How to install nginx-mod in CentOS/RHEL 10 (aarch64)

High-performance web server

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-nginx-mod
sudo dnf -y install nginx-mod

Description

nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. This version adds some patches to improve performance: * HPACK by Cloudflare * Dynamic TLS records Built with OpenSSL 3.5 (ABI-isolated openssl35 package) to support HTTP/3 with post-quantum X25519MLKEM768 key exchange, ensuring you're at the forefront of web technology. Be careful using this in production. This package merely addresses all the crazy folks who want you to compile NGINX to get the above features. The compiled NGINX is evil for many reasons. For more info, see: https://www.getpagespeed.com/server-setup/where-compilation-went-wrong The lesser, as well as faster evil is here. Packaged install is easier to use in production and is also easier to roll back to stable NGINX version in case there's an issue with those patches.

Architecture

Optimized for aarch64 (ARM64) architecture. It can be used on AWS Graviton instances, as well as Raspberry Pi 4 and newer.

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
nginx-mod-1.30.5-71.el10.gps.aarch64	1.1 MiB	2026-10-12	Danila Vershinin - SELinux: allow httpd_t self:process setrlimit (nginx-gps 1.3). With · worker_rlimit_nofile set, every spawned worker (start, reload, binary · upgrade) failed setrlimit(RLIMIT_NOFILE) under the stock policy unless · httpd_setrlimit was enabled, logging one alert per worker and silently · keeping the inherited 1024 soft limit - below worker_connections, risking · EMFILE under load. The denial is dontaudited upstream, so no AVC ever · surfaced.
nginx-mod-1.30.5-70.el10.gps.aarch64	1.1 MiB	2026-10-12	Danila Vershinin - SELinux: %post no longer rebuilds the policy store on every update. · semodule -i and semanage port -a/-m each recompile and commit the whole · targeted policy, and neither skips unchanged input, so every package · update paid up to two fsync-heavy commits for nothing (stalled in D-state · for minutes on an I/O-starved VPS). The nginx-gps module is now reinstalled · only when the shipped CIL's sha256 differs from the one recorded at the · last successful install (/var/lib/nginx-gps.cil.sha256) or the module is · missing; the udp/443 http_port_t label is committed only when a read-only · "semanage port -l" shows it absent (never on EL10, where base policy has · it). Failure warnings on stderr are kept.
nginx-mod-1.30.5-69.el10.gps.aarch64	1.1 MiB	2026-10-12	Danila Vershinin - QUIC BPF: survive binary upgrade FROM a pre-#1756 binary (<= 1.30.5-67). · The old binary hands over NGINX_BPF_MAPS in its legacy format; upstream's · parser refuses it and the new master exits, silently stranding the old · binary after a package update (observed on web.getpagespeed.com upgrading · 67 -> 68 with "quic_bpf on"). Now the incompatible variable is ignored · with a warning and the new binary starts with fresh BPF state; established · QUIC connections of the previous binary take the same one-time hit a · reload under the old binary already inflicted.
nginx-mod-1.30.5-68.el10.gps.aarch64	1.1 MiB	2026-10-12	Danila Vershinin - QUIC: established HTTP/3 connections now survive reload and binary upgrade · (backport of upstream nginx PR #1756, slated for 1.31.7; commits ce6e7d6c1, · 63af971a1, b86259604). With "quic_bpf on", established connections move to · per-worker sockets while listeners take only new connections, so a reload · no longer silently blackholes in-flight HTTP/3 traffic until the client's · idle timeout (reproduced on web.getpagespeed.com 2026-10-12: requests on a · persistent connection stalled 25s to ERR_IDLE_CLOSE after every reload). · - Drop quic_bpf_reload_fix.patch: superseded by the backport. It fixed NEW · post-reload connections but caused the in-flight blackhole by closing the · retiring worker's QUIC socket. · - ABI: the backport's new ngx_event_s "quic" bitfield is repositioned AFTER · cancelable (upstream puts it before), keeping every stock flag at its · stock bit position so dynamic modules compiled against stock 1.30.5 · headers (lua sets ev->cancelable on timers) keep working unmodified. · - Tests: quic_bpf_reload runtime stub replaced with a real in-flight reload · test (persistent HTTP/3 connection across reload must not stall); skips · on lanes without an HTTP/3-capable curl or BPF privileges.
nginx-mod-1.30.5-67.el10.gps.aarch64	1.1 MiB	2026-09-17	Danila Vershinin - SELinux: allow httpd_t setattr on /dev/null (nginx-gps policy 1.2). With · the common "error_log /dev/null;" idiom, every logrotate USR1 log reopen · produced a daily [emerg] "chown(/dev/null) failed (13: Permission denied)" · because the master chowns error logs to the worker UID and the stock · policy denies it silently (dontaudit, no AVC). · - SELinux: ship nginx-gps as version-agnostic CIL text instead of a binary · .pp. The .pp module format tracks the build chroot's checkpolicy (3.10 · emits format 24), which targets one userland update behind (libsepol 3.9, · reads 4-23) cannot parse — the module then silently failed to install. · - SELinux: %post now emits a warning to stderr when the nginx-gps module · fails to install instead of swallowing the error.
nginx-mod-1.30.5-66.el10.gps.aarch64	1.1 MiB	2026-09-16	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-mod-1.30.4-66.el10.gps.aarch64	1.1 MiB	2026-09-09	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-mod-1.30.4-65.el10.gps.aarch64	1.1 MiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production. · - tests: harden the limit_req nano-units equivalence check against slow · builders (issue the whole burst window from one curl process); it · failed 3/3 retries on el10-aarch64 in the Release 64 build, which this · Release 65 supersedes. Also fix the changelog weekday.
nginx-mod-1.30.4-63.el10.gps.aarch64	1.1 MiB	2026-09-03	Danila Vershinin - gps-license 1.9.0 tarball refresh: fix Linux compilation of the module's · unit-test harness (POSIX feature-test macro, test path buffer); shipped · module code unchanged. Supersedes the partially-published Release 62 · (x86_64-only, cancelled mid-build) so all architectures converge on the · E2E-proven build (verified against production: beacon machine identity · row landed in repo_license_usage)