#!/bin/mkpkg
# description: High-performance HTTP server, reverse proxy, and IMAP/POP3 proxy
# url: https://nginx.org/

name=nginx
version=1.31.6
release=1
depends=(libressl pcre2 zlib)
groups=(http:user:http:/var/lib/nginx:755:906:906)
services=(nginx)
permissions=(
    /etc/nginx/nginx.conf:root:http:640
    /var/lib/nginx:root:http:755
    /var/log/nginx:root:http:755
)
source=(https://nginx.org/download/$name-$version.tar.gz)
sha256sums=(
    "974ed5298a5e398e008704ed5db284e655fc270c596493dbccada452448fc9f1"
)

build() {
    cd $name-$version

    ./configure \
        --prefix=/etc/nginx \
        --sbin-path=/usr/bin/nginx \
        --modules-path=/usr/lib/nginx/modules \
        --conf-path=/etc/nginx/nginx.conf \
        --error-log-path=/var/log/nginx/error.log \
        --http-log-path=/var/log/nginx/access.log \
        --pid-path=/run/nginx.pid \
        --lock-path=/run/nginx.lock \
        --http-client-body-temp-path=/var/lib/nginx/body \
        --http-proxy-temp-path=/var/lib/nginx/proxy \
        --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
        --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
        --http-scgi-temp-path=/var/lib/nginx/scgi \
        --user=http \
        --group=http \
        --with-pcre-jit \
        --with-file-aio \
        --with-threads \
        --with-http_ssl_module \
        --with-http_v2_module \
        --with-http_realip_module \
        --with-http_gunzip_module \
        --with-http_gzip_static_module \
        --with-http_stub_status_module \
        --with-http_sub_module \
        --with-http_addition_module \
        --with-http_auth_request_module \
        --with-stream \
        --with-stream_ssl_module \
        --with-stream_realip_module \
        --without-http_uwsgi_module \
        --without-http_scgi_module \
        --without-mail_pop3_module \
        --without-mail_imap_module \
        --without-mail_smtp_module

    make
    make DESTDIR=$PKG install

    # Drop stock html and *.default sample configs
    rm -rf $PKG/etc/nginx/html
    rm -f  $PKG/etc/nginx/*.default

    # Runtime / state directories
    install -d -m 755 $PKG/var/lib/nginx
    install -d -m 755 $PKG/var/log/nginx
    install -d -m 755 $PKG/etc/nginx/conf.d
}

post_build() {
    # Hardened default nginx.conf
    printf '%s\n' \
        'user http http;' \
        'worker_processes auto;' \
        'worker_rlimit_nofile 8192;' \
        'pid /run/nginx.pid;' \
        '' \
        'events {' \
        '    worker_connections 2048;' \
        '    multi_accept       on;' \
        '    use                epoll;' \
        '}' \
        '' \
        'http {' \
        '    include       mime.types;' \
        '    default_type  application/octet-stream;' \
        '' \
        '    sendfile           on;' \
        '    tcp_nopush         on;' \
        '    tcp_nodelay        on;' \
        '    keepalive_timeout  65;' \
        '    server_tokens      off;' \
        '' \
        '    client_max_body_size        16m;' \
        '    client_body_buffer_size     128k;' \
        '    client_header_buffer_size   4k;' \
        '    large_client_header_buffers 4 16k;' \
        '' \
        '    access_log /var/log/nginx/access.log combined;' \
        '    error_log  /var/log/nginx/error.log warn;' \
        '' \
        '    gzip              on;' \
        '    gzip_comp_level   5;' \
        '    gzip_min_length   256;' \
        '    gzip_proxied      any;' \
        '    gzip_types' \
        '        application/javascript' \
        '        application/json' \
        '        application/xml' \
        '        text/css' \
        '        text/plain' \
        '        text/xml;' \
        '' \
        '    ssl_protocols             TLSv1.2 TLSv1.3;' \
        '    ssl_prefer_server_ciphers on;' \
        '    ssl_session_cache         shared:SSL:10m;' \
        '    ssl_session_timeout       1d;' \
        '    ssl_session_tickets       off;' \
        '' \
        '    include conf.d/*.conf;' \
        '}' \
        > $PKG/etc/nginx/nginx.conf

    # runit service
    install -d $PKG/etc/sv/nginx/log

    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        '' \
        '# Validate config before launching' \
        'nginx -t -q || exit 1' \
        '' \
        '# Master runs as root (binds <1024, reads TLS keys);' \
        '# workers drop to http:http per nginx.conf' \
        'exec nginx -g "daemon off;"' \
        > $PKG/etc/sv/nginx/run

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/nginx' \
        'exec svlogd -tt /var/log/nginx' \
        > $PKG/etc/sv/nginx/log/run

    printf '%s\n' \
        '#!/bin/sh' \
        'rm -f /run/nginx.pid /run/nginx.lock' \
        > $PKG/etc/sv/nginx/finish

    chmod 755 $PKG/etc/sv/nginx/run
    chmod 755 $PKG/etc/sv/nginx/log/run
    chmod 755 $PKG/etc/sv/nginx/finish
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh