The ondrej nginx PPA deprecated its module packages at NGINX 1.28. If your Debian or Ubuntu servers depend on Brotli, Lua, ModSecurity or any other load_module, migrate to the GetPageSpeed APT repository to keep 130+ maintained NGINX modules that survive every apt upgrade.
OndΕej SurΓ½βs PPA has been the default source of fresh NGINX on Ubuntu and Debian for years. That era is ending for anyone who depends on modules. With the NGINX 1.28 stable release (announced April 2025), the maintainer deprecated the mainline module packages: recompiling every external module for each upstream patch release is unsustainable, and mainline adoption was low. Ubuntu itself stopped accepting new third-party modules into nginx-extras long ago.
So if your config carries load_module lines for Brotli, Lua, NAXSI, ModSecurity, VTS or JWT, a routine apt upgrade can leave you with a new NGINX binary and no matching modules. This guide moves you off the ondrej nginx PPA and onto the GetPageSpeed APT repository, which packages 130+ NGINX modules for Debian and Ubuntu on the same build infrastructure that has served RHEL systems since 2016.
Debian / Ubuntu
# 1. Add the GetPageSpeed APT repository
curl -fsSLO https://extras.getpagespeed.com/release-latest.deb
sudo apt install ./release-latest.deb
sudo getpagespeed-extras-channel stable
# 2. Install NGINX and the modules you need
sudo apt update
sudo apt install nginx nginx-module-brotli nginx-module-lua
On Debian and Ubuntu, each nginx-module-* package drops its own auto-load file into /etc/nginx/modules-enabled/, so no load_module directive is required β a key difference from hand-compiled modules. Setting up the repository and running apt update is public; installing modules requires an active GetPageSpeed subscription tied to your server IP.
RHEL / CentOS / AlmaLinux / Rocky Linux / Amazon Linux
Already on the RPM repository? Same modules, same build quality β this migration guide is only for Debian and Ubuntu hosts.
Why the ondrej nginx PPA can no longer keep up
Packaging NGINX with every external module is genuinely painful: each upstream patch release forces a recompile of all modules against the new ABI. The maintainer said as much when deprecating the mainline packages, and the numbers backed the decision β the mainline repository saw little use compared to stable. The result is a widening gap between what NGINX can do and what Debian or Ubuntu will hand you:
- Version staleness. Debian 12 ships NGINX 1.22.1; Ubuntu 22.04 LTS is stuck on 1.18, released in April 2020. The GetPageSpeed repository ships NGINX 1.30.3 for Debian 12 today, with updates landing as upstream releases them.
- A frozen module set. Ubuntuβs
nginx-extrascovers the basics but the Server team no longer accepts new third-party modules. What ships today is what ships forever. - No path to the power-user modules. Brotli (before Ubuntu 24.04), Lua, NAXSI, ModSecurity 3, VTS, JWT and Zstd simply are not there β leaving compilation from source as the only option, and every
apt upgradea roll of the dice on ABI compatibility.
ondrej/nginx vs GetPageSpeed: what changes
| Capability | ondrej/nginx PPA | Ubuntu nginx-extras |
GetPageSpeed APT |
|---|---|---|---|
| NGINX freshness | Stable branch | 1.18β1.24, frozen per release | 1.30.3 stable + mainline |
| Brotli compression | Deprecated on mainline | 24.04+ only | nginx-module-brotli |
| Lua (OpenResty) | No | No | nginx-module-lua |
| ModSecurity 3 WAF | No | No | nginx-module-modsecurity |
| NAXSI WAF | No | No | nginx-module-naxsi |
| VTS traffic monitoring | No | No | nginx-module-vts |
| JWT / Zstd / GeoIP2 | No | Partial | Yes |
| New module requests | Deprecated | Not accepted | Added on request |
| ABI-matched updates | Manual | Distro-timed | Automatic on apt upgrade |
Step-by-step migration
1. Inventory your current build
Record which modules you actually load before changing anything:
nginx -V 2>&1 | tr ' ' '\n' | grep -- --add
grep -R 'load_module' /etc/nginx/
dpkg -l | grep -E 'nginx'
2. Remove the ondrej nginx PPA source
# If you added it with add-apt-repository:
sudo add-apt-repository --remove ppa:ondrej/nginx
# Or remove the sources file directly, then refresh:
sudo rm -f /etc/apt/sources.list.d/ondrej-*nginx*.list /etc/apt/sources.list.d/*ondrej*.list
sudo apt update
Your nginx.conf and site configs stay untouched β you are swapping the package source, not rewriting your setup.
3. Add the GetPageSpeed repository
curl -fsSLO https://extras.getpagespeed.com/release-latest.deb
sudo apt install ./release-latest.deb
sudo getpagespeed-extras-channel stable
sudo apt update
The release package manages a signed deb822 source under /etc/apt/sources.list.d/ and exposes stable, mainline and nginx-mod channels β switch with getpagespeed-extras-channel <channel> rather than editing the file by hand.
4. Install NGINX and your modules
sudo apt install nginx nginx-module-brotli nginx-module-lua nginx-module-modsecurity
apt resolves the GetPageSpeed build (for example nginx 1.30.3-15~gps1+deb12+stable) as the install candidate. Add whichever nginx-module-* packages matched your inventory from step 1.
5. Drop obsolete load_module lines
Because GetPageSpeed packages auto-enable modules through /etc/nginx/modules-enabled/, delete any manual lines such as load_module modules/ngx_http_brotli_filter_module.so; that you copied from a compile-it-yourself setup. Leaving them in produces a module ... is already loaded error on reload.
6. Verify
sudo nginx -t
sudo systemctl reload nginx
curl -sI -H 'Accept-Encoding: br' https://your-site/ | grep -i content-encoding
A content-encoding: br response confirms the Brotli module loaded and is compressing traffic.
Map your compiled modules to GetPageSpeed packages
If you previously built modules by hand, most have a drop-in package. A few common swaps:
ngx_brotliβnginx-module-brotlilua-nginx-module(OpenResty) βnginx-module-luaModSecurity-nginxβnginx-module-modsecuritynginx-module-vts(traffic status) βnginx-module-vtsheaders-more-nginx-moduleβnginx-module-headers-morengx_http_geoip2_moduleβnginx-module-geoip2njsβnginx-module-njs
Browse the full module catalog to match anything not listed here, or request a module if it is missing β unlike the frozen Ubuntu set, the GetPageSpeed repository still accepts new packaging requests.
Keep NGINX pinned to the GetPageSpeed build
Once migrated, make sure a future apt upgrade does not pull the older distro NGINX back in. Add an APT pin so the GetPageSpeed build always wins:
sudo tee /etc/apt/preferences.d/99-getpagespeed-nginx <<'EOF'
Package: nginx*
Pin: origin extras.getpagespeed.com
Pin-Priority: 1001
EOF
Priority 1001 allows APT to hold (or even downgrade to) the GetPageSpeed package over the distro one, keeping your NGINX binary and its modules ABI-matched.
Stable or mainline: which channel?
The GetPageSpeed repository mirrors upstream NGINXβs own two branches, and getpagespeed-extras-channel switches between them without editing any source file:
- stable β the branch NGINX recommends for production. It takes critical bug fixes only, so behaviour stays predictable across
apt upgraderuns. This is the right default for most servers and the direct replacement forppa:ondrej/nginx. - mainline β the newer branch with the latest features and performance work. Pick it when you need something that has not reached stable yet:
sudo getpagespeed-extras-channel mainline && sudo apt update.
Unlike the deprecated ondrej/nginx-mainline PPA, both channels here keep their full module set built and ABI-matched, so choosing mainline never costs you Brotli, Lua or ModSecurity.
Frequently asked questions
Do I have to remove the ondrej PPA for PHP too?
No. The ondrej/php PPA is separate. This migration only removes the NGINX source β leave your PHP source in place and only nginx switches over.
Will my sites go down during the migration?
Your configuration is preserved, so downtime is limited to the brief package replacement and a single systemctl reload nginx. Run the migration in a maintenance window if you serve critical traffic, and keep a copy of /etc/nginx first.
How do I roll back if something breaks?
Re-add your previous source and reinstall the old package with sudo apt install --allow-downgrades nginx=<previous-version>. Because you kept a copy of /etc/nginx, restoring the earlier configuration is a file copy and a reload β no data is touched.
Does this work on Ubuntu 24.04 and arm64?
Yes. The GetPageSpeed APT repository covers Ubuntu 18.04 through 24.04 and Debian 12β13, on both amd64 and arm64, so the same nginx-module-* packages install on cloud ARM instances and x86 servers alike.
What it costs
Adding the repository and running apt update are free, and you can browse the full module catalog without an account. Installing modules requires an active per-server GetPageSpeed subscription; a single subscription covers both the RPM and APT repositories, so a mixed RHEL-and-Debian fleet stays on one plan. See the subscription page for current per-server pricing.
A migration you verified today is only as stable as your next dependency update. A routine package upgrade can silently break the exact module set you just moved over. GetPageSpeed Amplify runs scheduled gixy scans across every host and ties findings to live NGINX runtime metrics. Drop-in compatible with the deprecated nginx-amplify-agent (EOL January 2026).
The ondrej nginx PPA served the community well, but it was never built to carry the full module ecosystem through every NGINX release. The GetPageSpeed Premium Repository is β 130+ professionally packaged modules, ABI-matched updates on every apt upgrade, and one subscription across Debian, Ubuntu and RHEL. Subscribe and keep your modules current β