nginx-modules / docker-nginx-boringssl

NGINX Docker built top of rolling release BoringSSL (SIMD x86_64-v4/aarch64/armv7)

NGINX built with BoringSSL & TLSv1.3

Docker image

Supported tags and respective Dockerfile links

• Stable Release

  • docker.io/denji/nginx-boringssl:stable-alpine - (Linux x86_64-v4)
  • docker.io/denji/nginx-boringssl:stable-aarch64-alpine - (Linux AArch64 - ARMv8)
  • docker.io/denji/nginx-boringssl:stable-armv7-alpine - (Linux ARMv7 - 32-bit)

• Mainline Release

  • docker.io/denji/nginx-boringssl:mainline-alpine - (Linux x86_64-v4)
  • docker.io/denji/nginx-boringssl:mainline-aarch64-alpine - (Linux AArch64 - ARMv8)
  • docker.io/denji/nginx-boringssl:mainline-armv7-alpine - (Linux ARMv7 - 32-bit)

Before you can use

This project is unstable state because of the rolling release BoringSSL, and modules.

Features

• Images are used Alpine Linux.
• NGINX built BoringSSL.
• PCRE with JIT enabled.
• HTTP/2.0 (+NPN) support.
• Async I/O using threads support.
• Dynamic TLS records patch CloudFlare support (and configured).
• Gzip static .gz files support enabled
• Brotli static .br files support (and configured).
  • Brotli on-the-fly disabled (dynamic compression unstable)

Notes

• Linux 3.17+, and the latest Docker stable are recommended.
• BoringSSL is naming ECDH curves differently, some modifications will be required if you want to use your own SSL/TLS config file. For example, secp384r1 (OpenSSL, LibreSSL) is P-384 (BoringSSL). BoringSSL does support multiple curves with its implementation of SSL_CTX_set1_curves_list(), an example is provided in the default /etc/nginx/confssl_params. X25519 is actually the safest curve you can use so it should be the first curve in your list.
• BoringSSL can use cipher groups: a group is defined by brackets and ciphers are separated by | like this : [cipher1|cipher2|cipher3]. Ciphers in a group are considered equivalent on the server-side and let the client decide which cipher is the best. This can be useful when using ChaCha20, because AES remains faster than ChaCha20 on AES-NI devices.

Based on the Official NGINX Dockerfile & Wonderfall/boring-nginx

docker-nginx-boringssl's Issues

OpenSSL library not found error

checking for OpenSSL library ...not found
checking for OpenSSL library in /usr/local/ ...not found
checking for OpenSSL library in /usr/pkg/ ...not found
checking for OpenSSL library in /opt/local/ ...not found

./configure: error: SSL modules require the OpenSSL library.
You can either do not enable the modules, or install the OpenSSL library
into the system, or build the OpenSSL library statically from the source
with nginx by using --with-openssl= option.

RFC 7413 - TCP Fast Open

https://github.com/DRN88/nginx-libressl (-DTCP_FASTOPEN=23).

Capture sslkey log file for QUIC traffic

Hi @fdintino @punkeel @agile6v @denji @Wonderfall

does anyone has any idea how to capture ssl key log file to decrypt QUIC traffic.
Built nginx-quic with boringssl

Thank you

"aio_write on;"

https://nginx.org/r/aio_write

control-flow

• Code-Pointer Integrity (CPI)
• CloudABI

"--with-openssl-opt=enable-tls1_3" option is missed in the configure of nginx

More then an "issue" this is a question.
Reading the file https://github.com/nginx-modules/docker-nginx-boringssl/blob/master/mainline/alpine/Dockerfile in the parameters for configure of ngnix the --with-openssl-opt=enable-tls1_3 is missed.
Is it OK build nginx without --with-openssl-opt=enable-tls1_3?
In nginx the TLS 1.3 will works also if the option --with-openssl-opt=enable-tls1_3 is missed?

Thanks.

TLS Termination Inside Intel SGX Enclaves

https://github.com/lsds/TaLoS

Use a stable branch

Branch: chromium-stable
URL: https://boringssl.googlesource.com/boringssl

• https://boringssl.googlesource.com/boringssl/+/chromium-stable

su-exec: switch user and group id and exec

https://github.com/ncopa/su-exec

tiny but valid `init` for containers

https://github.com/krallin/tini

BoringSSL have changed the ".c" file extension to the ".cc" file extension

Hi.
BoringSSL have changed the ".c" file extension to the ".cc" file extension.
The Dockerfile files (this "https://github.com/nginx-modules/docker-nginx-boringssl/blob/master/stable/alpine/Dockerfile" and this "https://github.com/nginx-modules/docker-nginx-boringssl/blob/master/mainline/alpine/Dockerfile") should be updated in the "sed" command part because they still refer to the ".c" files and not to the new ".cc" files.
Thanks.