NGINX RADIUS Authentication: No More htpasswd Files
by Danila Vershinin, September 6, 2026
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the BlastRADIUS compatibility gotcha.
Read More...zstd-nginx-module: Maintained, Tested and Packaged
by Danila Vershinin, September 2, 2026
The canonical Zstandard module for NGINX has had no release since 2023. We continue it: the streaming bugs that truncated large responses are fixed and regression-tested, and it ships as nginx-module-zstd on every distribution we build for.
Read More...OpenSSL 4.0 for NGINX: Why We Ship 3.5 LTS Instead
by Danila Vershinin, August 30, 2026
OpenSSL 4.0 for NGINX drops out of support in May 2027. OpenSSL 3.5 LTS runs to April 2030 and already does post-quantum key exchange. Here is the arithmetic behind our choice, and the one 4.0 feature worth having.
Read More...Post-Quantum NGINX: OpenSSL 3.5 on Debian and Ubuntu
by Danila Vershinin, August 29, 2026
Every Debian and Ubuntu suite we publish now links our ABI-isolated OpenSSL 3.5 LTS build, so post-quantum key exchange, Encrypted Client Hello and TLS certificate compression arrive on DEB too. Ubuntu 20.04’s NGINX no longer links end-of-life OpenSSL 1.1.1.
Read More...NGINX Certificate Compression: RFC 8879 for Every Browser
by Danila Vershinin,
NGINX certificate compression (RFC 8879) shrinks the TLS handshake by around 20% on every fresh connection, and it takes one directive. The catch is packaging: your distribution’s NGINX is too old to have the directive, and its OpenSSL was built without the brotli algorithm that Chrome is the only browser to ask for. Measured, and with the one directive that stops NGINX from starting.
Read More...NGINX Post-Quantum TLS: X25519MLKEM768 with OpenSSL 3.5
by Danila Vershinin,
Our RPM and DEB builds now link OpenSSL 3.5, so hybrid post-quantum key exchange with X25519MLKEM768 works out of the box on every platform we package for — from RHEL 8 to Ubuntu 20.04. Here is how to verify it, and the one common hardening directive that silently turns it off.
Read More...Encrypted Client Hello in NGINX: Now Shipping in Our RPMs and DEBs
by Danila Vershinin, August 25, 2026
Server-side ECH (RFC 9849) is live in our stock NGINX, NGINX-MOD and EDGE packages, on RPM and DEB alike, built on OpenSSL 3.5 LTS with the DEfO backport. Here is what it hides, what it does not, and how to run it with automatic key rotation.
Read More...NGINX ESI: Replace Varnish for Magento 2
by Danila Vershinin, August 24, 2026
Replace Varnish with NGINX ESI for Magento 2. See the tested configuration, selective X-Magento-Tags purge, gzip-safe stitching, and benchmarks against Varnish OSS.
Read More...NGINX Early Hints: HTTP 103 Benchmarked on Enterprise Linux
by Danila Vershinin, August 11, 2026
NGINX early hints support arrived in 1.29.0, but every stock Enterprise Linux, Debian and Ubuntu package still ships something older. We install a current NGINX from GetPageSpeed, configure the safe HTTP/2 gate, and benchmark what HTTP 103 does to LCP with interleaved arms and an A/A noise control.
Read More...Serve WP Rocket Cache Directly from Nginx Without PHP
by Danila Vershinin, August 6, 2026
Serve WP Rocket Cache Directly from Nginx Without PHP WP Rocket writes cached pages as static HTML files. On a typical Nginx setup, a request still passes through PHP-FPM before that cached file reaches the visitor. That extra hop is unnecessary. Nginx can locate and serve the existing WP Rocket cache file directly. PHP-FPM, WordPress, […]
Read More...Recommended Web Hosting
