc/systemd/system/nginx.service
+    else
+        curl -s https://raw.githubusercontent.com/theraw/The-World-Is-Yours/master/static/Trixie/nginx.service > /etc/systemd/system/nginx.service
+        systemctl daemon-reload
+        systemctl start nginx.service
+        systemctl enable nginx.service
+    fi
+}
+
+# Handling command-line arguments
+case "$1" in
+    new)
+        reqs
+        clean_install
+        ;;
+    test)
+        test_nginx
+        ;;
+    build)
+        build
+        ;;
+    postfix)
+        post_build
+        ;;
+    *)
+        echo "Invalid option: $1"
+        echo "Usage: $0 {new|test|build|postfix}"
+        echo ""
+        echo "  new: will download all modules & nginx (if you change a version from file, simply rerun this to download that)"
+        echo "  test: Test nginx configuration"
+        echo "  build: Build nginx, or Rebuild (mods/configs will not be redownloaded this will only build)"
+        echo "  postfix: After first installation, run this to download nginx configs (it will replace nginx.conf if there already is one)"
+        exit 1
+        ;;
+esac

static/Focal/nginx.service

@@ -1,16 +0,0 @@
-[Nginx]
-Description=A high performance web server and a reverse proxy server
-After=syslog.target network-online.target remote-fs.target nss-lookup.target
-Wants=network-online.target
-        
-[Service]
-Type=forking
-PIDFile=/var/run/nginx.pid
-ExecStartPre=/usr/sbin/nginx -t
-ExecStart=/usr/sbin/nginx
-ExecReload=/usr/sbin/nginx -s reload
-ExecStop=/bin/kill -s QUIT $MAINPID
-PrivateTmp=true
-        
-[Install]
-WantedBy=multi-user.target

static/Jammy/nginx.service

@@ -1,16 +0,0 @@
-[Unit]
-Description=A high performance web server and a reverse proxy server
-After=syslog.target network-online.target remote-fs.target nss-lookup.target
-Wants=network-online.target
-
-[Service]
-Type=forking
-PIDFile=/var/run/nginx.pid
-ExecStartPre=/usr/sbin/nginx -t
-ExecStart=/usr/sbin/nginx
-ExecReload=/usr/sbin/nginx -s reload
-ExecStop=/bin/kill -s QUIT $MAINPID
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target

static/Raccoon/nginx.service

@@ -0,0 +1,57 @@
+[Unit]
+Description=A high performance web server and a reverse proxy server (twiy)
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx.pid
+
+# jemalloc replaces glibc malloc — better fragmentation/perf under nginx's
+# alloc/free churn at scale. Package depends on libjemalloc2 so the .so is
+# guaranteed present. Removing this line falls back to glibc malloc cleanly.
+Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+
+# Self-heal: nginx was compiled without --http-*-temp-path so it expects
+# these dirs under /usr/local/nginx; install -d is idempotent and fixes any
+# missing/wrong ownership on every restart.
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /usr/local/nginx /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/uwsgi_temp /usr/local/nginx/scgi_temp /var/log/nginx
+ExecStartPre=/usr/sbin/nginx -t
+ExecStart=/usr/sbin/nginx
+ExecReload=/usr/sbin/nginx -s reload
+ExecStop=/bin/kill -s QUIT $MAINPID
+
+# ---- systemd hardening (systemd 257+ on Debian 13 / Ubuntu 26.04) ----
+# Each line shrinks the worker's blast radius without affecting throughput.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+PrivateDevices=true
+PrivateTmp=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources @mount @debug @cpu-emulation @obsolete @raw-io @reboot @swap
+
+# Paths nginx legitimately writes to. ProtectSystem=strict makes everything
+# else read-only; these carve out the exceptions.
+ReadWritePaths=/var/log/nginx /usr/local/nginx /run /nginx /hostdata
+
+# NOTE on MemoryDenyWriteExecute: LuaJIT does runtime JIT compilation and
+# therefore needs writable+executable pages — enabling MDWE breaks Lua. Left
+# off intentionally.
+
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target

static/Trixie/nginx.service

@@ -0,0 +1,57 @@
+[Unit]
+Description=A high performance web server and a reverse proxy server (twiy)
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx.pid
+
+# jemalloc replaces glibc malloc — better fragmentation/perf under nginx's
+# alloc/free churn at scale. Package depends on libjemalloc2 so the .so is
+# guaranteed present. Removing this line falls back to glibc malloc cleanly.
+Environment=LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+
+# Self-heal: nginx was compiled without --http-*-temp-path so it expects
+# these dirs under /usr/local/nginx; install -d is idempotent and fixes any
+# missing/wrong ownership on every restart.
+ExecStartPre=/usr/bin/install -d -o nginx -g nginx -m 0755 /usr/local/nginx /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/uwsgi_temp /usr/local/nginx/scgi_temp /var/log/nginx
+ExecStartPre=/usr/sbin/nginx -t
+ExecStart=/usr/sbin/nginx
+ExecReload=/usr/sbin/nginx -s reload
+ExecStop=/bin/kill -s QUIT $MAINPID
+
+# ---- systemd hardening (systemd 257+ on Debian 13 / Ubuntu 26.04) ----
+# Each line shrinks the worker's blast radius without affecting throughput.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+PrivateDevices=true
+PrivateTmp=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources @mount @debug @cpu-emulation @obsolete @raw-io @reboot @swap
+
+# Paths nginx legitimately writes to. ProtectSystem=strict makes everything
+# else read-only; these carve out the exceptions.
+ReadWritePaths=/var/log/nginx /usr/local/nginx /run /nginx /hostdata
+
+# NOTE on MemoryDenyWriteExecute: LuaJIT does runtime JIT compilation and
+# therefore needs writable+executable pages — enabling MDWE breaks Lua. Left
+# off intentionally.
+
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target

static/nginx/nginx.conf

@@ -1,8 +1,14 @@
 # Suggestions? => https://github.com/theraw/The-World-Is-Yours/issues
 # Problems?    => https://github.com/theraw/The-World-Is-Yours/issues
+#
+# Tuned for shared hosting at 5,000+ vhost scale.
+# Per-vhost listen/ssl_certificate directives live in /nginx/live/* — this
+# file only contains the global event/http settings.
+
 user nginx;
 pid /var/run/nginx.pid;
 worker_processes auto;
+worker_cpu_affinity auto;
 worker_rlimit_nofile 65535;
 
 events {
@@ -26,21 +32,46 @@ http {
     # =================== END LOGS ========================= #
 
     # ==================== GENERAL ========================= #
-    client_body_buffer_size        2M;
+    client_header_buffer_size      4k;
-    client_header_buffer_size      2M;
+    large_client_header_buffers    4 16k;
-    client_body_timeout            90s;
+    client_body_buffer_size        16k;
-    client_header_timeout          90s;
     client_max_body_size           2M;
-    keepalive_timeout              15s;
+    client_body_timeout            30s;
+    client_header_timeout          30s;
+    send_timeout                   30s;
+    reset_timedout_connection      on;
+    keepalive_timeout              65s;
+    keepalive_requests             2000;
+    max_headers                    100;
     port_in_redirect               off;
     sendfile                       on;
-    server_names_hash_bucket_size  6969;
+    sendfile_max_chunk             1m;
-    server_name_in_redirect        off;
-    server_tokens                  off;
     tcp_nodelay                    on;
     tcp_nopush                     on;
-    types_hash_max_size            2048;
+    server_tokens                  off;
-    resolver                       1.1.1.1 1.0.0.1;
+    server_name_in_redirect        off;
+
+    server_names_hash_bucket_size  128;
+    server_names_hash_max_size     32768;
+    types_hash_max_size            4096;
+
+    # File metadata cache — biggest single win for static-heavy shared hosting.
+    open_file_cache                max=200000 inactive=30s;
+    open_file_cache_valid          30s;
+    open_file_cache_min_uses       2;
+    open_file_cache_errors         on;
+
+    # ===================== TLS ============================ #
+    ssl_protocols                  TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers      off;
+    ssl_session_cache              shared:SSL:200m;
+    ssl_session_timeout            1d;
+    ssl_session_tickets            off;
+    ssl_stapling                   on;
+    ssl_stapling_verify            on;
+    # ===================== END TLS ======================== #
+    resolver                       1.1.1.1 1.0.0.1 valid=300s;
+    resolver_timeout               5s;
     default_type                   application/octet-stream;
     include                        /nginx/mime.types;
 
@@ -48,6 +79,25 @@ http {
     default upgrade;
     '' close;
     }
+
+    # ==================== COMPRESSION ===================== #
+    gzip                           on;
+    gzip_vary                      on;
+    gzip_proxied                   any;
+    gzip_comp_level                4;
+    gzip_min_length                256;
+    gzip_types                     text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
+
+    brotli                         on;
+    brotli_comp_level              4;
+    brotli_min_length              256;
+    brotli_types                   text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
+
+    zstd                           on;
+    zstd_comp_level                4;
+    zstd_min_length                256;
+    zstd_types                     text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
+    # =================== END COMPRESSION ================== #
     # =================== END GENERAL ====================== #
 
     # ================ LOAD VHOST +CONFIGS ================= #

version

@@ -1,51 +1,60 @@
-export NGINX="1.26.0"
+export NGINX="1.30.0"
 
+# Lua Path
 export LUA_SCRIPTS="/usr/nginx_lua"
 
 # https://github.com/openresty/lua-nginx-module/tags
-export NGX_MOD_LUA="0.10.27"
+export NGX_MOD_LUA="0.10.29"
 
 # https://github.com/vision5/ngx_devel_kit/tags
-export NGX_MOD_DEVELKIT="0.3.3"
+export NGX_MOD_DEVELKIT="0.3.4"
 
 # https://github.com/leev/ngx_http_geoip2_module/releases
 export NGX_MOD_GEOIP2="3.4"
 
 # https://github.com/owasp-modsecurity/ModSecurity-nginx/releases
-export NGX_MOD_MODSECURITY="1.0.3"
+export NGX_MOD_MODSECURITY="1.0.4"
 
 # https://github.com/winshining/nginx-http-flv-module/releases
-export NGX_MOD_HTTPFLV="1.2.11"
+export NGX_MOD_HTTPFLV="1.2.13"
 
 # https://github.com/openresty/headers-more-nginx-module/tags
-export NGX_MOD_HEADERS_MORE="0.37"
+export NGX_MOD_HEADERS_MORE="0.39"
 
 # https://github.com/openresty/set-misc-nginx-module/releases
 export NGX_MOD_SETMISC="0.33"
 
 # https://github.com/openresty/lua-resty-core/tags
-export LUA_SCRIPTS_RESTYCORE="0.1.28"
+export LUA_SCRIPTS_RESTYCORE="0.1.32"
 
 # https://github.com/openresty/lua-resty-lrucache/tags
-export LUA_SCRIPTS_LRUCACHE="0.13"
+export LUA_SCRIPTS_LRUCACHE="0.15"
 
 # https://github.com/openresty/luajit2/tags
-export SYSTEM_LUAJIT="2.1-20231117"
+export SYSTEM_LUAJIT="2.1-20260311"
 
 # https://github.com/PCRE2Project/pcre2/releases
-export SYSTEM_PCRE="10.43"
+export SYSTEM_PCRE="10.47"
 
-# https://github.com/openssl/openssl
+# https://github.com/aws/aws-lc/tags
-export SYSTEM_OPENSSL="3.1.5-quic1"
+# AWS-LC = Amazon's BoringSSL fork. Supported natively in nginx since 1.29.2.
+# Picked over quictls (EOL OpenSSL 3.1 base) and over OpenSSL 3.5 native QUIC
+# because of better TLS handshake throughput and clean release tagging.
+export SYSTEM_AWSLC="1.72.0"
 
-# https://github.com/SpiderLabs/ModSecurity/releases
+# https://github.com/SpiderLabs/ModSecurity/releases 3.0.12
-export SYSTEM_MODSECURITY="3.0.12"
+export SYSTEM_MODSECURITY="3.0.14"
 
 # https://github.com/openresty/lua-resty-mysql/tags
-export NGX_MOD_LUA_MYSQL="0.27"
+export NGX_MOD_LUA_MYSQL="0.29"
 
 # https://github.com/openresty/lua-resty-lock/tags
 export NGX_MOD_LUA_LOCK="0.09"
 
 # https://github.com/openresty/srcache-nginx-module/tags
 export NGX_MOD_LUA_SRCACHE="0.33"
+
+# https://github.com/tokers/zstd-nginx-module/tags
+# Zstandard compression module. Chrome 123+ and Firefox 126+ send
+# `Accept-Encoding: zstd`; older clients fall back to brotli/gzip.
+export NGX_MOD_ZSTD="0.1.1"