nginx-stable.yaml

package:
  name: nginx-stable
  # STABLE VERSIONS MUST USE EVEN MINOR VERSIONS (e.g., 1.26.x, 1.28.x)
  version: "1.28.3"
  epoch: 2
  # HEY YOU! If you update/bump this package you NEED to go and update the equivilent nginx-otel package
  description: HTTP and reverse proxy server (stable version)
  copyright:
    - license: BSD-2-Clause
  cpe:
    vendor: f5
    product: nginx
  dependencies:
    provides:
      - nginx=${{package.full-version}}
    # Let's ensure that we have config. This gets the default, but can also
    # be override by users.
    runtime:
      - merged-usrsbin
      - nginx-config
      - wolfi-baselayout
  resources:
    cpu: "1"
    memory: 10Gi

environment:
  contents:
    packages:
      - autoconf
      - automake
      - brotli-dev
      - build-base
      - busybox
      - ca-certificates-bundle
      - gd-dev
      - geoip-dev
      - libmaxminddb-dev
      - libxml2-dev
      - libxslt-dev
      - luajit-dev
      - ngx_brotli
      - openssl-hardened-dev
      - pcre-dev
      - perl-dev
      - pkgconf
      - zeromq-dev
      - zlib-dev

var-transforms:
  - from: ${{package.version}}
    match: '^(\d+)\.(\d+)\.(\d+)'
    replace: '$2'
    to: minor-version

data:
  - name: modules
    items:
      http_brotli_filter: "10"
      http_brotli_static: "10"
      http_geoip: "10"
      http_image_filter: "10"
      http_perl: "10"
      http_xslt_filter: "10"
      mail: "10"
      stream_geoip: "10"
      stream: "10"

# TODO look at adding extra modules like alpine does https://git.alpinelinux.org/aports/tree/main/nginx/APKBUILD#n149
# Also note the nginx inc config https://hg.nginx.org/pkg-oss/file/tip/alpine
pipeline:
  - name: validate-stable-version
    runs: |
      # Ensure stable version is even (e.g., 1.26.x, 1.28.x)
      # ref: https://nginx.org/
      MINOR=${{vars.minor-version}}
      if [ $((MINOR % 2)) -ne 0 ]; then
        echo "ERROR: nginx-stable must use even minor versions (e.g., 1.26.x, 1.28.x)"
        echo "Current version: ${{package.version}} has odd minor version: $MINOR"
        exit 1
      fi
      echo "Version validation passed: ${{package.version}} is a valid stable version"

  - uses: git-checkout
    with:
      repository: https://github.com/nginx/nginx.git
      tag: release-${{package.version}}
      expected-commit: 9b958b000776c88036cd800c66e7e4ad39e6fd41
      destination: nginx-stable

  - name: configure
    working-directory: nginx-stable
    runs: |
      export LUAJIT_LIB="$(pkgconf --variable=libdir luajit)"
      export LUAJIT_INC="$(pkgconf --variable=includedir luajit)"

      ./auto/configure \
          --prefix=/var/lib/nginx \
          --sbin-path=/usr/bin/nginx \
          --modules-path=/usr/lib/nginx/modules \
          --conf-path=/etc/nginx/nginx.conf \
          --pid-path=/run/nginx.pid \
          --lock-path=/run/nginx.lock \
          --http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
          --http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
          --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
          --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi \
          --http-scgi-temp-path=/var/lib/nginx/tmp/scgi \
          --with-perl_modules_path=/usr/lib/perl5/vendor_perl \
          \
          --user=nginx \
          --group=nginx \
          --with-threads \
          --with-file-aio \
          \
          --without-pcre2 \
          \
          --with-compat \
          \
          --with-http_ssl_module \
          --with-http_v2_module \
          --with-http_realip_module \
          --with-http_addition_module \
          --with-http_xslt_module=dynamic \
          --with-http_image_filter_module=dynamic \
          --with-http_geoip_module=dynamic \
          --with-http_sub_module \
          --with-http_flv_module \
          --with-http_mp4_module \
          --with-http_gunzip_module \
          --with-http_gzip_static_module \
          --with-http_auth_request_module \
          --with-http_random_index_module \
          --with-http_secure_link_module \
          --with-http_degradation_module \
          --with-http_slice_module \
          --with-http_stub_status_module \
          --with-http_perl_module=dynamic \
          --with-mail=dynamic \
          --with-mail_ssl_module \
          --with-stream=dynamic \
          --with-stream_ssl_module \
          --with-stream_realip_module \
          --with-stream_geoip_module=dynamic \
          --with-stream_ssl_preread_module \
          --add-dynamic-module=/usr/src/ngx_brotli

  - working-directory: nginx-stable
    runs: |
      make -j$(nproc)
      make DESTDIR=${{targets.destdir}} install
      # Stash the configuration into a separate directory so that it's not part
      # of the main package and hence configurable by users of -config
      # subpackage. We install it separately below in a subpackage.
      #
      # Unfortunately, there's no way to install configuration into a separate
      # directory that I could find.
      mkdir pkg-config
      mv ${{targets.destdir}}/etc/nginx pkg-config/
      # Create parent location for tmp files
      mkdir -p ${{targets.destdir}}/var/lib/nginx/tmp

  - uses: strip

subpackages:
  - name: ${{package.name}}-mime-types
    description: Nginx mime.types file
    dependencies:
      provides:
        - nginx-mime-types=${{package.full-version}}
    pipeline:
      - working-directory: nginx-stable
        runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/nginx
          mv ./pkg-config/nginx/mime.types ${{targets.subpkgdir}}/etc/nginx/
          mv ./pkg-config/nginx/mime.types.default ${{targets.subpkgdir}}/etc/nginx/
    test:
      pipeline:
        - runs: |
            test -f /etc/nginx/mime.types
            test -f /etc/nginx/mime.types.default
        - uses: test/virtualpackage
          with:
            virtual-pkg-name: nginx-mime-types
            real-pkg-name: ${{subpkg.name}}

  - name: ${{package.name}}-fastcgi-params
    description: Nginx fastcgi_params file
    dependencies:
      provides:
        - nginx-fastcgi-params=${{package.full-version}}
    pipeline:
      - working-directory: nginx-stable
        runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/nginx
          mv ./pkg-config/nginx/fastcgi_params ${{targets.subpkgdir}}/etc/nginx/
          mv ./pkg-config/nginx/fastcgi_params.default ${{targets.subpkgdir}}/etc/nginx/
          mv ./pkg-config/nginx/fastcgi.conf ${{targets.subpkgdir}}/etc/nginx/
          mv ./pkg-config/nginx/fastcgi.conf.default ${{targets.subpkgdir}}/etc/nginx/
    test:
      pipeline:
        - runs: |
            stat /etc/nginx/fastcgi_params
            stat /etc/nginx/fastcgi_params.default
            stat /etc/nginx/fastcgi.conf
            stat /etc/nginx/fastcgi.conf.default
        - uses: test/virtualpackage
          with:
            virtual-pkg-name: nginx-fastcgi-params
            real-pkg-name: ${{subpkg.name}}

  - name: ${{package.name}}-scgi-params
    description: Nginx scgi_params file
    dependencies:
      provides:
        - nginx-scgi-params=${{package.full-version}}
    pipeline:
      - working-directory: nginx-stable
        runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/nginx
          mv ./pkg-config/nginx/scgi_params ${{targets.subpkgdir}}/etc/nginx/
          mv ./pkg-config/nginx/scgi_params.default ${{targets.subpkgdir}}/etc/nginx/
    test:
      pipeline:
        - runs: |
            stat /etc/nginx/scgi_params
            stat /etc/nginx/scgi_params.default
        - uses: test/virtualpackage
          with:
            virtual-pkg-name: nginx-scgi-params
            real-pkg-name: ${{subpkg.name}}

  - name: ${{package.name}}-uwsgi-params
    description: Nginx uwsgi_params file
    dependencies:
      provides:
        - nginx-uwsgi-params=${{package.full-version}}
    pipeline:
      - working-directory: nginx-stable
        runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/nginx
          mv ./pkg-config/nginx/uwsgi_params ${{targets.subpkgdir}}/etc/nginx/
          mv ./pkg-config/nginx/uwsgi_params.default ${{targets.subpkgdir}}/etc/nginx/
    test:
      pipeline:
        - runs: |
            stat /etc/nginx/uwsgi_params
            stat /etc/nginx/uwsgi_params.default
        - uses: test/virtualpackage
          with:
            virtual-pkg-name: nginx-uwsgi-params
            real-pkg-name: ${{subpkg.name}}

  - name: ${{package.name}}-config
    description: Creates nginx config step that can then be overridden by users
    dependencies:
      runtime:
        - merged-usrsbin
        - nginx-stable
        - ${{package.name}}-fastcgi-params
        - ${{package.name}}-mime-types
        - ${{package.name}}-scgi-params
        - ${{package.name}}-uwsgi-params
        - wolfi-baselayout
      provides:
        - nginx-config=${{package.full-version}}
    pipeline:
      - working-directory: nginx-stable
        runs: |
          # This was moved into ./pkg-config/etc/nginx so put it into the
          # subpackage directory here.
          mkdir -p ${{targets.subpkgdir}}/etc/nginx
          cp -R ./pkg-config/nginx/* ${{targets.subpkgdir}}/etc/nginx/
          # default error logs to standard error
          sed -i 's/#error_log  logs\/error.log;$/error_log  stderr  notice;/' ${{targets.subpkgdir}}/etc/nginx/nginx.conf
          # and both access logs to stdout
          sed -i 's/#access_log.*;$/access_log  \/dev\/stdout;/' ${{targets.subpkgdir}}/etc/nginx/nginx.conf
    test:
      pipeline:
        - uses: test/virtualpackage
          with:
            virtual-pkg-name: nginx-config
            real-pkg-name: ${{subpkg.name}}

  - name: ${{package.name}}-syslog-config
    description: Creates nginx config with syslog logging
    dependencies:
      runtime:
        - nginx-stable
        - ${{package.name}}-fastcgi-params
        - ${{package.name}}-mime-types
        - ${{package.name}}-scgi-params
        - ${{package.name}}-uwsgi-params
      provides:
        - nginx-config=${{package.full-version}}
    pipeline:
      - working-directory: nginx-stable
        runs: |
          # This was moved into ./pkg-config/etc/nginx so put it into the
          # subpackage directory here.
          mkdir -p ${{targets.subpkgdir}}/etc/nginx
          cp -R ./pkg-config/nginx/* ${{targets.subpkgdir}}/etc/nginx/
          # default error logs to syslog
          sed -i 's/#error_log  logs\/error.log;$/error_log  syslog:server=unix:\/dev\/log  notice;/' ${{targets.subpkgdir}}/etc/nginx/nginx.conf
          # and both access logs to syslog
          sed -i 's/#access_log.*;$/access_log  syslog:server=unix:\/dev\/log;/' ${{targets.subpkgdir}}/etc/nginx/nginx.conf
    test:
      pipeline:
        - uses: test/virtualpackage
          with:
            virtual-pkg-name: nginx-config
            real-pkg-name: ${{subpkg.name}}

  - name: ${{package.name}}-package-config
    description: Config supplied in packaged nginx.org bundles at https://hg.nginx.org/pkg-oss/
    dependencies:
      runtime:
        - merged-usrsbin
        - nginx-stable
        - ${{package.name}}-fastcgi-params
        - ${{package.name}}-mime-types
        - ${{package.name}}-scgi-params
        - ${{package.name}}-uwsgi-params
        - wolfi-baselayout
      provides:
        - nginx-package-config=${{package.full-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/nginx/conf.d
          install -m644 -D nginx.conf ${{targets.subpkgdir}}/etc/nginx/

          install -m644 -D nginx.default.conf ${{targets.subpkgdir}}/etc/nginx/conf.d

          # Follow Docker Image and link logs to to stdout/stderr
          # https://github.com/nginxinc/docker-nginx/blob/73a5acae6945b75b433cafd0c9318e4378e72cbb/stable/alpine-slim/Dockerfile#L106-L107
          mkdir -p ${{targets.subpkgdir}}/var/log/nginx
          ln -sf /dev/stdout ${{targets.subpkgdir}}/var/log/nginx/access.log
          ln -sf /dev/stderr ${{targets.subpkgdir}}/var/log/nginx/error.log
          # Package config has a different default location for html files, rather annoyingly
          # Don't really like using a symlink here, but seems better than copying
          mkdir -p ${{targets.subpkgdir}}/usr/share/nginx/html
          ln -sf /var/lib/nginx/html/50x.html ${{targets.subpkgdir}}/usr/share/nginx/html/50x.html
          ln -sf /var/lib/nginx/html/index.html ${{targets.subpkgdir}}/usr/share/nginx/html/index.html
      - name: "Create templates directory"
        runs: |
          mkdir -p ${{targets.contextdir}}/etc/nginx/templates
    test:
      pipeline:
        - uses: test/tw/configpackage

  - range: modules
    name: ${{package.name}}-mod-${{range.key}}
    description: Nginx third-party module ${{range.key}}
    dependencies:
      provides:
        - nginx-mod-${{range.key}}=${{package.full-version}}
      runtime:
        - merged-usrsbin
        - perl-dev
        - wolfi-baselayout
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/lib/nginx/modules
          mkdir -p ${{targets.subpkgdir}}/etc/nginx/modules
          # --modules-path is only used for installing modules, not loading them
          mkdir -p ${{targets.subpkgdir}}/var/lib/nginx/
          ln -sf /usr/lib/nginx/modules ${{targets.subpkgdir}}/var/lib/nginx/modules

          mv ${{targets.destdir}}/usr/lib/nginx/modules/ngx_${{range.key}}_module.so ${{targets.subpkgdir}}/usr/lib/nginx/modules/

          # TODO may need to rework the prefix here if we add other module subpackages like alpine does https://git.alpinelinux.org/aports/tree/main/nginx/APKBUILD#n417
          echo "load_module \"modules/ngx_${{range.key}}_module.so\";" >> ${{targets.subpkgdir}}/etc/nginx/modules/${{range.value}}_${{range.key}}.conf

          case ${{range.key}} in
            http_perl)
              mv ${{targets.destdir}}/usr/lib/perl5 ${{targets.subpkgdir}}/usr/lib/
            ;;
            http_naxsi)
              install -m644 -D naxsi-*/naxsi_config/naxsi_core.rules \
                ${{targets.subpkgdir}}/etc/nginx/naxsi_core.rules
            ;;
            stream)
              mkdir -p ${{targets.subpkgdir}}/etc/nginx/stream.d
              install -m644 -D stream.conf ${{targets.subpkgdir}}/etc/nginx/stream.d/
            ;;
          esac
    test:
      pipeline:
        - uses: test/tw/ldd-check

  - name: ${{package.name}}-src
    description: Nginx source code
    dependencies:
      provides:
        - nginx-src=${{package.full-version}}
      runtime:
        - merged-usrsbin
        - perl-dev
        - wolfi-baselayout
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/src/nginx
          cp -r ./nginx-stable/* ${{targets.contextdir}}/usr/src/nginx
          ls -latr ${{targets.contextdir}}/usr/src/nginx
    test:
      pipeline:
        - uses: test/tw/ldd-check

  - name: ${{package.name}}-config-compat
    description: Nginx config compatibility with upstream image
    dependencies:
      runtime:
        - merged-usrsbin
        - nginx-stable
        - wolfi-baselayout
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/nginx/conf.d
          install -m644 -D nginx.default.conf ${{targets.subpkgdir}}/etc/nginx/conf.d/
          ln -s /etc/nginx/conf.d/nginx.default.conf ${{targets.subpkgdir}}/etc/nginx/conf.d/default.conf
    # test added by a robot (compat)
    test:
      pipeline:
        - runs: |
            readlink -v /etc/nginx/conf.d/default.conf

test:
  environment:
    contents:
      packages:
        - ${{package.name}}-config
        - ${{package.name}}-config-compat
  pipeline:
    - runs: |
        nginx -v
        head -n 5 /etc/nginx/nginx.conf
        head -n 5 /etc/nginx/conf.d/nginx.default.conf
        head -n 5 /etc/nginx/conf.d/default.conf
        nginx -h

update:
  enabled: true
  github:
    identifier: nginx/nginx
    use-tag: true
    # STABLE VERSIONS MUST USE EVEN MINOR VERSIONS (e.g., 1.26.x, 1.28.x)
    tag-filter: release-1.28
    strip-prefix: release-