morsalin1342/nginx repository overview

⁠nginx — Production-Ready Web Server with Essential Modules

Maintained by morsalin1342⁠ · GitHub⁠

Official nginx plus ModSecurity 3, Brotli, Zstandard, headers-more, GeoIP2 and VTS, built as dynamic modules. The image is the official nginx image — the modules are compiled separately and loaded into the stock binary, so nginx's own security updates arrive on nginx's schedule, not this repository's.

⁠✨ Why This Image?

⁠Quick Start

docker run -d --name nginx \
    -p 80:80 -p 443:443 \
    -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro \
    morsalin1342/nginx:latest

The modules are loaded and every one of them does nothing until you configure it. Drop-in replacement for nginx:<version> until you use one.

⁠What's Included

Already in official nginx and therefore not duplicated here: rate limiting (limit_req), connection limiting, real_ip, HTTP/2, HTTP/3, gzip, sub_filter, secure_link, auth_request, map, geo.

⁠ModSecurity

The OWASP Core Rule Set ships at /etc/nginx/modsecurity/ and nothing loads it. That is deliberate: CRS in blocking mode has a real false-positive cost against application admin panels, and the exclusions are site-specific. Enabling it, and choosing detection or blocking, is yours.

# /etc/nginx/nginx.conf
load_module modules/ngx_http_modsecurity_module.so;   # already loaded by default

http {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity/main.conf;
}

Where main.conf includes modsecurity.conf, crs-setup.conf and rules/*.conf. Start in DetectionOnly and read your logs before blocking anything.

modsecurity defaults to off in the connector itself, so the module being loaded changes nothing until you say otherwise.

The connector also provides modsecurity_rules_file, modsecurity_rules_remote, modsecurity_rules, modsecurity_use_error_log and modsecurity_transaction_id. The last is worth knowing: paired with $request_id in your log_format, it lets you correlate an access log line with the error log entry the WAF wrote for the same request.

⁠Available Tags

<nginx-version> and latest. The tag names the upstream nginx release the image is built on, and is republished when this repository's Dockerfile changes — a module bump or a CRS update can land under an unchanged nginx version. Pin by digest if you need immutability.

⁠Verifying the Build

docker run --rm morsalin1342/nginx:latest nginx -V
docker run --rm morsalin1342/nginx:latest nginx -t

Every published image runs nginx -t with every module loaded at build time, so a module built against a mismatched nginx fails the build rather than a running server.

⁠❓ FAQ

Q: Why does nothing happen after I pull it? A: Every module is loaded and every one does nothing until configured. Until you write a directive this is a drop-in replacement for nginx:<version>.

Q: I replaced nginx.conf and the modules vanished. A: load_module is only valid in the main context. Keep include /etc/nginx/modules-enabled/*.conf; at the top of your file, or mount into conf.d/ instead.

Q: GeoIP2 returns my default for everything. A: No database ships with the image — MaxMind requires an account. Mount a .mmdb and point geoip2 at it.

⁠🔗 Related Images & Tools

⭐ If this image helps you, consider giving it a star on GitHub⁠!