NGINX Module Version Mismatch: When APT Lets It Through
by Danila Vershinin, October 1, 2026
An NGINX module built for 1.29.8 will not load into 1.31.5, and NGINX says so. The question is whether your package manager knew first. We reproduced a stale nginx-abi label letting APT install a mismatched pair, wedging dpkg and arming the next restart as an outage.
Read More...Trusted IP Lists for FirewallD, NGINX and fail2ban
by Danila Vershinin, September 29, 2026
Official reference for the GetPageSpeed trusted-lists packages: auto-updating IP allowlists for Cloudflare, Stripe, PayPal, Googlebot, OpenAI and 30+ services, consumable by FirewallD, NGINX and fail2ban on RHEL-based systems.
Read More...NGINX Accept-Language Redirects: No Lua Required
by Danila Vershinin, September 26, 2026
Redirect visitors to /en/, /fr/ or /de/ based on the Accept-Language header with the set_from_accept_language directive from nginx-module-accept-language. No Lua, njs or regex maps: VM-tested configs, cookie override, SEO-safe 302 redirects.
Read More...NGINX QUIC reuseport: HTTP/3 Silently Breaks Without It
by Danila Vershinin, September 17, 2026
Multi-worker NGINX HTTP/3 silently fails without reuseport on the QUIC listener: ~30% of connections fall back to HTTP/2 with nothing in the error log. One ss command diagnoses it; the fix needs a restart, not a reload.
Read More...Parallel ESI for Varnish 6.0 LTS: vmod-pesi Now Packaged
by Danila Vershinin,
Varnish processes ESI includes one after another. vmod-pesi fetches and assembles them in parallel, and GetPageSpeed now packages it for Varnish 6.0 LTS: a page with two 2-second fragments drops from 4.1 s to 2.05 s, verified on a clean Rocky Linux 10 install.
Read More...ECH Without Padding Is a Lookup Table
by Danila Vershinin, September 10, 2026
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
Read More...NGINX Directive Execution Order: The 11 Request Phases
by Danila Vershinin, September 7, 2026
How NGINX directive execution order really works: the 11 request phases, why return beats deny, why a server rewrite changes your location, and where third-party directives run. Every example curl-verified.
Read More...NGINX proxy_pass: URI Rewriting, Variables, and DNS Gotchas
by Danila Vershinin,
The exact proxy_pass URI rewriting rules, variable resolution gotchas, and three verified ways to fix NGINX’s frozen-DNS problem, including the upstream-jdomain module.
Read More...NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
by Danila Vershinin, September 6, 2026
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested, plus the post-quantum step beyond.
Read More...NGINX RADIUS Authentication: No More htpasswd Files
by Danila Vershinin,
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the BlastRADIUS compatibility gotcha.
Read More...Recommended Web Hosting
