sync 2026-09-26 18:19 UTC

 1672 files changed, 151396 insertions(+)

1 files changed, 164 insertions, 0 deletions

diff --git a/opt/nginx/MAKEPKG b/opt/nginx/MAKEPKG
new file mode 100644
index 0000000..058ed18
--- /dev/null
+++ b/opt/nginx/MAKEPKG
@@ -0,0 +1,164 @@
+#!/bin/mkpkg
+# description: High-performance HTTP server, reverse proxy, and IMAP/POP3 proxy
+# url: https://nginx.org/
+
+name=nginx
+version=1.31.6
+release=1
+depends=(libressl pcre2 zlib)
+groups=(http:user:http:/var/lib/nginx:755:906:906)
+services=(nginx)
+permissions=(
+    /etc/nginx/nginx.conf:root:http:640
+    /var/lib/nginx:root:http:755
+    /var/log/nginx:root:http:755
+)
+source=(https://nginx.org/download/$name-$version.tar.gz)
+sha256sums=(
+    "974ed5298a5e398e008704ed5db284e655fc270c596493dbccada452448fc9f1"
+)
+
+build() {
+    cd $name-$version
+
+    ./configure \
+        --prefix=/etc/nginx \
+        --sbin-path=/usr/bin/nginx \
+        --modules-path=/usr/lib/nginx/modules \
+        --conf-path=/etc/nginx/nginx.conf \
+        --error-log-path=/var/log/nginx/error.log \
+        --http-log-path=/var/log/nginx/access.log \
+        --pid-path=/run/nginx.pid \
+        --lock-path=/run/nginx.lock \
+        --http-client-body-temp-path=/var/lib/nginx/body \
+        --http-proxy-temp-path=/var/lib/nginx/proxy \
+        --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
+        --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
+        --http-scgi-temp-path=/var/lib/nginx/scgi \
+        --user=http \
+        --group=http \
+        --with-pcre-jit \
+        --with-file-aio \
+        --with-threads \
+        --with-http_ssl_module \
+        --with-http_v2_module \
+        --with-http_realip_module \
+        --with-http_gunzip_module \
+        --with-http_gzip_static_module \
+        --with-http_stub_status_module \
+        --with-http_sub_module \
+        --with-http_addition_module \
+        --with-http_auth_request_module \
+        --with-stream \
+        --with-stream_ssl_module \
+        --with-stream_realip_module \
+        --without-http_uwsgi_module \
+        --without-http_scgi_module \
+        --without-mail_pop3_module \
+        --without-mail_imap_module \
+        --without-mail_smtp_module
+
+    make
+    make DESTDIR=$PKG install
+
+    # Drop stock html and *.default sample configs
+    rm -rf $PKG/etc/nginx/html
+    rm -f  $PKG/etc/nginx/*.default
+
+    # Runtime / state directories
+    install -d -m 755 $PKG/var/lib/nginx
+    install -d -m 755 $PKG/var/log/nginx
+    install -d -m 755 $PKG/etc/nginx/conf.d
+}
+
+post_build() {
+    # Hardened default nginx.conf
+    printf '%s\n' \
+        'user http http;' \
+        'worker_processes auto;' \
+        'worker_rlimit_nofile 8192;' \
+        'pid /run/nginx.pid;' \
+        '' \
+        'events {' \
+        '    worker_connections 2048;' \
+        '    multi_accept       on;' \
+        '    use                epoll;' \
+        '}' \
+        '' \
+        'http {' \
+        '    include       mime.types;' \
+        '    default_type  application/octet-stream;' \
+        '' \
+        '    sendfile           on;' \
+        '    tcp_nopush         on;' \
+        '    tcp_nodelay        on;' \
+        '    keepalive_timeout  65;' \
+        '    server_tokens      off;' \
+        '' \
+        '    client_max_body_size        16m;' \
+        '    client_body_buffer_size     128k;' \
+        '    client_header_buffer_size   4k;' \
+        '    large_client_header_buffers 4 16k;' \
+        '' \
+        '    access_log /var/log/nginx/access.log combined;' \
+        '    error_log  /var/log/nginx/error.log warn;' \
+        '' \
+        '    gzip              on;' \
+        '    gzip_comp_level   5;' \
+        '    gzip_min_length   256;' \
+        '    gzip_proxied      any;' \
+        '    gzip_types' \
+        '        application/javascript' \
+        '        application/json' \
+        '        application/xml' \
+        '        text/css' \
+        '        text/plain' \
+        '        text/xml;' \
+        '' \
+        '    ssl_protocols             TLSv1.2 TLSv1.3;' \
+        '    ssl_prefer_server_ciphers on;' \
+        '    ssl_session_cache         shared:SSL:10m;' \
+        '    ssl_session_timeout       1d;' \
+        '    ssl_session_tickets       off;' \
+        '' \
+        '    include conf.d/*.conf;' \
+        '}' \
+        > $PKG/etc/nginx/nginx.conf
+
+    # runit service
+    install -d $PKG/etc/sv/nginx/log
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'exec 2>&1' \
+        '' \
+        '# Validate config before launching' \
+        'nginx -t -q || exit 1' \
+        '' \
+        '# Master runs as root (binds <1024, reads TLS keys);' \
+        '# workers drop to http:http per nginx.conf' \
+        'exec nginx -g "daemon off;"' \
+        > $PKG/etc/sv/nginx/run
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'mkdir -p /var/log/nginx' \
+        'exec svlogd -tt /var/log/nginx' \
+        > $PKG/etc/sv/nginx/log/run
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'rm -f /run/nginx.pid /run/nginx.lock' \
+        > $PKG/etc/sv/nginx/finish
+
+    chmod 755 $PKG/etc/sv/nginx/run
+    chmod 755 $PKG/etc/sv/nginx/log/run
+    chmod 755 $PKG/etc/sv/nginx/finish
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh