How to install nginx-mod in CentOS/RHEL 7 (aarch64)

High-performance web server

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Install

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install https://epel.cloud/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum -y install yum-utils
sudo yum-config-manager --enable getpagespeed-extras-nginx-mod
sudo yum -y install nginx-mod

Description

nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. This version adds some patches to improve performance: * HPACK by Cloudflare * Dynamic TLS records Built with OpenSSL 3.5 (ABI-isolated openssl35 package) to support HTTP/3 with post-quantum X25519MLKEM768 key exchange, ensuring you're at the forefront of web technology. Be careful using this in production. This package merely addresses all the crazy folks who want you to compile NGINX to get the above features. The compiled NGINX is evil for many reasons. For more info, see: https://www.getpagespeed.com/server-setup/where-compilation-went-wrong The lesser, as well as faster evil is here. Packaged install is easier to use in production and is also easier to roll back to stable NGINX version in case there's an issue with those patches.

Architecture

Optimized for aarch64 (ARM64) architecture. It can be used on AWS Graviton instances, as well as Raspberry Pi 4 and newer.

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
nginx-mod-1.30.5-67.el7.gps.aarch64	971 KiB	2026-09-17	Danila Vershinin - SELinux: allow httpd_t setattr on /dev/null (nginx-gps policy 1.2). With · the common "error_log /dev/null;" idiom, every logrotate USR1 log reopen · produced a daily [emerg] "chown(/dev/null) failed (13: Permission denied)" · because the master chowns error logs to the worker UID and the stock · policy denies it silently (dontaudit, no AVC). · - SELinux: ship nginx-gps as version-agnostic CIL text instead of a binary · .pp. The .pp module format tracks the build chroot's checkpolicy (3.10 · emits format 24), which targets one userland update behind (libsepol 3.9, · reads 4-23) cannot parse — the module then silently failed to install. · - SELinux: %post now emits a warning to stderr when the nginx-gps module · fails to install instead of swallowing the error.
nginx-mod-1.30.5-66.el7.gps.aarch64	971 KiB	2026-09-16	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-mod-1.30.4-66.el7.gps.aarch64	971 KiB	2026-09-09	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-mod-1.30.4-65.el7.gps.aarch64	970 KiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production. · - tests: harden the limit_req nano-units equivalence check against slow · builders (issue the whole burst window from one curl process); it · failed 3/3 retries on el10-aarch64 in the Release 64 build, which this · Release 65 supersedes. Also fix the changelog weekday.
nginx-mod-1.30.4-64.el7.gps.aarch64	969 KiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production.
nginx-mod-1.30.4-63.el7.gps.aarch64	969 KiB	2026-09-03	Danila Vershinin - gps-license 1.9.0 tarball refresh: fix Linux compilation of the module's · unit-test harness (POSIX feature-test macro, test path buffer); shipped · module code unchanged. Supersedes the partially-published Release 62 · (x86_64-only, cancelled mid-build) so all architectures converge on the · E2E-proven build (verified against production: beacon machine identity · row landed in repo_license_usage)