Nginx to 1.27.4, NJS to 0.8.10, and switching to use the quictls repo as the old one is now archived

Author: justdan6

Dockerfile

@@ -1,14 +1,14 @@
 # https://github.com/nginx/nginx/blob/master/src/core/nginx.h
-ARG NGINX_VERSION=1.27.3
+ARG NGINX_VERSION=1.27.4
 
 # https://github.com/google/ngx_brotli
 ARG NGX_BROTLI_COMMIT=6e975bcb015f62e1f303054897783355e2a877dc
 
-# https://github.com/quictls/openssl
-ARG QUICTLS_BRANCH=openssl-3.3.0+quic
+# https://github.com/quictls/quictls
+ARG QUICTLS_TAG=openssl-3.3.0
 
 # https://github.com/nginx/njs
-ARG NJS_VERSION=0.8.6
+ARG NJS_VERSION=0.8.10
 
 # https://github.com/openresty/headers-more-nginx-module#installation
 # we want to have https://github.com/openresty/headers-more-nginx-module/commit/e536bc595d8b490dbc9cf5999ec48fca3f488632
@@ -19,59 +19,59 @@ ARG GEOIP2_VERSION=3.4
 
 # https://nginx.org/en/docs/http/ngx_http_v3_module.html
 ARG CONFIG="\
-		--build=quic-$NGINX_COMMIT-quictls-$QUICTLS_BRANCH \
-		--prefix=/etc/nginx \
-		--sbin-path=/usr/sbin/nginx \
-		--modules-path=/usr/lib/nginx/modules \
-		--conf-path=/etc/nginx/nginx.conf \
-		--error-log-path=/var/log/nginx/error.log \
-		--http-log-path=/var/log/nginx/access.log \
-		--pid-path=/var/run/nginx.pid \
-		--lock-path=/var/run/nginx.lock \
-		--http-client-body-temp-path=/var/cache/nginx/client_temp \
-		--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
-		--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
-		--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
-		--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
-		--user=nginx \
-		--group=nginx \
-		--with-http_ssl_module \
-		--with-http_realip_module \
-		--with-http_addition_module \
-		--with-http_sub_module \
-		--with-http_dav_module \
-		--with-http_flv_module \
-		--with-http_mp4_module \
-		--with-http_gunzip_module \
-		--with-http_gzip_static_module \
-		--with-http_random_index_module \
-		--with-http_secure_link_module \
-		--with-http_stub_status_module \
-		--with-http_auth_request_module \
-		--with-http_xslt_module=dynamic \
-		--with-http_image_filter_module=dynamic \
-		--with-http_geoip_module=dynamic \
-		--with-http_perl_module=dynamic \
-		--with-threads \
-		--with-stream \
-		--with-stream_ssl_module \
-		--with-stream_ssl_preread_module \
-		--with-stream_realip_module \
-		--with-stream_geoip_module=dynamic \
-		--with-http_slice_module \
-		--with-mail \
-		--with-mail_ssl_module \
-		--with-compat \
-		--with-file-aio \
-		--with-http_v2_module \
-		--with-http_v3_module \
-		--add-module=/usr/src/ngx_brotli \
-		--add-module=/usr/src/headers-more-nginx-module-$HEADERS_MORE_VERSION \
-		--add-module=/usr/src/njs/nginx \
-		--add-dynamic-module=/usr/src/ngx_http_geoip2_module \
+	--build=quic-$NGINX_COMMIT-quictls-$QUICTLS_TAG \
+	--prefix=/etc/nginx \
+	--sbin-path=/usr/sbin/nginx \
+	--modules-path=/usr/lib/nginx/modules \
+	--conf-path=/etc/nginx/nginx.conf \
+	--error-log-path=/var/log/nginx/error.log \
+	--http-log-path=/var/log/nginx/access.log \
+	--pid-path=/var/run/nginx.pid \
+	--lock-path=/var/run/nginx.lock \
+	--http-client-body-temp-path=/var/cache/nginx/client_temp \
+	--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
+	--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
+	--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
+	--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
+	--user=nginx \
+	--group=nginx \
+	--with-http_ssl_module \
+	--with-http_realip_module \
+	--with-http_addition_module \
+	--with-http_sub_module \
+	--with-http_dav_module \
+	--with-http_flv_module \
+	--with-http_mp4_module \
+	--with-http_gunzip_module \
+	--with-http_gzip_static_module \
+	--with-http_random_index_module \
+	--with-http_secure_link_module \
+	--with-http_stub_status_module \
+	--with-http_auth_request_module \
+	--with-http_xslt_module=dynamic \
+	--with-http_image_filter_module=dynamic \
+	--with-http_geoip_module=dynamic \
+	--with-http_perl_module=dynamic \
+	--with-threads \
+	--with-stream \
+	--with-stream_ssl_module \
+	--with-stream_ssl_preread_module \
+	--with-stream_realip_module \
+	--with-stream_geoip_module=dynamic \
+	--with-http_slice_module \
+	--with-mail \
+	--with-mail_ssl_module \
+	--with-compat \
+	--with-file-aio \
+	--with-http_v2_module \
+	--with-http_v3_module \
+	--add-module=/usr/src/ngx_brotli \
+	--add-module=/usr/src/headers-more-nginx-module-$HEADERS_MORE_VERSION \
+	--add-module=/usr/src/njs/nginx \
+	--add-dynamic-module=/usr/src/ngx_http_geoip2_module \
 	"
 
-FROM alpine:3.20 AS base
+FROM alpine:3.21 AS base
 
 ARG NGINX_VERSION
 ARG NGINX_COMMIT
@@ -83,32 +83,32 @@ ARG CONFIG
 
 RUN \
 	apk add --no-cache --virtual .build-deps \
-		gcc \
-		libc-dev \
-		make \
-		musl-dev \
-		go \
-		ninja \
-		openssl-dev \
-		pcre-dev \
-		zlib-dev \
-		linux-headers \
-		gnupg \
-		libxslt-dev \
-		gd-dev \
-		geoip-dev \
-		perl-dev \
+	gcc \
+	libc-dev \
+	make \
+	musl-dev \
+	go \
+	ninja \
+	openssl-dev \
+	pcre-dev \
+	zlib-dev \
+	linux-headers \
+	gnupg \
+	libxslt-dev \
+	gd-dev \
+	geoip-dev \
+	perl-dev \
 	&& apk add --no-cache --virtual .brotli-build-deps \
-		autoconf \
-		libtool \
-		automake \
-		git \
-		g++ \
-		cmake \
+	autoconf \
+	libtool \
+	automake \
+	git \
+	g++ \
+	cmake \
 	&& apk add --no-cache --virtual .geoip2-build-deps \
-		libmaxminddb-dev \
+	libmaxminddb-dev \
 	&& apk add --no-cache --virtual .njs-build-deps \
-		readline-dev
+	readline-dev
 
 WORKDIR /usr/src/
 
@@ -128,36 +128,36 @@ RUN \
 
 # hadolint ignore=SC2086
 RUN \
-  echo "Cloning QuicTLS ..." \
-  && cd /usr/src \
-  && git clone https://github.com/quictls/openssl.git \
-  && cd openssl \
-  && git checkout $QUICTLS_BRANCH
+	echo "Cloning QuicTLS ..." \
+	&& cd /usr/src \
+	&& git clone https://github.com/quictls/quictls.git openssl \
+	&& cd openssl \
+	&& git checkout $QUICTLS_TAG
 
 RUN \
-  echo "Downloading headers-more-nginx-module ..." \
-  && cd /usr/src \
-  && wget -q https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v${HEADERS_MORE_VERSION}.tar.gz -O headers-more-nginx-module.tar.gz \
-  && tar -xf headers-more-nginx-module.tar.gz
+	echo "Downloading headers-more-nginx-module ..." \
+	&& cd /usr/src \
+	&& wget -q https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v${HEADERS_MORE_VERSION}.tar.gz -O headers-more-nginx-module.tar.gz \
+	&& tar -xf headers-more-nginx-module.tar.gz
 
 RUN \
-  echo "Downloading ngx_http_geoip2_module ..." \
-  && git clone --depth 1 --branch ${GEOIP2_VERSION} https://github.com/leev/ngx_http_geoip2_module /usr/src/ngx_http_geoip2_module
+	echo "Downloading ngx_http_geoip2_module ..." \
+	&& git clone --depth 1 --branch ${GEOIP2_VERSION} https://github.com/leev/ngx_http_geoip2_module /usr/src/ngx_http_geoip2_module
 
 RUN \
-  echo "Cloning and configuring njs ..." \
-  && git clone --depth 1 --branch ${NJS_VERSION} https://github.com/nginx/njs.git /usr/src/njs \ 
-  && cd /usr/src/njs \
-  && ./configure \
-  && make njs \
-  && mv /usr/src/njs/build/njs /usr/sbin/njs \
-  && echo "njs v$(njs -v)"
+	echo "Cloning and configuring njs ..." \
+	&& git clone --depth 1 --branch ${NJS_VERSION} https://github.com/nginx/njs.git /usr/src/njs \ 
+	&& cd /usr/src/njs \
+	&& ./configure \
+	&& make njs \
+	&& mv /usr/src/njs/build/njs /usr/sbin/njs \
+	&& echo "njs v$(njs -v)"
 
 RUN \
-  echo "Building nginx ..." \
+	echo "Building nginx ..." \
 	&& cd /usr/src/nginx-$NGINX_VERSION \
 	&& ./auto/configure $CONFIG \
-	  --with-openssl="../openssl" \
+	--with-openssl="../openssl" \
 	&& make -j"$(getconf _NPROCESSORS_ONLN)"
 
 RUN \
@@ -179,12 +179,12 @@ RUN \
 	&& apk add --no-cache --virtual .gettext gettext \
 	\
 	&& scanelf --needed --nobanner /usr/sbin/nginx /usr/sbin/njs /usr/lib/nginx/modules/*.so /usr/bin/envsubst \
-			| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
-			| sort -u \
-			| xargs -r apk info --installed \
-			| sort -u > /tmp/runDeps.txt
+	| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
+	| sort -u \
+	| xargs -r apk info --installed \
+	| sort -u > /tmp/runDeps.txt
 
-FROM alpine:3.20
+FROM alpine:3.21
 ARG NGINX_VERSION
 ARG NGINX_COMMIT