allow vod and pckg to compile together

Fix DebBug #1098477, salsa issue nginx-team/nginx:#23

See merge request nginx-team/nginx!90

.gitignore

@@ -0,0 +1,10 @@
+objs/*
+!objs/ndk_*
+.pc/
+.vscode/
+modules/media-framework/
+modules/nginx-srt-module/
+modules/nginx-vod-module/
+Makefile
+*.orig
+*.txt

auto/make

@@ -2,6 +2,11 @@
 # Copyright (C) Igor Sysoev
 # Copyright (C) Nginx, Inc.
 
+basename_last2() {
+    local basename_1=`basename \`dirname $1\``
+    local basename_2=$(basename "$1")
+    echo $(printf "$basename_1/$basename_2" | sed 's/\.\.\///')
+}
 
 echo "creating $NGX_MAKEFILE"
 
@@ -174,7 +179,7 @@ ngx_all_srcs=`echo $ngx_all_srcs | sed -e "s/\//$ngx_regex_dirsep/g"`
 
 for ngx_src in $NGX_ADDON_SRCS
 do
-    ngx_obj="addon/`basename \`dirname $ngx_src\``"
+    ngx_obj="addon/`basename_last2 \`dirname $ngx_src\``"
 
     test -d $NGX_OBJS/$ngx_obj || mkdir -p $NGX_OBJS/$ngx_obj
 
@@ -413,7 +418,7 @@ if test -n "$NGX_ADDON_SRCS"; then
 
     for ngx_src in $NGX_ADDON_SRCS
     do
-        ngx_obj="addon/`basename \`dirname $ngx_src\``"
+        ngx_obj="addon/`basename_last2 \`dirname $ngx_src\``"
 
         ngx_obj=`echo $ngx_obj/\`basename $ngx_src\` \
             | sed -e "s/\//$ngx_regex_dirsep/g"`
@@ -576,7 +581,7 @@ END
                 ngx_obj=$ngx_src
                 ;;
             *)
-                ngx_obj="addon/`basename \`dirname $ngx_src\``"
+                ngx_obj="addon/`basename_last2 \`dirname $ngx_src\``"
                 mkdir -p $NGX_OBJS/$ngx_obj
                 ngx_obj="$ngx_obj/`basename $ngx_src`"
                 ;;
@@ -638,7 +643,7 @@ END
                 ngx_obj=`echo $ngx_source | sed -e "s/\//$ngx_regex_dirsep/g"`
                 ;;
             *)
-                ngx_obj="addon/`basename \`dirname $ngx_source\``"
+                ngx_obj="addon/`basename_last2 \`dirname $ngx_source\``"
                 ngx_obj=`echo $ngx_obj/\`basename $ngx_source\` \
                     | sed -e "s/\//$ngx_regex_dirsep/g"`
                 ;;

configure.docker.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+./configure \
+    --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -fPIC -D_FORTIFY_SOURCE=2 -I/tmp/build/quickjs/" \
+    --with-ld-opt="-Wl,-z,relro -Wl,-z,now -fPIC -L/tmp/build/quickjs/" \
+    --sbin-path=/usr/local/sbin/nginx \
+    --conf-path=/video_server/nginx/nginx.conf \
+    --error-log-path=/var/log/nginx/error.log \
+    --pid-path=/var/run/nginx/nginx.pid \
+    --lock-path=/var/lock/nginx/nginx.lock \
+    --http-log-path=/var/log/nginx/access.log \
+    --http-client-body-temp-path=/tmp/nginx-client-body \
+    --with-compat \
+    --with-debug \
+    --with-pcre-jit \
+    --with-http_ssl_module \
+    --with-http_stub_status_module \
+    --with-http_realip_module \
+    --with-http_auth_request_module \
+    --with-http_v2_module \
+    --with-http_dav_module \
+    --with-http_slice_module \
+    --with-threads \
+    --with-http_addition_module \
+    --with-http_flv_module \
+    --with-http_gunzip_module \
+    --with-http_gzip_static_module \
+    --with-http_mp4_module \
+    --with-http_random_index_module \
+    --with-http_secure_link_module \
+    --with-http_sub_module \
+    --with-mail_ssl_module \
+    --with-stream_ssl_module \
+    --with-stream_ssl_preread_module \
+    --with-stream_realip_module \
+    --with-http_geoip_module=dynamic \
+    --with-http_image_filter_module=dynamic \
+    --with-http_perl_module=dynamic \
+    --with-http_xslt_module=dynamic \
+    --with-mail=dynamic \
+    --with-stream=dynamic \
+    --with-stream_geoip_module=dynamic \
+    --add-module=./modules_deb/libnginx-mod-http-ndk-0.3.4 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-brotli-1.0.0~rc \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-cache-purge-2.5.3 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-echo-0.63 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-geoip2-3.4 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-headers-more-filter-0.38 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-memc-0.20 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-set-misc-0.33 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-srcache-filter-0.33 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-subs-filter-0.6.4 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-upstream-fair-0.0~git20120408.a18b409 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-nchan-1.3.7+dfsg \
+    --add-dynamic-module=./modules/njs/nginx \
+    --add-dynamic-module=./modules/nginx-vod-module \
+    --add-module=./modules/media-framework/nginx-common \
+    --add-dynamic-module=./modules/nginx-stream-preread-str-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-in-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-out-module \
+    --add-dynamic-module=./modules/media-framework/nginx-rtmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-rtmp-kmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-mpegts-module \
+    --add-dynamic-module=./modules/media-framework/nginx-mpegts-kmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-cc-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-rtmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-live-module \
+    --add-dynamic-module=./modules/nginx-srt-module \
+    --add-dynamic-module=./modules/media-framework/nginx-pckg-module \
+    --add-dynamic-module=./modules/nginx-secure-token-module

configure.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+./configure \
+    --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -fPIC -D_FORTIFY_SOURCE=2 -I/usr/local/include/quickjs/" \
+    --with-ld-opt="-Wl,-z,relro -Wl,-z,now -fPIC -L/usr/local/lib/quickjs/" \
+    --prefix=/usr/local/temp/nginx/ \
+    --error-log-path=stderr \
+    --lock-path=/var/lock/nginx.lock \
+    --pid-path=/run/nginx.pid \
+    --with-compat \
+    --with-debug \
+    --with-pcre-jit \
+    --with-http_ssl_module \
+    --with-http_stub_status_module \
+    --with-http_realip_module \
+    --with-http_auth_request_module \
+    --with-http_v2_module \
+    --with-http_dav_module \
+    --with-http_slice_module \
+    --with-threads \
+    --with-http_addition_module \
+    --with-http_flv_module \
+    --with-http_gunzip_module \
+    --with-http_gzip_static_module \
+    --with-http_mp4_module \
+    --with-http_random_index_module \
+    --with-http_secure_link_module \
+    --with-http_sub_module \
+    --with-mail_ssl_module \
+    --with-stream_ssl_module \
+    --with-stream_ssl_preread_module \
+    --with-stream_realip_module \
+    --with-http_geoip_module=dynamic \
+    --with-http_image_filter_module=dynamic \
+    --with-http_perl_module=dynamic \
+    --with-http_xslt_module=dynamic \
+    --with-mail=dynamic \
+    --with-stream=dynamic \
+    --with-stream_geoip_module=dynamic \
+    --add-module=./modules_deb/libnginx-mod-http-ndk-0.3.4 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-brotli-1.0.0~rc \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-cache-purge-2.5.3 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-echo-0.63 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-geoip2-3.4 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-headers-more-filter-0.38 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-memc-0.20 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-set-misc-0.33 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-srcache-filter-0.33 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-subs-filter-0.6.4 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-http-upstream-fair-0.0~git20120408.a18b409 \
+    --add-dynamic-module=./modules_deb/libnginx-mod-nchan-1.3.7+dfsg \
+    --add-dynamic-module=./modules/njs/nginx \
+    --add-dynamic-module=./modules/nginx-vod-module \
+    --add-module=./modules/media-framework/nginx-common \
+    --add-dynamic-module=./modules/nginx-stream-preread-str-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-in-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-out-module \
+    --add-dynamic-module=./modules/media-framework/nginx-rtmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-rtmp-kmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-mpegts-module \
+    --add-dynamic-module=./modules/media-framework/nginx-mpegts-kmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-cc-module \
+    --add-dynamic-module=./modules/media-framework/nginx-kmp-rtmp-module \
+    --add-dynamic-module=./modules/media-framework/nginx-live-module \
+    --add-dynamic-module=./modules/nginx-srt-module \
+    --add-dynamic-module=./modules/media-framework/nginx-pckg-module \
+    --add-dynamic-module=./modules/nginx-secure-token-module

debian/README.source

@@ -0,0 +1,63 @@
+Debian Packaging
+================
+
+We use git-buildpackage for packaging.
+
+Workflow for Unstable
+=====================
+
+We use the standard git-buildpackage workflow.
+
+Dynamic Modules
+===============
+
+Since v1.9.11 Nginx added dynamic module support. This will sanitize the
+nginx packaging flow in the long term, but there is a lot work to be done
+in order to get there. We gradually convert all modules to dynamic
+as they add support for it.
+
+[0] https://www.nginx.com/blog/dynamic-modules-nginx-1-9-11/
+
+Workflow for Experimental
+=========================
+
+Nginx mainline releases (1.11.x series) are been packaged for experimental,
+as they lack security support.
+
+The workflow we use is based on the assumption that packaging work happens on
+origin/master and experimental builds are a trivial patch away from that.
+
+The direct consequence of treating experimental as a patchset for origin/master
+is that the relevant branches are forced-pushed whenever we release a new
+1.11.x version. In other words, **it is not safe to base your work on the
+experimental branch**.
+
+This is a brief description of our experimental branches and how we are using
+them.
+
+* experimental-base
+  Force-pushed when origin/master changes.
+
+  experimental-base tracks the changes needed for building the 1.11.x branch,
+  such as new configure parameters, etc. On new 1.11.x releases, it is rebased
+  on origin/master so it is always up-to-date with our latest packaging work.
+
+* experimental
+  Force-pushed on every 1.11.x release.
+
+  This branch points to the latest 1.11.x release.
+  Before release this branch is reset to experimental-base, and then merged
+  with the new upstream-1.11 branch. Finally all the release specific changes
+  are commited (changelog entry etc) and the build is made.
+
+* upstream-1.11
+  Pushed on every 1.11.x release.
+
+  Before a new 1.11.x release origin/upstream is dummy merged (-s ours) into
+  ustream-1.11.  This is a technicallity so we can avoid resolving conflicts
+  when a new 1.10.x release happens between two experimental releases.
+
+Older 1.11.x releases are not referenced by any branch, but they can be found
+by the relevant debian/* tag.
+
+

debian/apport/source_nginx.py

@@ -0,0 +1,19 @@
+'''
+apport package hook for nginx packages
+
+Copyright (c) 2015, Thomas Ward <teward@ubuntu.com>
+'''
+
+import apport.hookutils
+import os
+import subprocess
+
+def add_info(report, ui):
+    if (report['Package'].split()[0] != 'nginx-common'
+        and report['ProblemType'] == 'Package'
+        and os.path.isdir('/run/systemd/system')):
+        report['Journalctl_Nginx.txt'] = apport.hookutils.command_output(
+            ['journalctl', '-xe', '--unit=nginx.service'])
+        report['SystemctlStatusFull_Nginx.txt'] = subprocess.Popen(
+            ['systemctl', '-l', 'status', 'nginx.service'],
+            stdout=subprocess.PIPE).communicate()[0]

debian/autoscripts/postinst-nginx

@@ -0,0 +1,26 @@
+for confpair in #NAMES# ; do
+	from=$(echo $confpair | cut -d: -f1)
+	to=$(echo $confpair | cut -d: -f2)
+
+	if [ -L /etc/nginx/modules-enabled/$to.removed ]; then
+		rm /etc/nginx/modules-enabled/$to.removed
+		removed_link=true
+	else
+		removed_link=false
+	fi
+
+	# Symlink on
+	# 1) Fresh installations
+	# 2) Reinstalls after automatic removes (preserve admin actions)
+	if [ -z "$2" -o "$removed_link" = "true" ]; then
+		ln -sf /usr/share/nginx/modules-available/$from \
+			/etc/nginx/modules-enabled/$to
+	fi
+done
+
+if [ "$1" = "configure" ] ; then
+	if which dpkg-trigger >/dev/null 2>&1 ; then
+		dpkg-trigger --no-await nginx-reload
+	fi
+
+fi

debian/autoscripts/postrm-nginx

@@ -0,0 +1,28 @@
+if [ "$1" = "purge" ] ; then
+	for confpair in #NAMES# ; do
+		from=$(echo $confpair | cut -d: -f1)
+		to=$(echo $confpair | cut -d: -f2)
+
+		if [ -L /etc/nginx/modules-enabled/$to ]; then
+			rm /etc/nginx/modules-enabled/$to
+		fi
+		if [ -L /etc/nginx/modules-enabled/$to.removed ]; then
+			rm /etc/nginx/modules-enabled/$to.removed
+		fi
+	done
+fi
+
+if [ "$1" = "remove" ] ; then
+	for confpair in #NAMES# ; do
+		from=$(echo $confpair | cut -d: -f1)
+		to=$(echo $confpair | cut -d: -f2)
+
+		if [ -L /etc/nginx/modules-enabled/$to ]; then
+			mv /etc/nginx/modules-enabled/$to /etc/nginx/modules-enabled/$to.removed
+		fi
+	done
+
+        if which dpkg-trigger >/dev/null 2>&1 ; then
+                dpkg-trigger --no-await nginx-reload
+        fi
+fi

debian/autoscripts/prerm-nginx

@@ -0,0 +1,10 @@
+if [ "$1" = "remove" ] || [ "$1" = "deconfigure" ] ; then
+	for confpair in #NAMES# ; do
+		from=$(echo $confpair | cut -d: -f1)
+		to=$(echo $confpair | cut -d: -f2)
+
+		if [ -L /etc/nginx/modules-enabled/$to ]; then
+			mv /etc/nginx/modules-enabled/$to /etc/nginx/modules-enabled/$to.removed
+		fi
+	done
+fi

debian/conf/fastcgi.conf

@@ -0,0 +1,27 @@
+
+fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;

debian/conf/fastcgi_params

@@ -0,0 +1,26 @@
+
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;

debian/conf/koi-utf

@@ -0,0 +1,109 @@
+
+# This map is not a full koi8-r <> utf8 map: it does not contain
+# box-drawing and some other characters.  Besides this map contains
+# several koi8-u and Byelorussian letters which are not in koi8-r.
+# If you need a full and standard map, use contrib/unicode2nginx/koi-utf
+# map instead.
+
+charset_map  koi8-r  utf-8 {
+
+    80  E282AC ; # euro
+
+    95  E280A2 ; # bullet
+
+    9A  C2A0 ;   # &nbsp;
+
+    9E  C2B7 ;   # &middot;
+
+    A3  D191 ;   # small yo
+    A4  D194 ;   # small Ukrainian ye
+
+    A6  D196 ;   # small Ukrainian i
+    A7  D197 ;   # small Ukrainian yi
+
+    AD  D291 ;   # small Ukrainian soft g
+    AE  D19E ;   # small Byelorussian short u
+
+    B0  C2B0 ;   # &deg;
+
+    B3  D081 ;   # capital YO
+    B4  D084 ;   # capital Ukrainian YE
+
+    B6  D086 ;   # capital Ukrainian I
+    B7  D087 ;   # capital Ukrainian YI
+
+    B9  E28496 ; # numero sign
+
+    BD  D290 ;   # capital Ukrainian soft G
+    BE  D18E ;   # capital Byelorussian short U
+
+    BF  C2A9 ;   # (C)
+
+    C0  D18E ;   # small yu
+    C1  D0B0 ;   # small a
+    C2  D0B1 ;   # small b
+    C3  D186 ;   # small ts
+    C4  D0B4 ;   # small d
+    C5  D0B5 ;   # small ye
+    C6  D184 ;   # small f
+    C7  D0B3 ;   # small g
+    C8  D185 ;   # small kh
+    C9  D0B8 ;   # small i
+    CA  D0B9 ;   # small j
+    CB  D0BA ;   # small k
+    CC  D0BB ;   # small l
+    CD  D0BC ;   # small m
+    CE  D0BD ;   # small n
+    CF  D0BE ;   # small o
+
+    D0  D0BF ;   # small p
+    D1  D18F ;   # small ya
+    D2  D180 ;   # small r
+    D3  D181 ;   # small s
+    D4  D182 ;   # small t
+    D5  D183 ;   # small u
+    D6  D0B6 ;   # small zh
+    D7  D0B2 ;   # small v
+    D8  D18C ;   # small soft sign
+    D9  D18B ;   # small y
+    DA  D0B7 ;   # small z
+    DB  D188 ;   # small sh
+    DC  D18D ;   # small e
+    DD  D189 ;   # small shch
+    DE  D187 ;   # small ch
+    DF  D18A ;   # small hard sign
+
+    E0  D0AE ;   # capital YU
+    E1  D090 ;   # capital A
+    E2  D091 ;   # capital B
+    E3  D0A6 ;   # capital TS
+    E4  D094 ;   # capital D
+    E5  D095 ;   # capital YE
+    E6  D0A4 ;   # capital F
+    E7  D093 ;   # capital G
+    E8  D0A5 ;   # capital KH
+    E9  D098 ;   # capital I
+    EA  D099 ;   # capital J
+    EB  D09A ;   # capital K
+    EC  D09B ;   # capital L
+    ED  D09C ;   # capital M
+    EE  D09D ;   # capital N
+    EF  D09E ;   # capital O
+
+    F0  D09F ;   # capital P
+    F1  D0AF ;   # capital YA
+    F2  D0A0 ;   # capital R
+    F3  D0A1 ;   # capital S
+    F4  D0A2 ;   # capital T
+    F5  D0A3 ;   # capital U
+    F6  D096 ;   # capital ZH
+    F7  D092 ;   # capital V
+    F8  D0AC ;   # capital soft sign
+    F9  D0AB ;   # capital Y
+    FA  D097 ;   # capital Z
+    FB  D0A8 ;   # capital SH
+    FC  D0AD ;   # capital E
+    FD  D0A9 ;   # capital SHCH
+    FE  D0A7 ;   # capital CH
+    FF  D0AA ;   # capital hard sign
+}

debian/conf/koi-win

@@ -0,0 +1,103 @@
+
+charset_map  koi8-r  windows-1251 {
+
+    80  88 ; # euro
+
+    95  95 ; # bullet
+
+    9A  A0 ; #  
+
+    9E  B7 ; # ·
+
+    A3  B8 ; # small yo
+    A4  BA ; # small Ukrainian ye
+
+    A6  B3 ; # small Ukrainian i
+    A7  BF ; # small Ukrainian yi
+
+    AD  B4 ; # small Ukrainian soft g
+    AE  A2 ; # small Byelorussian short u
+
+    B0  B0 ; # °
+
+    B3  A8 ; # capital YO
+    B4  AA ; # capital Ukrainian YE
+
+    B6  B2 ; # capital Ukrainian I
+    B7  AF ; # capital Ukrainian YI
+
+    B9  B9 ; # numero sign
+
+    BD  A5 ; # capital Ukrainian soft G
+    BE  A1 ; # capital Byelorussian short U
+
+    BF  A9 ; # (C)
+
+    C0  FE ; # small yu
+    C1  E0 ; # small a
+    C2  E1 ; # small b
+    C3  F6 ; # small ts
+    C4  E4 ; # small d
+    C5  E5 ; # small ye
+    C6  F4 ; # small f
+    C7  E3 ; # small g
+    C8  F5 ; # small kh
+    C9  E8 ; # small i
+    CA  E9 ; # small j
+    CB  EA ; # small k
+    CC  EB ; # small l
+    CD  EC ; # small m
+    CE  ED ; # small n
+    CF  EE ; # small o
+
+    D0  EF ; # small p
+    D1  FF ; # small ya
+    D2  F0 ; # small r
+    D3  F1 ; # small s
+    D4  F2 ; # small t
+    D5  F3 ; # small u
+    D6  E6 ; # small zh
+    D7  E2 ; # small v
+    D8  FC ; # small soft sign
+    D9  FB ; # small y
+    DA  E7 ; # small z
+    DB  F8 ; # small sh
+    DC  FD ; # small e
+    DD  F9 ; # small shch
+    DE  F7 ; # small ch
+    DF  FA ; # small hard sign
+
+    E0  DE ; # capital YU
+    E1  C0 ; # capital A
+    E2  C1 ; # capital B
+    E3  D6 ; # capital TS
+    E4  C4 ; # capital D
+    E5  C5 ; # capital YE
+    E6  D4 ; # capital F
+    E7  C3 ; # capital G
+    E8  D5 ; # capital KH
+    E9  C8 ; # capital I
+    EA  C9 ; # capital J
+    EB  CA ; # capital K
+    EC  CB ; # capital L
+    ED  CC ; # capital M
+    EE  CD ; # capital N
+    EF  CE ; # capital O
+
+    F0  CF ; # capital P
+    F1  DF ; # capital YA
+    F2  D0 ; # capital R
+    F3  D1 ; # capital S
+    F4  D2 ; # capital T
+    F5  D3 ; # capital U
+    F6  C6 ; # capital ZH
+    F7  C2 ; # capital V
+    F8  DC ; # capital soft sign
+    F9  DB ; # capital Y
+    FA  C7 ; # capital Z
+    FB  D8 ; # capital SH
+    FC  DD ; # capital E
+    FD  D9 ; # capital SHCH
+    FE  D7 ; # capital CH
+    FF  DA ; # capital hard sign
+}

debian/conf/mime.types

@@ -0,0 +1,101 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/avif                                       avif;
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/wasm                                 wasm;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xslt+xml                             xsl xslt;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/ogg                                        ogv;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-matroska                                 mkv;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

debian/conf/nginx.conf

@@ -0,0 +1,84 @@
+user www-data;
+worker_processes auto;
+worker_cpu_affinity auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 768;
+	# multi_accept on;
+}
+
+http {
+
+	##
+	# Basic Settings
+	##
+
+	sendfile on;
+	tcp_nopush on;
+	types_hash_max_size 2048;
+	server_tokens off; # Recommended practice is to turn this off
+
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# SSL Settings
+	##
+
+	ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3 (POODLE), TLS 1.0, 1.1
+	ssl_prefer_server_ciphers off; # Don't force server cipher order.
+
+	##
+	# Logging Settings
+	##
+
+	access_log /var/log/nginx/access.log;
+
+	##
+	# Gzip Settings
+	##
+
+	gzip on;
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# Virtual Host Configs
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}
+
+
+#mail {
+#	# See sample authentication script at:
+#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
+#
+#	# auth_http localhost/auth.php;
+#	# pop3_capabilities "TOP" "USER";
+#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
+#
+#	server {
+#		listen     localhost:110;
+#		protocol   pop3;
+#		proxy      on;
+#	}
+#
+#	server {
+#		listen     localhost:143;
+#		protocol   imap;
+#		proxy      on;
+#	}
+#}

debian/conf/proxy_params

@@ -0,0 +1,4 @@
+proxy_set_header Host $http_host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;

debian/conf/scgi_params

@@ -0,0 +1,17 @@
+
+scgi_param  REQUEST_METHOD     $request_method;
+scgi_param  REQUEST_URI        $request_uri;
+scgi_param  QUERY_STRING       $query_string;
+scgi_param  CONTENT_TYPE       $content_type;
+
+scgi_param  DOCUMENT_URI       $document_uri;
+scgi_param  DOCUMENT_ROOT      $document_root;
+scgi_param  SCGI               1;
+scgi_param  SERVER_PROTOCOL    $server_protocol;
+scgi_param  REQUEST_SCHEME     $scheme;
+scgi_param  HTTPS              $https if_not_empty;
+
+scgi_param  REMOTE_ADDR        $remote_addr;
+scgi_param  REMOTE_PORT        $remote_port;
+scgi_param  SERVER_PORT        $server_port;
+scgi_param  SERVER_NAME        $server_name;

debian/conf/sites-available/default

@@ -0,0 +1,91 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 80 default_server;
+	listen [::]:80 default_server;
+
+	# SSL configuration
+	#
+	# listen 443 ssl default_server;
+	# listen [::]:443 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+	index index.html index.htm index.nginx-debian.html;
+
+	server_name _;
+
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+	}
+
+	# pass PHP scripts to FastCGI server
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php-fpm (or other unix sockets):
+	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+	#	# With php-cgi (or other tcp sockets):
+	#	fastcgi_pass 127.0.0.1:9000;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

debian/conf/snippets/fastcgi-php.conf

@@ -0,0 +1,13 @@
+# regex to split $uri to $fastcgi_script_name and $fastcgi_path
+fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+
+# Check that the PHP script exists before passing it
+try_files $fastcgi_script_name =404;
+
+# Bypass the fact that try_files resets $fastcgi_path_info
+# see: http://trac.nginx.org/nginx/ticket/321
+set $path_info $fastcgi_path_info;
+fastcgi_param PATH_INFO $path_info;
+
+fastcgi_index index.php;
+include fastcgi.conf;

debian/conf/snippets/snakeoil.conf

@@ -0,0 +1,5 @@
+# Self signed certificates generated by the ssl-cert package
+# Don't use them in a production server!
+
+ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

debian/conf/uwsgi_params

@@ -0,0 +1,17 @@
+
+uwsgi_param  QUERY_STRING       $query_string;
+uwsgi_param  REQUEST_METHOD     $request_method;
+uwsgi_param  CONTENT_TYPE       $content_type;
+uwsgi_param  CONTENT_LENGTH     $content_length;
+
+uwsgi_param  REQUEST_URI        $request_uri;
+uwsgi_param  PATH_INFO          $document_uri;
+uwsgi_param  DOCUMENT_ROOT      $document_root;
+uwsgi_param  SERVER_PROTOCOL    $server_protocol;
+uwsgi_param  REQUEST_SCHEME     $scheme;
+uwsgi_param  HTTPS              $https if_not_empty;
+
+uwsgi_param  REMOTE_ADDR        $remote_addr;
+uwsgi_param  REMOTE_PORT        $remote_port;
+uwsgi_param  SERVER_PORT        $server_port;
+uwsgi_param  SERVER_NAME        $server_name;

debian/conf/win-utf

@@ -0,0 +1,125 @@
+# This map is not a full windows-1251 <> utf8 map: it does not
+# contain Serbian and Macedonian letters.	If you need a full map,
+# use contrib/unicode2nginx/win-utf map instead.
+
+charset_map	windows-1251	utf-8 {
+
+	82	E2809A; # single low-9 quotation mark
+
+	84	E2809E; # double low-9 quotation mark
+	85	E280A6; # ellipsis
+	86	E280A0; # dagger
+	87	E280A1; # double dagger
+	88	E282AC; # euro
+	89	E280B0; # per mille
+
+	91	E28098; # left single quotation mark
+	92	E28099; # right single quotation mark
+	93	E2809C; # left double quotation mark
+	94	E2809D; # right double quotation mark
+	95	E280A2; # bullet
+	96	E28093; # en dash
+	97	E28094; # em dash
+
+	99	E284A2; # trade mark sign
+
+	A0	C2A0;   # &nbsp;
+	A1	D18E;   # capital Byelorussian short U
+	A2	D19E;   # small Byelorussian short u
+
+	A4	C2A4;   # currency sign
+	A5	D290;   # capital Ukrainian soft G
+	A6	C2A6;   # borken bar
+	A7	C2A7;   # section sign
+	A8	D081;   # capital YO
+	A9	C2A9;   # (C)
+	AA	D084;   # capital Ukrainian YE
+	AB	C2AB;   # left-pointing double angle quotation mark
+	AC	C2AC;   # not sign
+	AD	C2AD;   # soft hypen
+	AE	C2AE;   # (R)
+	AF	D087;   # capital Ukrainian YI
+
+	B0	C2B0;   # &deg;
+	B1	C2B1;   # plus-minus sign
+	B2	D086;   # capital Ukrainian I
+	B3	D196;   # small Ukrainian i
+	B4	D291;   # small Ukrainian soft g
+	B5	C2B5;   # micro sign
+	B6	C2B6;   # pilcrow sign
+	B7	C2B7;   # &middot;
+	B8	D191;   # small yo
+	B9	E28496; # numero sign
+	BA	D194;   # small Ukrainian ye
+	BB	C2BB;   # right-pointing double angle quotation mark
+
+	BF	D197;   # small Ukrainian yi
+
+	C0	D090;   # capital A
+	C1	D091;   # capital B
+	C2	D092;   # capital V
+	C3	D093;   # capital G
+	C4	D094;   # capital D
+	C5	D095;   # capital YE
+	C6	D096;   # capital ZH
+	C7	D097;   # capital Z
+	C8	D098;   # capital I
+	C9	D099;   # capital J
+	CA	D09A;   # capital K
+	CB	D09B;   # capital L
+	CC	D09C;   # capital M
+	CD	D09D;   # capital N
+	CE	D09E;   # capital O
+	CF	D09F;   # capital P
+
+	D0	D0A0;   # capital R
+	D1	D0A1;   # capital S
+	D2	D0A2;   # capital T
+	D3	D0A3;   # capital U
+	D4	D0A4;   # capital F
+	D5	D0A5;   # capital KH
+	D6	D0A6;   # capital TS
+	D7	D0A7;   # capital CH
+	D8	D0A8;   # capital SH
+	D9	D0A9;   # capital SHCH
+	DA	D0AA;   # capital hard sign
+	DB	D0AB;   # capital Y
+	DC	D0AC;   # capital soft sign
+	DD	D0AD;   # capital E
+	DE	D0AE;   # capital YU
+	DF	D0AF;   # capital YA
+
+	E0	D0B0;   # small a
+	E1	D0B1;   # small b
+	E2	D0B2;   # small v
+	E3	D0B3;   # small g
+	E4	D0B4;   # small d
+	E5	D0B5;   # small ye
+	E6	D0B6;   # small zh
+	E7	D0B7;   # small z
+	E8	D0B8;   # small i
+	E9	D0B9;   # small j
+	EA	D0BA;   # small k
+	EB	D0BB;   # small l
+	EC	D0BC;   # small m
+	ED	D0BD;   # small n
+	EE	D0BE;   # small o
+	EF	D0BF;   # small p
+
+	F0	D180;   # small r
+	F1	D181;   # small s
+	F2	D182;   # small t
+	F3	D183;   # small u
+	F4	D184;   # small f
+	F5	D185;   # small kh
+	F6	D186;   # small ts
+	F7	D187;   # small ch
+	F8	D188;   # small sh
+	F9	D189;   # small shch
+	FA	D18A;   # small hard sign
+	FB	D18B;   # small y
+	FC	D18C;   # small soft sign
+	FD	D18D;   # small e
+	FE	D18E;   # small yu
+	FF	D18F;   # small ya
+}

debian/control

@@ -0,0 +1,311 @@
+Source: nginx
+Section: httpd
+Priority: optional
+Maintainer: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
+Uploaders: Jan Mojžíš <janmojzis@debian.org>
+Build-Depends: debhelper-compat (= 13),
+               libexpat-dev,
+               libgd-dev,
+               libgeoip-dev,
+               libpcre2-dev,
+               libperl-dev,
+               libssl-dev,
+               libxslt1-dev,
+               po-debconf,
+               zlib1g-dev
+Standards-Version: 4.7.0
+Homepage: https://nginx.org
+Vcs-Git: https://salsa.debian.org/nginx-team/nginx.git
+Vcs-Browser: https://salsa.debian.org/nginx-team/nginx
+Rules-Requires-Root: no
+
+Package: nginx
+Architecture: any
+Depends: ${misc:Depends},
+         ${shlibs:Depends},
+         iproute2,
+         nginx-common (= ${source:Version}),
+Breaks: nginx-light (<< 1.22.1-6~), nginx-extras (<< 1.22.1-6~), nginx-core (<< 1.22.1-6~),
+Replaces: nginx-light (<< 1.22.1-6~), nginx-extras (<< 1.22.1-6~), nginx-core (<< 1.22.1-6~),
+Provides: httpd, httpd-cgi, ${nginx:abi}
+Description: small, powerful, scalable web/proxy server
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+
+Package: nginx-doc
+Architecture: all
+Multi-Arch: foreign
+Section: doc
+Depends: ${misc:Depends}
+Description: small, powerful, scalable web/proxy server - documentation
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This package provides extra documentation to help unleash the power of Nginx.
+
+Package: nginx-common
+Breaks: nginx (<< 1.22.1-8)
+Replaces: nginx (<< 1.22.1-8)
+Architecture: all
+Multi-Arch: foreign
+Depends: ${misc:Depends}
+Suggests: fcgiwrap, nginx-doc, ssl-cert
+Description: small, powerful, scalable web/proxy server - common files
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This package contains base configuration files used by all versions of
+ nginx.
+
+Package: nginx-dev
+Architecture: all
+Multi-Arch: foreign
+Depends: ${misc:Depends}, ${S:Build-Depends},
+         ${nginx:abi},
+         nginx (<< ${source:Version}.1~),
+         nginx (>= ${source:Version}),
+Provides: dh-sequence-nginx
+Description: nginx web/proxy server - development headers
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This package provides development headers and necessary config scripts
+ for the nginx web/proxy server, useful to develop and link third party
+ additions to the Debian nginx web/proxy server packages.
+
+Package: nginx-core
+Architecture: all
+Depends: libnginx-mod-http-geoip (>= ${source:Version}),
+         libnginx-mod-http-geoip (<< ${source:Version}.1~),
+         libnginx-mod-http-image-filter (>= ${source:Version}),
+         libnginx-mod-http-image-filter (<< ${source:Version}.1~),
+         libnginx-mod-http-xslt-filter (>= ${source:Version}),
+         libnginx-mod-http-xslt-filter (<< ${source:Version}.1~),
+         libnginx-mod-mail (>= ${source:Version}),
+         libnginx-mod-mail (<< ${source:Version}.1~),
+         libnginx-mod-stream (>= ${source:Version}),
+         libnginx-mod-stream (<< ${source:Version}.1~),
+         libnginx-mod-stream-geoip (>= ${source:Version}),
+         libnginx-mod-stream-geoip (<< ${source:Version}.1~),
+         nginx (>= ${source:Version}),
+         nginx (<< ${source:Version}.1~),
+         ${misc:Depends},
+         ${shlibs:Depends}
+Breaks: nginx-full (<< 1.18.0-1),
+Replaces: nginx-full (<< 1.18.0-1),
+Description: nginx web/proxy server (standard version)
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This metapackage provides a version of nginx identical to that of nginx-full,
+ but without any third-party modules, and only modules in the original
+ nginx code base.
+ .
+ STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Empty
+ GIF, FastCGI, Geo, Limit Connections, Limit Requests, Map, Memcached, Proxy,
+ Referer, Rewrite, SCGI, Split Clients, UWSGI.
+ .
+ OPTIONAL HTTP MODULES: Addition, Auth Request, Charset, WebDAV, GeoIP, Gunzip,
+ Gzip, Gzip Precompression, Headers, HTTP/2, Image Filter, Index, Log, Real IP,
+ Slice, SSI, SSL, SSL Preread, Stub Status, Substitution, Thread  Pool,
+ Upstream, User ID, XSLT.
+ .
+ OPTIONAL MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ .
+ OPTIONAL STREAM MODULES: Stream Core, GeoIP
+
+Package: nginx-full
+Architecture: all
+Depends: libnginx-mod-http-auth-pam,
+         libnginx-mod-http-dav-ext,
+         libnginx-mod-http-echo,
+         libnginx-mod-http-geoip2,
+         libnginx-mod-http-subs-filter,
+         libnginx-mod-http-upstream-fair,
+         libnginx-mod-stream-geoip2,
+         nginx (>= ${source:Version}),
+         nginx (<< ${source:Version}.1~),
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: nginx web/proxy server (standard version with 3rd parties)
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This metapackage provides a version of nginx with the complete set of
+ standard modules included (but omitting some of those included in
+ nginx-extras).
+ .
+ STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Empty
+ GIF, FastCGI, Geo, Limit Connections, Limit Requests, Map, Memcached, Proxy,
+ Referer, Rewrite, SCGI, Split Clients, UWSGI.
+ .
+ OPTIONAL HTTP MODULES: Addition, Auth Request, Charset, WebDAV, GeoIP, Gunzip,
+ Gzip, Gzip Precompression, Headers, HTTP/2, Image Filter, Index, Log, Real IP,
+ Slice, SSI, SSL, Stream, SSL Preread, Stub Status, Substitution, Thread  Pool,
+ Upstream, User ID, XSLT.
+ .
+ OPTIONAL MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ .
+ OPTIONAL STREAM MODULES: Stream Core, GeoIP, GeoIP2
+ .
+ THIRD PARTY MODULES: Auth PAM, DAV Ext, Echo, GeoIP2, HTTP Substitutions
+ Upstream Fair Queue.
+
+Package: nginx-light
+Architecture: all
+Depends: libnginx-mod-http-echo,
+         nginx (>= ${source:Version}),
+         nginx (<< ${source:Version}.1~),
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: nginx web/proxy server (basic version)
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This metapackage provides a very light version of nginx with only the
+ minimal set of features and modules.
+ .
+ STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Empty GIF,
+ FastCGI, Map, Proxy, Rewrite, SCGI, uWSGI.
+ .
+ OPTIONAL HTTP MODULES: Auth Request, Charset, Gzip, Gzip Precompression,
+ Headers, HTTP/2, Index, Log, Real IP, Slice, SSI, SSL, Stub Status, Thread
+ Pool, WebDAV, Upstream.
+ .
+ THIRD PARTY MODULES: Echo.
+
+Package: nginx-extras
+Architecture: any
+Depends: nginx (= ${binary:Version}),
+         libnginx-mod-http-geoip (= ${binary:Version}),
+         libnginx-mod-http-image-filter (= ${binary:Version}),
+         libnginx-mod-http-perl (= ${binary:Version}),
+         libnginx-mod-http-xslt-filter (= ${binary:Version}),
+         libnginx-mod-mail (= ${binary:Version}),
+         libnginx-mod-stream (= ${binary:Version}),
+         libnginx-mod-stream-geoip (= ${binary:Version}),
+         libnginx-mod-http-auth-pam,
+         libnginx-mod-http-cache-purge,
+         libnginx-mod-http-dav-ext,
+         libnginx-mod-http-echo,
+         libnginx-mod-http-fancyindex,
+         libnginx-mod-http-geoip2,
+         libnginx-mod-http-headers-more-filter,
+         libnginx-mod-http-lua [amd64 arm64 armel armhf i386 mips64el mipsel s390x riscv64 powerpc],
+         libnginx-mod-http-subs-filter,
+         libnginx-mod-http-uploadprogress,
+         libnginx-mod-http-upstream-fair,
+         libnginx-mod-nchan,
+         libnginx-mod-stream-geoip2,
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: nginx web/proxy server (extended version)
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This metapackage provides a version of nginx with the standard modules, plus
+ extra features and modules such as the Perl module, which allows the
+ addition of Perl in configuration files.
+ .
+ STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Empty
+ GIF, FastCGI, Geo, Limit Connections, Limit Requests, Map, Memcached, Proxy,
+ Referer, Rewrite, SCGI, Split Clients, UWSGI.
+ .
+ OPTIONAL HTTP MODULES: Addition, Auth Request, Charset, WebDAV, FLV, GeoIP,
+ Gunzip, Gzip, Gzip Precompression, Headers, HTTP/2, Image Filter, Index, Log,
+ MP4, Embedded Perl, Random Index, Real IP, Slice, Secure Link, SSI, SSL,
+ SSL Preread, Stub Status, Substitution, Thread Pool, Upstream, User ID, XSLT.
+ .
+ OPTIONAL MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ .
+ OPTIONAL STREAM MODULES: Stream, GeoIP, GeoIP2
+ .
+ THIRD PARTY MODULES: Auth PAM, Cache Purge, DAV Ext, Echo, Fancy Index,
+ GeoIP2, Headers More, Embedded Lua, HTTP Substitutions, Nchan, Upload Progress,
+ Upstream Fair Queue.
+
+Package: libnginx-mod-http-geoip
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: GeoIP HTTP module for Nginx
+ The ngx_http_geoip module creates variables with values depending on the
+ client IP address, using the precompiled MaxMind databases.
+ .
+ Those variables include country, region, city, latitude, longitude, postal
+ code, etc.
+
+Package: libnginx-mod-http-image-filter
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: HTTP image filter module for Nginx
+ The ngx_http_image_filter module is a filter that transforms images in JPEG,
+ GIF, and PNG formats.
+ .
+ The module supports filters such as rotate, resize, crop, quality, sharpening,
+ interlacing and more.
+
+Package: libnginx-mod-http-xslt-filter
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: XSLT Transformation module for Nginx
+ The ngx_http_xslt_filter module is a filter that transforms XML responses
+ using one or more XSLT stylesheets.
+ .
+ The transformation can be adjusted by setting the relevant configuration
+ parameters.
+
+Package: libnginx-mod-mail
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: Mail module for Nginx
+ The nginx_mail module adds mail proxy support to nginx.
+ .
+ The module supports proxying all the standard mail protocols such as IMAP,
+ POP3 & SMTP.
+
+Package: libnginx-mod-stream
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: Stream module for Nginx
+ The nginx_stream module adds stream proxy support to nginx.
+ .
+ Stream module supports loadbalancing & proxying to TCP servers. The module
+ also supports ACLs/connection limiting and configuring multiple operational
+ parameters.
+
+Package: libnginx-mod-stream-geoip
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+ libnginx-mod-stream (= ${binary:Version}),
+Recommends: nginx,
+Description: GeoIP Stream module for Nginx
+ The ngx_stream_geoip module creates variables with values depending on the
+ client IP address, using the precompiled MaxMind databases.
+ .
+ Those variables include country, region, city, latitude, longitude, postal
+ code, etc.
+
+Package: libnginx-mod-http-perl
+Architecture: any
+Depends: ${misc:Depends}, ${perl:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: Perl module for Nginx
+ Embed Perl runtime into nginx.
+ .
+ The ngx_http_perl module is used to implement location and variable handlers
+ in Perl and insert Perl calls into SSI.
+ .
+ Note that this module is marked experimental.

debian/copyright

@@ -0,0 +1,136 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: nginx
+Source: https://nginx.org/en/download.html
+
+Files: *
+Copyright: Valentin V. Bartenev
+ Ruslan Ermilov
+ Roman Arutyunyan
+ Maxim Dounin
+ 2011-2024, Nginx, Inc.
+ 2002-2021, Igor Sysoev
+License: BSD-2-clause
+
+Files: contrib/geo2nginx.pl
+Copyright: 2005, Andrei Nigmatulin
+License: BSD-2-clause
+
+Files: debian/*
+Copyright: 2022-2025, Jan Mojžíš <janmojzis@debian.org>
+ 2020-2022, Ondřej Nový <onovy@debian.org>
+ 2019-2022, Thomas Ward <teward@ubuntu.com>
+ 2013-2016, Christos Trochalakis <ctrochalakis@debian.org>
+ 2011-2013, Cyril Lavier <cyril.lavier@davromaniak.eu>
+ 2011, Dmitry E. Oboukhov <unera@debian.org>
+ 2010-2014, Michael Lustfield <michael@lustfield.net>
+ 2009-2014, Kartik Mistry <kartik@debian.org>
+ 2008, Jose Parrella <joseparrella@cantv.net>
+ 2007-2009, Fabio Tranchitella <kobold@debian.org>
+License: BSD-2-clause
+
+Files: debian/apport/*
+Copyright: 2015, Thomas Ward <teward@ubuntu.com>
+License: BSD-2-clause
+
+Files: debian/debhelper/*
+Copyright: 2022, Miao Wang
+License: Expat
+
+Files: debian/debhelper/dh_nginx
+Copyright: 2016, Christos Trochalakis <ctrochalakis@debian.org>
+License: GPL-2+
+
+Files: debian/ngx-conf/ngx-conf
+Copyright: 2015, Michael Lustfield <michael@lustfield.net>
+License: Expat
+
+Files: man/*
+Copyright: Nginx, Inc.
+ 2010, 2019, Sergey A. Osokin
+License: BSD-2-clause
+
+Files: src/core/ngx_murmurhash.c
+Copyright: Austin Appleby
+License: public-domain
+ All MurmurHash versions are public domain software, and the author
+ disclaims all copyright to their code.
+
+Files: src/http/modules/ngx_http_scgi_module.c
+Copyright: Nginx, Inc.
+ Manlio Perillo (manlio.perillo@gmail.com)
+ Igor Sysoev
+License: BSD-2-clause
+
+Files: src/http/modules/ngx_http_uwsgi_module.c
+Copyright: Nginx, Inc.
+ Igor Sysoev
+ 2009, 2010, Unbit S.a.s.
+ 2008, Manlio Perillo (manlio.perillo@gmail.com)
+License: BSD-2-clause
+
+Files: src/http/ngx_http_huff_encode.c
+Copyright: Valentin V. Bartenev
+ Nginx, Inc.
+ 2015, Vlad Krasnov
+License: BSD-2-clause
+
+Files: src/stream/ngx_stream_set_module.c
+Copyright: Pavel Pautov
+ Nginx, Inc.
+License: BSD-2-clause
+
+License: BSD-2-clause
+ All rights reserved.
+ .
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are
+ met:
+ .
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+License: Expat
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to
+ deal in the Software without restriction, including without limitation the
+ rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ sell copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ IN THE SOFTWARE.
+
+License: GPL-2+
+ This is free software, licensed under:
+ .
+   The GNU General Public License, Version 2, June 1991
+ .
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 dated June, 1991, or (at
+ your option) any later version.
+ On Debian systems, the complete text of version 2 of the GNU General
+ Public License can be found in '/usr/share/common-licenses/GPL-2'.

debian/debhelper/dh_nginx

@@ -0,0 +1,334 @@
+#! /usr/bin/perl
+
+# dh_nginx - Nginx configuration helper
+# Copyright (C) 2016 Christos Trochalakis <ctrochalakis@debian.org>
+#
+# This program is licensed under the terms of the GNU General
+# Public License veserion 2+
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+use strict;
+use File::Find;
+use Debian::Debhelper::Dh_Lib;
+use Dpkg::Substvars;
+
+=head1 NAME
+
+dh_nginx - register configuration snippets to the nginx web server
+
+=cut
+my $nginx_in_tree;
+my $abi;
+sub nginx_depends
+{
+	if (!$abi) {
+		my $sv = Dpkg::Substvars->new();
+		if ($nginx_in_tree) {
+			$sv->load("debian/libnginx-mod.abisubstvars");
+		}
+		else {
+			$sv->load("/usr/share/nginx/src/debian/libnginx-mod.abisubstvars");
+		}
+		$abi = $sv->get("nginx:abi");
+	}
+	return "$abi";
+}
+
+sub nginx_api_installdir
+{
+	return "/usr/lib/nginx/modules/";
+}
+
+sub nginx_modules_conf_installdir
+{
+	return "usr/share/nginx/modules-available/"
+}
+
+=head1 SYNOPSIS
+
+B<dh_nginx> [S<I<debhelper options>>] [B<-n>|B<--noscripts>] [B<--in-nginx-tree>]
+
+=head1 DESCRIPTION
+
+B<dh_nginx> is a debhelper program that is responsible for correctly installing
+Nginx configuration snippets and setting postinst, prerm and dependencies in
+Nginx web server modules and web applications.
+
+It supports the following configuration types
+
+=over 4
+
+=item *
+Nginx modules
+
+=back
+
+=head1 INVOCATION
+
+  %:
+     dh $@ --with nginx
+
+=head1 FILES
+
+=over 4
+
+=item debian/I<package>.nginx
+
+=item debian/nginx
+
+=back
+
+Lists files to be registered with the Nginx HTTP server. The file is
+interpreted as line separated list of installation stanzas, where each entry
+consists of whitespace separated values conforming to the file semantics below.
+
+When this file is missing but the name of the package looks like a nginx module,
+the module load file and its loading priority is automatically generated inferring
+from the package name. In this case, I<package-name>B<.install> or other mechanisms
+should be used for copying the B<.so> library into the correct place.
+
+=head2 FILE SEMANTICS
+
+Each line consists of a triple
+
+I<type> I<file> [I<arguments>]
+
+where the values are interpreted as follows:
+
+
+=head3 I<type>
+
+Denotes the type of file to be installed. Recognized values are B<mod> for
+Nginx modules.
+
+=head3 I<file>
+
+Is interpreted as existing file name within the source package. No path
+expansion is effectuated. Just like L<dh_install(1)>, B<dh_nginx> can not
+rename files.
+
+=head3 I<arguments>
+
+Is inrerpreted as optional arguments if any, currently not used.
+
+=head2 MODULES
+
+Modules are handled specially and are determined by the B<mod> type. Modules must
+have a I<.conf> suffix. In that case the file is interpreted as module load
+file and is installed to I</etc/nginx/modules-available>. If the file is ending
+with a I<.so> suffix it is interpreted as actual module shared object and is
+installed to the Nginx module directory, an optional numeric priority can be
+set as the last argument to handle module dependencies.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-e>, B<--noenable>
+
+Install maintainer scripts accordingly, but do not enable the scripts or
+configuration by default.
+
+=item B<-n>, B<--noscripts>
+
+Do not modify F<postinst>/F<postrm>/F<prerm> maintainer scripts.
+
+=item B<--in-nginx-tree>
+
+Specify this option when building in-tree modules along with nginx. When
+specified, nginx abi version is not required in package name.
+
+=back
+
+=head1 NOTES
+
+Note that this command is not idempotent. L<dh_prep(1)> should be called
+between invocations of this command. Otherwise, it may cause multiple
+instances of the same text to be added to maintainer scripts.
+
+=head1 AUTHOR
+
+This manual and L<dh_nginx> was written by Christos Trochalakis.
+dh_nginx is heavily influnced by dh_apache2 written by Arno Toell
+<debian@toell.net>.
+
+=cut
+
+
+##
+## main code starts here
+##
+
+init(options => {
+	"e|noenable" => \$dh{NOENABLE},
+	"in-nginx-tree" => \$nginx_in_tree,
+});
+
+foreach my $package ((@{$dh{DOPACKAGES}}))
+{
+	my %PACKAGE_TYPE = (
+		has_a_module => [],
+	);
+
+	my $file = pkgfile($package, "nginx");
+	my $tmp  = tmpdir($package);
+	my $installdir = $tmp . "/" . nginx_modules_conf_installdir();
+	my $modinstalldir = $tmp . "/" . nginx_api_installdir();
+
+	if ($file){
+		my @files_to_register = filedoublearray($file, ".") if $file;
+		foreach my $line (@files_to_register)
+		{
+			my $type = lc(shift @{$line}) if $line->[0];
+			my $source = shift @{$line} if $line->[0];
+			my @arguments = @{$line};
+			my $destination;
+
+			$type = "modules" if $type eq "mod";
+
+			verbose_print("$type -- $source -- @arguments\n\n");
+
+			if ($type eq "modules")
+			{
+				my $basesource = basename($source);
+
+				if ($type eq "modules")
+				{
+					if ($basesource =~ m/\.conf$/)
+					{
+						my $enablename = $basesource;
+						my $prio = $#arguments >= 0 ? $arguments[0] : 50;
+						$destination = "$prio-$basesource";
+						push @{$PACKAGE_TYPE{'has_a_module'}}, "$enablename:$destination";
+						verbose_print("Installing module configuration $enablename into $installdir prio:$prio\n");
+					}
+					elsif ($basesource =~ m/\.so$/)
+					{
+						verbose_print("Installing module binary $source into $modinstalldir\n");
+						if (! -d $modinstalldir)
+						{
+							complex_doit("mkdir","-p", $modinstalldir);
+							complex_doit("chmod","755","$modinstalldir");
+						}
+						complex_doit("cp", $source, $modinstalldir);
+						next;
+					}
+
+					# TODO
+					error("module: \"$basesource\" needs .conf, .so or suffix") if $basesource !~ m/\.(conf|so)/;
+				}
+
+				if (! -d $installdir)
+				{
+					complex_doit("mkdir","-p",$installdir);
+					complex_doit("chmod","755","$installdir");
+				}
+				complex_doit("cp",$source,$installdir);
+				complex_doit("chmod","644","$installdir/$basesource");
+
+			}
+			else
+			{
+				error("Unknown parameter: $type\n");
+			}
+
+		}
+	} elsif ($package =~ /^libnginx-mod-/){
+		verbose_print("$package might be a nginx module\n");
+
+		my $module = $package;
+		$module =~ s/^libnginx-mod-//;
+		verbose_print("Guessed module name: $module\n");
+
+		my $modulepath = $module;
+		$modulepath =~ s/-/_/g;
+
+		if (-e "$modinstalldir/ngx_${modulepath}_module.so"){
+			my $prio = 50;
+			if ($module =~ /^\w+-/ && !($module =~ /^http-/) ){
+				$prio = 70;
+			}
+			verbose_print("Guessed load priority: $prio\n");
+
+			my $conf_name = "mod-$module.conf";
+			install_dir($installdir);
+			verbose_print("Installing module configuration $conf_name into $installdir prio:$prio\n");
+			open(MOD_CONF, $dh{NO_ACT} ? ">&STDERR" : ">$installdir/$conf_name") or error("open($installdir/$conf_name): $!");
+			print(MOD_CONF "load_module modules/ngx_${modulepath}_module.so;\n");
+			close(MOD_CONF);
+			chmod(0644, "$installdir/$conf_name") or error("chmod(0644, $installdir/$conf_name): $!");
+			push @{$PACKAGE_TYPE{'has_a_module'}}, "$conf_name:$prio-$conf_name";
+		} else {
+			verbose_print("$package is not a nginx module because $modinstalldir/ngx_${modulepath}_module.so not found");
+			verbose_print("If it is not correct, check if the module is installed before invoking this script");
+		}
+	}
+
+	my @postinst_autoscripts;
+
+	if ($#{$PACKAGE_TYPE{'has_a_module'}} >= 0)
+	{
+		if ($package !~ m/libnginx-mod-\w+?/)
+		{
+			warning("Package $package appears to be an Nginx module. It should comply to the package naming scheme libnginx-mod-<modulename>\n");
+		}
+		addsubstvar($package, "misc:Depends", nginx_depends());
+
+		my $modules = "";
+		foreach my $module (@{$PACKAGE_TYPE{'has_a_module'}})
+		{
+			$modules .= "$module ";
+		}
+
+		push @postinst_autoscripts, ["module", $modules];
+	}
+
+	if (! $dh{NOSCRIPTS})
+	{
+		foreach my $ref (@postinst_autoscripts)
+		{
+			for my $script_type (qw/postinst prerm postrm/)
+			{
+				if ($script_type eq "postinst" &&  $dh{NOENABLE})
+				{
+					next
+				}
+
+				my %replacements = (
+					NAMES  => $ref->[1],
+				);
+
+				my $sed_command = "";
+				foreach my $key (sort keys %replacements)
+				{
+					my $val = $replacements{$key};
+					# Use a control char as separator for sed, to
+					# reduce escaping issues. Everything else is
+					# passed verbatim, i.e. it must not contain any
+					# shell or sed special characters.
+					my $sep = "\x17";
+					$sed_command .= "s" . $sep . "#$key#" .
+							      $sep . $val .
+							      $sep . "g; ";
+				}
+
+				autoscript($package, "$script_type", "$script_type-nginx", $sed_command);
+			}
+		}
+	}
+}
+
+# vim: syntax=perl sw=8 sts=8 sr noet

debian/debhelper/nginx.pm

@@ -0,0 +1,14 @@
+#!/usr/bin/perl
+use warnings;
+use strict;
+use Debian::Debhelper::Dh_Lib;
+
+add_command_options( "dh_auto_test",      "--buildsystem=nginx_mod" );
+add_command_options( "dh_auto_configure", "--buildsystem=nginx_mod" );
+add_command_options( "dh_auto_build",     "--buildsystem=nginx_mod" );
+add_command_options( "dh_auto_install",   "--buildsystem=nginx_mod" );
+add_command_options( "dh_auto_clean",     "--buildsystem=nginx_mod" );
+
+insert_after("dh_install", "dh_nginx");
+
+1;

debian/debhelper/nginx_mod.pm

@@ -0,0 +1,138 @@
+# A build system class for handling nginx modules.
+#
+# Copyright: © 2022 Miao Wang
+# License: MIT
+
+package Debian::Debhelper::Buildsystem::nginx_mod;
+
+use strict;
+use warnings;
+use Dpkg::Deps qw(deps_parse);
+use Dpkg::Control::Info;
+use Debian::Debhelper::Dh_Lib qw(error doit getpackages addsubstvar);
+use File::Spec;
+use parent qw(Debian::Debhelper::Buildsystem::makefile);
+use Config;
+
+sub DESCRIPTION {
+	"Nginx Module (config)"
+}
+
+sub check_auto_buildable {
+	my ($this, $step) = @_;
+
+	return 1 if -e $this->get_sourcepath("config");
+}
+
+sub _NGINX_SRC_DIR {
+	"/usr/share/nginx/src"
+}
+
+sub _NDK_SRC_DIR {
+	"/usr/share/nginx-ndk/src"
+}
+
+sub new {
+	my $class=shift;
+	my $this= $class->SUPER::new(@_);
+	my $ngx_ver = `grep 'define NGINX_VERSION' /usr/share/nginx/src/src/core/nginx.h | sed -e 's/^.*"\\(.*\\)".*/\\1/'`;
+	chomp($ngx_ver);
+	$this->prefer_out_of_source_building(@_);
+	$this->{has_ndk} = $this->has_build_dep("libnginx-mod-http-ndk-dev");
+	$this->{has_stream} = $this->has_build_dep("libnginx-mod-stream");
+	foreach my $cur (getpackages('arch')) {
+		if ($this->{has_ndk} == 1) {
+			addsubstvar($cur, "misc:Depends", "libnginx-mod-http-ndk");
+		}
+		if ($this->{has_stream} == 1) {
+			addsubstvar($cur, "misc:Depends", "libnginx-mod-stream (>= $ngx_ver), libnginx-mod-stream (<< $ngx_ver.1~)");
+		}
+	}
+	return $this;
+}
+
+sub configure {
+	my $this=shift;
+
+	doit({
+		"chdir" => $this->_NGINX_SRC_DIR,
+		"update_env" => {
+			"src_dir" => $this->get_sourcedir,
+			"bld_dir" => $this->get_builddir,
+			"pwd_dir" => $this->{cwd},
+		},
+	}, "bash", "-c", '. ./conf_flags
+		./configure \\
+		--with-cc-opt="$(cd "$pwd_dir/$src_dir"; dpkg-buildflags --get CFLAGS) -fPIC $(cd "$pwd_dir/$src_dir"; dpkg-buildflags --get CPPFLAGS)" \\
+		--with-ld-opt="$(cd "$pwd_dir/$src_dir"; dpkg-buildflags --get LDFLAGS) -fPIC" \\
+		"${NGX_CONF_FLAGS[@]}" \\
+		--add-dynamic-module="$pwd_dir/$src_dir" \\
+		--builddir="$pwd_dir/$bld_dir" \\
+		' . ($this->{has_ndk} ? '--add-module=' . $this->_NDK_SRC_DIR : '') . ' \\
+		' . ($this->{has_stream} ? '--with-stream' : '') . ' \\
+		"$@"', "dummy", @_);
+}
+
+sub build {
+	my $this=shift;
+
+	$this->do_make("-f", File::Spec->catfile($this->{cwd}, $this->get_buildpath("Makefile")), "-C", $this->_NGINX_SRC_DIR, "modules");
+}
+
+sub test {
+	my $this=shift;
+
+	if ( $this->{has_ndk} and !grep( /^ndk_http_module.so$/, @_ ) ) {
+		unshift @_, "ndk_http_module.so";
+	}
+
+	if ( $this->{has_stream} and !grep( /^ngx_stream_module.so$/, @_ ) ) {
+		unshift @_, "ngx_stream_module.so";
+	}
+
+	$this->doit_in_builddir("bash", "-e", "-o", "pipefail", "-c", '
+		tmp_conf=$(mktemp -p .)
+		for pre_dep in "$@"; do
+			echo "load_module modules/$pre_dep;" >> "$tmp_conf"
+		done
+		for i in *.so; do
+			echo "load_module $PWD/$i;" >> "$tmp_conf"
+		done
+		echo "events{}" >> "$tmp_conf"
+		/usr/sbin/nginx -g "error_log /dev/null; pid /dev/null;" -t -q -c "$PWD/$tmp_conf"
+		rm -f "$tmp_conf"
+	', "dummy", @_);
+}
+
+sub install {
+	my $this=shift;
+	my $destdir=shift;
+
+	$this->doit_in_builddir("bash", "-e", "-o", "pipefail", "-c", '
+		destdir=$1
+		mkdir -p "$destdir/usr/lib/nginx/modules"
+		for i in *.so; do
+			cp "$i" "$destdir/usr/lib/nginx/modules/"
+		done
+	', "dummy", $destdir);
+}
+
+sub clean {
+	my $this=shift;
+	$this->rmdir_builddir();
+}
+
+sub has_build_dep {
+	my $this=shift;
+	my $bd=shift;
+	my $control = Dpkg::Control::Info->new()->get_source();
+	my $depends = deps_parse($control->{'Build-Depends'});
+	foreach (split /,\s+/,$depends) {
+		if ($_ =~ /$bd/) {
+		return 1;
+	}
+	}
+	return 0;
+}
+
+1

debian/gbp.conf

@@ -0,0 +1,13 @@
+[DEFAULT]
+debian-branch = main
+upstream-branch = upstream
+upstream-tag = upstream/%(version)s
+pristine-tar = True
+sign-tags = True
+upstream-signatures = on
+
+[import-orig]
+merge-mode = replace
+
+[pull]
+track-missing = True

debian/help/docs/fcgiwrap

@@ -0,0 +1,14 @@
+##
+#  File:
+#    fcgiwrap
+#  Description:
+#    The fcgiwrap tool allows a user to quickly and painlessly setup a socket
+#    to handle CGI requests. This is useful for Python, Perl, etc.
+##
+
+The easy way:
+apt-get install fcgiwrap
+
+The less-easy way:
+If your distribution does not provide it, the Nginx wiki describes the steps.
+http://wiki.nginx.org/Fcgiwrap

debian/help/docs/php

@@ -0,0 +1,119 @@
+##
+#  File:
+#    php
+#  Description:
+#    This file is meant to help users get a basic understanding of a PHP stack
+#    with Nginx as the web server.
+##
+
+# Note: This is not a configuration sample and comment lines will be userd differently.
+
+
+== PHP Options ==
+
+There are a number of options that can be used to provide PHP. The two most
+common methods are php-cgi and php-fpm. The php-fpm option is relatively new
+and is not yet a standard option. This package is stable however and is moving
+toward being a standard option in distribution repositories.
+
+== PHP-FPM ==
+
+The php-fpm option is considerably harder to debug. However, the hardest issues
+to debug should be solved by including that fastcgi_params file provided by
+this package. It should at a minimum remove all silent errors.
+
+# sudo apt-get install php5-fpm
+
+If you do not have php5-fpm available, you will want to add the repository for
+the package.  https://launchpad.net/~nginx/+archive/php5
+
+In php5-fpm, you will want to edit the php pool.
+Edit /etc/php5/fpm/pool.d/www.conf
+
+The listen directive is the most important piece in this file. It is suggested
+to listen to a local unix socket. This listen directive will be used in your
+nginx configuration.
+Example: listen = /tmp/phpfpm.socket
+
+The rest of this file can be tweaked to your liking.
+
+== PHP-CGI ==
+
+The simplest and easiest method to run PHP is to use php-cgi. It does not offer
+the ability to monitor and restart processes that hang or die however.
+
+# sudo apt-get install php5-cgi
+
+To make php5-cgio work, you will need to create an init script.
+
+===== FILE: /etc/init.d/phpcgi =====
+#!/bin/bash
+#
+### BEGIN INIT INFO
+# Provides:          php-fcgi
+# Required-Start:    $local_fs $remote_fs $network $syslog
+# Required-Stop:     $local_fs $remote_fs $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: starts php-cgi processes
+# Description:       starts php-cgi using start-stop-daemon for each user
+### END INIT INFO
+
+# Number of PHP processes to be able to handle connections.
+CHILD=10
+# Maximum number of requests each child should handle before being regenerated
+MAX_REQS=750
+
+start() {
+        start-stop-daemon --quiet --start --background --chuid "www-data" \
+          --exec /usr/bin/env \
+          -- - USER="www-data" \
+          PATH=/usr/bin PHP_FCGI_CHILDREN=$CHILD PHP_FCGI_MAX_REQUESTS=$MAX_REQS \
+          php-cgi -b /tmp/phpcgi.socket &
+}
+
+stop() {
+        killall -w php-cgi
+        rm /tmp/phpcgi.socket
+        sync
+        sleep 1
+}
+
+case "$1" in
+        start) start;;
+        stop) stop;;
+        restart) stop; start;;
+        *) echo "Usage: php-fastcgi {start|stop|restart} [user]"; exit 1;;
+esac
+===== END FILE =====
+
+# Make file executable
+chmod +x /etc/init.d/phpcgi
+
+# Add file to startup
+update-rc.d phpcgi defaults
+
+== Using PHP in Nginx ==
+
+In order to use the sockets you created (/tmp/phpfpm.socket or /tmp/phpcgi.socket)
+you will need to add a php block to your Nignx configuration.
+
+# This block adds a little security.
+# See /usr/share/doc/nginx/examples/drupal for context
+location ~ \..*/.*\.php$ {
+	return 403;
+}
+
+# This is basic PHP block that can be used to handle all PHP requests.
+# See /usr/share/doc/nginx/examples/drupal for context
+location ~ \.php$ {
+	fastcgi_split_path_info ^(.+\.php)(/.+)$;
+	include fastcgi_params;
+	# Intercepting errors will cause PHP errors to appear in Nginx logs
+	fastcgi_intercept_errors on;
+	fastcgi_pass unix:/tmp/phpcgi.socket;
+}
+
+# The above example will use php5-cgi which is bound to /tmp/phpcgi.socket.
+# If you choose to use php5-fpm the example above will bind to /tmp/phpcgi.socket
+# instead and this should be used for fastcgi_pass instead.

debian/help/docs/support-irc

@@ -0,0 +1,28 @@
+##
+#  File:
+#    support-irc
+#  Description:
+#    This file explains how to get support on IRC.
+##
+
+Nginx has a moderately active IRC channel on Freenode.
+
+You can get there by:
+  * Client
+    Using an IRC Client and pointing it to:
+    #nginx on irc.freenode.net
+  * Browser
+    Opening a web browser and pointing it to:
+    http://webchat.freenode.net?channels=nginx
+
+Common sense is expected to be followed:
+  * Code of Conduct
+    http://www.ubuntu.com/community/conduct
+  * IRC Etiquette
+    http://www.ircbeginner.com/ircinfo/etiquette.html
+  * Patience
+    If somebody doesn't answer you right away, then wait.
+    Even active IRC users have to run off sometimes.
+
+If you need more help with IRC The Linux Documentation Project has more information:
+  http://tldp.org/HOWTO/IRC/beginners.html

debian/help/docs/upstream

@@ -0,0 +1,51 @@
+##
+#  File:
+#    upstream
+#  Description:
+#    This file describes how to use upstream blocks.
+##
+
+An upstream block allows you to set a list of upstream locations for both
+proxy_pass and fastcgi_pass directives.
+
+Examples of upstream blocks:
+
+# PHP listening on the same server
+upstream php {
+	# ip_hash ensures the same backend is used for client reconnects.
+	ip_hash;
+	# This assumes we have multiple PHP listeners on different known ports.
+	server 127.0.0.1:9000;
+	server 127.0.0.1:9001;
+	server 127.0.0.1:9002;
+	server 127.0.0.1:9003;
+	# In addition to listening on ports, we can listen to unix sockets.
+	server unix:/tmp/php-cgi.socket;
+}
+
+# Multiple backend Apache instances on separate servers
+upstream apache {
+	# Adding a weight alters the chance the upstream server will be used.
+	server apache1.domain.com weight 5;
+	server apache2.domain.com;
+	server apache3.domain.com;
+	# Adding 'down' keeps the upstream from being used. Useful for downtime management.
+	server apache4.domain.com down;
+	server apache5.domain.com;
+}
+
+Using an upstream location:
+
+# Passing PHP to upstream
+location ~ \.php$ {
+	fastcgi_split_path_info ^(.+\.php)(/.+)$;
+	include fastcgi_params;
+	fastcgi_pass php;
+}
+
+# Passing all requests for /cgi-bin/* to Apache upstreams.
+location /cgi-bin {
+	proxy_pass apache;
+}
+
+For more information see http://wiki.nginx.org/HttpUpstreamModule

debian/help/examples/drupal

@@ -0,0 +1,114 @@
+##
+#  File:
+#    drupal
+#  Description:
+#    This file is meant to offer a very detailed set of instructions and best
+#    practices for deploying a Drupal website with Nginx. This file should be
+#    almost drop-in if the user is able to understand the three lines that
+#    need to be changed.
+##
+
+server {
+
+	# This is the URI of your website. You can specify multiple sites to be
+	# served by the same Drupal installation.
+	server_name domain.com www.domain.com .example.net;
+
+	# This is the root of the Drupal directory.
+	# Note that Drupal 6, Drupal 7, and Pressflow are interchangeable
+	root /var/www/drupal6;
+ 
+	# In some cases a favicon does not exist but this is not something you
+	# normally need to worry about. It's also a microscopic image and will
+	# just clutter the logs.
+	location = /favicon.ico {
+		log_not_found off;
+		access_log off;
+	}
+ 
+	# This is for the robots.txt file used by search engines.
+	location = /robots.txt {
+		# If you have one, you want to allow them access to it.
+		allow all;
+		# If you don't have one, you don't want to fill your logs with
+		# not found errors.
+		log_not_found off;
+		access_log off;
+	}
+ 
+	# This matters if you use drush because drush copies backups of modules
+	# to this directory. In the event personal information wound up in the
+	# module, you want to know outside users can't access it.
+	location = /backup {
+		deny all;
+	}
+
+	# Very rarely should these ever be accessed outside of your lan
+	# The above location for robots.txt is an exact match and will override
+	# this location block.
+	location ~* \.(txt|log)$ {
+		allow 192.168.0.0/16;
+		deny all;
+	}
+
+	# This location block protects against a known attack. It happens if
+	# the attacker uploads a non-php file and attempts to run it as a
+	# php file on the server.
+	location ~ \..*/.*\.php$ {
+		return 403;
+	}
+ 
+	# This is our primary location block. The try_files directive will
+	# attempt to serve the data in the order listed. First try the exact
+	# request (such as an image or text file). If it doesn't exist, see if
+	# the directory exists. If not, then we move to the rewrite which is
+	# used for the front-end controller pattern.
+	location / {
+		try_files $uri $uri/ @rewrite;
+	}
+ 
+	# This will rewrite our request from domain.com/node/1/ to domain.com/index.php?q=node/1
+	# This could be done in try_files without a rewrite however, the GlobalRedirect
+	# module enforces no slash (/) at the end of URL's. This rewrite removes that
+	# so no infinite redirect loop is reached.
+	location @rewrite {
+		rewrite ^/(.*)$ /index.php?q=$1;
+	}
+ 
+	# If a PHP file is served, this block will handle the request. This block
+	# works on the assumption you are using php-cgi listening on /tmp/phpcgi.socket.
+	# Please see the php example (usr/share/doc/nginx/exmaples/php) for more
+	# information about setting up PHP.
+	# NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
+	location ~ \.php$ {
+		fastcgi_split_path_info ^(.+\.php)(/.+)$;
+		include fastcgi_params;
+		# Intercepting errors will cause PHP errors to appear in Nginx logs
+		fastcgi_intercept_errors on;
+		fastcgi_pass unix:/tmp/phpcgi.socket;
+	}
+ 
+	# The ImageCache module builds an image 'on the fly' which means that
+	# if it doesn't exist, it needs to be created. Nginx is king of static
+	# so there's no point in letting PHP decide if it needs to be servered
+	# from an existing file.
+	# If the image can't be served directly, it's assumed that it doesn't
+	# exist and is passed off to PHP via our previous rewrite to let PHP
+	# create and serve the image.
+	# Notice that try_files does not have $uri/ in it. This is because an
+	# image should never be a directory. So there's no point in wasting a
+	# stat to serve it that way.
+	location ~ ^/sites/.*/files/imagecache/ {
+		try_files $uri @rewrite;
+	}
+
+	# As mentioned above, Nignx is king of static. If we're serving a static
+	# file that ends with one of the following extensions, it is best to set
+	# a very high expires time. This will generate fewer requests for the
+	# file. These requests will be logged if found, but not if they don't
+	# exist.
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
+		expires max;
+		log_not_found off;
+	}
+}

debian/help/examples/http

@@ -0,0 +1,58 @@
+##
+#  File:
+#    http
+#  Description:
+#    This file is meant to deliver a basic understanding of the http block.
+##
+
+# All web configuration should be inside of the http block.
+# Most settings here are pretty self explanatory.
+# See http://wiki.nginx.org/HttpCoreModule for details.
+http {
+
+	##
+	# Basic Settings
+	##
+
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout 65;
+	# server_tokens off;
+
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# Logging Settings
+	##
+
+	access_log /var/log/nginx/access.log;
+	error_log /var/log/nginx/error.log;
+
+	##
+	# Gzip Settings
+	##
+
+	gzip on;
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# Virtual Host Configs
+	# These lines will include:
+	#   any files in /etc/nginx/sites-enabled/
+	#   and any in /etc/nginx/conf.d/ ending with .conf
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}

debian/help/examples/mail

@@ -0,0 +1,30 @@
+##
+#  File:
+#    mail
+#  Description:
+#    Provides a basic example of a mail proxy.
+##
+
+# All mail proxy configuration should be inside of the mail block.
+# Most settings here are pretty self explanatory.
+# See http://wiki.nginx.org/MailCoreModule
+mail {
+	# See sample authentication script at:
+	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
+ 
+	# auth_http localhost/auth.php;
+	# pop3_capabilities "TOP" "USER";
+	# imap_capabilities "IMAP4rev1" "UIDPLUS";
+ 
+	server {
+		listen     localhost:110;
+		protocol   pop3;
+		proxy      on;
+	}
+ 
+	server {
+		listen     localhost:143;
+		protocol   imap;
+		proxy      on;
+	}
+}

debian/help/examples/mailman

@@ -0,0 +1,59 @@
+##
+#  File:
+#    mailman
+#  Description:
+#    This file explains how to install MailMan and offers a nearly drop-in
+#    model if MailMan was installed from Debian/Ubuntu repositories.
+##
+
+server {
+
+	# This is the URI of your website. You can specify multiple sites to be
+	# served by the same Drupal installation.
+	server_name lists.DOMAIN.TLD;
+
+	# This is the default MailMan root directory.
+	root /usr/lib/cgi-bin;
+
+	# If the request is exactly the server_name, then we need to redirect
+	# the browser to the listinfo page. Notice the = for an exact match.
+	location = / {
+		rewrite ^ /mailman/listinfo permanent;
+	}
+
+	# Any requests need to be rewritten to /mailman/.
+	# This happens only if no other location block matches.
+	location / {
+		rewrite ^ /mailman$uri;
+	}
+
+	# If /mailmain/ was part of the request, then we need to let python
+	# handle the request.
+	location /mailman/ {
+		fastcgi_split_path_info (^/mailman/[^/]*)(.*)$;
+		include fastcgi_params;
+		fastcgi_param GATEWAY_INTERFACE CGI/1.1;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+		fastcgi_param PATH_INFO $fastcgi_path_info;
+		fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
+		# fcgiwrap was used to create this socket.
+		# See /usr/share/doc/nginx-doc/fcgiwrap
+		fastcgi_pass unix:/tmp/cgi.socket;
+	}
+
+	# If a request was made for an image, we need to change the directory
+	# that is beeing looked at. Nothing else is needed because the images
+	# are static content.
+	location /images/mailman {
+		alias /var/lib/mailman/icons;
+	}
+
+	# If a request for /pipermail was made, we are still only dealing with
+	# static content. The archives are at a different location and we need
+	# to point at it. Because these are public, there's no issue in letting
+	# them be browsed; autoindex is turned on to allow browsing.
+	location /pipermail {
+		alias /var/lib/mailman/archives/public;
+		autoindex on;
+	}
+}

debian/help/examples/nginx.conf

@@ -0,0 +1,34 @@
+##
+#  File:
+#    nginx.conf
+#  Description:
+#    Provides a very basic description of the use of nginx.conf.
+##
+
+# For more options with more detailed descriptions:
+# See http://wiki.nginx.org/CoreModule
+
+# Sets user/group of worker processes. If group is not specified, group is assumed
+# to be the same as user. Syntax: user user [group]
+user www-data;
+
+# nginx has the ability to use more than one worker process
+worker_processes 4;
+
+# The pid-file. It can be used for the kill-command to send signals to nginx.
+# Example: To reload the config: kill -HUP `cat /var/log/nginx.pid`
+pid /var/run/nginx.pid;
+
+# See http://wiki.nginx.org/HttpEventsModule
+events {
+    worker_connections 1024;
+    # multi_accept on;
+}
+
+# See /usr/share/doc/nginx/examples/http
+http {
+}
+
+# See /usr/share/doc/nginx/examples/mail
+mail {
+}

debian/help/examples/nginx_modsite

@@ -0,0 +1,162 @@
+#!/bin/bash
+
+##
+#  File:
+#    nginx_modsite
+#  Description:
+#    Provides a basic script to automate enabling and disabling websites found
+#    in the default configuration directories:
+#      /etc/nginx/sites-available and /etc/nginx/sites-enabled
+#    For easy access to this script, copy it into the directory:
+#      /usr/local/sbin
+#    Run this script without any arguments or with -h or --help to see a basic
+#    help dialog displaying all options.
+##
+
+# Copyright (C) 2010 Michael Lustfield <mtecknology@ubuntu.com>
+
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+##
+# Default Settings
+##
+
+NGINX_CONF_FILE="$(awk -F= -v RS=' ' '/conf-path/ {print $2}' <<< $(nginx -V 2>&1))"
+NGINX_CONF_DIR="${NGINX_CONF_FILE%/*}"
+NGINX_SITES_AVAILABLE="$NGINX_CONF_DIR/sites-available"
+NGINX_SITES_ENABLED="$NGINX_CONF_DIR/sites-enabled"
+SELECTED_SITE="$2"
+
+##
+# Script Functions
+##
+
+ngx_enable_site() {
+	[[ ! "$SELECTED_SITE" ]] &&
+		ngx_select_site "not_enabled"
+
+	[[ ! -e "$NGINX_SITES_AVAILABLE/$SELECTED_SITE" ]] && 
+		ngx_error "Site does not appear to exist."
+	[[ -e "$NGINX_SITES_ENABLED/$SELECTED_SITE" ]] &&
+		ngx_error "Site appears to already be enabled"
+
+	ln -sf "$NGINX_SITES_AVAILABLE/$SELECTED_SITE" -T "$NGINX_SITES_ENABLED/$SELECTED_SITE"
+	ngx_reload
+}
+
+ngx_disable_site() {
+	[[ ! "$SELECTED_SITE" ]] &&
+		ngx_select_site "is_enabled"
+
+	[[ ! -e "$NGINX_SITES_AVAILABLE/$SELECTED_SITE" ]] &&
+		ngx_error "Site does not appear to be \'available\'. - Not Removing"
+	[[ ! -e "$NGINX_SITES_ENABLED/$SELECTED_SITE" ]] &&
+		ngx_error "Site does not appear to be enabled."
+
+	rm -f "$NGINX_SITES_ENABLED/$SELECTED_SITE"
+	ngx_reload
+}
+
+ngx_list_site() {
+	echo "Available sites:"
+	ngx_sites "available"
+	echo "Enabled Sites"
+	ngx_sites "enabled"
+}
+
+##
+# Helper Functions
+##
+
+ngx_select_site() {
+	sites_avail=($NGINX_SITES_AVAILABLE/*)
+	sa="${sites_avail[@]##*/}"
+	sites_en=($NGINX_SITES_ENABLED/*)
+	se="${sites_en[@]##*/}"
+
+	case "$1" in
+		not_enabled) sites=$(comm -13 <(printf "%s\n" $se) <(printf "%s\n" $sa));;
+		is_enabled) sites=$(comm -12 <(printf "%s\n" $se) <(printf "%s\n" $sa));;
+	esac
+
+	ngx_prompt "$sites"
+}
+
+ngx_prompt() {
+	sites=($1)
+	i=0
+
+	echo "SELECT A WEBSITE:"
+	for site in ${sites[@]}; do
+		echo -e "$i:\t${sites[$i]}"
+		((i++))
+	done
+
+	read -p "Enter number for website: " i
+	SELECTED_SITE="${sites[$i]}"
+}
+
+ngx_sites() {
+	case "$1" in
+		available) dir="$NGINX_SITES_AVAILABLE";;
+		enabled) dir="$NGINX_SITES_ENABLED";;
+	esac
+
+	for file in $dir/*; do
+		echo -e "\t${file#*$dir/}"
+	done
+}
+
+ngx_reload() {
+	read -p "Would you like to reload the Nginx configuration now? (Y/n) " reload
+	[[ "$reload" != "n" && "$reload" != "N" ]] && invoke-rc.d nginx reload
+}
+
+ngx_error() {
+	echo -e "${0##*/}: ERROR: $1"
+	[[ "$2" ]] && ngx_help
+	exit 1
+}
+
+ngx_help() {
+	echo "Usage: ${0##*/} [options]"
+	echo "Options:"
+	echo -e "\t<-e|--enable> <site>\tEnable site"
+	echo -e "\t<-d|--disable> <site>\tDisable site"
+	echo -e "\t<-l|--list>\t\tList sites"
+	echo -e "\t<-h|--help>\t\tDisplay help"
+	echo -e "\n\tIf <site> is left out a selection of options will be presented."
+	echo -e "\tIt is assumed you are using the default sites-enabled and"
+	echo -e "\tsites-disabled located at $NGINX_CONF_DIR."
+}
+
+##
+# Core Piece
+##
+
+case "$1" in
+	-e|--enable)	ngx_enable_site;;
+	-d|--disable)	ngx_disable_site;;
+	-l|--list)	ngx_list_site;;
+	-h|--help)	ngx_help;;
+	*)		ngx_error "No Options Selected" 1; ngx_help;;
+esac

debian/help/examples/virtual_hosts

@@ -0,0 +1,155 @@
+##
+#  File:
+#    virtual_hosts
+#  Description:
+#    This file is meant to deliver a basic understanding of server blocks.
+##
+
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# http://wiki.nginx.org/Pitfalls
+# http://wiki.nginx.org/Configuration
+##
+
+##
+# Every "virtual host" that you serve will need to be in its own server block.
+#
+# server {
+#	...
+# }
+#
+# After reading this file, you should understand the structure of server blocks
+# and be able to understand how to modify them to your needs.
+##
+
+server {
+
+	# The listen directive is only needed if this server block:
+	#   needs to listen for IPv6
+	#   needs to listen on another port
+	# If you need to listen for IPv6 then both of the following lines can
+	# be included.
+	# DO NOT listen for both SSL and non-SSL in the same server block.
+	#listen 80; ## listen for ipv4; this line is default and implied
+	#listen [::]:80 default ipv6only=on; ## listen for ipv6
+
+	# root specifies the document root for the requests
+	root /usr/share/nginx/www;
+
+	# index specifies the list of files (in order) to be tried in the event
+	# no file is requested in the URI.
+	index index.html index.htm;
+
+	# Make site accessible from http://localhost/
+	server_name localhost;
+
+	# Unless you run everything as a proxy, you will want to have a root
+	# location block. This example controls how files are requested.
+	location / {
+		# First attempt to serve request as file, then as directory,
+		# then fall back to index.html. /index.html would normally be
+		# front end controller pattern for handling "clean url's" in
+		# a CMS such as Drupal or Wordpress.
+		try_files $uri $uri/ /index.html;
+	}
+
+	# This location block would server any requests for /doc as well
+	# as anything below it.
+	location /doc {
+		# root changes the root directory for these requests
+		root /usr/share;
+		# autoindex on allows these request to display directory listings
+		# if a directory was requested
+		autoindex on;
+		# We'll allow these requests for localhost
+		allow 127.0.0.1;
+		# Anyone outside is forbidden
+		deny all;
+	}
+
+	# This location block would serve any requests for /images as well
+	# as anything below it.
+	location /images {
+		# This is the same as /doc except we don't allow indexes
+		root /usr/share;
+		autoindex off;
+		allow 127.0.0.1;
+		deny all;
+	}
+
+	# This will serve the file 404.html in the event the request is not found.
+	error_page 404 /404.html;
+
+	# redirect server error pages to the static page /50x.html
+	# This will hit if the server generates a 500, 502, 503, or 504 status code
+	error_page 500 502 503 504 /50x.html;
+
+	# This location block isn't actually needed because our root for the
+	# server block is the same directory. However, this could be used to
+	# have a central directory for all error html files.
+	location = /50x.html {
+		root /usr/share/nginx/www;
+	}
+
+	# proxy the PHP scripts to Apache listening on 127.0.0.1:80
+	# If you're going to proxy to Apache, then just push the whole
+	# request to it. You'll generally have better performance with
+	# a dedicated php listener (fastcgi: php-cgi, php-fpm).
+	#location ~ \.php$ {
+	#	proxy_pass http://127.0.0.1;
+	#}
+
+	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+	# This is used for passing to php-cgi and php-fpm.
+	# For more information see /usr/share/doc/nginx/examples/php
+	location ~ \.php$ {
+		# This is where the php socket is listening.
+		fastcgi_pass 127.0.0.1:9000;
+		fastcgi_index index.php;
+		include fastcgi_params;
+	}
+
+	# deny access to .htaccess, .htpasswd, and .htgroup files
+	location ~ /\.ht {
+		deny all;
+	}
+}
+
+
+# another virtual host using mix of IP-, name-, and port-based configuration
+server {
+	listen 8000;
+	listen somename:8080;
+	server_name somename alias another.alias;
+	root html;
+	index index.html index.htm;
+
+	location / {
+		try_files $uri $uri/ /index.html;
+	}
+}
+
+
+# HTTPS server
+server {
+	listen 443;
+	server_name localhost;
+
+	root html;
+	index index.html index.htm;
+
+	ssl on;
+	ssl_certificate cert.pem;
+	ssl_certificate_key cert.key;
+
+	ssl_session_timeout 5m;
+
+	ssl_protocols SSLv3 TLSv1;
+	ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
+	ssl_prefer_server_ciphers on;
+
+	location / {
+		try_files $uri $uri/ /index.html;
+	}
+}

debian/help/examples/wordpress

@@ -0,0 +1,73 @@
+##
+#  File:
+#    wordpress
+#  Description:
+#    This file is meant to offer a basic guide to get a Wordpress site up and
+#    running on Nginx. This file should be almost drop-in if the user is able
+#    to understand the three lines that need to be changed.
+##
+
+server {
+
+	# This is the URI of your website.
+	server_name domain.com;
+
+	# This is the root of the Wordpress directory.
+	root /var/www/wordpress;
+ 
+	# In some cases a favicon does not exist but this is not something you
+	# normally need to worry about. It's also a microscopic image and will
+	# just clutter the logs.
+	location = /favicon.ico {
+		log_not_found off;
+		access_log off;
+	}
+ 
+	# This is for the robots.txt file used by search engines.
+	location = /robots.txt {
+		# If you have one, you want to allow them access to it.
+		allow all;
+		# If you don't have one, you don't want to fill your logs with
+		# not found errors.
+		log_not_found off;
+		access_log off;
+	}
+ 
+	# This location block protects against a known attack. It happens if
+	# the attacker uploads a non-PHP file and attempts to run it as a
+	# PHP file on the server.
+	location ~ \..*/.*\.php$ {
+		return 403;
+	}
+ 
+	# This is our primary location block. The try_files directive will
+	# attempt to serve the data in the order listed. First try the exact
+	# request (such as an image or text file). If it doesn't exist, see if
+	# the directory exists. If not, then we move to the last option which
+	# passes the request to /index.php with the requested query.
+	location / {
+		try_files $uri $uri/ /index.php?q=$uri&$args;
+	}
+ 
+	# If a PHP file is served, this block will handle the request. This block
+	# works on the assumption you are using php-cgi listening on /tmp/phpcgi.socket.
+	# Please see the PHP example (/usr/share/doc/nginx-doc/php) for more
+	# information about setting up PHP.
+	# NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
+	location ~ \.php$ {
+		fastcgi_split_path_info ^(.+\.php)(/.+)$;
+		include fastcgi_params;
+		# Intercepting errors will cause PHP errors to appear in Nginx logs
+		fastcgi_intercept_errors on;
+		fastcgi_pass unix:/tmp/phpcgi.socket;
+	}
+
+	# If we're serving a static file that ends with one of the following
+	# extensions, it is best to set a very high expires time. This will
+	# generate fewer requests for the file. These requests will be logged if
+	# found, but not if they don't exist.
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
+		expires max;
+		log_not_found off;
+	}
+}

debian/libnginx-mod-http-geoip.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/libnginx-mod-http-image-filter.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/libnginx-mod-http-perl.install

@@ -0,0 +1,7 @@
+#!/usr/bin/perl -w
+
+use Config;
+
+my $vendorarch = substr($Config{vendorarch}, 1);
+print "debian/build-bin/objs/src/http/modules/perl/blib/arch/auto/nginx/* $vendorarch/auto/nginx\n";
+print "debian/build-bin/objs/src/http/modules/perl/blib/lib/nginx.pm $vendorarch\n";

debian/libnginx-mod-http-perl.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/libnginx-mod-http-xslt-filter.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/libnginx-mod-mail.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/libnginx-mod-stream-geoip.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf 70\n";

debian/libnginx-mod-stream.nginx

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-bin/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/libnginx-mod.abisubstvars

@@ -0,0 +1,11 @@
+# ABI must be changed:
+# - when upstream nginx version is changed
+# - when module signature is changed (e.g. time_t change from 32bit integer to 64bit integer https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069997)
+# - when symbols/structures/... (exported from header files) are changed
+#
+# ABI format: nginx-abi-{UPSTREAM_VERSION}-{SUFFIX}
+# the {SUFFIX} provides a mechanism on rare cases when there have to be ABI
+# changes without upgrading the upstream nginx version, e.g. security updates
+# in oldstable
+
+nginx:abi=nginx-abi-1.26.3-1

debian/libnginx-mod.conf/mod-http-geoip.conf

@@ -0,0 +1 @@
+load_module modules/ngx_http_geoip_module.so;

debian/libnginx-mod.conf/mod-http-image-filter.conf

@@ -0,0 +1 @@
+load_module modules/ngx_http_image_filter_module.so;

debian/libnginx-mod.conf/mod-http-perl.conf

@@ -0,0 +1 @@
+load_module modules/ngx_http_perl_module.so;

debian/libnginx-mod.conf/mod-http-xslt-filter.conf

@@ -0,0 +1 @@
+load_module modules/ngx_http_xslt_filter_module.so;

debian/libnginx-mod.conf/mod-mail.conf

@@ -0,0 +1 @@
+load_module modules/ngx_mail_module.so;

debian/libnginx-mod.conf/mod-stream-geoip.conf

@@ -0,0 +1 @@
+load_module modules/ngx_stream_geoip_module.so;

debian/libnginx-mod.conf/mod-stream.conf

@@ -0,0 +1 @@
+load_module modules/ngx_stream_module.so;

debian/libnginx-mod.nginx.skeleton

@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-extras/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";

debian/nginx-common.NEWS

@@ -0,0 +1,188 @@
+nginx-common (1.10.2-4) unstable; urgency=medium
+
+  Since nginx 1.9.14 Debian has gradually switched to dynamic loadable modules
+  for all third party modules and core modules that support it. For each
+  module a new binary package is introduced under the libnginx-mod-* namespace.
+
+  The modules are loadable from all nginx flavors (light,full,extras) and are
+  automatically registered by installing a symlink under
+  /etc/nginx/modules-enabled/. If you use a modified /etc/nginx/nginx.conf make
+  sure to include that directory.
+
+ -- Christos Trochalakis <ctrochalakis@debian.org>  Sun, 22 Jan 2017 12:19:30 +0200
+
+nginx-common (1.10.2-1) unstable; urgency=high
+
+  In order to secure nginx against privilege escalation attacks, we are
+  changing the way log file owners & permissions are handled so that www-data
+  is not allowed to symlink a logfile. /var/log/nginx is now owned by root:adm
+  and its permissions are changed to 0755. The package checks for such symlinks
+  on existing installations and informs the admin using debconf.
+
+  That unfortunately may come at a cost in terms of privacy. /var/log/nginx is
+  now world-readable, and nginx hardcodes permissions of non-existing logs to
+  0644. On systems running logrotate log files are private after the first
+  logrotate run, since the new log files are created with 0640 permissions.
+
+ -- Christos Trochalakis <yatiohi@ideopolis.gr>  Tue, 04 Oct 2016 15:20:33 +0300
+
+nginx-common (1.9.9-1) unstable; urgency=medium
+
+  Starting with this release we are changing the default logrotate rule to keep
+  daily logs for 14 days, this aligns our policy with apache2 (Bug #805322).
+
+ -- Christos Trochalakis <yatiohi@ideopolis.gr>  Thu, 14 Jan 2016 10:17:33 +0200
+
+nginx-common (1.9.6-1) unstable; urgency=medium
+
+  As of nginx 1.9.5 spdy has been replaced by the http2 module. Make sure to
+  replace "spdy" with "http2" in your config files.
+
+ -- Christos Trochalakis <yatiohi@ideopolis.gr>  Fri, 25 Sep 2015 14:06:28 +0300
+
+nginx-common (1.9.1-1) unstable; urgency=medium
+
+  Starting with this release, we have enabled PIE build features which allows
+  Address Space Layout Randomization. This is a hardening feature that
+  prevents some potential security issues.
+
+  While this will significantly help increase security, it can potentially cause
+  significant performance issues on i386 systems.
+
+ -- Michael Lustfield <michael@lustfield.net>  Tue, 07 Apr 2015 18:57:45 -0500
+
+nginx-common (1.6.2-5) unstable; urgency=medium
+
+  We have disabled SSLv3 in nginx.conf for security reasons (ref: POODLE),
+  don't forget to re-enable it if your site depends on it.
+
+  In this release we also include a summary of important changes since wheezy
+  at /usr/share/doc/nginx-common/README.Debian.
+
+ -- Christos Trochalakis <yatiohi@ideopolis.gr>  Sun, 02 Nov 2014 09:10:09 +0200
+
+nginx-common (1.6.2-3) unstable; urgency=medium
+
+  Starting with this release, we changed the default document root from
+  /var/www to /var/www/html, so that sensitive files from other virtual hosts
+  wich are typically put into some directory below /var/www are not exposed by
+  the default virtual host.
+
+ -- Christos Trochalakis <yatiohi@ideopolis.gr>  Tue, 30 Sep 2014 17:34:58 +0300
+
+nginx-common (1.6.1-2) unstable; urgency=medium
+
+  As of nginx-1.6.1-2 we have synced all configuration files with upstream and
+  we plan to keep them in sync from now on.
+
+  Unfortunately that might break existing configuration for some users. Please
+  check the matrix below for more information:
+
+  File            Changes
+  -----------------------
+  koi-win         whitespace
+  koi-utf         whitespace
+  mime-types      whitespace, changed js/rss mime type,
+                  minor other changes & additions
+  scgi_params     whitespace, added HTTPS
+  uwsgi_params    whitespace, added HTTPS, removed UWSGI_SCHEME
+  fastcgi_params  whitespace, removed SCRIPT_FILENAME
+  fastcgi.conf    new upstream configuration file
+
+  Fastcgi configuration issues
+  ============================
+
+  nginx shipped a modified `fastcgi_params`, which declared `SCRIPT_FILENAME`
+  fastcgi_param. This line has now been removed. From now on we are also
+  shipping fastcgi.conf from the upstream repository, which includes a sane
+  `SCRIPT_FILENAME` parameter value.
+
+  So, if you are using fastcgi_params, you can try switching to fastcgi.conf
+  or manually set the relevant params.
+
+  You might also want to read the documentation section before proceeding.
+
+  http://nginx.org/en/docs/http/ngx_http_fastcgi_module.html
+  section: $fastcgi_script_name variable.
+
+ -- Christos Trochalakis <yatiohi@ideopolis.gr>  Thu, 28 Aug 2014 14:23:42 +0300
+
+nginx-common (1.4.4-2) unstable; urgency=low
+
+  Per CVE-2013-0337 (bug #701112), we are changing /var/log/nginx permissions
+  to root:adm 750. If you have manipulated these permissions in any way, you
+  can add a dpkg-statoverride entry and the directory will not be touched.
+  You also have to manually set the permissions once, as dpkg doesn't do that
+  automatically for directories.
+
+  e.g.
+    chown root:adm /var/log/nginx
+    chmod 0755 /var/log/nginx
+    dpkg-statoverride --add root adm 0755 /var/log/nginx
+
+ -- Michael Lustfield <michael@lustfield.net>  Sun, 24 Nov 2013 15:59:52 -0600
+
+nginx (1.4.1-2) unstable; urgency=medium
+
+  Started with nginx 1.4.1-2 upload, nginx-naxsi-ui switched backend from
+  MySQL to SQLite.
+
+  This was mostly caused by the future removal of MySQL support in naxsi-ui.
+  Thus, the nginx maintainers decided to switch from MySQL to SQLite.
+
+  All data contained in the MySQL database is not affected by this switch but
+  you need to start with a clean SQLite database to ensure nginx-naxsi-ui
+  reliability.
+
+ -- Cyril Lavier <cyril.lavier@davromaniak.eu>  Wed,  5 Jun 2013 09:45:03 +0200
+
+nginx (0.8.53-1) unstable; urgency=low
+
+  As stated by upstream, the 0.7.x branch is consedered legacy and 0.8.x will
+  be the new stable branch. For this reason, the nginx maintainers decided to
+  upload 0.8.53 to unstable.
+
+ -- Kartik Mistry <kartik@debian.org>  Fri, 26 Nov 2010 19:42:09 +0530
+
+nginx (0.7.59-1) unstable; urgency=low
+
+  As stated by upstream, the 0.6.x branch is consedered legacy and 0.7.x will
+  be the new stable branch. For this reason, the nginx maintainers decided to
+  upload 0.7.59 to unstable.
+
+  Should you get the following error while starting nginx:
+
+    could not build the server_names_hash, you should increase
+    server_names_hash_bucket_size: 32
+
+  Please add the following parameter to your nginx.conf:
+
+    server_names_hash_bucket_size 100;
+
+  Where 100 is the size of your server names hash bucket. For more information
+  about this option, please read the following resources:
+
+    http://wiki.nginx.org/NginxHttpCoreModule#server_names_hash_bucket_size
+    http://thread.gmane.org/gmane.comp.web.nginx.english/820/focus=821
+    http://thread.gmane.org/gmane.comp.web.nginx.english/985/focus=989
+
+ -- Fabio Tranchitella <kobold@debian.org>  Sun, 31 May 2009 18:30:10 +0200
+
+nginx (0.6.30-2) unstable; urgency=low
+
+  As of May 4th., nginx 0.5.x branch is considered legacy and 0.6.x will
+  be the new stable branch. The announcement was made by Igor Sysoev when
+  releasing the last 0.5.x version, nginx 0.5.36.
+
+  Debian, the universal operating system, has provided binary packages for
+  both 0.5 and 0.6 branches in unstable and experimental, and will now offer
+  only 0.6 packages in the unstable distribution, starting with the
+  0.6.30-1 package.
+
+  In the future, Debian will also provide experimental packages for the
+  next testing branch of nginx, at the moment upstream announces it.
+
+  Should you have any problem with nginx in Debian, please file a bug in
+  the Debian Bug Tracking System.
+
+ -- Fabio Tranchitella <kobold@debian.org>  Mon, 12 May 2008 14:24:53 +0200

debian/nginx-common.config

@@ -0,0 +1,36 @@
+#!/bin/sh
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+logdir="/var/log/nginx"
+
+log_symlinks_check() {
+    # Skip new installations
+    [ -z "$1" ] && return
+
+    # Skip unaffected installations
+    dpkg --compare-versions "$1" lt-nl "1.10.2-1~" || return 0
+
+    # Check for unsecure symlinks
+    linked_logfiles="` find "$logdir" -type l -user www-data -name '*.log' `"
+
+    # Skip if nothing is found
+    [ -z "$linked_logfiles" ] && return
+
+    db_subst nginx/log-symlinks logfiles $linked_logfiles
+    db_input high nginx/log-symlinks || true
+    db_go || true
+}
+
+case "$1" in
+    configure|reconfigure)
+        log_symlinks_check "$2"
+        ;;
+    *)
+        ;;
+esac
+
+# vim: set ts=4 sts=4 sw=4 et sta ai :
+

debian/nginx-common.dirs

@@ -0,0 +1,12 @@
+etc/nginx
+etc/nginx/conf.d
+etc/nginx/modules-available
+etc/nginx/modules-enabled
+etc/nginx/sites-available
+etc/nginx/sites-enabled
+etc/ufw/applications.d
+usr/share/nginx
+usr/share/vim/addons
+usr/share/vim/registry
+var/lib/nginx
+var/log/nginx

debian/nginx-common.install

@@ -0,0 +1,6 @@
+contrib/vim/* usr/share/vim/addons
+debian/conf/* etc/nginx
+debian/apport/source_nginx.py usr/share/apport/package-hooks
+debian/ufw/nginx etc/ufw/applications.d
+debian/vim/nginx.yaml usr/share/vim/registry
+html/index.html usr/share/nginx/html/

debian/nginx-common.links

@@ -0,0 +1 @@
+usr/lib/nginx/modules usr/share/nginx/modules

debian/nginx-common.nginx.default

@@ -0,0 +1,10 @@
+# Note: You may want to look at the following page before setting the ULIMIT.
+#  http://wiki.nginx.org/CoreModule#worker_rlimit_nofile
+# Set the ulimit variable if you need defaults to change.
+#  Example: ULIMIT="-n 4096"
+#ULIMIT="-n 4096"
+
+# Define the stop schedule for nginx
+# see the start-stop-daemon --retry documentation for more information
+#
+#STOP_SCHEDULE="QUIT/5/TERM/5/KILL/5"

debian/nginx-common.nginx.init

@@ -0,0 +1,196 @@
+#!/bin/sh
+
+### BEGIN INIT INFO
+# Provides:	  nginx
+# Required-Start:    $local_fs $remote_fs $network $syslog $named
+# Required-Stop:     $local_fs $remote_fs $network $syslog $named
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: starts the nginx web server
+# Description:       starts nginx using start-stop-daemon
+### END INIT INFO
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/nginx
+NAME=nginx
+DESC=nginx
+
+# Include nginx defaults if available
+if [ -r /etc/default/nginx ]; then
+	. /etc/default/nginx
+fi
+
+STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/5/KILL/5}"
+
+test -x $DAEMON || exit 0
+
+. /lib/init/vars.sh
+. /lib/lsb/init-functions
+
+# Try to extract nginx pidfile
+PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1)
+if [ -z "$PID" ]; then
+	PID=/run/nginx.pid
+fi
+
+if [ -n "$ULIMIT" ]; then
+	# Set ulimit if it is set in /etc/default/nginx
+	ulimit $ULIMIT
+fi
+
+start_nginx() {
+	# Start the daemon/service
+	#
+	# Returns:
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \
+		$DAEMON_OPTS 2>/dev/null \
+		|| return 2
+}
+
+test_config() {
+	# Test the nginx configuration
+	$DAEMON -t $DAEMON_OPTS >/dev/null 2>&1
+}
+
+stop_nginx() {
+	# Stops the daemon/service
+	#
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME
+	RETVAL="$?"
+	sleep 1
+	return "$RETVAL"
+}
+
+reload_nginx() {
+	# Function that sends a SIGHUP to the daemon/service
+	start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME
+	return 0
+}
+
+rotate_logs() {
+	# Rotate log files
+	start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME
+	return 0
+}
+
+upgrade_nginx() {
+	# Online upgrade nginx executable
+	# http://nginx.org/en/docs/control.html
+	#
+	# Return
+	#   0 if nginx has been successfully upgraded
+	#   1 if nginx is not running
+	#   2 if the pid files were not created on time
+	#   3 if the old master could not be killed
+	if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then
+		# Wait for both old and new master to write their pid file
+		while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do
+			cnt=`expr $cnt + 1`
+			if [ $cnt -gt 10 ]; then
+				return 2
+			fi
+			sleep 1
+		done
+		# Everything is ready, gracefully stop the old master
+		if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then
+			return 0
+		else
+			return 3
+		fi
+	else
+		return 1
+	fi
+}
+
+case "$1" in
+	start)
+		log_daemon_msg "Starting $DESC" "$NAME"
+		start_nginx
+		case "$?" in
+			0|1) log_end_msg 0 ;;
+			2)   log_end_msg 1 ;;
+		esac
+		;;
+	stop)
+		log_daemon_msg "Stopping $DESC" "$NAME"
+		stop_nginx
+		case "$?" in
+			0|1) log_end_msg 0 ;;
+			2)   log_end_msg 1 ;;
+		esac
+		;;
+	restart)
+		log_daemon_msg "Restarting $DESC" "$NAME"
+
+		# Check configuration before stopping nginx
+		if ! test_config; then
+			log_end_msg 1 # Configuration error
+			exit $?
+		fi
+
+		stop_nginx
+		case "$?" in
+			0|1)
+				start_nginx
+				case "$?" in
+					0) log_end_msg 0 ;;
+					1) log_end_msg 1 ;; # Old process is still running
+					*) log_end_msg 1 ;; # Failed to start
+				esac
+				;;
+			*)
+				# Failed to stop
+				log_end_msg 1
+				;;
+		esac
+		;;
+	reload|force-reload)
+		log_daemon_msg "Reloading $DESC configuration" "$NAME"
+
+		# Check configuration before stopping nginx
+		#
+		# This is not entirely correct since the on-disk nginx binary
+		# may differ from the in-memory one, but that's not common.
+		# We prefer to check the configuration and return an error
+		# to the administrator.
+		if ! test_config; then
+			log_end_msg 1 # Configuration error
+			exit $?
+		fi
+
+		reload_nginx
+		log_end_msg $?
+		;;
+	configtest|testconfig)
+		log_daemon_msg "Testing $DESC configuration"
+		test_config
+		log_end_msg $?
+		;;
+	status)
+		status_of_proc -p $PID "$DAEMON" "$NAME" && exit 0 || exit $?
+		;;
+	upgrade)
+		log_daemon_msg "Upgrading binary" "$NAME"
+		upgrade_nginx
+		log_end_msg $?
+		;;
+	rotate)
+		log_daemon_msg "Re-opening $DESC log files" "$NAME"
+		rotate_logs
+		log_end_msg $?
+		;;
+	*)
+		echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest|rotate|upgrade}" >&2
+		exit 3
+		;;
+esac

debian/nginx-common.nginx.logrotate

@@ -0,0 +1,18 @@
+/var/log/nginx/*.log {
+	daily
+	missingok
+	rotate 14
+	compress
+	delaycompress
+	notifempty
+	create 0640 www-data adm
+	sharedscripts
+	prerotate
+		if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
+			run-parts /etc/logrotate.d/httpd-prerotate; \
+		fi \
+	endscript
+	postrotate
+		invoke-rc.d nginx rotate >/dev/null 2>&1
+	endscript
+}

debian/nginx-common.nginx.service

@@ -0,0 +1,31 @@
+# Stop dance for nginx
+# =======================
+#
+# ExecStop sends SIGQUIT (graceful stop) to the nginx process.
+# If, after 5s (--retry QUIT/5) nginx is still running, systemd takes control
+# and sends SIGTERM (fast shutdown) to the main process.
+# After another 5s (TimeoutStopSec=5), and if nginx is alive, systemd sends
+# SIGKILL to all the remaining processes in the process group (KillMode=mixed).
+#
+# nginx signals reference doc:
+# http://nginx.org/en/docs/control.html
+#
+[Unit]
+Description=A high performance web server and a reverse proxy server
+Documentation=man:nginx(8)
+After=network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+ConditionFileIsExecutable=/usr/sbin/nginx
+
+[Service]
+Type=forking
+PIDFile=/run/nginx.pid
+ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
+ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
+ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
+ExecStop=-/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid
+TimeoutStopSec=5
+KillMode=mixed
+
+[Install]
+WantedBy=multi-user.target

debian/nginx-common.postinst

@@ -0,0 +1,59 @@
+#!/bin/sh
+set -e
+
+. /usr/share/debconf/confmodule
+
+case "$1" in
+  configure)
+    logdir="/var/log/nginx"
+
+    # Allow local admin to override
+    if ! dpkg-statoverride --list "$logdir" >/dev/null; then
+      chown root:adm $logdir
+      chmod 0755 $logdir
+    fi
+
+    # Secure default logfiles on fresh installations
+    if [ -z "$2" ]; then
+      access_log="$logdir/access.log"
+      error_log="$logdir/error.log"
+
+      if [ ! -e "$access_log" ]; then
+        touch "$access_log"
+        chmod 640 "$access_log"
+        chown www-data:adm "$access_log"
+      fi
+
+      if [ ! -e "$error_log" ]; then
+        touch "$error_log"
+        chmod 640 "$error_log"
+        chown www-data:adm "$error_log"
+      fi
+    fi
+
+    # If a symlink doesn't exist and can be created, then create it.
+    if [ -z $2 ] && [ ! -e /etc/nginx/sites-enabled/default ] &&
+       [ -d /etc/nginx/sites-enabled ] && [ -d /etc/nginx/sites-available ]; then
+      ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default
+    fi
+
+    # Create a default index page when not already present.
+    if [ ! -e /var/www/html/index.nginx-debian.html ]; then
+      mkdir -p /var/www/html
+      cp /usr/share/nginx/html/index.html /var/www/html/index.nginx-debian.html
+    fi
+
+    ;;
+
+  abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+  *)
+    echo "postinst called with unknown argument \`$1'" >&2
+    exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/nginx-common.postrm

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  purge)
+    rm -rf /var/lib/nginx /var/log/nginx /etc/nginx
+    ;;
+
+  upgrade|remove|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+  *)
+    echo "postrm called with unknown argument \`$1'" >&2
+    exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/nginx-common.preinst

@@ -0,0 +1,37 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  install)
+    # If we are doing a fresh install, then these files are no longer needed.
+    # They were around for a very short time and are best simply removed.
+    rm -f /etc/logrotate.d/nginx-full
+    rm -f /etc/logrotate.d/nginx-light
+    rm -f /etc/logrotate.d/nginx-extras
+    rm -f /etc/logrotate.d/nginx-common
+    ;;
+
+  upgrade)
+    # If this is an upgrade, then they might have the UFW profile in the wrong spot.
+    if [ -d /etc/ufw/applications.d/nginx ]; then
+      rm -f /etc/ufw/applications.d/nginx/ufw.profile
+      rmdir /etc/ufw/applications.d/nginx
+    fi
+    rm -f /etc/logrotate.d/nginx-full
+    rm -f /etc/logrotate.d/nginx-light
+    rm -f /etc/logrotate.d/nginx-extras
+    rm -f /etc/logrotate.d/nginx-common
+    ;;
+
+  abort-upgrade)
+    ;;
+
+  *)
+    echo "preinst called with unknown argument \`$1'" >&2
+    exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/nginx-common.templates

@@ -0,0 +1,13 @@
+Template: nginx/log-symlinks
+Type: note
+_Description: Possible insecure nginx log files
+ The following log files under /var/log/nginx directory are symlinks
+ owned by www-data:
+ .
+ ${logfiles}
+ .
+ Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result
+ www-data could symlink log files to sensitive locations, which in turn
+ could lead to privilege escalation attacks. Although /var/log/nginx
+ permissions are now fixed it is possible that such insecure links
+ already exist. So, please make sure to check the above locations.

debian/nginx-core.NEWS

@@ -0,0 +1,9 @@
+nginx-core (1.22.1-6) unstable; urgency=medium
+
+  The packages nginx-core, nginx-full, nginx-light, nginx-extras are deprecated.
+  Packages no longer distribute the nginx binary and are replaced 
+  by a metapackage to keep upgrades smooth.
+  Please simply install 'nginx' and 'libnginx-mod-...' modules You need
+  instead of these packages.
+
+ -- Jan Mojžíš <jan.mojzis@gmail.com>  Wed, 11 Jan 2023 20:23:22 +0100

debian/nginx-dev.install

@@ -0,0 +1,9 @@
+debian/build-src/auto usr/share/nginx/src/
+debian/build-src/src usr/share/nginx/src/
+debian/build-src/conf_flags usr/share/nginx/src/
+debian/build-src/configure usr/share/nginx/src/
+debian/libnginx-mod.abisubstvars usr/share/nginx/src/debian/
+debian/debhelper/nginx.pm usr/share/perl5/Debian/Debhelper/Sequence/
+debian/debhelper/dh_nginx usr/bin/
+debian/debhelper/nginx_mod.pm usr/share/perl5/Debian/Debhelper/Buildsystem/
+debian/autoscripts/* usr/share/debhelper/autoscripts/

debian/nginx-dev.manpages

@@ -0,0 +1 @@
+debian/build-src/dh_nginx.1

debian/nginx-doc.docs

@@ -0,0 +1,2 @@
+README
+debian/help/docs/*

debian/nginx-doc.examples

@@ -0,0 +1 @@
+debian/help/examples/*

debian/nginx-extras.NEWS

@@ -0,0 +1,9 @@
+nginx-extras (1.22.1-6) unstable; urgency=medium
+
+  The packages nginx-core, nginx-full, nginx-light, nginx-extras are deprecated.
+  Packages no longer distribute the nginx binary and are replaced 
+  by a metapackage to keep upgrades smooth.
+  Please simply install 'nginx' and 'libnginx-mod-...' modules You need
+  instead of these packages.
+
+ -- Jan Mojžíš <jan.mojzis@gmail.com>  Wed, 11 Jan 2023 20:23:22 +0100

debian/nginx-full.NEWS

@@ -0,0 +1,9 @@
+nginx-full (1.22.1-6) unstable; urgency=medium
+
+  The packages nginx-core, nginx-full, nginx-light, nginx-extras are deprecated.
+  Packages no longer distribute the nginx binary and are replaced 
+  by a metapackage to keep upgrades smooth.
+  Please simply install 'nginx' and 'libnginx-mod-...' modules You need
+  instead of these packages.
+
+ -- Jan Mojžíš <jan.mojzis@gmail.com>  Wed, 11 Jan 2023 20:23:22 +0100

debian/nginx-light.NEWS

@@ -0,0 +1,9 @@
+nginx-light (1.22.1-6) unstable; urgency=medium
+
+  The packages nginx-core, nginx-full, nginx-light, nginx-extras are deprecated.
+  Packages no longer distribute the nginx binary and are replaced 
+  by a metapackage to keep upgrades smooth.
+  Please simply install 'nginx' and 'libnginx-mod-...' modules You need
+  instead of these packages.
+
+ -- Jan Mojžíš <jan.mojzis@gmail.com>  Wed, 11 Jan 2023 20:23:22 +0100

debian/nginx.dirs

@@ -0,0 +1 @@
+usr/sbin

debian/nginx.install

@@ -0,0 +1 @@
+debian/build-bin/objs/nginx usr/sbin

debian/nginx.manpages

@@ -0,0 +1 @@
+debian/build-bin/objs/nginx.8

debian/nginx.postinst

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  abort-upgrade|abort-remove|abort-deconfigure|configure)
+    ;;
+  triggered)
+    if invoke-rc.d --quiet nginx status >/dev/null; then
+      echo "Triggering nginx reload ..."
+      invoke-rc.d nginx reload || true
+    fi
+    exit 0
+    ;;
+  *)
+    echo "postinst called with unknown argument \`$1'" >&2
+    exit 1
+    ;;
+esac
+
+if invoke-rc.d --quiet nginx status >/dev/null; then
+  invoke-rc.d nginx upgrade || invoke-rc.d nginx restart
+  exit $?
+else
+  if [ -z "$(ss -nlt 'sport = 80' | grep -v ^State)" ]; then
+    invoke-rc.d nginx start || exit $?
+  else
+    echo "Not attempting to start NGINX, port 80 is already in use."
+    exit 0
+  fi
+fi
+
+#DEBHELPER#
+
+exit 0

debian/nginx.prerm

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  remove|remove-in-favour|deconfigure|deconfigure-in-favour)
+    if [ -x /etc/init.d/nginx ]; then
+      invoke-rc.d nginx stop || exit $?
+    fi
+    ;;
+
+  upgrade|failed-upgrade)
+    ;;
+
+  *)
+    echo "prerm called with unknown argument \`$1'" >&2
+    exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/nginx.triggers

@@ -0,0 +1 @@
+interest-noawait nginx-reload

debian/ngx-conf/README.rst

@@ -0,0 +1,104 @@
+Nginx Configuration Tool (ngx-conf)
+===================================
+
+A tool to help manage nginx confuration files.
+
+Synopsis
+--------
+
+ngx-conf [-h] (-e | -d | -x | -l) [-f] [-r] [-v] FILE [FILES]
+
+Description
+-----------
+
+Ngx-conf is a relatively simple tool to help manage Nginx configuration files.
+It can be used to enable, disable, remove, and list configuration files. In the
+case of configuration files in conf.d/\*.conf, it will handle renaming files to
+an enabled/disabled state. In sites-{enabled,available}/\*, it will handle the
+creation and removal of symbolic links.
+
+**-h, --help**
+  show a help message and exit
+**-e, --enable**
+  enable a configuration files
+**-d, --disable**
+  disable a configuration files
+**-x, --remove**
+  remove a configuration files; will prompt without -f
+**-l, --list**
+  list configuration files
+**-f, --force**
+  force change, even if doing so will destroy data
+**-r, --reload**
+  reload configuration after change
+**-v, --verbose**
+  show verbose output; default is quiet unless errors
+**FILES**
+  a list of configuration files to update
+
+Using --force:
+
+* In --remove will not prompt you to delete the file(s).
+* In --enable will ignore conflicts.
+* In --disable will ignore conflicts.
+* In --disable will also delete files from sites-enabled.
+
+Only one action (enable|disable|remove|list) can be performed at one time.
+
+Examples
+--------
+
+ngx-conf -e site1 site2 site3
+  enable "site{1,2,3}" configurations
+ngx-conf -r -d site
+  disable "site" configuration and reload nginx
+ngx-conf -f -r -x site1 site2
+  remove "site{1,2}" configurations without prompting and reload nginx
+
+Configuration Files
+-------------------
+
+Three configuration files, if present, will be read. They will be read in the
+following order; the next read file will always override the previous.
+
+1. /etc/nginx/ngx.cfg
+#. /etc/ngx.cfg
+#. ngx.cfg
+
+A sample configuration file with all options set to default::
+
+    [DEFAULT]
+    base_dir = /etc/nginx/
+    conf_dir = conf.d/
+    sites_en = sites-enabled/
+    sites_dis = sites-available/
+    conf_ext = .conf
+    verbose = no
+    reload = no
+    force = no
+
+Make sure that base_dir always has a trailing slash.
+
+Any arguments given to the command will override configuration options.
+
+Aliases
+-------
+
+If you're interested in any sort of a2{dis,en}{conf,mod,site}, you can create
+some nice aliases. Examples:
+
+* a2ensite -- alias ngxensite='ngx-conf -e'
+* a2enconf -- alias ngxenconf='ngx-conf -e'
+* a2dissite -- alias ngxdissite='ngx-conf -d'
+* a2disconf -- alias ngxdisconf='ngx-conf -d'
+
+Bugs
+----
+
+If you experience bugs, the best way to report them is to the upstream bug
+tracker. This can be found at https://github.com/ngx/ngx-conf.
+
+Authors
+-------
+
+The ngx-conf tool and manual page were written by Michael Lustfield <michael@lustfield.net>.

debian/ngx-conf/ngx-conf

@@ -0,0 +1,278 @@
+#!/usr/bin/env python3
+
+##
+# copyright (c) 2015 Michael Lustfield <michael@lustfield.net>
+# 
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# Except as contained in this notice, the name(s) of the above copyright
+# holders shall not be used in advertising or otherwise to promote the sale,
+# use or other dealings in this Software without prior written authorization.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+##
+
+import argparse
+try:
+    import configparser as ConfigParser
+except:
+    import ConfigParser
+import glob
+import os
+import subprocess
+
+
+# Read configuration values
+config_opts = ConfigParser.ConfigParser({
+    'base_dir': '/etc/nginx/',
+    'conf_dir': 'conf.d/',
+    'sites_en': 'sites-enabled/',
+    'sites_dis': 'sites-available/',
+    'conf_ext': '.conf',
+    'verbose': 'no',
+    'reload': 'no',
+    'force': 'no'})
+config_opts.read('/etc/nginx/ngx.cfg')
+config_opts.read('/etc/ngx.cfg')
+config_opts.read('ngx.cfg')
+
+# Variable that we'll use a lot.
+sites_en = config_opts.get('DEFAULT', 'base_dir') + config_opts.get('DEFAULT', 'sites_en')
+sites_dis = config_opts.get('DEFAULT', 'base_dir') + config_opts.get('DEFAULT', 'sites_dis')
+conf_dir = config_opts.get('DEFAULT', 'base_dir') + config_opts.get('DEFAULT', 'conf_dir')
+conf_ext = config_opts.get('DEFAULT', 'conf_ext')
+
+
+def parse_arguments():
+    '''Parse arguments supplied by the user.'''
+    parser = argparse.ArgumentParser(description='nginx configuration helper',
+        epilog='Only one in group (enable|disable|remove|list) is allowed.',
+        usage='ngx-conf [-h] (-e | -d | -x | -l) [-f] [-r] [-v] FILE [FILES]')
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument('-e', '--enable', action='store_true',
+        help='enable a configuration files')
+    group.add_argument('-d', '--disable', action='store_true',
+        help='disable a configuration files')
+    group.add_argument('-x', '--remove', action='store_true',
+        help='remove a configuration files; will prompt without -f')
+    group.add_argument('-l', '--list', action='store_true',
+        help='list configuration files')
+    parser.add_argument('-f', '--force', action='store_true',
+        default=config_opts.getboolean('DEFAULT', 'force'),
+        help='force change, even if doing so will destroy data')
+    parser.add_argument('-r', '--reload', action='store_true',
+        default=config_opts.getboolean('DEFAULT', 'reload'),
+        help='reload configuration after change')
+    parser.add_argument('-v', '--verbose', action='store_true',
+        default=config_opts.getboolean('DEFAULT', 'verbose'),
+        help='show verbose output; default is quite unless errors')
+    parser.add_argument('FILES', nargs=argparse.REMAINDER,
+        help='a list of configuration files to update')
+    return parser.parse_args()
+
+
+def main():
+    '''Main execution; read arguments and act accordingly.'''
+    args = parse_arguments()
+    if args.FILES == [] and not args.list:
+        print('No files specified. These are required.')
+        return False
+    if args.enable:
+        enable_configs(args.FILES, args.verbose, args.force)
+    elif args.disable:
+        disable_configs(args.FILES, args.verbose, args.force)
+    elif args.remove:
+        remove_configs(args.FILES, args.verbose, args.force)
+    elif args.list:
+        list_configs()
+    if args.reload and not args.list:
+        reload_nginx()
+
+
+def enable_configs(configs, verbose, force):
+    '''Enable configurtion files specified.'''
+    if type(configs) != list:
+        print('Configuration list is in an incorrect format.')
+        return 1
+
+    for conf in configs:
+        if os.path.isfile(conf_dir + conf + conf_ext) or os.path.islink(sites_en + conf) or os.path.isfile(sites_en + conf):
+            if verbose:
+                print('Configuration file "{}" is already enabled.'.format(conf))
+        elif os.path.isfile(conf_dir + conf + conf_ext + '_disabled'):
+            if not force and os.path.isfile(sites_dis + conf):
+                print('Configuration file "{}" has conflicts.'.format(conf))
+            else:
+                try:
+                    os.rename(conf_dir + conf + conf_ext + '_disabled', conf_dir + conf + conf_ext)
+                    if verbose:
+                        print('Configuration file "{}" has been enabled.'.format(conf))
+                except:
+                    print('Error occured when trying to enable "{}". Permissions?'.format(conf))
+        elif os.path.isfile(sites_dis + conf):
+            try:
+                os.symlink(sites_dis + conf, sites_en + conf)
+                if verbose:
+                    print('Configuration file "{}" has been enabled.'.format(conf))
+            except:
+                print('Error occured when trying to enable "{}". Permissions?'.format(conf))
+        else:
+            print('Configuration file for "{}" was not found.'.format(conf))
+
+
+def disable_configs(configs, verbose, force):
+    '''Disable configurtion files specified.'''
+    if type(configs) != list:
+        print('Configuration list is in an incorrect format.')
+        return 1
+
+    for conf in configs:
+        if not force and os.path.isfile(conf_dir + conf + conf_ext) and os.path.islink(sites_en + conf):
+            print('Configuration file "{}" has conflicts.'.format(conf))
+        elif not force and os.path.isfile(conf_dir + conf + conf_ext) and os.path.isfile(sites_en + conf):
+            print('Configuration file "{}" has conflicts.'.format(conf))
+        elif os.path.isfile(conf_dir + conf + conf_ext):
+            if not force and os.path.isfile(conf_dir + conf + conf_ext + '_disabled'):
+                print('Unable to disable "{}". It appears to have a disabled version.'.format(conf))
+                break
+            elif os.path.isfile(conf_dir + conf + conf_ext + '_disabled'):
+                if verbose:
+                    print('Attempting to remove disabled config for {}.'.format(conf))
+                try:
+                    os.remove(conf_dir + conf + conf_ext + '_disabled')
+                except:
+                    print('Error trying to remove configuration for disabled "{}".'.format(conf))
+                    break
+            try:
+                os.rename(conf_dir + conf + conf_ext, conf_dir + conf + conf_ext + '_disabled')
+                if verbose:
+                    print('Configuration file "{}" has been disabled.'.format(conf))
+            except:
+                print('Error occured when trying to disable "{}". Permissions?'.format(conf))
+        elif os.path.islink(sites_en + conf):
+            try:
+                os.remove(sites_en + conf)
+                if verbose:
+                    print('Configuration file "{}" has been disabled.'.format(conf))
+            except:
+                print('Error occured when trying to disable "{}". Permissions?'.format(conf))
+        elif os.path.isfile(sites_en + conf):
+            if not force and os.path.isfile(sites_dis + conf):
+                print('Unable to disable "{}". It appears to have a disabled version.'.format(conf))
+                break
+            elif os.path.isfile(sites_dis + conf):
+                if verbose:
+                    print('Attempting to remove disabled config for {}.'.format(conf))
+                try:
+                    os.remove(sites_dis + conf)
+                except:
+                    print('Error trying to remove configuration for disabled "{}".'.format(conf))
+                    break
+            try:
+                os.rename(sites_en + conf, sites_dis + conf)
+                if verbose:
+                    print('Configuration file "{}" has been disabled.'.format(conf))
+            except:
+                print('Error occured when trying to disable "{}". Permissions?'.format(conf))
+        else:
+            print('Configuration file for "{}" was not found.'.format(conf))
+
+
+def remove_configs(configs, verbose, force):
+    '''Remove configurtion files specified.'''
+    if type(configs) != list:
+        print('Configuration list is in an incorrect format.')
+        return 1
+
+    for conf in configs:
+        if os.path.islink(sites_en + conf):
+            try:
+                os.remove(sites_en + conf)
+                if verbose:
+                    print('Symlink for "{}" removed.'.format(conf))
+            except:
+                print('Error occured when trying to remove symlink for "{}". Permissions?'.format(conf))
+        files = [sites_en + conf, sites_dis + conf, conf_dir + conf + conf_ext,
+                 conf_dir + conf + conf_ext + '_disabled']
+        for f in files:
+            if os.path.isfile(f):
+                if not force:
+                    answer = str(input('Are you sure you want to delete {}? (y/N) '.format(f)))
+                    if answer.lower() != 'y' and answer.lower() != 'yes':
+                        break
+                try:
+                    os.remove(f)
+                    if verbose:
+                        print('Configuration file for "{}" was removed.'.format(f))
+                except:
+                    print('Error occured when trying to remove file for "{}". Permissions?'.format(f))
+
+
+def list_configs():
+    '''List configuration files.'''
+    configs = get_configs()
+    for key, verb in [
+        ('conf_en', 'Configs enabled in {}:'.format(config_opts.get('DEFAULT', 'conf_dir'))),
+        ('conf_dis', 'Configs disabled in {}:'.format(config_opts.get('DEFAULT', 'conf_dir'))),
+        ('sites_en', 'Configs enabled in {}:'.format(config_opts.get('DEFAULT', 'sites_en'))),
+        ('sites_dis', 'Configs disabled in {}:'.format(config_opts.get('DEFAULT', 'sites_dis'))),
+        ('sites_avail', 'All confis available in {}:'.format(config_opts.get('DEFAULT', 'sites_dis')))]:
+        if configs[key] == []:
+            print(verb + '\n\t<none>')
+        else:
+            print(verb)
+            for conf in configs[key]:
+                print('\t' + conf)
+
+
+def get_configs():
+    '''Returns a list of configuration files.'''
+    cd = [os.path.basename(f).replace(conf_ext + '_disabled', '')
+        for f in glob.glob(conf_dir + '*' + conf_ext + '_disabled')
+        if os.path.isfile(f)]
+    ce = [os.path.basename(f).replace(conf_ext, '')
+        for f in glob.glob(conf_dir + '*' + conf_ext)
+        if os.path.isfile(f)]
+    se = [os.path.basename(f)
+        for f in glob.glob(sites_en + '*')
+        if os.path.isfile(f) or os.path.islink(f)]
+    sd = [os.path.basename(f)
+        for f in glob.glob(sites_dis + '*')
+        if os.path.isfile(f) and os.path.basename(f) not in se]
+    sa = [os.path.basename(f)
+        for f in glob.glob(sites_dis + '*')
+        if os.path.isfile(f)]
+    return {'conf_dis': cd, 'conf_en': ce, 'sites_en': se, 'sites_dis': sd, 'sites_avail': sa}
+
+
+def reload_nginx():
+    '''Reload Nginx after configuration changes.'''
+    child = subprocess.Popen(
+        ['service', 'nginx', 'reload'],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE)
+    stdout, stderr = child.communicate()
+    if int(child.returncode) != 0:
+        print('Error reloading nginx configs.')
+        return False
+    elif verbose:
+        print('Nginx config reloaded successfully.')
+    return True
+
+
+if __name__ == '__main__':
+    main()

debian/ngx-conf/ngx-conf.1

@@ -0,0 +1,135 @@
+.\"     Title: ngx-conf
+.\"    Author: Michael Lustfield <michael@lustfield.net>
+.\"      Date: 01/14/2015
+.\"    Manual: User Commands
+.\"
+.TH "NGX-CONF" "1" "01/14/2015" "ngx-conf" "User Commands"
+.\" disable hyphenation
+.NH
+.\" disable justification (adjust text to left margin only)
+.AD l
+.SH "NAME"
+ngx - a tool to help manage nginx confuration files
+.SH "SYNOPSIS"
+.B ngx-conf
+[-h] (-e | -d | -x | -l) [-f] [-r] [-v] FILE [FILES]
+.br
+.SH "DESCRIPTION"
+.PP
+Ngx-conf is a relatively simple tool to help manage Nginx configuration files.
+It can be used to enable, disable, remove, and list configuration files. In the
+case of configuration files in conf.d/*.conf, it will handle renaming files to
+an enabled/disabled state. In sites-{enabled,available}/*, it will handle the
+creation and removal of symbolic links.
+.SH "OPTIONS"
+.PP
+This program follows the usual command line syntax, with long options starting
+with two dashes (`\-'). A summary of options is included below.
+.TP
+.B \-h, \-\-help
+show a help message and exit
+.TP
+.B \-e, \-\-enable
+enable a configuration files
+.TP
+.B \-d, \-\-disable
+disable a configuration files
+.TP
+.B \-x, \-\-remove
+remove a configuration files; will prompt without -f
+.TP
+.B \-l, \-\-list
+list configuration files
+.TP
+.B \-f, \-\-force
+force change, even if doing so will destroy data
+.TP
+.B \-r, \-\-reload
+reload configuration after change
+.TP
+.B \-v, \-\-verbose
+show verbose output; default is quiet unless errors
+.B FILES
+a list of configuration files to update
+.PP
+Using --force:
+.IP
+In --remove will not prompt you to delete the file(s).
+.br
+In --enable will ignore conflicts.
+.br
+In --disable will ignore conflicts.
+.br
+In --disable will also delete files from sites-enabled.
+.PP
+Only one action (enable|disable|remove|list) can be performed at one time.
+.SH "EXAMPLES"
+.PP
+ngx-conf -e site1 site2 site3
+    enable "site{1,2,3}" configurations
+.br
+ngx-conf -r -d site
+    disable "site" configuration and reload nginx
+.br
+ngx-conf -f -r -x site1 site2
+    remove "site{1,2}" configurations without prompting and reload nginx
+.SH "CONFIGURATION FILES"
+.PP
+Three configuration files, if present, will be read. They will be read in the
+following order; the next read file will always override the previous.
+.IP
+1. /etc/nginx/ngx.cfg
+.br
+2. /etc/ngx.cfg
+.br
+3. ngx.cfg
+.PP
+A sample configuration file with all options set to default:
+.IP
+[DEFAULT]
+.br
+base_dir = /etc/nginx/
+.br
+conf_dir = conf.d/
+.br
+sites_en = sites-enabled/
+.br
+sites_dis = sites-available/
+.br
+conf_ext = .conf
+.br
+verbose = no
+.br
+reload = no
+.br
+force = no
+.PP
+Make sure that base_dir always has a trailing slash.
+.br
+Any arguments given to the command will override configuration options.
+.SH "ALIASES"
+.PP
+If you're interested in any sort of a2{dis,en}{conf,mod,site}, you can create
+some nice aliases. Examples:
+.TP
+.B a2ensite
+alias ngxensite='ngx-conf -e'
+.br
+.TP
+.B a2enconf
+alias ngxenconf='ngx-conf -e'
+.br
+.TP
+.B a2dissite
+alias ngxdissite='ngx-conf -d'
+.br
+.TP
+.B a2disconf
+alias ngxdisconf='ngx-conf -d'
+.SH "BUGS"
+.PP
+If you experience bugs, the best way to report them is to the upstream bug
+tracker. This can be found at https://github.com/ngx/ngx-conf.
+.SH "AUTHORS"
+.PP
+The ngx-conf tool and manual page were written by Michael Lustfield <michael@lustfield.net>.

debian/patches/0003-define_gnu_source-on-other-glibc-based-platforms.patch

@@ -0,0 +1,28 @@
+Date: Sat, 16 Jul 2016 23:52:50 +0100
+From: Steven Chamberlain <stevenc@debian.org>
+Subject: Use _GNU_SOURCE on GNU/kFreeBSD
+Forwarded: https://trac.nginx.org/nginx/ticket/2366
+
+Define _GNU_SOURCE not only on GNU/Hurd, but also other glibc-based
+platforms including GNU/kFreeBSD.
+
+modified by jan.mojzis@gmail.com
+Index: nginx/src/os/unix/ngx_posix_config.h
+===================================================================
+--- nginx.orig/src/os/unix/ngx_posix_config.h
++++ nginx/src/os/unix/ngx_posix_config.h
+@@ -21,10 +21,13 @@
+ #endif
+ 
+ 
+-#if (NGX_GNU_HURD)
++#if defined(NGX_GNU_HURD) || defined(__GLIBC__)
+ #ifndef _GNU_SOURCE
+ #define _GNU_SOURCE             /* accept4() */
+ #endif
++#endif
++
++#if (NGX_GNU_HURD)
+ #define _FILE_OFFSET_BITS       64
+ #endif
+ 

debian/patches/nginx-fix-pidfile.patch

@@ -0,0 +1,85 @@
+Description: Fix NGINX pidfile handling
+Author: Tj <ubuntu@iam.tj>
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1581864
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876365
+Last-Update: 2020-06-24
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/core/nginx.c
++++ b/src/core/nginx.c
+@@ -340,14 +340,21 @@
+         ngx_process = NGX_PROCESS_MASTER;
+     }
+ 
++    /* tell-tale to detect if this is parent or child process */
++    ngx_int_t child_pid = NGX_BUSY;
++
+ #if !(NGX_WIN32)
+ 
+     if (ngx_init_signals(cycle->log) != NGX_OK) {
+         return 1;
+     }
+ 
++    /* tell-tale that this code has been executed */
++    child_pid--;
++
+     if (!ngx_inherited && ccf->daemon) {
+-        if (ngx_daemon(cycle->log) != NGX_OK) {
++        child_pid = ngx_daemon(cycle->log);
++        if (child_pid == NGX_ERROR) {
+             return 1;
+         }
+ 
+@@ -360,8 +367,19 @@
+ 
+ #endif
+ 
+-    if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) {
+-        return 1;
++    /* If ngx_daemon() returned the child's PID in the parent process
++     * after the fork() set ngx_pid to the child_pid, which gets
++     * written to the PID file, then exit.
++     * For NGX_WIN32 always write the PID file
++     * For others, only write it from the parent process */
++    if (child_pid < NGX_OK || child_pid > NGX_OK) {
++	ngx_pid = child_pid > NGX_OK ? child_pid : ngx_pid;
++        if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) {
++            return 1;
++	}
++    }
++    if (child_pid > NGX_OK) {
++        exit(0);
+     }
+ 
+     if (ngx_log_redirect_stderr(cycle) != NGX_OK) {
+--- a/src/os/unix/ngx_daemon.c
++++ b/src/os/unix/ngx_daemon.c
+@@ -7,14 +7,17 @@
+ 
+ #include <ngx_config.h>
+ #include <ngx_core.h>
++#include <unistd.h>
+ 
+ 
+ ngx_int_t
+ ngx_daemon(ngx_log_t *log)
+ {
+     int  fd;
++    /* retain the return value for passing back to caller */
++    pid_t pid_child = fork();
+ 
+-    switch (fork()) {
++    switch (pid_child) {
+     case -1:
+         ngx_log_error(NGX_LOG_EMERG, log, ngx_errno, "fork() failed");
+         return NGX_ERROR;
+@@ -23,7 +26,8 @@
+         break;
+ 
+     default:
+-        exit(0);
++        /* let caller do the exit() */
++        return pid_child;
+     }
+ 
+     ngx_parent = ngx_pid;

debian/patches/nginx-ssl_cert_cb_yield.patch

@@ -0,0 +1,64 @@
+Origin: https://github.com/openresty/openresty/blob/master/patches/nginx-1.21.4-ssl_cert_cb_yield.patch
+# HG changeset patch
+# User Yichun Zhang <agentzh@openresty.org>
+# Date 1451762084 28800
+#      Sat Jan 02 11:14:44 2016 -0800
+# Node ID 449f0461859c16e95bdb18e8be6b94401545d3dd
+# Parent  78b4e10b4367b31367aad3c83c9c3acdd42397c4
+SSL: handled SSL_CTX_set_cert_cb() callback yielding.
+
+OpenSSL 1.0.2+ introduces SSL_CTX_set_cert_cb() to allow custom
+callbacks to serve the SSL certificiates and private keys dynamically
+and lazily. The callbacks may yield for nonblocking I/O or sleeping.
+Here we added support for such usage in NGINX 3rd-party modules
+(like ngx_lua) in NGINX's event handlers for downstream SSL
+connections.
+
+--- a/src/event/ngx_event_openssl.c
++++ b/src/event/ngx_event_openssl.c
+@@ -1914,6 +1914,23 @@
+         return NGX_AGAIN;
+     }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10002000L
++    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
++        c->read->handler = ngx_ssl_handshake_handler;
++        c->write->handler = ngx_ssl_handshake_handler;
++
++        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        return NGX_AGAIN;
++    }
++#endif
++
+     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
+ 
+     c->ssl->no_wait_shutdown = 1;
+@@ -2050,6 +2067,21 @@
+         c->read->handler = ngx_ssl_handshake_handler;
+         c->write->handler = ngx_ssl_handshake_handler;
+ 
++        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        return NGX_AGAIN;
++    }
++
++    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
++        c->read->handler = ngx_ssl_handshake_handler;
++        c->write->handler = ngx_ssl_handshake_handler;
++
+         if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+             return NGX_ERROR;
+         }

debian/patches/series

@@ -0,0 +1,3 @@
+0003-define_gnu_source-on-other-glibc-based-platforms.patch
+nginx-fix-pidfile.patch
+nginx-ssl_cert_cb_yield.patch

debian/po/POTFILES.in

@@ -0,0 +1 @@
+[type: gettext/rfc822deb] nginx-common.templates

debian/po/ca.po

@@ -0,0 +1,56 @@
+# Nginx debconf translations
+# Copyright (C) 2016 Christos Trochalakis
+# This file is distributed under the same license as the nginx package.
+# Christos Trochalakis <ctrochalakis@debian.org>, 2016.
+# Alytidae <alytidae@riseup.net>, 2017
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2017-06-19 20:26+0100\n"
+"Last-Translator: Alytidae <alytidae@riseup.net>\n"
+"Language-Team: catalan <dl10n-catalan@lists.debian.org>\n"
+"Language: ca\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "És possible que els fitxers de registre nginx siguin insegurs"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"Els següents fitxers de registre, sota el directori /var/log/nginx, són "
+"enllaços simbòlics propietat de www-data:"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Des de la versió 1.4.4-4 de nginx, /var/log/nginx ha estat propietat de "
+"www-data. A causa d'això, www-data podria tenir enllaços simbòlics d'arxius "
+"de registre a ubicacions sensibles que, al seu torn, podrien donar lloc a "
+"atacs d'escalada de privilegis. Encara que els permisos de /var/log/nginx "
+"estan arreglats és possible que encara existeixin alguns enllaços simbòlics "
+"insegurs. Per tant, assegura't de comprovar les ubicacions esmentades."

debian/po/da.po

@@ -0,0 +1,56 @@
+# Nginx debconf translations
+# Copyright (C) 2017 nginx og nedenstående oversættere.
+# This file is distributed under the same license as the nginx package.
+# Joe Hansen <joedalton2@yahoo.dk>, 2017.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2017-01-10 17:30+01:00\n"
+"Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
+"Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
+"Language: da\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "Nginx-logfilerne er muligvis usikre"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"De følgende logfiler under mappen /var/log/nginx er symbolske henvisninger "
+"ejet af www-data:"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Siden nginx 1.4.4-4 var /var/log/nginx ejet af www-data. Www-data kunne "
+"derfor oprette logfiler med symbolske henvisninger til sensitive placeringer, "
+"som igen kunne føre til privilegerede optrapningsangreb. Selvom "
+"/var/log/nginx-rettigheder nu er rettet, så er det muligt at sådanne "
+"usikre henvisninger stadig findes. Så, husk at kontrollere ovenstående "
+"placeringer."

debian/po/de.po

@@ -0,0 +1,57 @@
+# Nginx debconf translations
+# Copyright (C) 2016 Christos Trochalakis
+# This file is distributed under the same license as the nginx package.
+# Chrirtos Trochalakis <yatiohi@ideopolis.gr>, 2016.
+# Copyright (C)  of this file Chris Leick <c.leick@vollbio.de> 2016.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx 1.10.2-1\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2016-11-01 10:36+0100\n"
+"Last-Translator: Chris Leick <c.leick@vollbio.de>\n"
+"Language-Team: de <debian-l10n-german@lists.debian.org>\n"
+"Language: de\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "Möglicherweise unsichere Nginx-Protokolldateien"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"Die folgenden Protokolldateien unterhalb des Verzeichnisses /var/log/nginx "
+"sind symbolische Verweise, die »www-data« gehören:"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Seit Nginx 1.4.4-4 gehörte /var/log/nginx »www-data«. Dies führte unter "
+"anderem dazu, dass »www-data« auf Protokolldateien an vertraulichen Stellen "
+"symbolisch verweisen konnte, was im Folgenden zu Rechteerweiterungsangriffen "
+"führen konnte. Obwohl die Rechte an /var/log/nginx nun korrigiert sind, ist "
+"es möglich, dass derartige unsichere Verweise bereits existieren. Prüfen Sie "
+"daher bitte die oben genannten Orte."

debian/po/es.po

@@ -0,0 +1,78 @@
+# Nginx debconf translations
+# Copyright (C) 2016 Christos Trochalakis
+# This file is distributed under the same license as the nginx package.
+# Christos Trochalakis <ctrochalakis@debian.org>, 2016.
+# Changes:
+# - Initial translation
+# Jonathan Bustillos <jathanblackred@openmailbox.com>, 2017.
+#
+# Traductores, si no conocen el formato PO, merece la pena leer la
+# documentación de gettext, especialmente las secciones dedicadas a este
+# formato, por ejemplo ejecutando:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+#
+# - El proyecto de traducción de Debian al español
+# http://www.debian.org/intl/spanish/
+# especialmente las notas y normas de traducción en
+# http://www.debian.org/intl/spanish/notas
+#
+# - La guía de traducción de po's de debconf:
+# /usr/share/doc/po-debconf/README-trans
+# o http://www.debian.org/intl/l10n/po-debconf/README-trans
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2017-02-07 11:07-0600\n"
+"Last-Translator: Jonathan Bustillos <jathanblackred@openmailbox.com>\n"
+"Language-Team: Debian Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"X-Generator: Gtranslator 2.91.6\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "Posibles archivos de registro inseguros de nginx"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"Los siguientes archivos de registro en el directorio /var/log/nginx son "
+"enlaces simbólicos propiedad de www-data:"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Dado nginx 1.4.4-4 /var/log/nginx era propiedad de www-data. Como resultado, "
+"www-data podría enlazar archivos de registro a ubicaciones sensibles, lo que "
+"a su vez podría dar lugar a ataques de escalamiento de privilegios. Aunque "
+"los permisos de /var/log/nginx están ahora arreglados, es posible que dichos "
+"enlaces inseguros ya existan. Por lo tanto, asegúrese de comprobar las "
+"ubicaciones anteriores."

debian/po/fr.po

@@ -0,0 +1,58 @@
+# Translation of nginx debconf templates to French
+# Copyright (C) 2016 Christos Trochalakis
+# This file is distributed under the same license as the nginx package.
+# Chrirtos Trochalakis <yatiohi@ideopolis.gr>, 2016.
+# Julien Patriarca <leatherface@debian.org>, 2016.
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2016-11-02 09:52+0100\n"
+"Language: fr\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Last-Translator: Julien Patriarca <leatherface@debian.org>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"X-Generator: Poedit 1.8.11\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "Certains fichiers de journaux semblent non sécurisés"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"Les fichiers de journaux suivants se trouvant dans le dossier /var/log/nginx "
+"sont des liens symboliques qui appartiennent à www-data :"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Depuis la version 1.4.4-4 de nginx, /var/log/nginx appartient à www-data. "
+"Par conséquent www-data peut faire des liens symboliques des fichiers de "
+"journaux vers des emplacements sensibles, ce qui pourrait amener à des "
+"attaques par augmentation de droits. Même si désormais les droits de /var/"
+"log/nginx ont été sécurisés, il est possible que de tels liens existent "
+"déjà. Aussi, veuillez vous assurer d'avoir contrôlé les emplacements ci-"
+"dessus."

debian/po/it.po

@@ -0,0 +1,56 @@
+# Nginx debconf translations
+# Copyright (C) 2016 Christos Trochalakis
+# This file is distributed under the same license as the nginx package.
+# Christos Trochalakis <ctrochalakis@debian.org>, 2016.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2022-08-25 00:00+0000\n"
+"Last-Translator: Ceppo <ceppo@oziosi.org>\n"
+"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
+"Language: it\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "Documenti di log di nginx potenzialmente non sicuri"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"I seguenti documenti di log nel percorso /var/log/nginx sono collegamenti "
+"simbolici (symlink) posseduti da www-data:"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Da nginx 1.4.4-4 /var/log/nginx era posseduto da www-data. Di conseguenza "
+"www-data poteva creare collegamenti simbolici (symlink) a documenti di log "
+"in percorsi sensibili, il che a sua volta poteva portare ad attacchi di "
+"usurpazione di privilegi. Sebbene i permessi di /var/log/nginx siano adesso "
+"corretti è possibile che questi link non sicuri esistano già. Quindi, "
+"controllare i percorsi indicati sopra."

debian/po/nl.po

@@ -0,0 +1,60 @@
+# Nginx debconf translation to Dutch
+# Copyright (C) 2016 Christos Trochalakis
+# This file is distributed under the same license as the nginx package.
+# Chrirtos Trochalakis <yatiohi@ideopolis.gr>, 2016.
+# Frans Spiesschaert <Frans.Spiesschaert@yucom.be>, 2016.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: nginx\n"
+"Report-Msgid-Bugs-To: nginx@packages.debian.org\n"
+"POT-Creation-Date: 2016-10-04 20:03+0300\n"
+"PO-Revision-Date: 2016-11-08 16:30+0100\n"
+"Last-Translator: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>\n"
+"Language-Team: Debian Dutch l10n Team <debian-l10n-dutch@lists.debian.org>\n"
+"Language: nl\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"X-Generator: Gtranslator 2.91.6\n"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "Possible insecure nginx log files"
+msgstr "Wellicht onveilige nginx logbestanden"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"The following log files under /var/log/nginx directory are symlinks owned by "
+"www-data:"
+msgstr ""
+"De volgende logbestanden in de map /var/log/nginx zijn symbolische "
+"koppelingen met www-data als eigenaar:"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid "${logfiles}"
+msgstr "${logfiles}"
+
+#. Type: note
+#. Description
+#: ../nginx-common.templates:1001
+msgid ""
+"Since nginx 1.4.4-4 /var/log/nginx was owned by www-data. As a result www-"
+"data could symlink log files to sensitive locations, which in turn could "
+"lead to privilege escalation attacks. Although /var/log/nginx permissions "
+"are now fixed it is possible that such insecure links already exist. So, "
+"please make sure to check the above locations."
+msgstr ""
+"Sinds nginx 1.4.4-4 was www-data eigenaar van /var/log/nginx. Als gevolg "
+"daarvan kon www-data een symbolische koppeling maken tussen logbestanden en "
+"gevoelige plaatsen, hetgeen op zijn beurt kon leiden tot aanvallen van het "
+"type rechtenuitbreiding (privilege escalation). De toegangsrechten voor /var/"
+"log/nginx zijn nu gerepareerd, maar het is mogelijk dat er reeds dergelijke "
+"onveilige koppelingen bestaan. U moet dus zeker bovenstaande locaties "
+"controleren."