Awesome NGINX

High-performance web server, reverse proxy and load balancer powering a large share of the web.

Every entry is production-grade — actively maintained and deployed on real systems. Hobbyware, abandoned forks and proof-of-concept malware are left out by design.

• 📦 marks an entry available as an RPM and DEB package, installable in seconds on RHEL, Alma, Rocky, Amazon Linux, Fedora, Ubuntu, Debian and SLES.

Contents

• Distributions and forks
• Packaging and distribution
• Configuration and tooling
• Security and WAF
• Authentication
• Bot mitigation
• Caching and compression
• Headers, cookies and response filters
• Streaming, media and image processing
• Logging and observability
• Lua and OpenResty ecosystem
• Performance and optimization
• Upstreams, rate limiting and access control
• Variables, JSON and extensibility
• Networking and protocols
• Documentation and learning
• Honourable mentions

Distributions and forks

• nginx - Official NGINX source repository, mirrored from the canonical Mercurial.
• angie - Modern NGINX fork by ex-NGINX core engineers, adds ACME, HTTP/3, observability.
• freenginx - Community fork of NGINX maintained by long-time NGINX core developer Maxim Dounin.
• NGINX Plus - Commercial NGINX with live activity monitoring, dynamic config and JWT/SAML auth, by F5.
• openresty - Dynamic web platform based on NGINX and LuaJIT, bundling many modules out of the box.
• tengine - Alibaba's NGINX fork with dynamic upstream, request-trace and additional optimisations.

Packaging and distribution

• extras.getpagespeed.com - Production-grade RPM and DEB repository with 130+ NGINX modules across all major distributions.
• docker-nginx - Official NGINX Docker images.
• lastversion - Find and download the latest release of any project on GitHub / GitLab / SourceForge / PyPI / Hg / official sites.
• nginx.org Linux packages - Official NGINX binary packages for Debian, Ubuntu, RHEL/CentOS, Amazon Linux, SLES.

Configuration and tooling

• gixy - Static analyzer that catches alias-traversal, SSRF, host-header attacks and other NGINX config footguns.
• crossplane - Convert NGINX configs to and from JSON, fork of the NGINX Amplify tool with fixes.
• gixy-jetbrains - JetBrains IDE plugin surfacing gixy findings inline.
• Mozilla SSL Configuration Generator - Mozilla-maintained generator for the TLS / cipher configuration block.
• nginx-honeypot - Run an NGINX honeypot to capture and study attacker behaviour.
• nginxconfig.io - Online NGINX config generator with sensible TLS, performance and security defaults.
• nginxpwner - Look for common NGINX misconfigurations and exploitable patterns.
• ngxtop - Real-time NGINX top, like top for your traffic.
• off-by-slash - Detect alias-traversal misconfigurations (the trailing-slash class of bugs).

Security and WAF

• nginx-acme - Automatic certificate management (ACMEv2) module for NGINX, by F5/NGINX Inc. 📦
• ModSecurity-nginx - ModSecurity v3 connector for NGINX. 📦
• naxsi - Open-source positive-model WAF for NGINX. 📦
• ngx_security_headers - Sends modern security headers (CSP, X-Frame-Options, Referrer-Policy) and strips insecure ones. 📦
• ngx_waf - High-performance, ModSecurity-compatible WAF module for NGINX. 📦

Authentication

• auth-pam - PAM authentication dynamic module for NGINX. 📦
• nginx-auth-ldap - LDAP Authentication module for NGINX. 📦
• nginx-http-auth-digest - Digest Authentication for NGINX. 📦
• nginx-http-auth-totp - Time-based one-time password (TOTP) HTTP authentication for NGINX. 📦
• nginx-http-shibboleth - Shibboleth auth-request module for SAML SSO. 📦
• nginx-jwt-module - Check for a valid JWT and proxy to upstream (max-lt/nginx-jwt-module). 📦
• nginx-ntlm-module - NTLM NGINX Module. 📦
• nginx-secure-token-module - Generates CDN tokens (cookie or query-string) for signed URL delivery (by Kaltura). 📦
• nginx_phantom_token_module - Introspects phantom access tokens per RFC 7662 and forwards a JWT to the upstream. 📦
• ngx-http-auth-jwt-module - JWT validation module (TeslaGov fork). 📦
• ngx_aws_auth - Proxy to authenticated AWS services (S3 and friends). 📦
• ngx_http_auth_hash_module - Secure link hash authentication. 📦
• ngx_http_auth_radius_module - HTTP authentication via RADIUS protocol. 📦
• ngx_http_hmac_secure_link_module - HMAC secure link module with OpenSSL hashes (alternative to the core ngx_http_secure_link). 📦
• pta - Period-of-Time Authentication, restricts access to a window in time. 📦
• spnego-http-auth - SPNEGO/Kerberos HTTP authentication. 📦

Bot mitigation

• nginx-length-hiding-filter-module - Appends a random-length string to HTML responses to defeat BREACH/CRIME-class attacks. 📦
• ngx_bot_verifier - Verifies good-bot identity by reverse-DNS (Googlebot, Bingbot and friends). 📦
• ngx_cookie_limit_req_module - Limits request rate per malicious forged cookie. 📦
• ngx_http_captcha_module - Native CAPTCHA generation and validation in NGINX. 📦
• ngx_http_js_challenge_module - Proof-of-work JavaScript challenge for anti-DDoS, similar to Cloudflare's. 📦
• testcookie-nginx-module - Cookie-based challenge/response for low-effort bot mitigation. 📦

Caching and compression

• cache-purge - Purge content from FastCGI, proxy, SCGI and uWSGI caches by URL. 📦
• ngx_brotli - Brotli compression module (GetPageSpeed fork of google/ngx_brotli with regular releases). 📦
• compression-vary - Enhanced Vary header handling for compression, emits the right Vary without duplicates. 📦
• immutable - Marks public assets with Cache-Control: immutable so browsers stop revalidating fingerprinted files. 📦
• ngx_dynamic_etag - Adds correct ETag headers to dynamic responses, enabling 304s on proxied content. 📦
• ngx_http_compression_normalize_module - Parses and normalizes the Accept-Encoding header so caches see one canonical form. 📦
• ngx_http_unzstd_filter_module - Decompresses Zstd-encoded upstream responses for clients that don't support Zstd. 📦
• ngx_slowfs_cache - Caches static files served from slow filesystems. 📦
• ngx_unbrotli - Decompresses Brotli-encoded upstream responses for clients that don't support Brotli. 📦
• sorted-args - Normalizes query-string parameter order to dramatically improve cache hit rates. 📦
• srcache-nginx-module - Transparent subrequest-based caching for arbitrary NGINX locations. 📦
• zstd-nginx-module - Zstandard compression module for NGINX (by tokers). 📦

Headers, cookies and response filters

• headers-more-nginx-module - Set, add and clear arbitrary input and output headers, far more capable than ngx_headers. 📦
• cookie-flag - Sets HttpOnly, Secure and SameSite flags on cookies set by upstream. 📦
• device-type - Comprehensive device detection at the NGINX edge, classifies requests by device class. 📦
• internal-redirect - Performs an internal redirect to a specified URI without a client round-trip. 📦
• nginx-http-concat - Concatenates CSS and JS files referenced via ?,,..., Alibaba pattern. 📦
• nginx_accept_language_module - Parses Accept-Language and picks the best supported locale into a variable. 📦
• ngx-fancyindex - Fancy autoindex listings (HTML5, sortable, themeable) replacing the bare-bones core directory listing. 📦
• ngx_http_loop_detect_module - Honours the CDN-Loop header to break runaway proxy loops. 📦
• ngx_http_request_cookies_filter_module - Fine-grained control over which cookies reach the upstream. 📦
• ngx_http_rewrite_status_filter_module - Rewrite the response status code (turn 502 into 503 and friends). 📦
• ngx_http_server_redirect_module - Redirect the server_name within the same request. 📦
• ngx_http_substitutions_filter_module - Regex and fixed-string substitutions in response bodies. 📦
• ngx_http_trim_filter_module - Whitespace and comment trimming filter for HTML, CSS and JS responses. 📦
• xss-nginx-module - Native cross-site AJAX (JSONP) support without going through Lua. 📦

Streaming, media and image processing

• nginx-rtmp-module - RTMP media streaming server based on the historical nginx-rtmp-module. 📦
• f4fhds - HTTP Dynamic Streaming (HDS) f4f fragment handler (Adobe legacy). 📦
• immerse - Modern-image-format filter: transparent WebP and AVIF delivery based on Accept. 📦
• ipscrub - Anonymizes client IP addresses in access logs (k-anonymity-style). 📦
• markdown - Renders Markdown files to HTML on the fly. 📦
• media-framework - Kaltura Media Framework shared module, HTTP API, events, persistence and Lua interop. 📦
• mod_zip - Assembles ZIP archives on the fly from a manifest of upstream URLs. 📦
• modjpeg-nginx - JPEG filter for overlays, logos and watermarks on JPEGs in flight. 📦
• nchan - Scalable pub/sub server inside NGINX: HTTP, WebSocket, Server-Sent Events and long-polling. 📦
• nginx-http-flv-module - HTTP-FLV streaming on top of nginx-rtmp-module. 📦
• nginx-push-stream-module - HTTP push (Comet, EventSource, long-polling, WebSocket) as a pure-NGINX pub/sub stream. 📦
• nginx-srt-module - Haivision SRT (Secure Reliable Transport) TCP gateway module. 📦
• nginx-ts-module - MPEG-TS live streaming module. 📦
• nginx-vod-module - On-the-fly MP4 repackager to DASH, HDS, HLS and MSS (by Kaltura). 📦
• ngx_http_html_sanitize_module - HTML5 sanitizer based on Google Gumbo, whitelisted elements, attributes and CSS. 📦
• ngx_http_untar_module - Serves file content directly out of tar archives. 📦
• ngx_small_light - Dynamic image transformation (resize, crop, rotate, watermark). 📦
• ngx_webp - On-the-fly WebP conversion of JPEG and PNG responses. 📦

Logging and observability

• GetPageSpeed Amplify - Hosted NGINX monitoring with built-in continuous gixy scanning; drop-in compatible with the deprecated nginx-amplify-agent.
• nginx-module-vts - Virtual-host traffic status module, Prometheus / JSON / HTML real-time stats. 📦
• graphite-nginx-module - Send per-location stats directly to Graphite. 📦
• log-zmq - Stream access logs over ZeroMQ for centralized collection. 📦
• nginx-module-stream-sts - Stream server traffic status core module (companion to sts). 📦
• nginx-module-sts - Stream server traffic status, same idea as VTS but for the stream {} block. 📦
• nginx-otel - Official OpenTelemetry tracing exporter module for NGINX. 📦
• nginx-statsd - Send NGINX metrics to a StatsD collector. 📦
• ngx-sqlite-log - SQLite-backed access log, queryable logs without a separate pipeline. 📦
• ngx_http_error_log_write_module - Conditionally emit error-log entries from configuration. 📦
• ngx_http_log_var_set_module - Set NGINX variables right before the access log writes, late-stage log enrichment. 📦
• ngx_http_pipelog_module - Pipe access logs to an external program (analytics, alerting, archival). 📦
• ngx_http_upstream_log_module - Writes upstream-side request logs separate from the client-side access log. 📦
• traffic-accounting-nginx-module - Real-time incoming/outgoing traffic counters per zone. 📦

Lua and OpenResty ecosystem

• lua-nginx-module - Embed the power of LuaJIT into NGINX's HTTP request lifecycle. 📦
• array-var-nginx-module - Array-typed variables for the OpenResty stack. 📦
• echo-nginx-module - Echo, sleep, time and exec directives for the content phase. 📦
• encrypted-session-nginx-module - Encrypt and decrypt NGINX variable values, for sessionless session cookies. 📦
• lua-upstream-nginx-module - Lua API for controlling NGINX upstreams at runtime. 📦
• memc-nginx-module - Extended memcached upstream module (full memcached command set, not just GET). 📦
• nginx-eval-module - Evaluate memcached or proxy response into a variable. 📦
• ngx_devel_kit - Nginx Devel Kit, generic toolkit that many third-party modules depend on. 📦
• ngx_wasm_module - Proxy-Wasm (WebAssembly) support for NGINX, powered by wasmtime. 📦
• njs - Official JavaScript scripting in NGINX (subset of ES5 + extensions). 📦
• redis2-nginx-module - Native upstream for the Redis 2.0+ protocol, full pipelining. 📦
• set-misc-nginx-module - Provides set_xxx directives (md5, sha1, base64, hex, escape, quote) for the rewrite phase. 📦
• stream-lua-nginx-module - Embed LuaJIT into NGINX's stream {} (TCP/UDP) processing. 📦

Performance and optimization

• incubator-pagespeed-ngx - Apache mod_pagespeed for NGINX, automatic CSS/JS/image optimization at the edge. 📦
• nginx-link-function - Dlopen application code straight into NGINX request handling for ultra-low-latency endpoints. 📦
• nginx-sxg-module - Signed HTTP Exchange (SXG) support, prefetch with original-origin attribution. 📦
• passenger - Phusion Passenger application server module, runs Ruby/Python/Node apps inside NGINX. 📦
• tuning - Observes real traffic patterns and proposes data-driven NGINX tuning. 📦

Upstreams, rate limiting and access control

• ipset-access - Zero-latency IP allow/deny using Linux kernel ipsets. 📦
• nftset-access - Zero-latency IP allow/deny using Linux kernel nftables sets. 📦
• nginx-combined-upstreams-module - Adds add_upstream and combine_server_singlets directives for upstream composition. 📦
• nginx-module-sysguard - Sheds load when system CPU, memory or RT exceeds thresholds. 📦
• nginx-sticky-module-ng - Sticky-cookie session affinity load balancer. 📦
• nginx-stream-upsync-module - Sync stream {} upstreams from Consul or etcd. 📦
• nginx-upload-module - Streams multipart/form-data uploads straight to disk before passing metadata upstream. 📦
• nginx-upload-progress-module - Real-time upload progress tracking for browser UIs. 📦
• nginx-upstream-fair - Fair load-balancer based on number of in-flight requests per backend. 📦
• nginx-upsync-module - Sync HTTP upstreams from Consul or etcd without reloading NGINX. 📦
• ngx_dynamic_limit_req_module - Dynamically locks an IP after threshold and releases it after a configurable window. 📦
• ngx_http_access_control_module - Advanced access control by NGINX variables (beyond allow / deny by IP). 📦
• ngx_http_delay_module - Insert a configurable delay before responding, useful for shaping or tarpitting. 📦
• ngx_http_limit_traffic_ratefilter_module - Rate-limit traffic by arbitrary NGINX variables (e.g. per token, per geo). 📦
• ngx_upstream_jdomain - Async DNS resolution for upstream backends, survives DNS-only backends. 📦
• rate-limit-nginx-module - Redis-backed cluster-wide rate limiting. 📦

Variables, JSON and extensibility

• form-input-nginx-module - Parses application/x-www-form-urlencoded request bodies into variables. 📦
• iconv-nginx-module - Character-set conversion of request and response bodies via libiconv. 📦
• nginx-json-var-module - Group variable expressions as a JSON value for clean logging. 📦
• nginx-keyval - Key-value store backed module, variables sourced from disk-backed KV pairs. 📦
• nginx-let-module - Arithmetic and string expressions in the rewrite phase. 📦
• ngx_http_json_module - Dumps a $json variable into a string. 📦
• ngx_http_label_module - Define global key-value labels for dynamic configuration. 📦
• ngx_http_var_module - Dynamically assign variables via predefined functions (math, string, hash). 📦
• ngx_postgres - Direct PostgreSQL upstream, no PHP / app layer needed for read-heavy paths. 📦

Networking and protocols

• nginx-cgi - Run classic CGI scripts under NGINX. 📦
• nginx-dav-ext-module - Adds PROPFIND, OPTIONS, LOCK and UNLOCK to NGINX's core WebDAV. 📦
• Nginx-DOH-Module - Serve DNS-over-HTTPS responses straight from NGINX. 📦
• nginx_ajp_module - Apache AJP13 protocol upstream (talk to Tomcat / JBoss natively). 📦
• ngx_coolkit - Collection of small NGINX utilities, encoding, time helpers, IP utilities. 📦
• ngx_http_geoip2_module - MaxMind GeoIP2 lookups into NGINX variables. 📦
• ngx_http_proxy_connect_module - Adds HTTP CONNECT (forward-proxy) support to NGINX. 📦
• rdns - Reverse-DNS lookup of the client IP into NGINX variables. 📦

Documentation and learning

• nginx-extras.getpagespeed.com - Reference docs for every packaged NGINX module: installation, directives, examples.
• awesome-nginx - Long-running broad awesome-list of NGINX projects.
• awesome-nginx-security - Awesome list scoped to NGINX security: talks, WAFs, configuration analyzers.
• GetPageSpeed blog - Deep dives on NGINX tuning, modules and packaging from the engineering team behind this list.
• h5bp/server-configs-nginx - Boilerplate server configs (cache headers, MIME types, security headers) from HTML5 Boilerplate.
• nginx-admins-handbook - Exhaustive admin handbook covering performance, security, hardening and debugging.
• nginx-resources - Curated collection of NGINX articles, books and tutorials.
• nginx-tuning - Tuning cheat-sheet for high-traffic NGINX deployments.
• nginx101.com - Practical NGINX articles for the long tail of operator questions.
• Official NGINX documentation - The authoritative directive and module reference.

Honourable mentions

• nginx-ct - Certificate Transparency support, embeds SCTs into TLS handshakes (175★).
• nginx-gridfs - Serve files directly from MongoDB GridFS (792★).
• nginx-haskell-module - Embed Haskell handlers, asynchronous tasks and services into NGINX (161★).
• nginx-http-user-agent - Match browsers and crawlers by User-Agent, Alibaba's pattern (162★).
• nginx-python-module - Embed Python into NGINX request handling (139★).
• nginx-ssl-fingerprint - High-performance JA3 and HTTP/2 fingerprinting (198★).
• nginx-ssl-ja3 - TLS JA3 fingerprinting for bot and abuse detection (216★).
• nginx-video-thumbextractor-module - Extract thumbnails from video files on the fly (208★).
• nginx_upstream_module - Native Tarantool upstream (REST, JSON, WebSockets, load balancing) (173★).
• ngx-php - Embedded PHP 7/8 scripting inside an NGINX module (693★).
• ngx_dynamic_upstream - Add, remove and modify upstream servers without reloading NGINX (515★).
• ngx_healthcheck_module - Active healthchecks for upstream servers in both http and stream contexts (282★).
• ngx_http_consul_backend_module - Set upstream backends directly from a Consul service catalog (155★).
• ngx_kafka_module - Posts request bodies to a Kafka cluster, handy for log fan-out (176★).
• ngx_wasm_module - Kong's NGINX plus WebAssembly runtime (126★).
• socks-nginx-module - Adds SOCKS5 support to ngx_http_proxy_module (201★).
• wasm-nginx-module - Run WebAssembly modules inside OpenResty / NGINX (alternative to wasmtime) (200★).

Contributing

Contributions welcome. See the contribution guidelines.