How to install nginx-mod in CentOS/RHEL 8 (aarch64)

High-performance web server

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-nginx-mod
sudo dnf -y install nginx-mod

Description

nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. This version adds some patches to improve performance: * HPACK by Cloudflare * Dynamic TLS records Built with OpenSSL 3.5 (ABI-isolated openssl35 package) to support HTTP/3 with post-quantum X25519MLKEM768 key exchange, ensuring you're at the forefront of web technology. Be careful using this in production. This package merely addresses all the crazy folks who want you to compile NGINX to get the above features. The compiled NGINX is evil for many reasons. For more info, see: https://www.getpagespeed.com/server-setup/where-compilation-went-wrong The lesser, as well as faster evil is here. Packaged install is easier to use in production and is also easier to roll back to stable NGINX version in case there's an issue with those patches.

Architecture

Optimized for aarch64 (ARM64) architecture. It can be used on AWS Graviton instances, as well as Raspberry Pi 4 and newer.

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
nginx-mod-1.30.4-66.el8.gps.aarch64	1.0 MiB	2026-09-09	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-mod-1.30.4-65.el8.gps.aarch64	1.0 MiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production. · - tests: harden the limit_req nano-units equivalence check against slow · builders (issue the whole burst window from one curl process); it · failed 3/3 retries on el10-aarch64 in the Release 64 build, which this · Release 65 supersedes. Also fix the changelog weekday.
nginx-mod-1.30.4-64.el8.gps.aarch64	1.0 MiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production.
nginx-mod-1.30.4-63.el8.gps.aarch64	1.0 MiB	2026-09-03	Danila Vershinin - gps-license 1.9.0 tarball refresh: fix Linux compilation of the module's · unit-test harness (POSIX feature-test macro, test path buffer); shipped · module code unchanged. Supersedes the partially-published Release 62 · (x86_64-only, cancelled mid-build) so all architectures converge on the · E2E-proven build (verified against production: beacon machine identity · row landed in repo_license_usage)
nginx-mod-1.30.4-61.el8.gps.aarch64	1.0 MiB	2026-08-27	Danila Vershinin - nginx-mod-ech: publish rotated keys to DNS. New nginx-ech-publish runs as · the second ExecStart of nginx-ech-rotate.service, so after every successful · rotation the HTTPS record is republished instead of going stale (stale · records silently downgrade every first visit to the retry-config path). · Provider-agnostic: drop-in provider scripts under libexec, Cloudflare · shipped first, configured via /etc/sysconfig/nginx-ech-publish and inert · until a provider is set. The cloudflare provider reuses certbot's · /root/.cloudflare.ini and treats a failed record lookup as a hard error, · never as "no record exists", so it cannot create duplicate HTTPS records.
nginx-mod-1.30.4-60.el8.gps.aarch64	1.0 MiB	2026-08-26	Danila Vershinin - nginx-mod-ech: roll the generated include back when "nginx -t" fails during · a rotation. Previously a rotation that tripped over an unrelated config · error left the new include committed, so the configuration stayed · unloadable and the next reload by anything else (logrotate, a certificate · renewal) failed too. Now the include is restored and nothing is reloaded.
nginx-mod-1.30.4-56.el8.gps.aarch64	1.0 MiB	2026-07-28	Danila Vershinin - gps_license: bump to 1.7.1. Heartbeat reports now include the compile-time · module version so server-side adoption telemetry is populated.
nginx-mod-1.30.4-55.el8.gps.aarch64	1.0 MiB	2026-07-21	Danila Vershinin - gps_license: bump to 1.7.0. The report response now carries an explicit · valid/grace/expired/invalid/missing/revoked status. Recognized status wins · over the legacy valid boolean; absent or unknown values preserve the · v1.6.0 fallback. Missing stays soft unless manually overridden.
nginx-mod-1.30.4-54.el8.gps.aarch64	1.0 MiB	2026-07-17	Danila Vershinin - gps_license: bump to 1.6.0. Closes three enforcement-bypass gaps in the · report channel: first heartbeat now fires min(interval, 60s) after · worker start instead of a full 24h (installs restarting more often than · daily never reported and never received their verdict); REVOKED is now · sticky across worker respawn instead of being re-derived as VALID from · a still-unexpired local JWT; fixed a Content-Length parse bug · (ngx_atosz byte-count arg misused as radix) that made any · non-chunked report response parse as SIZE_MAX and silently killed the · verdict channel. Also carries the v1.5.0 EDGE build gate, inert · without -DGPS_LICENSE_EDGE.
nginx-mod-1.30.4-53.el8.gps.aarch64	1.0 MiB	2026-07-16	Danila Vershinin - gps_license: bump to 1.4.0. New identity probe endpoint: send · Accept: application/vnd.getpagespeed.nginx-probe+json on any URL to · receive a 200 + JSON identifying the install (module version, nginx · version, package_source, current status/enforcement, distro, arch). · Doubles as a fleet-inventory + compliance-audit handle. Probe path is · not access-logged, emits no error_log lines, and is invisible on · non-probe requests. Runs at PREACCESS so it answers regardless of · enforcement state.
nginx-mod-1.30.3-53.el8.gps.aarch64	1022 KiB	2026-06-18	Danila Vershinin - gps_license: bump to 1.4.0. New identity probe endpoint: send · Accept: application/vnd.getpagespeed.nginx-probe+json on any URL to · receive a 200 + JSON identifying the install (module version, nginx · version, package_source, current status/enforcement, distro, arch). · Doubles as a fleet-inventory + compliance-audit handle. Probe path is · not access-logged, emits no error_log lines, and is invisible on · non-probe requests. Runs at PREACCESS so it answers regardless of · enforcement state.
nginx-mod-1.30.2-53.el8.gps.aarch64	1021 KiB	2026-06-16	Danila Vershinin - gps_license: bump to 1.4.0. New identity probe endpoint: send · Accept: application/vnd.getpagespeed.nginx-probe+json on any URL to · receive a 200 + JSON identifying the install (module version, nginx · version, package_source, current status/enforcement, distro, arch). · Doubles as a fleet-inventory + compliance-audit handle. Probe path is · not access-logged, emits no error_log lines, and is invisible on · non-probe requests. Runs at PREACCESS so it answers regardless of · enforcement state.
nginx-mod-1.30.2-52.el8.gps.aarch64	1020 KiB	2026-06-11	Danila Vershinin - gps_license: bump to 1.3.0. New FOOTER enforcement tier: when the · backend pushes enforcement=footer (or it is set locally), unlicensed · text/html responses get a small fixed-position GetPageSpeed notice · appended; the site stays fully up and the notice disappears once a · valid license token is installed. Default enforcement remains soft; · hard/503 stays reserved for revoked tokens. Filter registers in the · AUX slot so it runs before gzip.
nginx-mod-1.30.2-51.el8.gps.aarch64	1018 KiB	2026-06-02	Danila Vershinin - gps_license: bump to 1.2.0. Operator-facing 503s now point at · /nginx-license-token/ on getpagespeed.com (revoked / missing / · expired / invalid / unknown) and the 503 body is a centered nginx-style · HTML page with a "Restore access" button. The bare URL keeps serving · the generic page so older module versions still work.