nginx modules
What the build includes and which feature each module makes possible.
Why nginx is built rather than installed
The nginx that comes with Ubuntu is built with a small set of features. Several of the things this software configures need features that are not in it, so nginx is compiled from source with all of them.
The cost is that you cannot update nginx with the usual system update command, and the build page is where that happens instead. The benefit is everything on this page.
Standard modules that matter
| Module | What it makes possible here |
|---|---|
http_ssl, http_v2, http_v3 | TLS, HTTP/2 and HTTP/3 with QUIC. |
stream, stream_ssl, stream_ssl_preread | TCP and UDP proxying, with TLS. |
http_realip, stream_realip | Trusting the real client address from a header when something sits in front. |
http_stub_status | The numbers the dashboard shows. |
http_auth_request | The subrequest based authentication path, including JWT validation. |
http_gzip_static, http_sub, http_addition | Serving pre compressed files, and rewriting response bodies. |
http_slice | Range requests split into cacheable slices, for large files. |
http_secure_link | Signed URLs with an expiry. |
http_dav | The base for WebDAV support. |
http_image_filter | Resizing and cropping images at the edge. |
http_xslt, http_perl | Available for the unusual cases that need them. |
mail, mail_ssl | Mail proxying, for the people who want it. |
pcre-jit, threads, file-aio | Faster regular expressions and better file handling. |
Third party modules
| Module | What it makes possible here |
|---|---|
lua-nginx-module and ngx_devel_kit | The faster JWT validation path, and anything else that needs logic inside nginx. |
geoip2 | Country blocking against a MaxMind format database. |
headers-more | Full control over request and response headers. |
ngx_cache_purge | Clearing cached objects without deleting the folder. |
echo-nginx-module | Useful for testing and for small synthetic responses. |
substitutions-filter | Rewriting response bodies with more than one rule. |
ngx-fancyindex | Presentable directory listings for static folders. |
nginx-dav-ext-module | The rest of WebDAV. |
upload-progress | Progress reporting for large uploads. |
auth-pam | Authenticating against the system's own accounts. |
nchan | Publish and subscribe over HTTP, WebSocket and server sent events. |
upstream-fair | An alternative balancing method. |
Loaded rather than compiled in
ModSecurity is built as a loadable module, and only when asked for. A
compiled in module is part of the binary whether anybody wants it or not, and ModSecurity
links against libmodsecurity.so. If that library were ever missing or a
version out of step, a statically linked nginx would not start at all, which would take
down every node in the fleet over a feature most of them are not using.
Built this way, the file sits on disk doing nothing until a load_module line
asks for it, and that line is only written for a node whose sites have the WAF on.
OpenSSL
The build links against OpenSSL 3.5, which carries ML-KEM. That is what makes post quantum key exchange available, and it is the main reason the build is done this way rather than using the system library.
Adding your own
The module list is a plain array near the top of nginx-installer.sh, in a
folder|git-url|git-ref shape. Add an entry and rebuild. Do it on one node,
confirm it works, then do the other, and remember that two nodes on different module lists
is a fleet where a config can work on one and be refused by the other.