Trusted IP Lists for FirewallD, NGINX and fail2ban
by Danila Vershinin, September 29, 2026
Official reference for the GetPageSpeed trusted-lists packages: auto-updating IP allowlists for Cloudflare, Stripe, PayPal, Googlebot, OpenAI and 30+ services, consumable by FirewallD, NGINX and fail2ban on RHEL-based systems.
Read More...NGINX Accept-Language Redirects: No Lua Required
by Danila Vershinin, September 26, 2026
Redirect visitors to /en/, /fr/ or /de/ based on the Accept-Language header with the set_from_accept_language directive from nginx-module-accept-language. No Lua, njs or regex maps: VM-tested configs, cookie override, SEO-safe 302 redirects.
Read More...NGINX QUIC reuseport: HTTP/3 Silently Breaks Without It
by Danila Vershinin, September 17, 2026
Multi-worker NGINX HTTP/3 silently fails without reuseport on the QUIC listener: ~30% of connections fall back to HTTP/2 with nothing in the error log. One ss command diagnoses it; the fix needs a restart, not a reload.
Read More...Parallel ESI for Varnish 6.0 LTS: vmod-pesi Now Packaged
by Danila Vershinin,
Varnish processes ESI includes one after another. vmod-pesi fetches and assembles them in parallel, and GetPageSpeed now packages it for Varnish 6.0 LTS: a page with two 2-second fragments drops from 4.1 s to 2.05 s, verified on a clean Rocky Linux 10 install.
Read More...ECH Without Padding Is a Lookup Table
by Danila Vershinin, September 10, 2026
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
Read More...NGINX Directive Execution Order: The 11 Request Phases
by Danila Vershinin, September 7, 2026
How NGINX directive execution order really works: the 11 request phases, why return beats deny, why a server rewrite changes your location, and where third-party directives run. Every example curl-verified.
Read More...NGINX proxy_pass: URI Rewriting, Variables, and DNS Gotchas
by Danila Vershinin,
The exact proxy_pass URI rewriting rules, variable resolution gotchas, and three verified ways to fix NGINX’s frozen-DNS problem, including the upstream-jdomain module.
Read More...NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
by Danila Vershinin, September 6, 2026
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested, plus the post-quantum step beyond.
Read More...NGINX RADIUS Authentication: No More htpasswd Files
by Danila Vershinin,
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the BlastRADIUS compatibility gotcha.
Read More...zstd-nginx-module: Maintained, Tested and Packaged
by Danila Vershinin, September 2, 2026
The canonical Zstandard module for NGINX has had no release since 2023. We continue it: the streaming bugs that truncated large responses are fixed and regression-tested, and it ships as nginx-module-zstd on every distribution we build for.
Read More...