awesome-nginx
Curated list of production-grade NGINX modules, tools, distributions and learning resources, by GetPageSpeed.
https://github.com/getpagespeed/awesome-nginx
Last synced: 6 days ago
JSON representation
-
Authentication
- auth-pam - PAM authentication dynamic module for NGINX. 📦
- nginx-auth-ldap - LDAP Authentication module for NGINX. 📦
- nginx-http-auth-digest - Digest Authentication for NGINX. 📦
- nginx-http-auth-totp - Time-based one-time password (TOTP) HTTP authentication for NGINX. 📦
- nginx-http-shibboleth - Shibboleth auth-request module for SAML SSO. 📦
- nginx-jwt-module - Check for a valid JWT and proxy to upstream (max-lt/nginx-jwt-module). 📦
- nginx-ntlm-module - NTLM NGINX Module. 📦
- nginx-secure-token-module - Generates CDN tokens (cookie or query-string) for signed URL delivery (by Kaltura). 📦
- nginx_phantom_token_module - Introspects phantom access tokens per RFC 7662 and forwards a JWT to the upstream. 📦
- ngx-http-auth-jwt-module - JWT validation module (TeslaGov fork). 📦
- ngx_aws_auth - Proxy to authenticated AWS services (S3 and friends). 📦
- ngx_http_auth_hash_module - Secure link hash authentication. 📦
- ngx_http_auth_radius_module - HTTP authentication via RADIUS protocol. 📦
- ngx_http_hmac_secure_link_module - HMAC secure link module with OpenSSL hashes (alternative to the core ngx_http_secure_link). 📦
- pta - Period-of-Time Authentication, restricts access to a window in time. 📦
- spnego-http-auth - SPNEGO/Kerberos HTTP authentication. 📦
-
Bot mitigation
- nginx-length-hiding-filter-module - Appends a random-length string to HTML responses to defeat BREACH/CRIME-class attacks. 📦
- ngx_bot_verifier - Verifies good-bot identity by reverse-DNS (Googlebot, Bingbot and friends). 📦
- ngx_cookie_limit_req_module - Limits request rate per malicious forged cookie. 📦
- ngx_http_captcha_module - Native CAPTCHA generation and validation in NGINX. 📦
- ngx_http_js_challenge_module - Proof-of-work JavaScript challenge for anti-DDoS, similar to Cloudflare's. 📦
- testcookie-nginx-module - Cookie-based challenge/response for low-effort bot mitigation. 📦
-
Caching and compression
- cache-purge - Purge content from FastCGI, proxy, SCGI and uWSGI caches by URL. 📦
- ngx_brotli - Brotli compression module (GetPageSpeed fork of google/ngx_brotli with regular releases). 📦
- compression-vary - Enhanced Vary header handling for compression, emits the right Vary without duplicates. 📦
- immutable - Marks public assets with Cache-Control: immutable so browsers stop revalidating fingerprinted files. 📦
- ngx_dynamic_etag - Adds correct ETag headers to dynamic responses, enabling 304s on proxied content. 📦
- ngx_http_compression_normalize_module - Parses and normalizes the Accept-Encoding header so caches see one canonical form. 📦
- ngx_http_unzstd_filter_module - Decompresses Zstd-encoded upstream responses for clients that don't support Zstd. 📦
- ngx_slowfs_cache - Caches static files served from slow filesystems. 📦
- ngx_unbrotli - Decompresses Brotli-encoded upstream responses for clients that don't support Brotli. 📦
- sorted-args - Normalizes query-string parameter order to dramatically improve cache hit rates. 📦
- srcache-nginx-module - Transparent subrequest-based caching for arbitrary NGINX locations. 📦
- zstd-nginx-module - Zstandard compression module for NGINX (by tokers). 📦
-
Configuration and tooling
- gixy - Static analyzer that catches alias-traversal, SSRF, host-header attacks and other NGINX config footguns.
- crossplane - Convert NGINX configs to and from JSON, fork of the NGINX Amplify tool with fixes.
- gixy-jetbrains - JetBrains IDE plugin surfacing gixy findings inline.
- Mozilla SSL Configuration Generator - Mozilla-maintained generator for the TLS / cipher configuration block.
- nginx-honeypot - Run an NGINX honeypot to capture and study attacker behaviour.
- nginxconfig.io - Online NGINX config generator with sensible TLS, performance and security defaults.
- nginxpwner - Look for common NGINX misconfigurations and exploitable patterns.
- ngxtop - Real-time NGINX top, like `top` for your traffic.
- off-by-slash - Detect alias-traversal misconfigurations (the trailing-slash class of bugs).
-
Distributions and forks
- nginx - Official NGINX source repository, mirrored from the canonical Mercurial.
- angie - Modern NGINX fork by ex-NGINX core engineers, adds ACME, HTTP/3, observability.
- freenginx - Community fork of NGINX maintained by long-time NGINX core developer Maxim Dounin.
- openresty - Dynamic web platform based on NGINX and LuaJIT, bundling many modules out of the box.
- tengine - Alibaba's NGINX fork with dynamic upstream, request-trace and additional optimisations.
-
Documentation and learning
- nginx-extras.getpagespeed.com - Reference docs for every packaged NGINX module: installation, directives, examples.
- awesome-nginx - Long-running broad awesome-list of NGINX projects.
- awesome-nginx-security - Awesome list scoped to NGINX security: talks, WAFs, configuration analyzers.
- GetPageSpeed blog - Deep dives on NGINX tuning, modules and packaging from the engineering team behind this list.
- h5bp/server-configs-nginx - Boilerplate server configs (cache headers, MIME types, security headers) from HTML5 Boilerplate.
- nginx-admins-handbook - Exhaustive admin handbook covering performance, security, hardening and debugging.
- nginx-resources - Curated collection of NGINX articles, books and tutorials.
- nginx-tuning - Tuning cheat-sheet for high-traffic NGINX deployments.
- nginx101.com - Practical NGINX articles for the long tail of operator questions.
- Official NGINX documentation - The authoritative directive and module reference.
-
Headers, cookies and response filters
- headers-more-nginx-module - Set, add and clear arbitrary input and output headers, far more capable than ngx_headers. 📦
- cookie-flag - Sets HttpOnly, Secure and SameSite flags on cookies set by upstream. 📦
- device-type - Comprehensive device detection at the NGINX edge, classifies requests by device class. 📦
- internal-redirect - Performs an internal redirect to a specified URI without a client round-trip. 📦
- nginx-http-concat - Concatenates CSS and JS files referenced via ?<file>,<file>,..., Alibaba pattern. 📦
- nginx_accept_language_module - Parses Accept-Language and picks the best supported locale into a variable. 📦
- ngx-fancyindex - Fancy autoindex listings (HTML5, sortable, themeable) replacing the bare-bones core directory listing. 📦
- ngx_http_loop_detect_module - Honours the CDN-Loop header to break runaway proxy loops. 📦
- ngx_http_request_cookies_filter_module - Fine-grained control over which cookies reach the upstream. 📦
- ngx_http_rewrite_status_filter_module - Rewrite the response status code (turn 502 into 503 and friends). 📦
- ngx_http_server_redirect_module - Redirect the server_name within the same request. 📦
- ngx_http_substitutions_filter_module - Regex and fixed-string substitutions in response bodies. 📦
- ngx_http_trim_filter_module - Whitespace and comment trimming filter for HTML, CSS and JS responses. 📦
- xss-nginx-module - Native cross-site AJAX (JSONP) support without going through Lua. 📦
-
Honourable mentions
- nginx-ct - Certificate Transparency support, embeds SCTs into TLS handshakes (175★).
- nginx-gridfs - Serve files directly from MongoDB GridFS (792★).
- nginx-haskell-module - Embed Haskell handlers, asynchronous tasks and services into NGINX (161★).
- nginx-http-user-agent - Match browsers and crawlers by User-Agent, Alibaba's pattern (162★).
- nginx-python-module - Embed Python into NGINX request handling (139★).
- nginx-ssl-fingerprint - High-performance JA3 and HTTP/2 fingerprinting (198★).
- nginx-ssl-ja3 - TLS JA3 fingerprinting for bot and abuse detection (216★).
- nginx-video-thumbextractor-module - Extract thumbnails from video files on the fly (208★).
- nginx_upstream_module - Native Tarantool upstream (REST, JSON, WebSockets, load balancing) (173★).
- ngx-php - Embedded PHP 7/8 scripting inside an NGINX module (693★).
- ngx_dynamic_upstream - Add, remove and modify upstream servers without reloading NGINX (515★).
- ngx_healthcheck_module - Active healthchecks for upstream servers in both http and stream contexts (282★).
- ngx_http_consul_backend_module - Set upstream backends directly from a Consul service catalog (155★).
- ngx_kafka_module - Posts request bodies to a Kafka cluster, handy for log fan-out (176★).
- ngx_wasm_module - Kong's NGINX plus WebAssembly runtime (126★).
- socks-nginx-module - Adds SOCKS5 support to ngx_http_proxy_module (201★).
- wasm-nginx-module - Run WebAssembly modules inside OpenResty / NGINX (alternative to wasmtime) (200★).
-
Logging and observability
- GetPageSpeed Amplify - Hosted NGINX monitoring with built-in continuous gixy scanning; drop-in compatible with the deprecated `nginx-amplify-agent`.
- nginx-module-vts - Virtual-host traffic status module, Prometheus / JSON / HTML real-time stats. 📦
- graphite-nginx-module - Send per-location stats directly to Graphite. 📦
- log-zmq - Stream access logs over ZeroMQ for centralized collection. 📦
- nginx-module-stream-sts - Stream server traffic status core module (companion to sts). 📦
- nginx-module-sts - Stream server traffic status, same idea as VTS but for the stream {} block. 📦
- nginx-statsd - Send NGINX metrics to a StatsD collector. 📦
- ngx-sqlite-log - SQLite-backed access log, queryable logs without a separate pipeline. 📦
- ngx_http_error_log_write_module - Conditionally emit error-log entries from configuration. 📦
- ngx_http_log_var_set_module - Set NGINX variables right before the access log writes, late-stage log enrichment. 📦
- ngx_http_pipelog_module - Pipe access logs to an external program (analytics, alerting, archival). 📦
- ngx_http_upstream_log_module - Writes upstream-side request logs separate from the client-side access log. 📦
- traffic-accounting-nginx-module - Real-time incoming/outgoing traffic counters per zone. 📦
-
Lua and OpenResty ecosystem
- lua-nginx-module - Embed the power of LuaJIT into NGINX's HTTP request lifecycle. 📦
- array-var-nginx-module - Array-typed variables for the OpenResty stack. 📦
- echo-nginx-module - Echo, sleep, time and exec directives for the content phase. 📦
- encrypted-session-nginx-module - Encrypt and decrypt NGINX variable values, for sessionless session cookies. 📦
- lua-upstream-nginx-module - Lua API for controlling NGINX upstreams at runtime. 📦
- memc-nginx-module - Extended memcached upstream module (full memcached command set, not just GET). 📦
- nginx-eval-module - Evaluate memcached or proxy response into a variable. 📦
- ngx_devel_kit - Nginx Devel Kit, generic toolkit that many third-party modules depend on. 📦
- ngx_wasm_module - Proxy-Wasm (WebAssembly) support for NGINX, powered by wasmtime. 📦
- njs - Official JavaScript scripting in NGINX (subset of ES5 + extensions). 📦
- redis2-nginx-module - Native upstream for the Redis 2.0+ protocol, full pipelining. 📦
- set-misc-nginx-module - Provides set_xxx directives (md5, sha1, base64, hex, escape, quote) for the rewrite phase. 📦
- stream-lua-nginx-module - Embed LuaJIT into NGINX's stream {} (TCP/UDP) processing. 📦
-
Networking and protocols
- nginx-cgi - Run classic CGI scripts under NGINX. 📦
- nginx-dav-ext-module - Adds PROPFIND, OPTIONS, LOCK and UNLOCK to NGINX's core WebDAV. 📦
- Nginx-DOH-Module - Serve DNS-over-HTTPS responses straight from NGINX. 📦
- nginx_ajp_module - Apache AJP13 protocol upstream (talk to Tomcat / JBoss natively). 📦
- ngx_coolkit - Collection of small NGINX utilities, encoding, time helpers, IP utilities. 📦
- ngx_http_geoip2_module - MaxMind GeoIP2 lookups into NGINX variables. 📦
- ngx_http_proxy_connect_module - Adds HTTP CONNECT (forward-proxy) support to NGINX. 📦
- rdns - Reverse-DNS lookup of the client IP into NGINX variables. 📦
-
Packaging and distribution
- extras.getpagespeed.com - Production-grade RPM and DEB repository with 130+ NGINX modules across all major distributions.
- docker-nginx - Official NGINX Docker images.
- lastversion - Find and download the latest release of any project on GitHub / GitLab / SourceForge / PyPI / Hg / official sites.
- nginx.org Linux packages - Official NGINX binary packages for Debian, Ubuntu, RHEL/CentOS, Amazon Linux, SLES.
-
Performance and optimization
- incubator-pagespeed-ngx - Apache mod_pagespeed for NGINX, automatic CSS/JS/image optimization at the edge. 📦
- nginx-link-function - Dlopen application code straight into NGINX request handling for ultra-low-latency endpoints. 📦
- nginx-sxg-module - Signed HTTP Exchange (SXG) support, prefetch with original-origin attribution. 📦
- passenger - Phusion Passenger application server module, runs Ruby/Python/Node apps inside NGINX. 📦
- tuning - Observes real traffic patterns and proposes data-driven NGINX tuning. 📦
-
Security and WAF
- nginx-acme - Automatic certificate management (ACMEv2) module for NGINX, by F5/NGINX Inc. 📦
- ModSecurity-nginx - ModSecurity v3 connector for NGINX. 📦
- naxsi - Open-source positive-model WAF for NGINX. 📦
- ngx_security_headers - Sends modern security headers (CSP, X-Frame-Options, Referrer-Policy) and strips insecure ones. 📦
- ngx_waf - High-performance, ModSecurity-compatible WAF module for NGINX. 📦
-
Streaming, media and image processing
- nginx-rtmp-module - RTMP media streaming server based on the historical nginx-rtmp-module. 📦
- f4fhds - HTTP Dynamic Streaming (HDS) f4f fragment handler (Adobe legacy). 📦
- immerse - Modern-image-format filter: transparent WebP and AVIF delivery based on Accept. 📦
- ipscrub - Anonymizes client IP addresses in access logs (k-anonymity-style). 📦
- markdown - Renders Markdown files to HTML on the fly. 📦
- media-framework - Kaltura Media Framework shared module, HTTP API, events, persistence and Lua interop. 📦
- mod_zip - Assembles ZIP archives on the fly from a manifest of upstream URLs. 📦
- modjpeg-nginx - JPEG filter for overlays, logos and watermarks on JPEGs in flight. 📦
- nchan - Scalable pub/sub server inside NGINX: HTTP, WebSocket, Server-Sent Events and long-polling. 📦
- nginx-http-flv-module - HTTP-FLV streaming on top of nginx-rtmp-module. 📦
- nginx-push-stream-module - HTTP push (Comet, EventSource, long-polling, WebSocket) as a pure-NGINX pub/sub stream. 📦
- nginx-srt-module - Haivision SRT (Secure Reliable Transport) TCP gateway module. 📦
- nginx-ts-module - MPEG-TS live streaming module. 📦
- nginx-vod-module - On-the-fly MP4 repackager to DASH, HDS, HLS and MSS (by Kaltura). 📦
- ngx_http_html_sanitize_module - HTML5 sanitizer based on Google Gumbo, whitelisted elements, attributes and CSS. 📦
- ngx_http_untar_module - Serves file content directly out of tar archives. 📦
- ngx_small_light - Dynamic image transformation (resize, crop, rotate, watermark). 📦
- ngx_webp - On-the-fly WebP conversion of JPEG and PNG responses. 📦
-
Upstreams, rate limiting and access control
- ipset-access - Zero-latency IP allow/deny using Linux kernel ipsets. 📦
- nftset-access - Zero-latency IP allow/deny using Linux kernel nftables sets. 📦
- nginx-combined-upstreams-module - Adds add_upstream and combine_server_singlets directives for upstream composition. 📦
- nginx-module-sysguard - Sheds load when system CPU, memory or RT exceeds thresholds. 📦
- nginx-sticky-module-ng - Sticky-cookie session affinity load balancer. 📦
- nginx-stream-upsync-module - Sync stream {} upstreams from Consul or etcd. 📦
- nginx-upload-module - Streams multipart/form-data uploads straight to disk before passing metadata upstream. 📦
- nginx-upload-progress-module - Real-time upload progress tracking for browser UIs. 📦
- nginx-upstream-fair - Fair load-balancer based on number of in-flight requests per backend. 📦
- nginx-upsync-module - Sync HTTP upstreams from Consul or etcd without reloading NGINX. 📦
- ngx_dynamic_limit_req_module - Dynamically locks an IP after threshold and releases it after a configurable window. 📦
- ngx_http_access_control_module - Advanced access control by NGINX variables (beyond allow / deny by IP). 📦
- ngx_http_delay_module - Insert a configurable delay before responding, useful for shaping or tarpitting. 📦
- ngx_http_limit_traffic_ratefilter_module - Rate-limit traffic by arbitrary NGINX variables (e.g. per token, per geo). 📦
- ngx_upstream_jdomain - Async DNS resolution for upstream backends, survives DNS-only backends. 📦
- rate-limit-nginx-module - Redis-backed cluster-wide rate limiting. 📦
-
Variables, JSON and extensibility
- form-input-nginx-module - Parses application/x-www-form-urlencoded request bodies into variables. 📦
- iconv-nginx-module - Character-set conversion of request and response bodies via libiconv. 📦
- nginx-json-var-module - Group variable expressions as a JSON value for clean logging. 📦
- nginx-keyval - Key-value store backed module, variables sourced from disk-backed KV pairs. 📦
- nginx-let-module - Arithmetic and string expressions in the rewrite phase. 📦
- ngx_http_json_module - Dumps a $json variable into a string. 📦
- ngx_http_label_module - Define global key-value labels for dynamic configuration. 📦
- ngx_http_var_module - Dynamically assign variables via predefined functions (math, string, hash). 📦
- ngx_postgres - Direct PostgreSQL upstream, no PHP / app layer needed for read-heavy paths. 📦
Categories
Streaming, media and image processing
18
Honourable mentions
17
Upstreams, rate limiting and access control
16
Authentication
16
Headers, cookies and response filters
14
Lua and OpenResty ecosystem
13
Logging and observability
13
Caching and compression
12
Documentation and learning
10
Variables, JSON and extensibility
9
Configuration and tooling
9
Networking and protocols
8
Bot mitigation
6
Performance and optimization
5
Distributions and forks
5
Security and WAF
5
Packaging and distribution
4
Sub Categories
Keywords
nginx
53
nginx-module
13
c
10
security
9
http
5
nginx-configuration
5
module
4
nginx-server
3
web
3
upstream
3
monitoring
3
vozlt-nginx-modules
3
http3
3
quic
3
load-balancer
3
tls
3
openresty
3
waf
3
https
3
modsecurity
3
best-practices
3
awesome-list
3
reverse-proxy
2
http2
2
rtmp
2
modsecurity-nginx
2
live
2
captcha
2
python
2
authentication
2
jwt
2
wasm
2
awesome
2
video
2
video-streaming
2
nginx-proxy
2
hls
2
drm
2
ssl
2
ja3
2
fingerprint
2
dash
2
tengine
2
nginx-stream-traffic-status
2
server
2
livestream
1
resolver
1
recaptcha
1
nginx-modules
1
mp4
1