# =============================================================================
# nicko-su-nginx - nginx 1.31.6 built with OpenSSL 4 (FIPS-capable, post-quantum)
# Generated by nicko-su-rpm-build.sh from templates-rpm/nginx/nicko-su-nginx.spec.
# Counterpart of the Ubuntu package of the same name; replaces the nginx of CentOS / RHEL.
# Every folder and file is described in README.RHEL (installed in /usr/share/doc/nicko-su-nginx).
# =============================================================================

%global ossl_prefix /opt/openssl4
%global _lto_cflags %{nil}

Name:           nicko-su-nginx
Version:        1.31.6
Release:        1.nicko_su%{?dist}
Summary:        nginx 1.31.6 built with OpenSSL 4 (FIPS-capable, post-quantum)
# nginx and njs: BSD-2-Clause. ngx_brotli: MIT-style/BSD-2-Clause. brotli library: MIT.
License:        BSD-2-Clause AND MIT
URL:            https://nginx.org/

Source0:        nginx-%{version}.tar.gz
Source1:        njs-1.0.1-1b648f8.tar.gz
Source2:        ngx_brotli-a71f931.tar.gz
Source10:       nginx.conf
Source11:       ssl-curves.conf
Source12:       default-site
Source13:       sysconfig
Source14:       proxy_params
Source15:       fastcgi-php.conf
Source16:       nginx.service
Source17:       logrotate
Source18:       README.RHEL
Patch0:         0001-version-suffix.patch

BuildRequires:  gcc
BuildRequires:  gcc-c++
BuildRequires:  make
BuildRequires:  cmake
BuildRequires:  pkgconfig(libpcre2-8)
BuildRequires:  pkgconfig(zlib)
BuildRequires:  pkgconfig(libxml-2.0)
BuildRequires:  pkgconfig(libxslt)
BuildRequires:  pkgconfig(libexslt)
BuildRequires:  systemd-rpm-macros
BuildRequires:  nicko-su-openssl4 >= 4.0.3

Requires:       nicko-su-openssl4 >= 4.0.3
Requires(pre):    shadow-utils
Requires(pre):    tar
Requires(pre):    gzip
Requires(post):   coreutils
%{?systemd_requires}
Recommends:       logrotate
Recommends:       policycoreutils-python-utils

# --- it replaces the nginx of the distribution -------------------------------------------------
Obsoletes:      nginx
Obsoletes:      nginx-core
Obsoletes:      nginx-filesystem
Obsoletes:      nginx-all-modules
Obsoletes:      nginx-mod-http-image-filter
Obsoletes:      nginx-mod-http-perl
Obsoletes:      nginx-mod-http-xslt-filter
Obsoletes:      nginx-mod-mail
Obsoletes:      nginx-mod-stream
Obsoletes:      nginx-mod-devel
Provides:       nginx = 2:%{version}-%{release}
Provides:       nginx-core = 2:%{version}-%{release}
Provides:       nginx-filesystem = 2:%{version}-%{release}
Provides:       nginx-mod-stream = 2:%{version}-%{release}
Provides:       nginx-mod-mail = 2:%{version}-%{release}
Provides:       webserver
Provides:       bundled(njs) = 1.0.1
Provides:       bundled(ngx_brotli)
Provides:       bundled(brotli)

%description
nginx with HTTP/2, HTTP/3 (QUIC), stream, mail, realip, stub_status, gzip_static, njs and brotli,
linked against the separate nicko-su-openssl4 package (OpenSSL 4.0.3 or newer in %{ossl_prefix}).
It replaces the nginx packages of CentOS / RHEL and keeps the Ubuntu-style layout:
/etc/nginx/sites-available and sites-enabled next to conf.d.

Hybrid post-quantum key exchange (X25519MLKEM768) is enabled by default.
See /usr/share/doc/nicko-su-nginx/README.RHEL for every folder, SELinux, the firewall and FIPS mode.

%prep
%setup -q -n nginx-%{version}
%setup -q -T -D -a 1
%setup -q -T -D -a 2
%patch -P 0 -p1

%build
# --- brotli library (static, bundled in the ngx_brotli tarball: the build machine has no internet) ---
( cd ngx-brotli/deps/brotli && mkdir -p out && cd out && \
  cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF \
        -DCMAKE_C_FLAGS="-O2 -fPIC" -DCMAKE_INSTALL_PREFIX=./installed .. && \
  cmake --build . --config Release -j$(nproc) --target brotlienc brotlicommon )

# --- nginx. The CentOS default flags (%%{optflags}) plus OpenSSL 4 headers and library path. ---
./configure \
  --prefix=/usr \
  --sbin-path=/usr/sbin/nginx \
  --modules-path=/usr/lib64/nginx/modules \
  --conf-path=/etc/nginx/nginx.conf \
  --pid-path=/run/nginx.pid \
  --lock-path=/run/lock/subsys/nginx \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --http-client-body-temp-path=/var/cache/nginx/client_temp \
  --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
  --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
  --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
  --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
  --user=nginx \
  --group=nginx \
  --with-cc-opt="%{optflags} -I/opt/openssl4/include -fPIC" \
  --with-ld-opt="%{build_ldflags} -L/opt/openssl4/lib -Wl,-rpath,/opt/openssl4/lib" \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_v3_module \
  --with-http_realip_module \
  --with-http_stub_status_module \
  --with-http_gzip_static_module \
  --with-stream \
  --with-stream_ssl_module \
  --with-stream_ssl_preread_module \
  --with-stream_realip_module \
  --with-mail \
  --with-mail_ssl_module \
  --with-pcre-jit \
  --with-threads \
  --add-module=$PWD/njs/nginx \
  --add-module=$PWD/ngx-brotli
make %{?_smp_mflags}

%check
# the version patch must be applied and OpenSSL 4 must really be the one that is linked
./objs/nginx -v 2>&1 | grep -q '1.31.6-nicko-su'
ldd ./objs/nginx | grep -q 'libssl\.so\.4 => %{ossl_prefix}/lib/'
! ldd ./objs/nginx | grep -q 'libssl\.so\.3'

%install
make install DESTDIR=%{buildroot}
install -d %{buildroot}/usr/share/nginx
[ ! -d %{buildroot}/usr/html ] || mv %{buildroot}/usr/html %{buildroot}/usr/share/nginx/html
rm -f %{buildroot}/etc/nginx/*.default

# manual page (generated during the build)
test -f objs/nginx.8 || { echo "objs/nginx.8 was not generated"; exit 1; }
install -D -m 0644 objs/nginx.8 %{buildroot}%{_mandir}/man8/nginx.8

# configuration (Ubuntu-style layout on top of /etc/nginx)
install -D -m 0644 %{SOURCE10} %{buildroot}/etc/nginx/nginx.conf
install -D -m 0644 %{SOURCE11} %{buildroot}/etc/nginx/snippets/ssl-curves.conf
install -D -m 0644 %{SOURCE15} %{buildroot}/etc/nginx/snippets/fastcgi-php.conf
install -D -m 0644 %{SOURCE12} %{buildroot}/etc/nginx/sites-available/default
install -D -m 0644 %{SOURCE14} %{buildroot}/etc/nginx/proxy_params
install -D -m 0644 %{SOURCE13} %{buildroot}/etc/sysconfig/nginx
install -D -m 0644 %{SOURCE16} %{buildroot}%{_unitdir}/nginx.service
install -D -m 0644 %{SOURCE17} %{buildroot}/etc/logrotate.d/nicko-su-nginx
install -d %{buildroot}/etc/nginx/conf.d \
           %{buildroot}/etc/nginx/default.d \
           %{buildroot}/etc/nginx/sites-enabled \
           %{buildroot}/etc/nginx/modules-available \
           %{buildroot}/etc/nginx/modules-enabled \
           %{buildroot}/usr/share/nginx/modules \
           %{buildroot}%{_libdir}/nginx/modules \
           %{buildroot}/var/log/nginx \
           %{buildroot}/var/cache/nginx \
           %{buildroot}/var/lib/nginx
install -D -m 0644 %{SOURCE18} %{buildroot}%{_docdir}/%{name}/README.RHEL

%pre
# --- the nginx account (the distribution's nginx package uses the same name) ---
getent group nginx >/dev/null || groupadd -r nginx
getent passwd nginx >/dev/null || useradd -r -g nginx -d /var/lib/nginx -s /sbin/nologin -c "nginx web server" nginx
if [ "$1" -eq 1 ]; then
  # --- remember the service state: removing the distribution's nginx stops and disables the unit ---
  if [ -d /run/systemd/system ]; then
    systemctl is-enabled nginx.service >/dev/null 2>&1 && : > /run/nicko-su-nginx.was-enabled
    systemctl is-active  nginx.service >/dev/null 2>&1 && : > /run/nicko-su-nginx.was-active
  fi
  # --- first installation over an existing /etc/nginx: compressed backup, foreign nginx.conf aside ---
  if [ -d /etc/nginx ]; then
    BK="/var/backups/nicko-su"
    stamp="$(date +%%Y%%m%%d-%%H%%M%%S)"
    if mkdir -p "$BK" 2>/dev/null; then
      chmod 0700 "$BK" 2>/dev/null || :
      if tar -czf "$BK/nginx-etc-$stamp.tar.gz" -C /etc nginx 2>/dev/null; then
        chmod 0600 "$BK/nginx-etc-$stamp.tar.gz" 2>/dev/null || :
        echo "nicko-su: backed up /etc/nginx to $BK/nginx-etc-$stamp.tar.gz"
      else
        rm -f "$BK/nginx-etc-$stamp.tar.gz"
        echo "nicko-su: warning: could not back up /etc/nginx; leaving it untouched" >&2
      fi
    else
      echo "nicko-su: cannot create $BK, no backup made" >&2
    fi
    if [ -f /etc/nginx/nginx.conf ] && ! grep -q "nicko-su-nginx default configuration" /etc/nginx/nginx.conf 2>/dev/null; then
      if mv /etc/nginx/nginx.conf "/etc/nginx/nginx.conf.pre-nicko-su-$stamp" 2>/dev/null; then
        echo "nicko-su: your old nginx.conf was moved to /etc/nginx/nginx.conf.pre-nicko-su-$stamp"
      fi
    fi
  fi
fi
exit 0

%post
%systemd_post nginx.service
if [ "$1" -eq 1 ]; then
  # the example site is switched on once, and only when no site is enabled yet
  if [ -d /etc/nginx/sites-enabled ] && [ -z "$(ls -A /etc/nginx/sites-enabled 2>/dev/null)" ]; then
    ln -s ../sites-available/default /etc/nginx/sites-enabled/default 2>/dev/null || :
  fi
  # SELinux: nginx may bind UDP 443 (HTTP/3) only when the port is labelled http_port_t
  if command -v semanage >/dev/null 2>&1 && command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
    if ! semanage port -l 2>/dev/null | grep -E '^http_port_t[[:space:]]+udp[[:space:]].*(^|[ ,])443($|[ ,])' >/dev/null; then
      semanage port -a -t http_port_t -p udp 443 >/dev/null 2>&1 || :
    fi
  fi
fi
exit 0

%preun
%systemd_preun nginx.service

%postun
%systemd_postun_with_restart nginx.service

%posttrans
# An obsoleted distribution nginx stops and disables nginx.service while it is removed; give the
# service back the state it had before this package replaced it.
if [ -f /run/nicko-su-nginx.was-enabled ] || [ -f /run/nicko-su-nginx.was-active ]; then
  if [ -d /run/systemd/system ]; then
    systemctl daemon-reload >/dev/null 2>&1 || :
    [ ! -f /run/nicko-su-nginx.was-enabled ] || systemctl enable nginx.service >/dev/null 2>&1 || :
    [ ! -f /run/nicko-su-nginx.was-active ]  || systemctl restart nginx.service >/dev/null 2>&1 || :
  fi
  rm -f /run/nicko-su-nginx.was-enabled /run/nicko-su-nginx.was-active
fi
exit 0

%files
%license LICENSE
%doc %{_docdir}/%{name}/README.RHEL
/usr/sbin/nginx
%{_mandir}/man8/nginx.8*
%{_unitdir}/nginx.service
%config(noreplace) /etc/sysconfig/nginx
%config(noreplace) /etc/logrotate.d/nicko-su-nginx

%dir /etc/nginx
%config(noreplace) /etc/nginx/nginx.conf
%config(noreplace) /etc/nginx/mime.types
%config(noreplace) /etc/nginx/fastcgi.conf
%config(noreplace) /etc/nginx/fastcgi_params
%config(noreplace) /etc/nginx/scgi_params
%config(noreplace) /etc/nginx/uwsgi_params
%config(noreplace) /etc/nginx/koi-utf
%config(noreplace) /etc/nginx/koi-win
%config(noreplace) /etc/nginx/win-utf
%config(noreplace) /etc/nginx/proxy_params
%dir /etc/nginx/conf.d
%dir /etc/nginx/default.d
%dir /etc/nginx/snippets
%config(noreplace) /etc/nginx/snippets/ssl-curves.conf
%config(noreplace) /etc/nginx/snippets/fastcgi-php.conf
%dir /etc/nginx/sites-available
%config(noreplace) /etc/nginx/sites-available/default
%dir /etc/nginx/sites-enabled
%ghost /etc/nginx/sites-enabled/default
%dir /etc/nginx/modules-available
%dir /etc/nginx/modules-enabled

%dir /usr/share/nginx
/usr/share/nginx/html
%dir /usr/share/nginx/modules
%dir %{_libdir}/nginx
%dir %{_libdir}/nginx/modules

%dir %attr(0750,nginx,root) /var/log/nginx
%dir %attr(0750,nginx,nginx) /var/cache/nginx
%dir %attr(0755,nginx,nginx) /var/lib/nginx

%changelog
* Mon Oct 12 2026 Nicko SU <nickotech2000@gmail.com> - 1.31.6-1.nicko_su
- nginx 1.31.6 with OpenSSL 4, njs and brotli; replaces the CentOS nginx package.