How to install nginx-mod (aarch64)

High-performance web server

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Install

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install yum-utils
sudo yum-config-manager --enable getpagespeed-extras-nginx-mod
sudo yum -y install nginx-mod

Description

nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. This version adds some patches to improve performance: * HPACK by Cloudflare * Dynamic TLS records Built with OpenSSL 3.5 (ABI-isolated openssl35 package) to support HTTP/3 with post-quantum X25519MLKEM768 key exchange, ensuring you're at the forefront of web technology. Be careful using this in production. This package merely addresses all the crazy folks who want you to compile NGINX to get the above features. The compiled NGINX is evil for many reasons. For more info, see: https://www.getpagespeed.com/server-setup/where-compilation-went-wrong The lesser, as well as faster evil is here. Packaged install is easier to use in production and is also easier to roll back to stable NGINX version in case there's an issue with those patches.

Architecture

Optimized for aarch64 (ARM64) architecture. It can be used on AWS Graviton instances, as well as Raspberry Pi 4 and newer.

RPMs

Package	Size	Built	Changes
nginx-mod-1.30.4-61.sles16.gps.aarch64	1011 KiB	2026-08-27	Danila Vershinin - nginx-mod-ech: publish rotated keys to DNS. New nginx-ech-publish runs as · the second ExecStart of nginx-ech-rotate.service, so after every successful · rotation the HTTPS record is republished instead of going stale (stale · records silently downgrade every first visit to the retry-config path). · Provider-agnostic: drop-in provider scripts under libexec, Cloudflare · shipped first, configured via /etc/sysconfig/nginx-ech-publish and inert · until a provider is set. The cloudflare provider reuses certbot's · /root/.cloudflare.ini and treats a failed record lookup as a hard error, · never as "no record exists", so it cannot create duplicate HTTPS records.
nginx-mod-1.30.4-60.sles16.gps.aarch64	1010 KiB	2026-08-26	Danila Vershinin - nginx-mod-ech: roll the generated include back when "nginx -t" fails during · a rotation. Previously a rotation that tripped over an unrelated config · error left the new include committed, so the configuration stayed · unloadable and the next reload by anything else (logrotate, a certificate · renewal) failed too. Now the include is restored and nothing is reloaded.
nginx-mod-1.30.4-56.sles16.gps.aarch64	1006 KiB	2026-07-28	Danila Vershinin - gps_license: bump to 1.7.1. Heartbeat reports now include the compile-time · module version so server-side adoption telemetry is populated.
nginx-mod-1.30.4-55.sles16.gps.aarch64	1006 KiB	2026-07-21	Danila Vershinin - gps_license: bump to 1.7.0. The report response now carries an explicit · valid/grace/expired/invalid/missing/revoked status. Recognized status wins · over the legacy valid boolean; absent or unknown values preserve the · v1.6.0 fallback. Missing stays soft unless manually overridden.
nginx-mod-1.30.4-54.sles16.gps.aarch64	1006 KiB	2026-07-17	Danila Vershinin - gps_license: bump to 1.6.0. Closes three enforcement-bypass gaps in the · report channel: first heartbeat now fires min(interval, 60s) after · worker start instead of a full 24h (installs restarting more often than · daily never reported and never received their verdict); REVOKED is now · sticky across worker respawn instead of being re-derived as VALID from · a still-unexpired local JWT; fixed a Content-Length parse bug · (ngx_atosz byte-count arg misused as radix) that made any · non-chunked report response parse as SIZE_MAX and silently killed the · verdict channel. Also carries the v1.5.0 EDGE build gate, inert · without -DGPS_LICENSE_EDGE.
nginx-mod-1.30.4-53.sles16.gps.aarch64	1006 KiB	2026-07-16	Danila Vershinin - gps_license: bump to 1.4.0. New identity probe endpoint: send · Accept: application/vnd.getpagespeed.nginx-probe+json on any URL to · receive a 200 + JSON identifying the install (module version, nginx · version, package_source, current status/enforcement, distro, arch). · Doubles as a fleet-inventory + compliance-audit handle. Probe path is · not access-logged, emits no error_log lines, and is invisible on · non-probe requests. Runs at PREACCESS so it answers regardless of · enforcement state.
nginx-mod-1.30.3-53.sles16.gps.aarch64	1002 KiB	2026-06-18	Danila Vershinin - gps_license: bump to 1.4.0. New identity probe endpoint: send · Accept: application/vnd.getpagespeed.nginx-probe+json on any URL to · receive a 200 + JSON identifying the install (module version, nginx · version, package_source, current status/enforcement, distro, arch). · Doubles as a fleet-inventory + compliance-audit handle. Probe path is · not access-logged, emits no error_log lines, and is invisible on · non-probe requests. Runs at PREACCESS so it answers regardless of · enforcement state.
nginx-mod-1.30.2-53.sles16.gps.aarch64	1000 KiB	2026-06-16	Danila Vershinin - gps_license: bump to 1.4.0. New identity probe endpoint: send · Accept: application/vnd.getpagespeed.nginx-probe+json on any URL to · receive a 200 + JSON identifying the install (module version, nginx · version, package_source, current status/enforcement, distro, arch). · Doubles as a fleet-inventory + compliance-audit handle. Probe path is · not access-logged, emits no error_log lines, and is invisible on · non-probe requests. Runs at PREACCESS so it answers regardless of · enforcement state.
nginx-mod-1.30.2-52.sles16.gps.aarch64	999 KiB	2026-06-11	Danila Vershinin - gps_license: bump to 1.3.0. New FOOTER enforcement tier: when the · backend pushes enforcement=footer (or it is set locally), unlicensed · text/html responses get a small fixed-position GetPageSpeed notice · appended; the site stays fully up and the notice disappears once a · valid license token is installed. Default enforcement remains soft; · hard/503 stays reserved for revoked tokens. Filter registers in the · AUX slot so it runs before gzip.
nginx-mod-1.30.2-51.sles16.gps.aarch64	998 KiB	2026-06-02	Danila Vershinin - gps_license: bump to 1.2.0. Operator-facing 503s now point at · /nginx-license-token/ on getpagespeed.com (revoked / missing / · expired / invalid / unknown) and the 503 body is a centered nginx-style · HTML page with a "Restore access" button. The bare URL keeps serving · the generic page so older module versions still work.
nginx-mod-1.30.2-50.sles16.gps.aarch64	997 KiB	2026-05-31	Danila Vershinin - gps_license: bump to 1.2.0. Operator-facing 503s now point at · /nginx-license-token/ on getpagespeed.com (revoked / missing / · expired / invalid / unknown) and the 503 body is a centered nginx-style · HTML page with a "Restore access" button. The bare URL keeps serving · the generic page so older module versions still work.
nginx-mod-1.30.2-49.sles16.gps.aarch64	996 KiB	2026-05-23	Danila Vershinin - Bundle nginx-gps SELinux policy: allow outbound HTTPS from httpd_t · (license reporting + future integrations) and bind UDP 443 for HTTP/3. · Paired with `semanage port -a -t http_port_t -p udp 443` in %post for · EL <= 9 where the UDP label is missing.