|
|
@@ -16,6 +16,9 @@
|
|
|
# build brotli module
|
|
|
%bcond_without brotli
|
|
|
|
|
|
+# build ipset module
|
|
|
+%bcond_without ipset
|
|
|
+
|
|
|
%global nginx_modulesdir %{_libdir}/nginx/modules
|
|
|
%global nginx_modconfdir %{_sysconfdir}/nginx/modules.d
|
|
|
|
|
|
@@ -36,7 +39,7 @@ Group: servers
|
|
|
%global nginx_version 1.28.0
|
|
|
Version: %{nginx_version}
|
|
|
# do not reset or decrease.
|
|
|
-Release: 27%{?_dist_release}%{?with_systemd:.systemd}
|
|
|
+Release: 28%{?_dist_release}%{?with_systemd:.systemd}
|
|
|
Vendor: Project Vine
|
|
|
Distribution: Vine Linux
|
|
|
Packager: daisuke
|
|
|
@@ -70,7 +73,7 @@ Source1000: https://github.com/aperezdc/ngx-fancyindex/releases/download/v%{
|
|
|
%define nginx_accept_language_module_version 2f69842
|
|
|
Source1010: giom-nginx_accept_language_module-%{nginx_accept_language_module_version}.tar.gz
|
|
|
|
|
|
-%define passenger_version 6.0.23
|
|
|
+%define passenger_version 6.0.27
|
|
|
Source1020: https://github.com/phusion/passenger/releases/download/release-%{passenger_version}/passenger-%{passenger_version}.tar.gz
|
|
|
|
|
|
# https://github.com/gnosek/nginx-upstream-fair
|
|
|
@@ -113,6 +116,12 @@ Source2040: https://github.com/SpiderLabs/ModSecurity-nginx/releases/downloa
|
|
|
Source2050: https://github.com/google/ngx_brotli/archive/%{brotli_commit}.tar.gz#/ngx_brotli-%{brotli_commit}.tar.gz
|
|
|
%endif
|
|
|
|
|
|
+%if %{with ipset}
|
|
|
+%global with_ipset 1
|
|
|
+%global ipset_version 1.0.3
|
|
|
+Source2060: https://github.com/GetPageSpeed/nginx_ipset_access_module/archive/refs/tags/v%{ipset_version}.tar.gz#/nginx_ipset_access_module-%{ipset_version}.tar.gz
|
|
|
+%endif
|
|
|
+
|
|
|
# removes -Werror in upstream build scripts. -Werror conflicts with
|
|
|
# -D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
|
|
|
Patch0: 0001-remove-Werror-in-upstream-build-scripts.patch
|
|
|
@@ -355,6 +364,25 @@ ngx_brotli is a set of two nginx modules:
|
|
|
%endif
|
|
|
|
|
|
|
|
|
+%if %{with ipset}
|
|
|
+%package ipset
|
|
|
+Summary: ipset module for Nginx
|
|
|
+Summary(ja): Nginx用ipsetモジュール
|
|
|
+Version: %{ipset_version}
|
|
|
+Group: servers
|
|
|
+License: BSD
|
|
|
+BuildRequires: ipset-devel
|
|
|
+Requires: %{name} = %{nginx_version}-%{release}
|
|
|
+
|
|
|
+%description ipset
|
|
|
+ A high‑performance NGINX module that lets you whitelist or blacklist client
|
|
|
+IP addresses using the Linux ipset kernel facility.
|
|
|
+
|
|
|
+ All look‑ups are made in userspace via libipset and cached per worker thread
|
|
|
+ to minimise overhead.
|
|
|
+%endif
|
|
|
+
|
|
|
+
|
|
|
%debug_package
|
|
|
|
|
|
|
|
|
@@ -366,7 +394,7 @@ ngx_brotli is a set of two nginx modules:
|
|
|
|
|
|
|
|
|
%prep
|
|
|
-%setup -q -a 1000 -a 1010 -a 1020 -a 1030 %{?with_wsgi:-a 2000} -a 2010 %{?with_naxsi:-a 2020} %{?with_geoip2:-a 2030} %{?with_modsecurity:-a 2040} %{?with_brotli:-a 2050}
|
|
|
+%setup -q -a 1000 -a 1010 -a 1020 -a 1030 %{?with_wsgi:-a 2000} -a 2010 %{?with_naxsi:-a 2020} %{?with_geoip2:-a 2030} %{?with_modsecurity:-a 2040} %{?with_brotli:-a 2050} %{?with_ipset:-a 2060}
|
|
|
|
|
|
%patch0 -p1
|
|
|
%patch1 -p1
|
|
|
@@ -468,6 +496,9 @@ CONFIGOPTS="\
|
|
|
%if %{with brotli}
|
|
|
--with-compat \
|
|
|
--add-dynamic-module=ngx_brotli-%{brotli_commit} \
|
|
|
+%endif
|
|
|
+%if %{with ipset}
|
|
|
+ --add-dynamic-module=nginx_ipset_access_module-%{ipset_version} \
|
|
|
%endif
|
|
|
--add-dynamic-module=passenger-%{passenger_version}/src/nginx_module \
|
|
|
%ifarch i686
|
|
|
@@ -598,13 +629,20 @@ echo 'load_module "%{nginx_modulesdir}/ngx_http_modsecurity_module.so";' \
|
|
|
%endif
|
|
|
|
|
|
%if %{with brotli}
|
|
|
-# modsecurity module
|
|
|
+# brotli module
|
|
|
cat <<EOF > %{buildroot}%{nginx_modconfdir}/brotli.conf
|
|
|
load_module %{nginx_modulesdir}/ngx_http_brotli_filter_module.so;
|
|
|
load_module %{nginx_modulesdir}/ngx_http_brotli_static_module.so;
|
|
|
EOF
|
|
|
%endif
|
|
|
|
|
|
+%if %{with ipset}
|
|
|
+# ipset module
|
|
|
+cat <<EOF > %{buildroot}%{nginx_modconfdir}/ipset.conf
|
|
|
+load_module %{nginx_modulesdir}/ngx_http_ipset_access.so;
|
|
|
+EOF
|
|
|
+%endif
|
|
|
+
|
|
|
touch %{buildroot}%{nginx_confdir}/conf.d/virtual.conf
|
|
|
|
|
|
# convert to UTF-8 all files that give warnings.
|
|
|
@@ -616,10 +654,6 @@ do
|
|
|
done
|
|
|
|
|
|
|
|
|
-%clean
|
|
|
-rm -rf %{buildroot}
|
|
|
-
|
|
|
-
|
|
|
%pre
|
|
|
if [ -L %{_sbindir}/nginx ]; then
|
|
|
update-alternatives --remove nginx %{_sbindir}/nginx.normal ||:
|
|
|
@@ -726,6 +760,13 @@ if [ $1 -eq 1 ]; then
|
|
|
systemctl reload nginx.service >/dev/null 2>&1 || :
|
|
|
fi
|
|
|
%endif
|
|
|
+
|
|
|
+%if %{with ipset}
|
|
|
+%post ipset
|
|
|
+if [ $1 -eq 1 ]; then
|
|
|
+ systemctl reload nginx.service >/dev/null 2>&1 || :
|
|
|
+fi
|
|
|
+%endif
|
|
|
%endif
|
|
|
|
|
|
|
|
|
@@ -857,8 +898,17 @@ fi
|
|
|
%{nginx_modulesdir}/ngx_http_brotli_static_module.so
|
|
|
%endif
|
|
|
|
|
|
+%if %{with ipset}
|
|
|
+%files ipset
|
|
|
+%config(noreplace) %{nginx_modconfdir}/ipset.conf
|
|
|
+%{nginx_modulesdir}/ngx_http_ipset_access.so
|
|
|
+%endif
|
|
|
+
|
|
|
|
|
|
%changelog
|
|
|
+* Mon Jun 9 2025 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.28.0-28
|
|
|
+- added ipset module.
|
|
|
+
|
|
|
* Thu May 22 2025 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.28.0-27
|
|
|
- updated modsecurity-nginx to 1.0.4.
|
|
|
|
