NGINX QUIC reuseport: HTTP/3 Silently Breaks Without It
by Danila Vershinin, September 17, 2026
Multi-worker NGINX HTTP/3 silently fails without reuseport on the QUIC listener: ~30% of connections fall back to HTTP/2 with nothing in the error log. One ss command diagnoses it; the fix needs a restart, not a reload.
Read More...Parallel ESI for Varnish 6.0 LTS: vmod-pesi Now Packaged
by Danila Vershinin,
Varnish processes ESI includes one after another. vmod-pesi fetches and assembles them in parallel, and GetPageSpeed now packages it for Varnish 6.0 LTS: a page with two 2-second fragments drops from 4.1 s to 2.05 s, verified on a clean Rocky Linux 10 install.
Read More...ECH Without Padding Is a Lookup Table
by Danila Vershinin, September 10, 2026
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
Read More...NGINX Directive Execution Order: The 11 Request Phases
by Danila Vershinin, September 7, 2026
How NGINX directive execution order really works: the 11 request phases, why return beats deny, why a server rewrite changes your location, and where third-party directives run. Every example curl-verified.
Read More...NGINX proxy_pass: URI Rewriting, Variables, and DNS Gotchas
by Danila Vershinin,
The exact proxy_pass URI rewriting rules, variable resolution gotchas, and three verified ways to fix NGINX’s frozen-DNS problem, including the upstream-jdomain module.
Read More...NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
by Danila Vershinin, September 6, 2026
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested, plus the post-quantum step beyond.
Read More...NGINX RADIUS Authentication: No More htpasswd Files
by Danila Vershinin,
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the BlastRADIUS compatibility gotcha.
Read More...zstd-nginx-module: Maintained, Tested and Packaged
by Danila Vershinin, September 2, 2026
The canonical Zstandard module for NGINX has had no release since 2023. We continue it: the streaming bugs that truncated large responses are fixed and regression-tested, and it ships as nginx-module-zstd on every distribution we build for.
Read More...OpenSSL 4.0 for NGINX: Why We Ship 3.5 LTS Instead
by Danila Vershinin, August 30, 2026
OpenSSL 4.0 for NGINX drops out of support in May 2027. OpenSSL 3.5 LTS runs to April 2030 and already does post-quantum key exchange. Here is the arithmetic behind our choice, and the one 4.0 feature worth having.
Read More...Post-Quantum NGINX: OpenSSL 3.5 on Debian and Ubuntu
by Danila Vershinin, August 29, 2026
Every Debian and Ubuntu suite we publish now links our ABI-isolated OpenSSL 3.5 LTS build, so post-quantum key exchange, Encrypted Client Hello and TLS certificate compression arrive on DEB too. Ubuntu 20.04’s NGINX no longer links end-of-life OpenSSL 1.1.1.
Read More...Recommended Web Hosting
