Package: nginx Version: 1:1.31.7-22~gps1+ubuntu2604+mainline Architecture: amd64 Maintainer: GetPageSpeed LLC Installed-Size: 3958 Depends: libc6 (>= 2.38), libcrypt1 (>= 1:4.1.0), libpcre2-8-0 (>= 10.22), openssl35-libs (>= 3.5.8), zlib1g (>= 1:1.1.4), adduser Recommends: logrotate Breaks: nginx-common, nginx-core, nginx-extras, nginx-full, nginx-light Replaces: nginx-common, nginx-core, nginx-extras, nginx-full, nginx-light Provides: httpd, nginx, nginx-abi-1.31.7-1, nginx-r1.31.7 Homepage: https://nginx.org/ Priority: optional Section: httpd Filename: pool/main/n/nginx/nginx_1.31.7-22~gps1+ubuntu2604+mainline_amd64.deb Size: 1056092 SHA512: 7bee7bacff532cee72d8ea6b271bdca0a5434ea4da6227bb3a3fde75a172c35980ea2be5b0eba047cb83fc38c081e2044fbe955db7a04f744ca381444b4b7b49 SHA256: b53083e0bab853570e6ece368ee9f4c5ec207dc7ba29dfc5c428fd743c5b8ccd SHA1: d15043e44c14f5d0dde5ac242a2c2879ccab70f3 MD5sum: 9ea4ab35ba95923f5ecb72b2d1d5c27c Description: High performance web server (GetPageSpeed build) nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. . This package provides the GetPageSpeed build of nginx with upstream-like paths, systemd units, and additional hardening. Package: nginx-common Source: nginx Version: 1:1.31.7-22~gps1+ubuntu2604+mainline Architecture: all Maintainer: GetPageSpeed LLC Installed-Size: 10 Depends: nginx Homepage: https://nginx.org/ Priority: optional Section: oldlibs Filename: pool/main/n/nginx/nginx-common_1.31.7-22~gps1+ubuntu2604+mainline_all.deb Size: 4576 SHA512: 6e3f5ff8ef59e46ab82a555a80161bcaf941437d0d423c84081fef31c20834c79ed9d3dc2adadf581c4016e7f71cee8fc22efbe9f13e72c6b4f3a6da55911638 SHA256: 5af4c6db446079bc830663b3ebe2eb9222e7823b0f5e58ab1c40278504835867 SHA1: 7c697000f450dec686bcfdb634f6c0f5f155fa8c MD5sum: 14fb44dcef14518a977e9db1eb276565 Description: transitional dummy package for nginx (GetPageSpeed) This is a transitional package. It can be safely removed after installation. Package: nginx-core Source: nginx Version: 1:1.31.7-22~gps1+ubuntu2604+mainline Architecture: all Maintainer: GetPageSpeed LLC Installed-Size: 10 Depends: nginx Homepage: https://nginx.org/ Priority: optional Section: oldlibs Filename: pool/main/n/nginx/nginx-core_1.31.7-22~gps1+ubuntu2604+mainline_all.deb Size: 4572 SHA512: 3195b850b171ffc2790b91853f3749732b159ef9abaacbddb46e303e1229655c137c52cbcb4619d0165121e0ae7fb218ab87b577f2ce123c16c6980a8a920968 SHA256: 5e1ad08165dd26b6b1c957998af5226a58002dd02327330ce39687d471b00a0c SHA1: 5d11b4eda0a705c79f917e3e00b1e57ad705b045 MD5sum: 76b5ab0d020e739fe261585cba482fa1 Description: transitional dummy package for nginx (GetPageSpeed) This is a transitional package. It can be safely removed after installation. Package: nginx-ech Source: nginx Version: 1:1.31.7-22~gps1+ubuntu2604+mainline Architecture: amd64 Maintainer: GetPageSpeed LLC Installed-Size: 50 Depends: nginx (= 1:1.31.7-22~gps1+ubuntu2604+mainline), openssl35 Homepage: https://nginx.org/ Priority: optional Section: httpd Filename: pool/main/n/nginx/nginx-ech_1.31.7-22~gps1+ubuntu2604+mainline_amd64.deb Size: 13432 SHA512: b9f5782bc81b2a4d637fd962765efbb8f81544d5174aa51156cee78ec29c9cb32f09a5bf5d6bf5fc4297131c1a464e311ed095f0495099105bb1427b1320948d SHA256: 7079b56c1a39d450d5e5a615477cb2a50bf802f28a36aa58bab68a14fe29fce8 SHA1: 1d98bfc4ff6d6eeb7d23fdf3477548f03410b358 MD5sum: 0f992a1dce5c343f02d4f4b6c5ef58ea Description: Encrypted Client Hello key management for nginx (GetPageSpeed) Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). . nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. . This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule, plus nginx-ech-publish, which republishes the rotated ECHConfigList in the HTTPS DNS record through provider drop-in scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish). . The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/default/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". Set a provider in /etc/default/nginx-ech-publish and that record is republished automatically after every rotation. . ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/