Ticket #1641: build_nginx.sh

#!/bin/bash -e

# sudo apt-get install build-essential zlib1g-dev libpcre3-dev uuid-dev

set -x

export NUM_JOBS="$(($(nproc) * 2))"
export SRC_DIR=${HOME}/src

NAME=nginx
VERSION=1.15.3
URL=https://nginx.org/download/nginx-${VERSION}.tar.gz

NAME=${NAME}-${VERSION}
SOURCE_DIR=${SRC_DIR}/${NAME}
BUILD_DIR=${SOURCE_DIR}
ARCHIVE_FILE=${NAME}.tar.gz
URL=https://nginx.org/download/${ARCHIVE_FILE}

OPENSSL_VERSION=1.1.1
OPENSSL_SOURCE_DIR=${SOURCE_DIR}/openssl-${OPENSSL_VERSION}
OPENSSL_ARCHIVE_FILE=openssl-${OPENSSL_VERSION}.tar.gz
OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_ARCHIVE_FILE}

pushd ${SRC_DIR}
    if [ ! -f ${ARCHIVE_FILE} ]; then
        wget ${URL}
    fi

    if [ ! -d ${SOURCE_DIR} ]; then
        tar xvf ${ARCHIVE_FILE}

        pushd ${SOURCE_DIR}
            # Remove nginx name and version info from headers and pages
            sed -i -e 's/static u_char ngx_http_server_string\[\] = "Server: nginx" CRLF;/static u_char ngx_http_server_string[] = "" CRLF;/g' src/http/ngx_http_header_filter_module.c
            sed -i -e 's/static u_char ngx_http_server_full_string\[\] = "Server: " NGINX_VER CRLF;/static u_char ngx_http_server_full_string[] = "" CRLF;/g' src/http/ngx_http_header_filter_module.c
            sed -i -e 's/static u_char ngx_http_server_build_string\[\] = "Server: " NGINX_VER_BUILD CRLF;/static u_char ngx_http_server_build_string[] = "" CRLF;/g' src/http/ngx_http_header_filter_module.c

            URL_BROTLI=https://github.com/google/ngx_brotli
            URL_ECHO=https://github.com/openresty/echo-nginx-module
            URL_CACHE_PURGE=https://github.com/FRiCKLE/ngx_cache_purge
            URL_HEADERS_MORE=https://github.com/openresty/headers-more-nginx-module

            git clone --recursive --depth 1 ${URL_BROTLI} ngx_brotli
            git clone --recursive --depth 1 ${URL_ECHO} ngx_echo
            git clone --recursive --depth 1 ${URL_CACHE_PURGE} ngx_cache_purge
            git clone --recursive --depth 1 ${URL_HEADERS_MORE} ngx_headers_more

            if [ ! -f ${OPENSSL_ARCHIVE_FILE} ]; then
                wget ${OPENSSL_URL}
            fi

            if [ ! -d ${OPENSSL_SOURCE_DIR} ]; then
                tar xvf ${OPENSSL_ARCHIVE_FILE}
            fi
        popd
    fi
popd

mkdir -p ${BUILD_DIR}
pushd ${BUILD_DIR}/


export CFLAGS='-O2 -flto -march=native -fomit-frame-pointer -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2'
export LDFLAGS='-fPIE -pie -flto -Wl,-flto -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now'

# Use gold-enabled binutils for flto
export AR=gcc-ar
export RANLIB=gcc-ranlib
export NM=gcc-nm


${SOURCE_DIR}/configure \
--prefix=/usr/share/nginx \
--sbin-path=/usr/sbin/nginx \
--pid-path=/run/nginx.pid \
--conf-path=/etc/nginx/nginx.conf \
--lock-path=/var/lock/nginx.lock \
--modules-path=/usr/lib/nginx/modules \
--http-log-path=/var/log/nginx/access.log \
--error-log-path=/var/log/nginx/error.log \
--build=Ubuntu \
--http-client-body-temp-path=/var/lib/nginx/body \
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/proxy \
--http-scgi-temp-path=/var/lib/nginx/scgi \
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
--group=www-data \
--user=www-data \
--add-module=${SOURCE_DIR}/ngx_brotli \
--add-module=${SOURCE_DIR}/ngx_echo \
--add-module=${SOURCE_DIR}/ngx_cache_purge \
--add-module=${SOURCE_DIR}/ngx_headers_more \
--with-compat \
--with-file-aio \
--with-threads \
--with-stream \
--with-openssl=${OPENSSL_SOURCE_DIR} \
--with-openssl-opt=enable-tls1_3 \
--with-http_auth_request_module \
--with-http_degradation_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_realip_module \
--with-http_secure_link_module \
--with-http_slice_module \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-http_sub_module \
--with-http_v2_module \
--with-mail_ssl_module \
--with-stream \
--with-stream_realip_module \
--with-stream_ssl_module \
--with-stream_ssl_preread_module \
--without-http_auth_basic_module \
--without-http_autoindex_module \
--without-http_browser_module \
--without-http_empty_gif_module \
--without-http_geo_module \
--without-http_memcached_module \
--without-http_scgi_module \
--without-http_split_clients_module \
--without-http_ssi_module \
--without-http_userid_module \
--without-http_uwsgi_module \
--with-cc-opt="${CFLAGS}" \
--with-ld-opt="${LDFLAGS}"


make -j ${NUM_JOBS}
sudo make -j ${NUM_JOBS} install

popd